Sometimes you may want to see all the devices that a domain user has recently accessed. This may be valuable for forensic purposes, where device damage or malicious network behavior may need to be traced to a particular user.
User activity reports can only be run on domain users, and will only be obtainable from the Google Admin Console when Chrome device settings allow local data to be preserved.
Note: Because user activity reports must be tabulated across all Chrome devices on your domain, this report can take a long time to run. Do not close the sidebar while it is running or you will interrupt the job.
To generate a user activity report:
- Open a new Google Sheet.
- In the top menu, go to Add-ons > Gopher for Chrome > Launch Sidebar.
- Once the sidebar loads, click Run reports.
- Click Single User.
- Enter the user’s email address.
- Click Run.
This report will show you a 60 days history of all devices that have been logged into by that user based on information stored in the Google Admin Console. Because user logins are ordered, but not associated with timestamps in Google’s available data, Recentness of Use is used to represent how recently the user was logged onto the device. A 1 means that the user was the most recent user to log into the device.
You will be able to see 60 days worth of sessions from both the Google Admin Console as well as detailed session data provided from Gopher Buddy.