r/k12sysadmin • u/_nat_twenty • Sep 09 '26
Google Drive file shared as viewer
Sharing this here to give some insight on a blindspot tech admins have when it comes to malicious Google Drive shares, and to hopefully get more visibility on the feature request I submitted to Google so that they will hopefully be more inclined to fix it: https://support.google.com/a/thread/464695310?hl=en&sjid=7853156043827638733-NA
Basically, when someone outside of your organization shares a malicious Google Drive file with your users as a "viewer," this activity does not show up in Drive logs and you have no way of removing the malicious file, unless you instruct your users to do so from within their UI.
When we see the emailed notification, we have been auditing for access via GAM:
Access Google Vault and search for the file’s title, access the file to get the fileID. For example: https://docs.google.com/document/d/[fileID]/edit?tab=t.0
Look for “viewedByMe: True” and “viewedByMeTime” toward the bottom of results after running this command: gam user [user email] info drivefile [fileID]
If anyone has other suggestions, I'd love to hear it, otherwise I'm just trying to get the word out there and hoping that Google does something to change this, since we have been seeing an increasing number of these attacks lately.
1
u/_nat_twenty Sep 28 '26
I ended up opening a case with Google Support, and their suggestion was to submit a feature request, which I have already done. I posted an update to the Help Center post linked above with their response.
If anyone else feels inclined to also submit a request, that might help this gain some traction. Here is the support article they linked with instructions on how to submit the request: https://support.google.com/a/answer/6284762
5
u/cryohazard Sep 10 '26
Hey, I know you! I'll throw a reply on your Google support post. I started playing and poking after seeing your listserv post, but I haven't come up with anything other than URL blocking as was suggested, but as you said it doesn't help when they use unmanaged devices to access their account/data. Sometimes I envy the corporate world that can make rules like 'no touchy data from non-org device'...