11 Legacy public-share inventory & cleanup

Sharing defaults are prospective: tightening them leaves every file that is already link-shared to anyone, or shared domain-wide, exactly as it was. This runbook enumerates those files with GAM — the console will not show sharing state in bulk — triages each row into justified or not against a register, revokes the rest, and then re-runs on a schedule and diffs against the register. The recurring diff is what makes it a control rather than a one-off tidy-up.

Documentation: Take action based on search results ↗

Caveats

Cleanup without the recurring diff is a one-off¹
Do not mass-revoke blind²
`print filelist` across all users is slow and quota-heavy on a large tenant³
Revoking a public link on a file inside a shared drive can fail when the drive’s own sharing policy conflicts⁴
Files owned by suspended or deleted users still surface publicly⁵

Setup steps

Inventory every externally-visible file. GAM emits the sharing fields the console will not show you in bulk.
```
gam all users print filelist fields id,name,owners.emailaddress,permissions,webviewlink > shares.csv
```
Method: files.list ↗
open ↗
https://admin.google.com/ac/sc/investigation · captured 2026-07-15

Filter the CSV to the two dangerous states: link-shared to anyone, and shared to a domain-wide audience. Record the matched permission's id in its own column — the revoke step deletes exactly that grant.

Keep rows where permissions.*.type = anyone (allowFileDiscovery true or false) or type = domain; write that permission's id to a permId column
Triage against a register: each surviving row is either justified (record it) or not (remediate it). Do not mass-revoke blind — public shares are load-bearing for some teams.

Output two lists: public-approved.csv (documented) and public-revoke.csv
Revoke the unjustified shares, addressing each by the permission id the triage recorded.
```
gam csv public-revoke.csv gam user "~owners.0.emailAddress" delete drivefileacl "~id" "~permId"
```
Method: permissions.delete ↗
open ↗
https://admin.google.com/ac/managedsettings/55656082996/sharing · captured 2026-07-15
Apps › Google Workspace › Drive and Docs › Sharing settings
Close the tap so the inventory does not refill: tighten the sharing default (control №13 covers this screen in full).

Sharing outside of your organization
Off, or Allowlisted domains
General access default
Private to the owner

Manage external sharing for your organization ↗ Set general access sharing options for your organization ↗
Re-run the inventory on a schedule and diff against the approved register.

Monthly cron: re-run print filelist → diff vs public-approved.csv → alert on new rows

Ongoing maintenance

automatable: script Monthly: re-run the sweep and diff against the exceptions register.
requires a human Per finding: contact the owner and revoke or register the share.

How to verify

Re-run the public-link inventory; the result should be empty or exactly the approved exceptions register.

gam all users print filelist query "visibility='anyoneWithLink' or visibility='anyoneCanFind' or visibility='domainWithLink' or visibility='domainCanFind'" fields id,title,owners

v0.1.3Prevent policy #15 · #12 ↗