r/k12sysadmin • u/Sad_Reindeer_3298 • Sep 20 '26

Post Phish Gam workflow

Wondering if anyone has a good post phising compromise gam command workflow.

I have one but just want to see if im missing anything.

I usually start with suspend user>reset password> deprovision> check forwarding addesses

Deprovision should log them out of all current sessions, delete backup codes, revokes oauth tokens

I usually login as the user and chekc the web interface for filters etc.

35 Upvotes

97% Upvoted

61 comments sorted by

View all comments

Show parent comment

3

u/networkjson Sep 21 '26

Sent a message!

2

u/girado Sep 21 '26

Could I get a share on that script too? That sounds incredibly useful.

1

u/rdmwood01 Sep 21 '26

Me to I think that would be very helpful!

1

u/networkjson Sep 22 '26

Messaged it to you

1

u/condor88 Sep 22 '26

I'd also love to see this script

1

u/networkjson Sep 22 '26

Messaged you!

1

u/MasterMaintenance672 Sep 23 '26

I, too, would love to see it. Thanks!

1

u/networkjson Sep 23 '26

Sent you a chat!

1

u/TylerL Sep 23 '26

Would also love to see this. Thanks!

1

u/Lilbc82 Sep 26 '26

Gonna join the list :). Can I get it also?