Situation? Shared files for a suspended ot deleted user

[jasoncrcsd]

I was wondering how you all handle this. User is employed, shared documents. User leaves. We suspend the account or at some point delete it. Then sometimes months later we get requests I cannot access this shared document etc. Sometimes I can find it in Google vault etc but not always. Is there a good process for this? I can't go through every users docunts that are shared for every user that leaves id be doing nothing but that. And its not like we can tell the user to do this or that before they leave becaused they are leaving and probably won;t anyway.

Just wondering if anyone has found a process to handle this well.

Thanks

[BrianGray]

We NEVER delete accounts - for exactly this reason.  Our attorney approved the scheme.

[AndyCaffrey]

1. A "Shared by Default" Policy of having everything created put into shared drives helps (in the UK, all resources created are the property of the school, so I understand this may be easier than in other locations)
2. When removing staff users, transfer their drives to another account (which could be an account specifically for this) - so no files are actually deleted - helps if you discover they created the school-wide lesson plan file. 

[Kim_Nilsson]

Train your users in a new process.

1. All curated ( = good) shared content should reside in a Shared Drive, never only live in a user's own MyDrive.
2. You can DEFINITELY require leaving users to take responsibility of their shared content and make sure it resides in a Shared Drive, or transfer ownership to the relevant person before they leave. This is super boring and will help bring about change towards #1.
3. If that fails, have their closest colleagues take note of content they know was created by this person, so it can be handled appropriately before the account is deleted. This will be boring, and will help bring about change towards #1.
4. If all else fails, you will have to do it! That's just insanely boring, which will help motivate you to motivate everyone towards #1. 🙂

[icrew · Accepted solution]

For those of us in higher ed, we're struggling with similar things, as we work to delete old accounts in order to get under Google's new storage limits. Echoing a number of the comments here, we're also trying to push the "if it needs to stick around after you leave, it needs to be in a Shared Drive" culture change.

Additionally, some of the techniques that various universities are using to let still-current folks know that they might be using a file that's owned by an expired user include:

• Renaming the account (human readable name and/or login) to include "EXPIRED" (like "EXPIRED Ian Crew" or "expired__iancrew@example.edu")
• Changing the profile picture to something like this:
  
• Using DLP rules to apply a badged label to all of the files owned by a people in a particular group or OU (e.g., the "expired" OU or something) as follows (credit Tron Compton-Engle at CWRU and Chuck Boeheim at Cornell for these steps):
  1. Turn on labels and create a label. I used badged labels because of the great additional features (bright red, description field and even the ability to specify a URL for additional information).
  2. Leave the detector section blank
  3. Create a rule (Security, Access and data control, Data protection). The rule applies the badged label in step 1, and since the detector section is blank it will happen for any file. I applied it to an OU.

The DLP labeling is particularly useful, because badged labels appear as the document is being used/edited, so they're pretty obvious. They also can be searched for in Drive, making it easy for any particular person to see the files that they have access to that are owned by expired folks. See https://it.cornell.edu/file-storage/google-drive-orphaned-content for more details about what the end-user sees.

Hope that helps,

Ian

[Kim_Nilsson]

wow, those were some great suggestions, @icrew !