Outside Domain account shared a Phishing / Malicious file to numerous staff members.

[Brodie_McBeath]

Hey folks!

I had a user from outside of our domain share out a PDF on Google Drive. What, if possible, would be the most effecient way to revoke this share from all user accounts that received it? We are on essentials.

Appreciate the input and digging the new forum format!

[Dean_Mantz]

We had a similar issue happen a few years ago and realize it is not exactly the same but may provide a starting point.  I went into the Admin Console and set up a Content Compliance rule. GAC> Apps> Google Workspace> Settings for Gmail> Content Compliance. In our case, this was restricting a OneDrive PDF from being shared via email. 

[Kim_Nilsson]

@Dean_Mantz that only affects the email notification of the shared file.

It should do absolutely nothing the actual share.

[Kim_Nilsson · Accepted solution]

@Brodie_McBeath there is actually nothing you can do, unless it was shared with one of your users with Edit rights!

If, and only if, the file is shared with one of your users with Edit rights, you can change the sharing.

If not, you (the admin) can do absolutely nothing.

Each individual user can go to their Shared with me view, and "delete" the file from their view, but they too can't affect the actual sharing.

There is no API for this, so no external tool can do it.

[Brodie_McBeath]

Thats what I figured but was hoping I was wrong. Appreciate the response.