topic Re: Security issue or invalid log entry? in Peer-Peer Topics

Security issue or invalid log entry?

jasoncrcsd — Tue, 08 Aug 2023 14:24:04 GMT

In looking at another issue in the Drive log events I found some entries of a user downlaoding files a few days ago. But the users account was suspended a month ago. Do we have a user able to access files with their suspended account? I looked at other logs of a suer shared files and if another user edits it it shows as that user modifying that file not the suspended user downloading it.

Re: Security issue or invalid log entry?

Kim_Nilsson — Tue, 08 Aug 2023 15:08:29 GMT

No other activity on the account?

For example Google Drive for Desktop app would log accessing a file as a download. Maybe also in the Drive on mobile app.

Just suspending an account doesn't actually log the user out from all sessions immediately. It should happen eventually, but there is a special button to sign out from sessions, on the Security tab of the user card in the admin console.

It can also be done with gam.

Re: Security issue or invalid log entry?

Kim_Nilsson — Tue, 08 Aug 2023 15:09:57 GMT

Oh, a file truly owned by the suspended user but edited by someone else is logged as suspended user actually doing the edit? No reference to the active user at all in the Drive Audit Log?

Re: Security issue or invalid log entry?

jasoncrcsd — Tue, 08 Aug 2023 15:43:06 GMT

Yea but I would think in 30 days it would close the session.

Re: Security issue or invalid log entry?

jasoncrcsd — Tue, 08 Aug 2023 15:43:39 GMT

These don;t show edit they show downlaod, if that matters from IPs in another state.

Re: Security issue or invalid log entry?

Kim_Nilsson — Wed, 09 Aug 2023 07:32:24 GMT

I'd talk to Support, to get some engineer eyes on it.

Re: Security issue or invalid log entry?

jasoncrcsd — Wed, 09 Aug 2023 11:14:33 GMT

I have the chat agent is escalating it to some other team.