Find Internally Shared Google Documents

In Drive audit, we can see a nice overview of all drive files of your entire G Suite domain.

overview of all drive files in GAT+

An admin can select each of the categories and it will lead them to all the files from which the category was created from.
In this case will display all Google Drive files which are Open to internal users.
Sharing flags is set ‘Open to internal’, the users are in grey background color, which also indicates that the user are local and not from an outside domain.

Sharing flags tab in GAT+

Create a daily report of files shared internally

As super admins, we are interested in what files are shared in or out of our domain but it can also be quite interesting to see what documents are being shared internally. This is quite easy with the GAT+.

In Drive Audit, click on the apply custom filters button.

In Drive Audit, click on the apply custom filters button.

Select the following search parameters in the filter selection area.

Select the following search parameters in the filter selection area.

Select 'apply & schedule'

Note: We selected a time period since the files were last updated.
In our case since yesterday. Then we schedule the report to run daily.
This report will show us data for all files shared internally within our domain on a daily basis for each previous day going forward.

The date will be changed automatically to run a new search for files shared internally on the next day and so on.

Understanding and Measuring Internal Email Communications

GAT supports two ways to measure and understand internal email communications. The first method is through the ‘Users Audit’.

Select the ‘Users Audit’ from the GAT homepage, and from the range of audit areas, select the ‘Emails’ tab (1).  This shows the last 30 days of email activity, both internal and external.

By default, this will show all the users on the domain. As this might be a large number of users you might like to focus on an individual or a group. You can enter an individual or a group name at (2). You can also select an Organization Unit (3).

The email volumes for each user is laid out in 8 columns. The first 4 are for external volumes and the last 4 are for internal volumes. The columns show the following

No. of email sent

No. of emails sent with files attached

No. of emails received

No. of emails received with files attached

For internal emails look to the second set of 4 columns (5).

Clicking on any number in blue shows you the email metadata that is behind the figure. You can see the ‘from’, ‘to’, ‘cc’ etc.

If you wish to see the volumes for each day of the last 30 days, select ‘Show daily stats’ (6).

All columns are sortable.

They say a picture is worth a thousand words, so for the big picture select the ‘Business Intelligence’ section from the GAT homepage.

From there select ‘Internal/External Collaboration’.

Then select a look back period of the last 4 weeks.

Select ‘Show Graph’.

Wait for the graph to draw. This will take about 30 seconds.

When the graph has drawn select the following choices. Under ‘View’ select ‘Emails’ and in the Filters section, select ‘Dampen external collaboration’

What you are left with on the graph is a map of the actual internal email activity for ‘replied to’ email over the last four weeks.

If you want to see the numerical values behind the pairs of email relationships, select ‘Pairs’. You can sort to the top pairs to the top.

You can even explore the activity between any two individuals, any two groups, any two OU’s or any combination of the above.

Finally, if you want to understand more about this suite of tools and how you can make them work for you, you can read here.


The two methods are actually slightly different in terms of what they measure. Under the ‘Users Audit’ absolute volumes of emails are being measured. Every email sent and every email received is counted and tabulated. Under the ‘Business Intelligence’ graph, the measurement only reflects ‘replied to’ emails. Emails not replied to or ignored are not counted for use in this graph as they are not considered to form part of a collaborative effort. The purpose of the Collaboration graph is to show collaboration activity.

How to Stop Internal Shares Among Students

First, read the post here in the GAT G+ Community. This will save you a lot of time creating and sharing rules. Don’t forget to return to this post – this rule is a new rule and not the same as the ‘Chinese wall’ example in the link above.

(If you have some useful filters you can share with others in the GAT community, whether for business Admins or GAFE Admins.)

This rule will show you how to find all the internal shares for an OU called students. After finding the shares it will then show you how to remove remove them on a scheduled basis.

Having read the paper at the end of the link posted above, go to the GAT Drive audit and using the pencil icon (beside ‘Export to Spreadsheet’), paste the following rule


 “0privacy”: “OPEN_TO_DOMAIN_PRIVACY”,

 “0editedFrom”: “04/05/2015 23:00:00″,

 “0userOwnedDocs”: “true”,

 “0searchTextType”: “DOC_NAME”,

 “#multi”: “and 0 1”,

 “0deleted”: “false”,

 “1deleted”: “false”,

 “1privacy”: “NULL_PRIVACY”,

 “_reportType”: “USER_DOCS”,

 “0organization”: “/Students“,

 “1searchTextType”: “DOC_NAME”,

 “1negate”: “true”,

 “1organization”: “/Staff



After pasting the rule above, look carefully at the items in blue. Change the date to yesterday’s date (based on the date format you set for your domain dd/mm/yyyy or mm/dd/yyyy). Change the Students OU to the OU name you use for students on your domain. Change the Staff OU to the OU name you use for teachers or staff on your domain.

Having pasted this rule and run a search, next press the ‘Schedule/Save’ button, then schedule this report to run every day after midnight. This will generate a report for you in either pdf or csv output, showing students who shared documents internally, excluding those shared with teachers.

Run the report for a few nights to make sure you are happy with it. Also, test with a few documents to make sure your scopes are working fine. Note, based on the rule above, one use case where a pupil can share with another and not have it reported is where the share is to a teacher and a fellow pupil. In all cases, we expect this is legitimate as it will be transparent to the teacher.

When you are happy with the rule, return to editing the rule via the scheduled reports icon.

scheduled reports icon

From here, clicking on the scheduled report name (see area in red oval below)

lets you edit the scheduled report. From here you can automatically have all shares removed and optionally a warning sent to the students (select ‘Notify Local Users’ also).

Only implement this feature when you are sure the files being reported in the nightly reports are correct and are of the type you want to stop internal sharing of.

How it’s done

To learn how to build up the rule we outlined above, you first find all the documents owned by the OU you want to monitor/control, in the screenshot below we selected ‘Users’ as the OU.

You select the items as shown above and finally to build the search and filter string, you press the selection for internally shared, (‘1’ in the example above). If there is nothing already internally shared, the yellow filter may not exist, so share at least 1 internal document (an unlikely scenario).

Next, we find all the documents used by Teachers or Staff. This is the default search for an OU (in the example below we use the OU ‘Leavers’).

NOTE! Owned Docs selection box is not ticked. This means show all the docs for teachers which they either own, can read or can edit.

We are looking for these, so we can exclude them, so after you complete the search, select

‘Negate Filter’ New Filter button

The final step is to combine the two filters. To do this select the tab ‘Recent Filters’ and select the last two searches.

GAT filters

Combine with ‘AND’ and press ‘Show’, now you have your filter and a rule that you can schedule to run every night (‘Schedule/Save’).

Remember the example above is for an OU, but you can also repeat the above steps and just pick a Google group.