Out of Hours Email Activity Reporting with GAT+

In France, the legal length of the working week is 35 hours in all types of companies with more than 50 employees. The working day may not exceed 10 hours. Furthermore, employees may not work for more than 4.5 hours without a break. The maximum working day may be extended to 12 hours under a collective agreement.

If you wish to enforce this policy throughout your organization you can utilize GAT Shield. Let’s presume you already know about Shield and utilize it within your organization.

You have the ability as a super admin to enforce the French working hours after getting proper approval from your management team.

Navigate to the Configuration area of GAT Shield. In the Login Control section.

Now, I will create a time frame window outside of this time frame users on my domain won’t be allowed to log into their G Suite account to check emails or other cloud services.

The below example covers 9AM to 7PM.

Login time window (from): 0 0 9 1/1 * ? *

Login time window (to): 0 0 19 1/1 * ? *

This means my employees can log in and do their work from 9AM to 7PM after which they will be blocked.

If you don’t wish to block entry into the account when users are out of hour you can report on your employee’s activities using GAT Shield User Activity section. This will show you when a user was active and what sites they went to throughout a given day.

How to Create a Report About Devices Not Synced Within the Last 30 days

This report will show us which mobile devices are no longer synced with our domain.

The report will produce a list of mobile devices which have not synced in over 30 days.

On the GAT Home page, select “Mobile Devices”  

select 'mobile devices'

On the top right-hand side of the screen, click on the familiar ‘Apply custom filter’ button.

click on the ‘Apply custom filter’ button.

We select “Last sync” before or equal to the 1st day of the last month.
Schedule the report to run monthly.
The example above shows us a report for all devices that have “Last synced” more than a month ago.
GAT+ will automatically change the date on the next scan next month and every report will give you data for the previous month.

Google Calendar Event Reporting with GAT+

Need to run a report to see who has scheduled time in the Google Calendar? Elsewhere GAT+ reports on everyone’s event details, past and future. In this report GAT+ lets you look over a certain time period and total the amount of time each user spent in those events.

GAT+ lets Admins run scheduled reports to show the amount of time each user has allocated to events marked in their calendar.

First from the GAT+ home page, under ‘Reports’, select ‘Scheduled Reports’

Next select Calendar Events Stats and the press ‘New report’

GAT calendar event statsOnce in the new report, configure as to best suit your needs.

how to report on Google Calendar events with GAT

You can give the output report a name of your choice, if not it will default to ‘Calendar Events Stats’ and a date combination.

You can also ask the scheduler to look back a number of weeks and then select to run ‘Just Once’. This will generate a one-time historical report.

You can also make other selections such as looking back 1 week and then running the report every Monday to cover the previous week.

The report output will measure event durations in minutes for each user.

A sample of the output:

Simple Daily Report to Identify All the Documents Added or Changed That Day

This post will show you how, using GAT, you can identify the daily documents added and changed during any given day.

First in ‘Drive’ audit

Then in Scheduler

If any changes were made the day before, you will get a PDF report every morning with the changes.

Google User Folder Structure Displayed in GAT+

GAT+ displays the User folder structure for each user on your domain 

In the ‘Users’ audit section, as you hover over each user, a new icon will appear beside the folder count.

Clicking on the folder icon will display the folder tree beneath the user’s photo or email.

Each folder name has a file count and a quota usage count for the folder itself.

Selecting any folder name and clicking on it will show you the exact file type breakdown of that folder.

You can click the > marker before the folder to expand or contract the folder to the next level.

Scheduled Reports

Many Admins are not aware of the extensive reporting that GAT can perform for them in the background. In this post, we outline some of the reports we run internally to give you some ideas for your own domain and to demonstrate the power and range of GAT reporting. Below is a screenshot of the scheduled reports for our domain.

The first two reports are standard and automatically created by GAT for your domain when you install GAT.

The ‘What’s Hot’ report shows all documents shared in and out of your domain in the last 24 hours, including ones shared prior to that time window, but changed in the last 24 hours. Because this report tracks documents shared in, that may frequently change but are of little importance, it may give too much detail, not letting you see the wood from the trees after your domain becomes mature. We have a refined version of this report described below that may be more appropriate for large or mature domains. This report is ideal for new Google domains or those Google domains new to external sharing.

The ‘Activity’ report which runs weekly, generates the weekly big picture stats for your domain. It also helps build the business intelligence data, so worth leaving run once every week.

The ‘Login Events’ report on our scheduler runs with ‘every scan’ and reports login failures since the last scan. ‘Every scan’ means every time an Admin logs into GAT or every time a scheduled report runs an Admin is alerted to login failures from user accounts. This can be very useful in identifying a hacking attack in a timely fashion.

The ‘Daily User Email Stats’ report is currently disabled on our scheduler, but we use it from time to time if we are interested in tracking email volumes for each user.

The ‘Documents Report’ is the refined version of the ‘What’s Hot’ report we described in the first paragraph. This is the one we recommend for all large domains. It reports on all the documents created or changed in the last 24 hours that are shared out. It also reports on all documents that are shared in, that were created or changed in the last 24 hours, but only if these external documents have local editors.

Below is the code for this rule which you can paste in the rule edit section of the drive audit. See here for details on how to do that. Remember to change both the domain name and the date and times for your own requirements.


 “0privacy”: “NULL_PRIVACY”,

 “0searchTextType”: “DOC_WITH_USER_AS_EDITOR”,

 “#multi”: “or 0 1”,

 “0updatedFrom”: “31/12/2014 01:59:27“,

 “0deleted”: “false”,

 “1deleted”: “false”,

 “0searchText”: ““,

 “1privacy”: “NULL_PRIVACY”,

 “1updatedFrom”: “31/12/2014 01:59:27“,

 “1sharedOut”: “true”,

 “_reportType”: “USER_DOCS”,

 “1searchTextType”: “DOC_NAME”,

 “0sharedIn”: “true”


The ‘Doc Actions’ report covers the same set of documents as the above Documents Report but reports which of your users did what and when, with the document. This can be really useful when there are multiple local editors on a document.

The final ‘Documents Report’ in our list shows only documents that were created and shared out.

The ‘Emails Report’ shows any emails in the last 24 hours, to or from any user in the domain that contains the word “Purchase Order’. This report could be useful for a finance manager monitoring sales or purchasing activity. See here for an example. In this example, the reporting is domain-wide, but can be restricted to a user, a list of users, a group or an OU (see the following Calendars example).

The ‘Calendars Events Report’ example in our domain confined to reporting future calendar appointments that are made each day for the sales group. Again this quite narrow report might be one that can be directed to the sales manager.
These are just a sample of the potentially thousands of unique and individual reports, that using GAT, Admins can create for their domain. Over the years these are ones we have found useful, we hope you do too. To create a report simply go to any audit area in GAT, select the user scope and date range you are interested in, run the report and then just schedule it. See here for examples of the power of the GAT scheduler, not just for reporting but for policy enforcement also.

Activity Reporting – Permission Change Reporting

Activity/Permission Change/Deletion Reporting

GAT supports the ability, on a file by file basis, to report who changed access permissions and when they changed them.

Permission Changes

From the Drive Audit table, using the search and filters available to you, find the file you are interested in.

Under the ‘Metadata Changed’ column you will now find a new link called ‘Activity’. Clicking on the Activity link now shows not only the ‘Edit’ and ‘View’ history of the file but also the permission changes.

This is ideal for identifying who shared out or changed the editing rights on a file. (Note, Where Google has the users image on file we retrieve it.)


In addition, if you return to the top of the drive audit you will find a link to all ‘Deleted’ files.

As highlighted elsewhere in the documentation this is a listing of all files that GAT knew about that have now been removed from trash and permanently deleted from the Google Drive environment. Where possible GAT has recorded the actions of the person who performed the ‘delete’ or ‘empty trash’.

GAT can not report on any deleted file that was deleted BEFORE GAT was installed.



Before using this feature please ensure you have granted the extra permissions required by GAT.


From the Google Apps Admin Console …


GAT Activity Report

The weekly GAT activity report, which you receive each weekend is designed specifically to give Google Apps domain Admins a snapshot of the week’s major activities on their domain.


We hope to answer 3 questions at a glance:

  • What is changed?
  • What is new?
  • Who is collaborating?


As Admins ourselves, we know there is no point seeing the same old thing every week, so we are focusing for you on things like new docs shared in or out, new domains we are sharing docs with or if you use GAT+email, new domains we are sending emails to.


Our goal is to try and bring new or unusual activity to the top, so you can then use GAT to investigate deeper. Where we say NEW, we mean just that.


Report Sections explained


Document Growth:

This covers all the headline figures for Google Documents on your domain.

We start by showing you the number of documents shared in.

Then the number of docs shared outside publically, shared outside privately, shared internally or just created privately.


Top Collaborators – External Docs:

These are the users who share out the most documents or receive in the most document shares during the week.

Number of users who share documents outside the domain. We list the Top 10 by account name.

Number of users who open documents shared into the domain. We list the Top 10 by account name.


Top Collaboration Pairs – Internal Docs:

This counts the pairs where one or other person in the pair shares a document with the other and the document is read or edited.  A simple share will not count.  We return the top 5 in the domain. The pairs are internal organization pairs only, external collaboration is not counted in this table.  Two domains may be covered, provided they are both inside the same organization.


New External Domains Collaboration – Docs:

The number of NEW domains sharing documents with our domain.

Then a count of the number of new domains who are sharing docs into us, followed by a ranking of the top 10 new domains.

Followed by a count of the number of new domains we are sharing docs out to, followed by a ranking of the top 10 new domains.


Top Email Senders and Receivers:

Number of emails sent. We list the Top 10 senders by account name.

Number of emails received. We list the Top 10 receivers by account name.


Top External Domains Collaborating – Emails:

We list the number of NEW domains who started to share email with us in the last week (in or out).

Then a count of the number of new domains we are sending email to, followed by a ranking of the top 10 new domains.

Followed by a count of the number of new domains we are receiving email from, followed by a ranking of the top 10 new domains.

In all cases, we are only looking at new domains – ones we have not seen before. Use this to identify new business leads or spot a new burst of activity you should be concerned about.


Top Internal Collaboration Pairs – Emails:

Here we list the internal pairs of individuals who send the most emails to each other. Each individual might send many more emails, but here we look for the maximum count between pairings.