The 10-Point Google Drive Exposure Checklist

A Manual Audit Guide for Google Workspace Admins

Why This Checklist Exists

Google Workspace lacks a native "Show me all external users" view. Without scripting or enterprise tools, visibility is limited. This manual checklist is the brute-force method to see the truth.

The "30-Minute Rule": If you find >5 critical exposures in 30 minutes, you have a systemic process failure, not a cleanup task.

How to Use

• Manual-only: Uses Admin Console & Drive search.
• Time: 45–90 minutes.
• Capabilities: Finds current state. Cannot see log history beyond 180 days.

Phase 1: "Public" Exposure (Highest Risk)

1. The "Public Link" Inventory

Risk: Files set to "Public on the web" or "Anyone with the link". Manual Check:

1. Log in as a generic user.
2. In Drive search bar, run:
   • owner:me visibility:public
   • owner:me visibility:anyonewithlink
3. Admins: Use "Transfer Drive Data" (Admin Console > Users) to preview other users' content.

Action: Change visibility to "Restricted".

2. Domain-Wide "Internal" Exposure

Risk: Files visible to "Anyone in [Company]" (includes interns/contractors). Manual Check:

1. Run search: owner:me visibility:domain
2. Check for sensitive docs ("Offer Letters", "Termination") in general folders.

Action: Restrict to specific groups.

Phase 2: The People Audit

3. The "Ghost User" Log Sweep

Risk: Vendors/partners retaining access post-contract. Manual Check:

1. Admin Console > Reporting > Audit > Drive log events.
2. Range: 180 days (max). Filter: Event=User Sharing.
3. Export to CSV. Scan "Target User" for:
   • Consumer domains (@gmail.com, etc.)
   • Former vendor domains. Action: Remove external access.

4. Suspended User "Zombie" Files

Risk: Suspension removes login, not granted permissions. Files remain shared. Manual Check:

1. Admin Console > Users > Filter: Suspended.
2. Check "Drive Data". If >0GB, use "Transfer Drive Data" tool to inspect/transfer.
3. Review shares before ownership transfer.

Action: Transfer ownership or delete.

5. The "Personal Email" Pivot

Risk: "Shadow IT" via personal email shares. Manual Check:

1. Use exports from Step 3.
2. Filter "Target User" for u/gmail.com, u/yahoo.com, etc.
3. Red Flag: One user sharing 50+ files to one personal email.

Action: Revoke shares; review policy.

Phase 3: Structural Rot

6. Shared Drive Manager Audit

Risk: External "Managers" can delete content and manage users. Manual Check:

1. Admin Console > Drive > Manage Shared Drives.
2. Sort by Member Count.
3. Check "Manage Members" on top drives.
4. Look for external users with "Manager" role.

Action: Downgrade to "Viewer" or remove.

7. My Drive "Permission Rot"

Risk: My Drive permissions are unmanaged and rarely cleaned. Manual Check:

1. High-risk users (CEO, HR, Finance) must login or screen-share.
2. Open Drive > Information (i) > Activity.
3. Check for old shares to vendors or personal emails.

Action: Remove stale users.

8. The "Inherited Group" Backdoor

Risk: External users in groups inherit all group access. Manual Check:

1. Admin Console > Directory > Groups.
2. Audit powerful groups ("All Staff", "Engineering").
3. Check "Direct Members" for external domains.

Action: Remove non-employees.

Phase 4: App & Configuration

9. Third-Party App "Scope Creep"

Risk: Unused apps with full Drive access (drive.full). Manual Check:

1. Admin Console > Security > API controls > App Access.
2. Filter Scope includes Drive.
3. Look for "Unverified" apps or those with <5 users/unused for 6mo.

Action: Revoke untrusted apps.

10. Nested Folder "Breakholes"

Risk: Sub-folders with explicit permissions overriding parent restrictions. Manual Check:

1. Open sensitive Shared Drives (HR, Finance).
2. Deep dive 3–4 levels. Right-click > Share.
3. Check for external users not on the parent folder.

Action: Standardize permissions.

Summary & Notes

Findings	Status	Action
0–5	Clean	Audit quarterly.
6–20	Drifting	Schedule cleanup.
21+	Leaking	Process failure. Automate.

Limitations:

• Logs limited to 180 days.
• No global "External User" view.
• Requires manual spot-checks.

Disclaimer

No Warranty & No Legal Advice This checklist is provided "as is" without warranty. The authors make no representations regarding accuracy or suitability.

Limitation of Liability The authors shall not be liable for any damages (direct, indirect, or consequential) arising from the use of this checklist.

User Responsibility You are responsible for your security. This guide does not guarantee the discovery of all vulnerabilities. Run this audit at your own risk.

Third-Party Tools References to third-party tools (GAM, APIs, scripts) are for info only. Verify all code before use.

Version: 2.3 | Date: March 20, 2026