Google Workspace
Google Workspace: admin management, authentication, Drive, Gmail, groups, OAuth, devices, and logging.
- Command
Invoke-GWSAudit- checks
- 190
- Check families
- 11
| Family | Checks |
|---|---|
| Admin & User Management | 25 |
| Advanced Threat Protection | 36 |
| Adversary Tradecraft | 7 |
| Authentication & Access Controls | 19 |
| Collaboration | 25 |
| Device & Endpoint Management | 11 |
| Drive Security & Data Protection | 23 |
| Gemini for Workspace | 12 |
| K12 Baseline | 15 |
| Logging, Alerting & Monitoring | 7 |
| OAuth & API Security | 10 |
Admin & User Management (25)
- ADMIN-001: Super Admin Account Inventory Critical
- ADMIN-002: Admin Role Assignments Audit High
- ADMIN-003: Delegated Admin Permissions Review Medium
- ADMIN-004: Inactive/Suspended Admin Accounts High
- ADMIN-005: User Account Inventory Medium
- ADMIN-006: Stale User Accounts Medium
- ADMIN-007: OU Structure Review Low
- ADMIN-008: Directory Sharing Settings Medium
- ADMIN-009: User Profile Visibility Low
- ADMIN-010: Groups Settings and External Membership High
- ADMIN-011: Group Creation Restrictions Medium
- ADMIN-012: Groups for Business Settings Medium
- ADMIN-013: Super Admin Count High
- ADMIN-014: Assured Controls - Access Approvals Enabled Medium
- ADMIN-015: Assured Controls - Support Access Restricted to U.S. Staff Medium
- ADMIN-016: Assured Controls - Multi-Region Data Processing Disabled Medium
- ADMIN-017: Internal apps not auto-trusted (GWS.COMMONCONTROLS.10.3) Medium
- ADMIN-018: Data at-rest region configured (GWS.COMMONCONTROLS.15.1) Low
- ADMIN-019: Data processing restricted to storage region (GWS.COMMONCONTROLS.15.2) Low
- ADMIN-020: Access to unconfigured third-party apps blocked (GWS.COMMONCONTROLS.10.4) High
- ADMIN-021: Additional Google services without individual control restricted (GWS.COMMONCONTROLS.16.1) Medium
- ADMIN-022: Early Access applications disabled (GWS.COMMONCONTROLS.16.2) Medium
- ADMIN-023: Super admin count within the supported range (GWS.COMMONCONTROLS.6.2) High
- ADMIN-024: Marketplace apps limited to an allowlist (GWS.COMMONCONTROLS.11.1) High
- ADMIN-025: Multi-party approval required for sensitive admin actions (GWS.COMMONCONTROLS.17.1) Medium
Advanced Threat Protection (36)
- EMAIL-001: SPF Record Validation Critical
- EMAIL-002: DKIM Signing Enabled Critical
- EMAIL-003: DMARC Policy Audit Critical
- EMAIL-004: MTA-STS Policy Medium
- EMAIL-005: TLS Enforcement High
- EMAIL-006: Email Allowlist/Blocklist Review Medium
- EMAIL-007: Inbound Gateway Configuration Medium
- EMAIL-008: Email Routing Rules Audit Medium
- EMAIL-009: Auto-Forwarding Policy High
- EMAIL-010: Delegate Access Settings Medium
- EMAIL-011: POP/IMAP Access Settings High
- EMAIL-012: Spam and Phishing Filter Settings High
- EMAIL-013: Enhanced Pre-Delivery Message Scanning High
- EMAIL-014: External Recipient Warning Medium
- EMAIL-015: Attachment Safety Settings High
- EMAIL-016: Links and External Images Protection High
- EMAIL-017: Spoofing and Authentication Protection Critical
- EMAIL-018: Compliance Rules Audit Medium
- EMAIL-019: DLP Rules Configuration Medium
- EMAIL-020: Gmail Confidential Mode Low
- EMAIL-021: S/MIME Settings Low
- EMAIL-022: Mail Forwarding Rule Enumeration High
- EMAIL-023: Per-user outbound gateways disabled (GWS.GMAIL.12.1) Medium
- EMAIL-024: Gmail Security Sandbox enabled (GWS.GMAIL.16.1) Medium
- EMAIL-025: Gmail mail delegation disabled (GWS.GMAIL.1.1) Medium
- EMAIL-026: Gmail POP and IMAP access disabled (GWS.GMAIL.9.1) High
- EMAIL-027: Gmail user email/contacts import disabled (GWS.GMAIL.8.1) Low
- EMAIL-028: Google Workspace Sync for Outlook disabled (GWS.GMAIL.10.1) Low
- EMAIL-029: Gmail spam-override sender lists reviewed (GWS.GMAIL.18.1) Low
- EMAIL-030: Automatic email forwarding disabled (GWS.GMAIL.11.1) Medium
- EMAIL-031: Enhanced pre-delivery message scanning enabled (GWS.GMAIL.15.1) Medium
- EMAIL-032: Comprehensive mail storage enabled (GWS.GMAIL.17.1) Medium
- EMAIL-033: Unsafe attachments are not left in the inbox (GWS.GMAIL.5.5) High
- EMAIL-034: Spoofed and unauthenticated mail is not left in the inbox (GWS.GMAIL.7.6) High
- EMAIL-035: No domains bypass spam filtering and warnings (GWS.GMAIL.18.2) High
- EMAIL-036: Spam filter bypass not enabled for all senders (GWS.GMAIL.18.3) High
Adversary Tradecraft (7)
- GTRADE-001: Domain-Wide Delegation Org-Takeover Exposure Critical
- GTRADE-002: Internet-Readable Google Groups High
- GTRADE-003: Open-Join / External-Member Groups Medium
- GTRADE-004: Super-Admin Sprawl Medium
- GTRADE-005: Super-Admin-Equivalent Custom Roles Medium
- GTRADE-006: Persistent / Over-Scoped OAuth Grants High
- GTRADE-007: Admin Role Granted Through a Group High
Authentication & Access Controls (19)
- AUTH-001: 2SV Enforcement Critical
- AUTH-002: 2SV Enrollment Rate High
- AUTH-003: 2SV Method Strength Medium
- AUTH-004: Password Minimum Length High
- AUTH-005: Password Reuse Restriction Medium
- AUTH-006: Session Duration Medium
- AUTH-007: SSO Configuration Medium
- AUTH-008: Less Secure Apps Access High
- AUTH-009: App Passwords Policy Medium
- AUTH-010: Recovery Options Configuration High
- AUTH-011: Login Challenge Settings Medium
- AUTH-012: Super Admin 2SV Enrollment Critical
- AUTH-013: Stale Super Admin Accounts High
- AUTH-014: 2SV Enrollment Allowed Medium
- AUTH-015: 2SV Enrollment Grace Period Low
- AUTH-016: Advanced Protection Self-Enrollment Low
- AUTH-017: Super Admin Account Self-Recovery High
- AUTH-018: Account self-recovery disabled for users and non-super admins (GWS.COMMONCONTROLS.8.2) Medium
- AUTH-019: Conflicting unmanaged accounts replaced (GWS.COMMONCONTROLS.7.1) Medium
Collaboration (25)
- COLLAB-001: Meet Recording Settings Medium
- COLLAB-002: Meet External Participant Settings Medium
- COLLAB-003: Meet Anonymous Join Settings Medium
- COLLAB-004: Chat External Communication High
- COLLAB-005: Chat History Settings Medium
- COLLAB-006: Chat Spaces External Access Medium
- COLLAB-007: Chat App Installation Settings Low
- COLLAB-008: Calendar External Sharing High
- COLLAB-009: Calendar External Invitations Medium
- COLLAB-010: Calendar Appointment Slots External Visibility Low
- COLLAB-011: Meet External Participant Labeling Low
- COLLAB-012: Meet Host Management Medium
- COLLAB-013: Chat external file sharing disabled (GWS.CHAT.2.1) High
- COLLAB-014: Chat space history is on (GWS.CHAT.3.1) Low
- COLLAB-015: Meeting join restricted to the organization (GWS.MEET.2.1) High
- COLLAB-016: Meet automatic transcription off by default (GWS.MEET.5.2) Low
- COLLAB-017: Calendar external interoperability managed (GWS.CALENDAR.3.1) Low
- COLLAB-018: Calendar appointment payments disabled (GWS.CALENDAR.4.1) Low
- COLLAB-019: Meet automatic recording off by default (GWS.MEET.5.1) Low
- GROUP-001: External access to Google Groups restricted (GWS.GROUPS.1.1) High
- GROUP-002: Group owners cannot add external members (GWS.GROUPS.1.2) Medium
- GROUP-003: Groups cannot receive mail from outside the org (GWS.GROUPS.1.3) Medium
- GROUP-004: Group creation restricted to administrators (GWS.GROUPS.2.1) Low
- GROUP-005: Group conversation visibility defaults to members (GWS.GROUPS.3.1) Low
- GROUP-006: Groups are visible in the directory (GWS.GROUPS.4.1) Low
Device & Endpoint Management (11)
- DEVICE-001: MDM Policy Audit High
- DEVICE-002: Device Approval Requirements High
- DEVICE-003: Screen Lock Enforcement High
- DEVICE-004: Device Encryption Requirements High
- DEVICE-005: Compromised Device Blocking High
- DEVICE-006: Jailbroken/Rooted Device Policy High
- DEVICE-007: Chrome Browser Management Medium
- DEVICE-008: Chrome Extension Whitelist/Blocklist High
- DEVICE-009: Chrome OS Device Policies Medium
- DEVICE-010: Endpoint Verification Settings Medium
- DEVICE-011: Company-Owned Device Inventory Low
Drive Security & Data Protection (23)
- DRIVE-001: External Sharing Defaults High
- DRIVE-002: Link Sharing Default Settings High
- DRIVE-003: Anyone With the Link Sharing Audit High
- DRIVE-004: Shared Drive Creation Restrictions Medium
- DRIVE-005: Shared Drive Member Management Medium
- DRIVE-006: Shared Drive External Sharing High
- DRIVE-007: File Ownership Transfer Settings Medium
- DRIVE-008: Drive for Desktop Allowed/Blocked Medium
- DRIVE-009: Third-Party App Drive Access High
- DRIVE-010: Drive DLP Rules Audit Medium
- DRIVE-011: Target Audience Settings Medium
- DRIVE-012: Drive Add-ons Settings Low
- DRIVE-013: Offline Access Settings Medium
- DRIVE-014: Drive SDK API access disabled (GWS.DRIVEDOCS.4.1) High
- DRIVE-015: Drive external-file warning enabled (GWS.DRIVEDOCS.1.9) Low
- DRIVE-016: Drive file security update enforced (GWS.DRIVEDOCS.3.1) Medium
- DRIVE-017: Default file access set to private to owner (GWS.DRIVEDOCS.1.8) Medium
- DRIVE-018: Shared Drive External-Sharing Exposure High
- DRIVE-019: External-sharing warning enabled (GWS.DRIVEDOCS.1.3) Medium
- DRIVE-020: Sharing with non-Google accounts disabled (GWS.DRIVEDOCS.1.4) Medium
- DRIVE-021: Publishing Drive content to the web disabled (GWS.DRIVEDOCS.1.5) High
- DRIVE-022: Content distribution to outside shared drives blocked (GWS.DRIVEDOCS.1.7) Medium
- DRIVE-023: Drive for Desktop limited to authorized devices (GWS.DRIVEDOCS.5.1) High
Gemini for Workspace (12)
- GWS-CLASS-001: Classroom Membership - Who Can Join Classes Medium
- GWS-CLASS-002: Classroom Membership - Which Classes Users Can Join Medium
- GWS-CLASS-003: Classroom API Data Access Restricted Medium
- GWS-CLASS-004: Classroom Roster Import Disabled Low
- GWS-CLASS-005: Classroom Student Unenrollment Restricted Low
- GWS-CLASS-006: Classroom Class Creation Restricted to Verified Teachers Medium
- GWS-GEMINI-001: Gemini App Access Restricted to Licensed Users Medium
- GWS-GEMINI-002: Gemini Alpha Features Disabled Low
- GWS-GEMINI-003: Gemini Conversation History Enabled Low
- GWS-GEMINI-004: Gemini Conversation Retention Minimum 18 Months Low
- GWS-GEMINI-005: Gemini Conversation Sharing Disabled Medium
- GWS-SITES-001: Sites Service Disabled Low
K12 Baseline (15)
- GWS-K12-001: Student OU Sharing Not Inherited From Staff Medium
- GWS-K12-002: Student External Drive Sharing Restricted High
- GWS-K12-003: Students Cannot Authorize Third-Party Apps High
- GWS-K12-004: Vendor Delegated Access Review High
- GWS-K12-005: Delegated Admin Least Privilege High
- GWS-K12-006: Student Communication Boundaries High
- GWS-K12-007: Guardian Access Integrity Medium
- GWS-K12-008: Managed Student Chromebook Posture Medium
- GWS-K12-009: Departed Student Account Disposition Medium
- GWS-K12-010: Student Account Security Floor High
- GWS-K12-011: Student Auto-Forwarding Disabled Medium
- GWS-K12-012: Student Data Export (Takeout) Disabled Medium
- GWS-K12-013: Legacy Authentication Disabled For Students High
- GWS-K12-014: Vault Export And Retention Privileges Restricted High
- GWS-K12-015: Audit Logging License Coverage Medium
Logging, Alerting & Monitoring (7)
- LOG-001: Audit Log Retention Settings High
- LOG-002: Alert Center Rules Inventory High
- LOG-003: Activity Rules Coverage Analysis Medium
- LOG-004: Data Export Settings Medium
- LOG-005: Admin Email Alerts Configuration Medium
- LOG-006: Reporting API Access Low
- LOG-007: System-defined alerting rules all enabled (GWS.COMMONCONTROLS.13.1) High
OAuth & API Security (10)
- OAUTH-001: OAuth App Whitelist/Blocklist High
- OAUTH-002: Installed OAuth Apps Inventory High
- OAUTH-003: OAuth Scope Analysis Critical
- OAUTH-004: OAuth App Risk Scoring High
- OAUTH-005: Unverified App Access Policy High
- OAUTH-006: API Access Control Medium
- OAUTH-007: Marketplace App Installation Restrictions Medium
- OAUTH-008: Domain-Wide Delegation Grants Audit Critical
- OAUTH-009: Service Account Key Enumeration High
- OAUTH-010: Connected Apps With Sensitive Scopes High
Zero analytics. Zero tracking. Zero cookies. This site makes no external requests, so there is nothing to consent to.
Guerrilla is free and open source. · Validation
Guerrilla is written and maintained by Jim Tyler. This copy lives on jimtyler.org; the project also publishes at guerrilla.army.