Drive Log Events Actions

[speedingwolf]

Before I jump to assumptions or conclusions toward my SA. I found the entry in the Google Drive Audit event. Please see below. What does this mean? My SA downloaded the users' files? My understanding is that SA can not access a user folder and download unless reset the user password or log on as that user. However, reading online, SA can do this via API. Also, assumption is that the folders, files are not shared to the SA.

https://tanaikech.github.io/2017/03/20/download-files-without-authorization-from-google-drive/

I

[Jan-Carlos]

Hello @speedingwolf 

Anyone with reader or edit permission could download that.

Probably the file is shared internally with all users of your organization.

Not directly but with the general access set to the organization as default.

So anyone with the link could download, because they would have the permission to do that.

Can you send us a picture of the sharing configuration of the file?

It's hard to grasp the problem without the screenshot of the permissions of the file.

[speedingwolf]

Hi Jan-Carlos,

Thank you for your reply. The files are shared internally either through a shared folder or shared as individual folders or files. Based on the logs, the majority of these files belong to Legal, Finance, Accounting, HR, and Executive Assistant to the CEO. Some are rather personal info, and financial sensitivity. I looked at the Title from the logs export.  I am not a SA, and Google suite is relatively new to me, so I can not find out sharing configuration of the files. This SA is our Super Admin. I checked a few shared folders from our Legal team, and only one person in legal as a Content Manager permission. The other folder has other compliance team members but not my SA. So, I am curious how he was able to download these files and downloaded to where. I think the first step is to ask these files owner if they asked the SA to perform any duties. Second, if they shared any of these content to the SA or who?