GWS-009 · Script
User Account Inventory
Exports all Google Workspace user accounts with key details and flags inactive accounts.
Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing
What it does
Read-only. Saves a dated CSV with each user's email, name, OU, status, admin status, 2-Step Verification enrollment, creation date and last sign-in. Adds two helper columns: DaysSinceLogin and Flag (Never signed in, Inactive, No 2SV, Admin without 2SV).
Requirements
GAM7, installed and authorized by you. GAM is not included. Windows PowerShell 5.1 or PowerShell 7.
How to run it
- Run from: an admin workstation or scheduled task with GAM7 set up
- This is an admin script for your Google Workspace tenant, not a per-device endpoint script
- User interaction: none with app-only sign-in
- Schedule: run on demand, or weekly for reports
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| InactiveDays | Days without sign-in before an active account is flagged Inactive. Default: 90. | 90 | |
| OrgUnit | Limit the export to one OU. Default: whole domain. | ||
| AlertOnFindings | Exit 1 when any admin accounts lack 2-Step Verification or active accounts are inactive. | False | |
| GamPath | Path to GAM. Default: gam (on PATH). | gam |
Exit codes
- 0 = Completed
- 1 = Findings present (only with -AlertOnFindings)
- 2 = Script error (see log)
Testing steps
- Run it on one test tenant or small OU and check the output and log.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report only. It saves a CSV and changes nothing else.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |