Transcript
Hailee Zapata:
Hi, everyone. Thanks for tuning into this edition of gPanel Office Hours.
This is our monthly webinar series on the second Tuesday of every month designed to help you all master the platform, basically in order to help you better serve your organizations.
Every month, we follow the same agenda. We're going to explain and demo new features and product updates. Then we'll walk you through a detailed tutorial on specific functions.
Today we're going to be doing offboarding and decommissioning. And of course, we'll take you through your questions.
One quick note, as many of you have taken advantage of, you can RSVP for a single webinar or you can go ahead and register for all of our webinars in the office hour series with the one form submission, which is the link here on this slide.
All right, let's meet our presenters today. I am Hailee Zapata. I'm the Alliance Marketing Manager here at Promevo, and Mark Baquirin our resident gPanel rockstar, who is our Systems Support Engineer.
Mark Baquirin:
Hello, nice to be with you all today.
Hailee Zapata:
Thanks for your time, Mark. So before we get started, let's talk about Promevo. Promevo is a premier Google partner that sells services and builds Google products. We are 100 percent Google focused. And we specialize in ChromeOS, Google Workspace, Google Cloud, and of course, gPanel, the reason we're here.
If you are only working with us on gPanel and Google Workspace, you're only just tipping your toe into all the solutions that we can provide and help you with. Not everyone here is a gPanel user yet. And what is gPanel? gPanel is Promevo's proprietary Google Workspace user management and reporting tool.
It takes the functions of the Google Admin console and it adds it in a much deeper level of user control management and so much more. It enhances your user efficiency by administration delegation and an automated onboarding and decommissioning process.
It creates more visibility through customizing reporting, helps drive consistency within your brand and has API integration, and it also protects your company from security risks and breaches through security controls.
So if you're watching this and you're not a gPanel user, and you want to sign up for a free trial, please reach out to us, we'll give you a personal guided demo and walk through what all gPanel can do for your company.
I'm going to bring Mark in to talk with you about before I do that, though, just a reminder. We put all of our new features and updates and more in our release notes. So make sure you're signed up for those. Okay. Mark, I'm going to hand it over you to discuss our new update and get into our workshop.
Mark Baquirin:
Okay. Thanks Hailee.
So today we're going to begin with 1 of our new updates, which is the recovery information fields that we've added to gPanel. So I'm going to go ahead and switch over.
So now we're in gPanel.
The recovery information field is a field that you can use to view and update a user's recovery information. It wasn't here previously on gPanel version 1. And just as a reminder we have switched, or we're in the process of switching from gPanel version one to version two.
And if you want to check out this new feature, it's only gonna be available on v2. So just go ahead and click on your settings, slide this over from v1 to v2, and you should see an interface similar to this. So the new recovery information field is located by clicking on a user. Where it's located is in the users profile section under general settings, and we've put it right at the very bottom.
So there it is recovery information here. If I had recovery information you'd be able to view it here and then you can update it. So if I wanted to, I can go ahead and add my recovery email and save.
And what that would do is when I went into my users Google account settings, which is, I believe accounts dot Google dot com in the security section, you'll see that the recovery email will have been filled out there. If the user happens to change it, you'll see the update here. Also, the recovery phone number you can add this in.
I'm not going to put in my real phone number. If you don't put a real phone number, you will get this error message. So just to let you know, but if you do have a real phone number, updating that will, once again, update the security section of the user's Google account. so that is our new feature for now.
I'm going to go ahead and switch gears to get to the main point of today's discussion, which is gPanels decommissioning tool.
And for this, I'm actually going to switch over to version 1, because we aren't quite there with our transition to version 2. So we've started at the top there, and we're making our way down. To get to the decommissioning tool, it's located in tools and this will change a little bit in V2, but it will be in a similar area.
It's going to be in tools and decommissioning. Before I get into how the decommissioning works I'd like to talk about what is the decommissioning tool and when you would want to use it.
So the decommissioning tool is, a tool created so that during the offboarding process of a user, you can specify a list of actions that you can take in preparation for deleting the user's account.
And these are common things that you would normally do so that you don't lose the user's data or that you can retain the user's data properly and you don't have anything like abandoned calendar events.
And this is how you can configure the decommissioning tool. When you come to the decommissioning tool main page, you will see a list of all of your decommissioning policies that you've already created. You can create multiple policies and by selecting a policy, you will have options to run all the policies or you can run that individual policies.
You can refresh the list. You have some actions here where you can edit the policy that's highlighted. Make a copy of that highlighted policy, delete it or simply disable it. And this is useful when you're testing or if you have multiple policies.
To create a new policy, you would click this add button here or this plus sign. I should say create policy. So when you click that, it takes you to the decommissioning Policy creation page, and I'm going to go into as much detail as I can to explain some commonly asked questions that we get.
It's actually in our knowledge base, but sometimes people just don't know what to look for. So I hopefully can explain everything here. But if you have any follow up questions afterwards, just feel free to let me know. And I'll go over that.
So the main part of the decommissioning policy or setting up a decommissioning policy, is specifying an organizational unit that you would want the decommissioning policy to run on.
So, specifically that's this button here. You can hit add multiple organizations when clicking that a source picker will pop up. You'll be automatically on the org unit button. You won't be able to click on anything else because this is specific to an org unit.
What I like to do is although if you're on the search tab you can just start typing in your org unit and it'll give you a list of selections. I like to hit browse instead, and then it would just allow me to scroll down and see all the org units that are in my workspace.
If you have a lot of org units and nested org units, search might be a better option to be honest. But you could use either or whichever is more convenient for you.
So I have a couple of org units that I've created. I've got contractors. Let's see. I've got interns, part time employees, seasonal employees. So I'm going to set this 1 up to affect contractors. Now you can hit the plus sign here.
You can also, just like the other sections in gPanel, you are able to click the check boxes and select these two, hit add selected.
Once they're in this column on the right, it means that anybody within these OUs will have the decomm policy, and it could trigger depending on how you set your trigger, and we're going to go over that next.
So I'm going to go ahead and select this, and you can see that they're off here to the right, and if you wanted to, you can actually click on the minus sign, and it would remove that org unit from your list.
Okay, so before I get to triggers, let's just go ahead and fill in these other sections here.
You just have to give it a quick name, but it's probably best to name it something that makes a little bit more sense to you. Notification email always a good idea.
You can put your email in or anybody else that you'd like. And I like to pair that with this checkbox here: send summary email. So they would send to this person.
And then here is what I wanted to discuss next. Your decomm triggers. So, there are 2 decomm triggers here. There's user suspension and org unit change. So I'm going to explain each of them and give an example of how and when you would want to use these.
So on user suspension, what that means is two criteria have to be met before the actions that we will choose in just a minute before these actions will be applied to users in these orgs. The criteria is they have to be located in one of the OUs you've selected and then you have to manually suspend that user within gPanel.
For example, when I have it on user suspension, anybody in my contractor's OU, as soon as I suspend them, they will have all of these, whichever actions I select. They would have that apply to that user. If they're not suspended, no action will happen. That's the difference.
Oh, I'm sorry. I forgot to actually talk about the other 1.
The other one is org unit change, which would mean, simply by moving somebody into this OU, the actions that you select will kick off.
So this would actually probably not work for these. And what I would do in this case is instead of choosing those org units, I would go to my list and I'd probably just create one, create in a separate OU called, I think I have built it here.
Oh, I might've removed it. Usually I have an OU that's just called decommissioning. Oh, I have decomm on suspension. I think I had accidentally removed it, but we'll just use this one for now.
Usually I'd have an OU that's just called decommissioning, or you might have several, "decommissioning one", "decommissioning two," "decommissioning three." However you'd like to organize it, if I was to select org unit change, and that way I could leave a user in whatever organization they're in, and when I wanted to decommission that user, I would simply select their account and move them to what would be like my decommissioning OU here. So that would be the difference between these two triggers.
I do see a lot of questions, but I'm going to try and answer them afterwards, so I don't get too off topic here. Okay. So let's see.
Another question that we have frequently is what do these what does this do, this button here or this checkbox here, "leave unsuspended," and when would you use leave unsuspended?
There are 3 actions within our actions policy here that required "leave unsuspended" to be checked in order for the actions to work. And so those three actions are add a delegate set forwarding and delete ASPs.
Delete ASPs is under the user section. Delete ASPs is apps are app specific passwords. So in order to delete any apps specific passwords for that user, "leave unsuspended" needs to be checked, as well as these two email actions, which are "add delegate" and "set forwarding."
So those would be a delegate here, and that would be adding a delegate to that user's inbox, adding an email delegate. Not a contact delegate, but an email delegate. And then set forwarding . So that's, that is when you would actually check the leave unsuspended box. Try not to check it otherwise; it may conflict with user suspension here because you're asking it to spend suspend and leave unsuspended.
So if you are trying to do it that way there are certain things that you can do, like configuring the sequence of events. And that's something I'll go over in a few minutes, but that is the question. We have a lot about this "leave unsuspended" box.
And then "run after saving" simply means after you've configured your policy and hit save it will be, running immediately. So, you can actually check that or leave it unchecked. If you're still in the middle of configuring, or maybe just doing some testing, you could just leave that unchecked.
Next I'm going to go into the actions that you can set here. There are four categories of actions. I'll start at the top and explain all of these actions: reassigning a nickname, resetting a password, username change.
I'll go through each of these, but if you wanted to actually select one and one of the most common ones is "reset the password," you would simply click on it. It would move it to this area in the right, and that means that you have selected this action to kick off when this decommissioning action is taking place.
And the nice thing about it is, you can stack up these actions. So you can have "reset password," " clear primary calendar," for example. That would clear the user's primary calendar. "User org change," if you wanted the user to perhaps change OUs afterwards.
You can remove them from all groups, revoke 3rd party apps, transfer their calendars to another user. And that would be another option.
You can either clear their future events or transfer their future events to another user. And actually, I'm going to choose that one as well, so we can see what that does.
"User suspension," if you do not want to wish the user to have access to the account that you would configure that.
If you have an archived user subscription, you can choose archived user. That could be one of your options.
You do have to have the subscription because it applies an archived user license to that user. So that also means that you must have unavailable license for that user. If not you can get an error. You can sign the user out and You can a lot of people like to do this manually, but you can add the user deletion there.
That would be the final step, typically. So all of these steps usually happen before user deletion, but you could also schedule use user deletion to happen. And the second thing you want, you'd want to configure is the sequence of when these events happen. And to do that actually, it's getting a little bit busy here, but, I'll just Yeah, I was going to remove some, but I'll just leave them.
If I was to click on one of the actions, like "reset password," you can actually configure when you want it to run. So, each of these actions runs nightly. And they run one time nightly, when you configure it to run.
First run would mean that it would run that night sometime between 10 PM and 12, to whatever settings you have in your your settings area. You have your your choice of what times when you're going to be operating in.
So if you have the slider on first run, it's going to run that evening. And if you move the slider to the right, you can actually pick how many days out you'd want it to delay.
So, if I wanted them to have their password available today and tomorrow. In 2 days, I would want the password to be reset. I'd go ahead and hit 2 there and their password wouldn't actually reset for be reset for 2 days. And that's how you configure each of these as far as the sequence of events.
This is an org unit change. Some of these actually have additional options. So, not only does the org unit change have the ability to be scheduled into the future. And this is probably one that you do want to schedule to happen after your initial wave of actions you might want the second wave of actions, maybe in four days, just as an example.
After all of the primary actions have taken place, a secondary action would be to now move this user away from the decomm OU and put them in another OU. You can actually click on this box and you can start typing in and it will give you a list of all your available OU's. So perhaps I want to put them in a temp employees after that.
That means after four days, this user would actually be moved to the temp employees. So this is a way to not clutter up your decommissioning OU. It's just one of your options.
Okay. Another one that I'd like to show is, this one's actually pretty important, when you're decommissioning a user, you want to do something with their future calendar events so that they don't cause notifications for everybody else that's invited to that event. It also allows you to free up any resources that have been assigned to events for a user that's going to be deleted.
You can either clear out their primary calendar by assigning this feature here, "clear primary calendar," and you can once again assign when you'd like to do it.
But actually, instead of clear primary calendar, I like to actually transfer the calendar to another user. So once again, you can schedule when you would like this to happen: either that night or sometime in the future. You could choose to notify the user. And then here this is the person that you're going to be transferring it to.
If you have the slider to the left here, custom user, you'll have this box available to you. And you can select the user that you'd like to transfer it to.
If I wanted to transfer everyone to Kimmy, I could put their name here. Or if you wanted to slide this over to the manager option, what that does is whoever is listed as the person's manager in their profile information section, that manager will become the owner of all of the future calendar events. Those are the options there.
Let's see here. I'm going to go ahead and take this one off just to clear things up a little bit.
Suspend user. That's pretty self explanatory. Archiving. Let me explain that.
Okay. So these are some of the available actions for the user actions. I'm going to go ahead and talk a little bit about the other categories.
So, I'm going to go ahead and remove these from our list. But if you had any questions on any of those specifically, just let me know.
Okay, we're going to move on to the document section. Let's see.
Oh, I'm sorry. What our archived user action does is if you have an archived users subscription, which is an add on subscription to whatever workspace edition that you have, you can apply an archived user license as long as you have an available license. And what that does is it moves the user to a long term storage.
The user will have no ability to access their account, but you still have access to the user's data, their drive data, email data, meets data, chat data. All the data that you need to access from the user will be available to you.
And typically it's for legal purposes to be able to retain their data for a specified amount of time. That's the archive user license and that's how it works. And that's what the action does.
Okay. So let me go ahead and move on to the document section.
In the document section, we have three actions here. So that would be "transfer docs," " remove external shares," and "remove from all shares." These in the middle here are reports that we recently added to gPanel, but are useful when you're offboarding to automatically generate a report.
For example, "docs shared externally report." You probably do want to know, upon off boarding a user, which of their documents have been shared externally. So by clicking that, you'll actually have the ability to run that report and then send that report to either their manager or once again, you can choose a specific person that you can add to that report.
So that's what the doc shared externally report is. And these 4 activity reports there. They're quite similar. Activity shared externally for my drive, shared drives public, public my drive, and public shared drives.
And then going back to the action. So I'm going to take this one off the actions for transferring docs.
This is incredibly important before you delete a user. Some time before you delete a user, you want to make sure that you transfer all of their documents to somebody else, whether it's their manager or a specific user or service account, which is designed to hold all of their information. Otherwise, upon deleting the user, you will lose all of their data.
So this is one of the most important actions that you can take prior to deleting an account. And then, of course, you can automatically remove them. Remove the user from all shares, and then all shares from the share drive as well. So those are the document actions. I'm going to go ahead and move on.
The next section is the Gmail section. This is where you can configure what happens to a person's inbox and what happens to their mail.
So, the first one is the email dump. This is another option you have for retaining their data. This is specifically if you weren't going to use the archive user license, which retains everything. This is specifically retention of their emails, and it creates a Gmail export in the form of an inbox file. That would be the email dump.
Other things you could do are hiding the user from the directory, so nobody will have the ability to contact them. Set up a forwarding address. Very important. If you feel that the user will continue to get email, setting up this forwarding will continue to forward it to one of your active users.
Then you can add a delegate to their inbox. And that would be like another user being able to access that users inbox. Delegate to relation, which would be very similar. Remove email aliases, so any aliases that they have would be automatically removed and set up a vacation responder.
This one's nice because you can actually just perhaps leave a little message here about. That this user will be perhaps transferring all their duties to another user. So it gives a little bit more of an explanation for anyone trying to contact them. So, those are the Gmail actions.
The last section is mobile management options. And this is what to do if anyone, any of these users that are being decommissioned has accessed your workspace data using their mobile device.
So you have the option to wipe the device. Or wipe just the account. And I think it might work a little bit differently depending on if they have an Android or an iPhone or something else, but you can find those details in our knowledge base.
You also have the ability to block the device. So they won't have the option to contact your workspace again or access their data from with their workspace credentials.
And then just to clean up your your inventory list, you can delete this deletes the device from your inventory list, so it won't be there anymore.
So let's see the 4 sections we've covered. Let me just check and make sure I didn't miss anything.
Okay. I did miss something. So that's actually how to configure everything. But the additional things I wanted to talk about were the options on the left hand side here.
So, currently we're on the policy list. If I was to save this policy now, I'll go ahead and save it with just whatever settings I have. It will now appear on our main policy list after a couple of seconds.
So, you can see it's right there, MB demo, and you can see that this active column is true. That means this policy is running right now.
I can't remember what I set the trigger to, but if the trigger was on org unit change, anybody that I put in this org unit testing would be decommissioned automatically. If I had set the trigger to on suspension, I'd have to move them here and then manually suspend them before the actions were triggered.
This column is the name that I've assigned it. This is the org unit. Once again, this is updated by me and last updated the time and date. And then this is a summary of the actions that are to be taken on this account.
Other things are when I click on "suspended users" here, any user that has been suspended due to a decomm policy would be listed here.
And then these are the columns you can see. They're pretty self explanatory there.
This is the log view. So, I didn't decommission anybody, but if anybody had been decommissioned, it would describe the action, give you their email address, the job name, which decommissioning policy was applied to them, and which actions and if the action is complete or not.
And remember, since you can schedule these in sequence, not every action will be complete. You'd have to wait for the sequence to kick off.
But, this column will also indicate if you have any errors and errors will occur if you set up conflicting actions. If you suspend somebody before you transfer their drive data, for example, you will get an error.
So, you have to be mindful to check this log view and see if there was any errors and then investigate why. If you have a question about any areas that you see, you can always give us a call or contact us through email or chat. And then we will, help troubleshoot and see why that happened.
And bulk load user here. This is used a little bit rarely cause you can actually off board a lot of people at once, but that could be a kind of a dangerous situation. I would not use this bulk load user, unless you for sure want to decommissioning a large group of people all at once.
So I think that kind of concludes it and I'm going to try and catch up on some of these questions I saw in the chat.
If you have any questions for me right now, I'd be happy to go over anything that I described here or any other questions you have, and hopefully I can get them answered.
But let me see if I can pick any out in the chat here.
Hailee Zapata:
Yeah, we did get a couple, Mark. One that I wanted to bring up is from the very beginning, and you addressed this earlier with decomming contractors and full time employees, but can you talk about the different decomm processes?
Mark Baquirin:
I guess I don't totally understand the question. You mean, let me head back into the policy here. Did you mean the decomm triggers?
Hailee Zapata:
Yeah, so, what's one example for having multiple decomm policies?
Mark Baquirin:
Oh, if you had multiple policies, like we have here on our policy list. We've created three different policies and oftentimes one policy will be enough, but sometimes not.
For example, I have a contractor's OU. So I've put anyone who's a part time contractor into that OU. And perhaps for like legal reasons, some data will be retained and others don't have to be retained. So, their policy might look different from any other policy you have here.
So, it just depends on you. You don't have to have multiple policies. You can have one overall policy, but it gives you the option to have several configured differently, if you need it to be configured differently. So, that's just the the reason you can have different policies.
And then the reason that you could choose multiple org units is because you might not, always want to just decomm in one org unit.
You might want to have part time and seasonal employees together. You might want to say, okay, for part time employees and seasonal employees, all of their actions will be the same. So, instead of making two separate policies, I have one policy assigned to do two different org units.
I hope that answers the question there, but let me know if you need further clarification.
Hailee Zapata:
Since we're already talking about the policies: after a policy is run, and the email is sent out, the tasks have been completed, is there any way to get more granular on what exactly was done?
Mark Baquirin:
Yeah, although I don't have a good example. The log view will show you a log of what happened.
Even though it'll have a log view, you still have to be able to extrapolate what's going on because it won't tell you exactly, especially if you get errors.
It might not be obvious why there's an error, but typically it's an issue having to an error that has to do with the sequence of timing that happens or conflicting actions like leave unsuspended is checked, but at the same time, you have suspend user as your trigger, it could cause a conflict.
So, things like that.
Hailee Zapata:
So, I think he had a specific example like he wants to know if we have a user that gets removed from all groups and you get an email that they were removed from X number of groups, but it doesn't say which ones, can we add the groups that have been removed from? Can you list granularly each group that they were removed from?
Mark Baquirin:
Oh no, it's not going to show here in these logs, but you will be able to see that in your, admin console logs under the under reporting. Audit and investigation, then go to your group enterprise logs, you'll have to put in a few filters.
Hailee Zapata:
Mine always does that most inopportune time. Please log in again.
Mark Baquirin:
Exactly. Okay. Yeah, you'd have to put in a few filters in here to be able to specify the user and so forth and perhaps the date range that you're looking for. But it'll show you each group that the user was removed from.
The only thing that would be different is this actor section will not list specifically who did it. It will list the gPanel application admin, but we have separate logs here so that you know which admin actually did the action if it wasn't you.
Hailee Zapata:
Okay. And then one more decomm policy question. Can we set times to run a decomm policy similar to signature templates?
I think you touched on this, but. Can you refresh us?
Mark Baquirin:
Sure. You can't set the exact time.
When you have actions here, and I'll just choose a random action mobile wipe. The only thing you could do is first run. They always run in the evening, and it would be, I think, between 10 to midnight, set to your local time or the time you have set here in gPanel, or you can choose a number of days out, but it would still be the evening of that day.
If you were to choose 5 days, it'd be in 5 days that evening is when the action would take place.
Okay, switching gears a little bit. Someone asked, I manage users via AD, active directory. Can I have something in AD trigger the decommission?
You might be able to use the gPanel API, if you had gPanel Enterprise . But not quite, if you're just using AD.
I think you can use suspend user, but you'd have to just make sure that the user is already in a an OU that's selected here.
So upon suspension, the actions will trigger. If you wanted a little bit more clarification, perhaps we can we can set up a call later and check out yourindividual situation there.
Hailee Zapata:
Yeah, that's a great idea.
Another question is where is the email dump located? And what is the best way to archive the email account?
Mark Baquirin:
Once the email dump or email export is executed, it would live in here under tools on the left hand side, "Gmail export," which is the other name for it. You would see it listed here and you would have, I think, 15 days to download it.
It's going to be encrypted, so you'd have to create a key. We have in our, knowledge base instructions, how to create the encryption and decryption keys and then how to basically take this encrypted dump and then decrypt it.
After you go through the whole decryption process, it becomes an inbox file, which you cannot view natively in Gmail. You actually have to use a third party tool.
This is not a gPanel thing. It's just a Google thing.
You'd have to use a third party tool such as Thunderbird, in order to view. And I think in Thunderbird, you can add an extension, which will allow you to bring it back into Gmail, but it's not like a seamless process really.
But yeah, just to answer your question, it will live here under tools, Gmail export.
Hailee Zapata:
Okay, great. Just time for a couple more questions. Is there a way to transfer files to a shared drive instead of a specific user?
Mark Baquirin:
No, currently it's only set up to let me head back over there. And this I know for sure, because I've had this question asked. Transferring your docs, this action, you only have the option to transfer to a specific user. Not a shared drive. And I'm not sure if we have the ability to do that. I can check on my past case and see if they're working on it or see if it's just not possible. But I'll have to check up on that.
But currently, no, you cannot do that.
Hailee Zapata:
Okay.And then last question. And then just so everyone knows, if your questions were not answered, we will reach out personally or we're going to create a blog with all these questions. All of your information and questions will get answered. But for this one, it's for the mobile management.
Mark Baquirin:
If you wipe an Apple device, will it completely factory reset the device? Some other mobile management softwares do. Or will it just remove the apps and account?
According to my testing , both wipe and wipe account will fully factory reset the device. I don't have a newer device to test with. But I would err on the side of caution, unless you have a spare device that you can test with. I would say that both of these for an apple device will wipe will factory reset your apple device.
Hailee Zapata:
Okay, good to go. Thanks for that tutorial, Mark, and answering all those questions. Hopefully you all found that super helpful. As always, reach out to us if you need help with offboarding or decommissioning or anything else gPanel.
If you want to submit questions ahead of time, you can always send an email to updates@promevo.com, and we'll make sure it gets addressed in our next office hour session.
Some quick notes before we go. If you're not on our gPanel mailing list, go to promevo.com/gpanel-newsletter, and we'll make sure you are aware of any new features, new webinars, and everything else that's important for you to know.
As you can see, we have a full slate of webinars planned throughout 2024. In our March Office Hours, we're going to be covering reporting, which is a massive topic that we always get a ton of requests for. And then in April, we're going to look into signature templates, which I know we had some questions on those today.
So those are just the next two Office Hour webinars, and there are many more after that. If you're not yet a gPanel user, kick off your free trial today at promevo.com /ganel.
So thanks to all of you who joined us and thanks for being such a great gPanel community of experts to work with. Thank you, Mark, again, for presenting and answering all of our questions and walking us through our workshop.
We hope everyone has a fantastic week. See you next time.
Mark Baquirin:
Thank you, Hailee. Thank you, everyone.
Custom and secure business email
Custom and secure business email + eDiscovery, retention, S/MIME encryption