Security issue or invalid log entry?

[jasoncrcsd]

In looking at another issue in the Drive log events I found some entries of a user downlaoding files a few days ago. But the users account was suspended a month ago. Do we have a user able to access files with their suspended account? I looked at other logs of a suer shared files and if another user edits it it shows as that user modifying that file not the suspended user downloading it.

[Kim_Nilsson]

No other activity on the account?

For example Google Drive for Desktop app would log accessing a file as a download. Maybe also in the Drive on mobile app.

Just suspending an account doesn't actually log the user out from all sessions immediately. It should happen eventually, but there is a special button to sign out from sessions, on the Security tab of the user card in the admin console.

It can also be done with gam.

[jasoncrcsd]

Yea but I would think in 30 days it would close the session. 

[Kim_Nilsson]

Oh, a file truly owned by the suspended user but edited by someone else is logged as suspended user actually doing the edit? No reference to the active user at all in the Drive Audit Log?

[jasoncrcsd]

These don;t show edit they show downlaod, if that matters from IPs in another state.

[Kim_Nilsson]

I'd talk to Support, to get some engineer eyes on it.

[jasoncrcsd]

I have the chat agent is escalating it to some other team.