https://www.orinexsystems.com/guides/ Practical technical notes for Google Workspace administrators, based on real K-12 administration. en-us https://www.orinexsystems.com/guides/google-workspace-summer-rollover https://www.orinexsystems.com/guides/google-workspace-summer-rollover Rollover is four populations, one hard deadline, and an ordering constraint that will merge two grade levels if you get it backwards. Most of the work is decisions made in May, not clicks made in July. K-12 operations https://www.orinexsystems.com/guides/graduating-students-google-workspace https://www.orinexsystems.com/guides/graduating-students-google-workspace There is no single right answer, but there is a right order. Students can only move their own work while they can still sign in, and two separate settings have to be on before the transfer tool works at all. K-12 operations https://www.orinexsystems.com/guides/google-workspace-teacher-offboarding https://www.orinexsystems.com/guides/google-workspace-teacher-offboarding Suspending the account is the easy part. The work is everything attached to it: Drive ownership that does not transfer the way you expect, delegation nobody remembers granting, and a deletion window that closes permanently after twenty days. K-12 operations https://www.orinexsystems.com/guides/chromeos-device-counts-dont-match https://www.orinexsystems.com/guides/chromeos-device-counts-dont-match Two systems read the same Google Workspace tenant and report different Chromebook totals. It is almost always deprovisioned devices or a child organizational unit roll-up. Google documents the behavior without documenting its consequence. ChromeOS and devices https://www.orinexsystems.com/guides/chromebook-disable-deprovision-delete https://www.orinexsystems.com/guides/chromebook-disable-deprovision-delete Disabling and deprovisioning a ChromeOS device do very different things, and deleting one is not an option Google offers at all. The deprovision reason you pick is a license decision, and picking the wrong one can cost you the license permanently. ChromeOS and devices https://www.orinexsystems.com/guides/google-directory-api-write-lag https://www.orinexsystems.com/guides/google-directory-api-write-lag We measured it. Unsuspending an account was visible on a direct account lookup faster than we could detect, and took about eleven seconds to reach the filtered lists and searches administrators actually look at. Google's own published bound is far more conservative. Administration and security https://www.orinexsystems.com/guides/clean-up-old-google-groups https://www.orinexsystems.com/guides/clean-up-old-google-groups A group is four things at once and only one of them is visible from the Groups list. Deleting it revokes every permission it was silently holding, and in a school the things that break are the ones that only happen once a year. Administration and security https://www.orinexsystems.com/guides/google-workspace-compromised-account https://www.orinexsystems.com/guides/google-workspace-compromised-account Resetting the password is not containment. The controls overlap, but no single one of them covers everything — and the persistence someone leaves behind survives all of them if you do not go looking for it specifically. Administration and security https://www.orinexsystems.com/guides/google-drive-share-phishing https://www.orinexsystems.com/guides/google-drive-share-phishing A Google Drive sharing notification can be generated by Google itself, pass every email authentication check, and still hand a staff member a phishing document carrying the superintendent's name. What is actually happening, what Google's own protections do and do not catch, and what to tell staff. Phishing and incident response https://www.orinexsystems.com/guides/investigate-google-drive-phishing https://www.orinexsystems.com/guides/investigate-google-drive-phishing A staff member reports a shared document that turned out to be phishing. What to capture first, how to identify the account that actually shared it, what your Drive and Gmail logs can and cannot show for a file your organization does not own, and where the edition line falls between Education Fundamentals, Standard and Plus. Phishing and incident response https://www.orinexsystems.com/guides/google-drive-phishing-remediation https://www.orinexsystems.com/guides/google-drive-phishing-remediation An incident-response workflow for a malicious Drive share that reached your staff: what to preserve, how to pull the notification out of inboxes on each Education edition, what can and cannot be done about the shared file itself, and how to close it out. Education Fundamentals and Standard/Plus are handled separately, and so is the ORINEX Compliance workflow. Phishing and incident response https://www.orinexsystems.com/guides/block-google-drive-phishing-email https://www.orinexsystems.com/guides/block-google-drive-phishing-email The first instinct after a malicious Drive share is to block the sender. In a Drive-share attack the sender is Google, the account that shared the file is someone else, and the person named in the document is a third party. Which of the three you can block, what each block actually does, and what works instead. Phishing and incident response https://www.orinexsystems.com/guides/google-drive-phishing-content-compliance https://www.orinexsystems.com/guides/google-drive-phishing-content-compliance Gmail's content compliance rules can examine the headers and body of inbound mail and quarantine, reject, or modify what matches. A methodology for turning one preserved Drive-share phishing notification into a rule that catches the campaign without touching legitimate Drive notifications, and why there is no universal rule to copy. Phishing and incident response https://www.orinexsystems.com/guides/google-workspace-delete-phishing-email https://www.orinexsystems.com/guides/google-workspace-delete-phishing-email Yes on Education Standard and Plus, from the Admin console's security investigation tool. On Education Fundamentals the console can tell you who received it but cannot remove it; removal needs the Gmail API through GAM or another tool. An edition-by-edition comparison of what your license actually gives you, verified against Google's documentation. Phishing and incident response https://www.orinexsystems.com/guides/block-google-drive-share-phishing https://www.orinexsystems.com/guides/block-google-drive-share-phishing There is no setting that safely eliminates Drive-share phishing for every district without also affecting legitimate external collaboration. What Google's own protections do, the difference between users sharing files out and users receiving files in, where the allowlist and trust rules draw the line and which editions have them, and a K-12 approach that tightens receiving where it costs the least. Phishing and incident response https://www.orinexsystems.com/guides/k12-impersonation-phishing https://www.orinexsystems.com/guides/k12-impersonation-phishing The lures that work on school staff borrow the names on the district letterhead and the routines those names control: payroll, benefits, evaluations, payments. Why those roles, how the messages arrive (including through Google's own Drive notifications), why a familiar name beats an unfamiliar address, and what district IT can actually do about it. Phishing and incident response https://www.orinexsystems.com/guides/dmarc-google-drive-phishing https://www.orinexsystems.com/guides/dmarc-google-drive-phishing SPF, DKIM and DMARC authenticate the domain that sent a message, and they work. A Google Drive share notification is sent by Google, so it authenticates as Google's, correctly, while the account that shared the file, the document and the link inside it sit outside anything authentication examines. A short, sourced explanation of why a pass is expected and what it does and does not tell you. Phishing and incident response https://www.orinexsystems.com/guides/gam-remove-user-from-all-groups https://www.orinexsystems.com/guides/gam-remove-user-from-all-groups One GAM7 command takes a user out of every group they belong to. Here is the command, the preview to run first, and what it does that is easy to miss: owned groups, nested groups, and everything that was shared to those groups. GAM guides https://www.orinexsystems.com/guides/gam-find-all-groups-a-user-belongs-to https://www.orinexsystems.com/guides/gam-find-all-groups-a-user-belongs-to One GAM7 command lists the groups a user was added to. A second lists those groups and the groups they sit inside, which is what decides what the person can actually reach. Here are both. GAM guides https://www.orinexsystems.com/guides/gam-move-users-to-another-ou https://www.orinexsystems.com/guides/gam-move-users-to-another-ou GAM7 moves one user, or everyone in an organizational unit, with a single command. Here is each form, the preview to run first, how to leave suspended accounts where they are, and how long the new settings take to apply. GAM guides https://www.orinexsystems.com/guides/gam-list-suspended-users https://www.orinexsystems.com/guides/gam-list-suspended-users One GAM7 command lists every suspended account in your domain. Here is the command, the form Google uses in its own examples, and why the list matters more than it looks: suspension by itself does not free an account's license. GAM guides https://www.orinexsystems.com/guides/gam-sign-user-out https://www.orinexsystems.com/guides/gam-sign-user-out One GAM7 command signs a user out of every web and device session. Here is the command, what Google says about how fast it takes effect, and why a district that uses single sign-on needs one more step. GAM guides https://www.orinexsystems.com/guides/gam-archive-suspended-users https://www.orinexsystems.com/guides/gam-archive-suspended-users Google publishes its own GAM command for archiving every suspended account in an Education domain. Here it is, the preview to run first, and what archiving changes: the license it frees, and what it takes to bring an account back. GAM guides https://www.orinexsystems.com/guides/gam-transfer-drive-ownership https://www.orinexsystems.com/guides/gam-transfer-drive-ownership One GAM7 command moves ownership of a user's Drive files to someone else. Here is the command, its built-in preview, what it leaves the old account by default, and what happens to files in the old owner's trash. GAM guides https://www.orinexsystems.com/guides/gam-deprovision-chromebooks https://www.orinexsystems.com/guides/gam-deprovision-chromebooks GAM7 deprovisions a Chromebook with one command and two safety catches built in. Here is the preview, the command, the reason you have to choose, and what deprovisioning means for the device afterwards. GAM guides https://www.orinexsystems.com/guides/gam-find-users-suspended-for-days https://www.orinexsystems.com/guides/gam-find-users-suspended-for-days GAM7 can select suspended accounts by how long ago they were disabled. Here is the 90-day command, how its options fit together, and the one combination that quietly includes archived accounts too. GAM guides https://www.orinexsystems.com/guides/gam-export-groups-and-members https://www.orinexsystems.com/guides/gam-export-groups-and-members One GAM7 command exports every group in your domain with its members, one row per membership. Here is the command, how to expand nested groups into the people inside them, and which of the two exports to keep. GAM guides