How to remove a user from all Google Groups with GAM

One GAM7 command takes a user out of every group they belong to. Here is the command, the preview to run first, and what it does that is easy to miss: owned groups, nested groups, and everything that was shared to those groups.

When a teacher leaves, or an account is compromised, taking them out of every group is one of the first jobs. The groups themselves rarely matter. What matters is what the groups can reach: shared folders, shared drives, calendars, and mail that other people assume is going somewhere safe.

GAM does it in one command. The command is simple. What takes care is knowing exactly what "every group" covers.

The short answer

List what they belong to first:

gam user alice@example.org print groups

Then remove them from all of it:

gam user alice@example.org delete groups

With no group named, the GAM documentation is explicit: "By default, users will be deleted from all groups of which they are a member". (GAM wiki: Users Group Membership)

For a list of leavers, run the same command from a CSV file with a column named email:

gam csv leavers.csv gam user "~email" delete groups

Save the list before you remove anything

There is no undo. Once the command has run, the only record of what they belonged to is whatever you printed first, so send it somewhere that lasts:

gam user alice@example.org print groups todrive

That writes the list to a Google Sheet in your Drive. If a removal turns out to be a mistake, that sheet is how you put it back.

What "all groups" actually covers

Every role, not just member. In Google's Groups API a membership carries a role, and the role can be member, manager or owner. (Directory API: members) So a user who owns a group is removed from it like any other member. Before you run the command, check which groups they own:

gam user alice@example.org print groups roles owner

If they are the only owner of a group that people still use, decide who takes it over first. Administrators can always manage any group from the Admin console, but the staff who relied on that owner to run the group cannot.

Direct memberships, and the ones that came with them. Google's reference for listing a user's groups describes the result only as the groups "the given user is a member of", and does not say whether that includes groups they belong to through another group. (Directory API: groups.list) In practice the answer rarely changes the outcome. If Alice is in grade7teachers, and grade7teachers is itself a member of middleschool, her place in middleschool only ever existed through the inner group. Remove her from grade7teachers and it ends too.

Everything shared to those groups. A folder, shared drive or calendar shared with mathdept@ is shared with whoever is in mathdept@ at that moment. Take someone out of the group and anything they could reach only through that membership goes with it, with no separate warning. On a leaver, that is exactly what you want. On a role change, it is how a teacher who moved buildings loses the department folder they still need. How to clean up years of old Google Groups explains why a group reaches much further than its member list suggests.

Keep some groups

Sometimes "all groups" is too much. A staff member moving to another building should leave that building's groups but keep the district-wide ones. The command takes a pattern, and not turns it around:

gam user alice@example.org delete groups emailmatchpattern not ".*allstaff.*"

The GAM documentation describes the option as deleting "from all groups of which they are a member based on (not) matching the group email address", so this removes Alice from every group whose address does not match the pattern and leaves the matching ones alone.

The pattern is matched from the start of the address. That is what the leading wildcard in the example is for. Measured on a live domain: with a plain allstaff as the pattern, a group at allstaff-anchor@ was kept and one at zz-allstaff-anchor@ was removed, because the second address does not begin with the word. Without the wildcard the pattern means "starts with"; with it, it means "contains", which is usually what you meant. Run the preview first and read the list against the pattern.

Where this fits

Removing groups is one step of someone leaving, not the whole of it, and the order matters. Drive files have to be transferred while the account is still active, and suspending the account also resets their sign-in cookies. What actually has to happen when a teacher leaves walks through the full sequence.

Sources

In ORINEX Workspace, taking a leaver out of every group is one checked step in the offboarding workflow. It runs in the order the other steps need, alongside transferring their Drive files, signing them out and suspending the account, for one person or a whole list. What ORINEX Workspace does.