Running a user activity report

Sometimes you may want to see all the devices that a domain user has recently accessed.  This may be valuable for forensic purposes, where device damage or malicious network behavior may need to be traced to a particular user.

**User activity reports can only be run on domain users, and will only be obtainable from the Google Admin Console when Chrome device settings allow local data to be preserved.**

Note:  Because user activity reports must be tabulated across all Chrome devices on your domain, this report can take a long time to run.  Do not close the sidebar while it is running or you will interrupt the job.

Screen_Shot_2019-10-31_at_4.17.48_PM.png Screen_Shot_2019-10-31_at_4.18.03_PM.png   

 

Sample user activity report:

Screen_Shot_2019-10-31_at_4.23.09_PM.png

Basic Subscribers: This report will show you a 60 days history of all devices that have been logged into by that user based on information stored in the Google Admin Console. Because user logins are ordered, but not associated with timestamps in Google’s available data, Recentness of Use is used to represent how recently the user was logged onto the device.  A 1 means that the user was the most recent user to log into the device.

Premium Subscribers:  You will be able to see 60 days worth of sessions from both the Google Admin Console as well as detailed session data provided from Gopher Buddy.