GWS-010 · Script
User Offboarding Automation
Runs a repeatable offboarding workflow for one or more departing Google Workspace users.
What it does
For each departing user, in this order: 1. Saves a list of the user's groups to the Reports folder (for your records) 2. Resets the password to a random value and signs the user out everywhere 3. Removes app passwords, backup codes and access tokens; turns off POP/IMAP 4. Hides the user from the directory (global address list) 5. Optionally sets an auto-reply and gives a manager delegated mailbox access 6. Transfers Drive files and calendars to the manager (or -TransferTo account) 7. Removes the user from all groups 8. Moves the user to the archive OU 9. Optionally removes a license 10. Suspends the account, unless an auto-reply or delegate is set (those need an active account); add -ForceSuspend to suspend anyway. Nothing is deleted. Preview mode (default) shows every step without making changes.
Requirements
GAM7, installed and authorized by you. GAM is not included. Windows PowerShell 5.1 or PowerShell 7.
How to run it
- Run from: an admin workstation or scheduled task with GAM7 set up
- This is an admin script for your Google Workspace tenant, not a per-device endpoint script
- User interaction: none with app-only sign-in
- Schedule: run on demand, or weekly for reports
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Preview = show steps only (default). Apply = run them. | Preview, Apply | Preview |
| User | One departing user's email. Or use -InputCsv for several. | ||
| Manager | Who receives Drive files and calendars (and mailbox access, with -DelegateToManager). | ||
| InputCsv | CSV with columns: Email, Manager. | ||
| ArchiveOrgUnit | OU for departed users. Default: /Departed Users | /Departed Users | |
| AutoReplyMessage | Optional auto-reply text. Example: "I am no longer with the organization. Please contact [email protected]." | ||
| DelegateToManager | Give the manager delegated access to the mailbox. | False | |
| RemoveLicenseSku | Optional license SKU ID to remove (for example 1010310008). | ||
| ForceSuspend | Suspend even when an auto-reply or delegate is set. | False | |
| GamPath | Path to GAM. Default: gam (on PATH). | gam |
Exit codes
- 0 = Completed, all steps succeeded
- 1 = Completed, but one or more steps failed (see log)
- 2 = Script error (see log)
Testing steps
- Run it first with the mode set to Preview on one test account or small group. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Preview mode changes nothing. The log records each step. Restore the account with GWS-002, add groups back from the log, and reassign the license. File transfers are not reversed automatically.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |