How to use GAM
This page will show you how to set up and use GAM (Google Apps Manager) — a command-line tool for managing Google Workspace. There’s also a newer fork, GAMADV-XTD3, with extra features.
Installation
The wiki can be found here — note the pages on the right under “GAM Command Reference” for detailed instructions on how to use each feature (for example, the page on Email).
bash <(curl -s -S -L https://git.io/install-gam)
gam update project
gam user "[email protected]" check serviceaccount
gam user [email protected] update serviceaccount
Syntax
Most of the time you’ll want to start a command as follows:
gam user "[email protected]"
This specifies the target of the following commands (in this case, the e-mail address [email protected]). This is denoted in the wiki documentation as gam <who>, which, at least for me, was a little confusing at first.
Examples
Enable/disable e-mail forwarding
gam user "[email protected]" show forwardingaddress
gam user "[email protected]" delete forwardingaddress "forwarding_address@external_domain.com"
gam user "[email protected]" forward off
gam user "[email protected]" forward on "forwarding_address@external_domain.com" keep
Check or set out-of-office message
Check
The show vacation command will show the current settings. Note that the indentation is only for GAM, and won’t appear in the real message.
gam user "[email protected]" show vacation
Example output:
User: [email protected], Vacation: (1/1)
Enabled: True
Contacts Only: True
Domain Only: False
Start Date: Started
End Date: 2026-09-08
Subject: Thanks for your message!
Message:
<Vacation message>
Set
There are lots of options available when it comes to setting your message, but do note that if a message already exists, then any non-specified fields will revert to their default, and not what they were previously. For example, if you don’t set contactsonly, then this will revert to the default of false, even though it was true before.
subject— sets the subject of the messagefile— specify the file with the message- or alternatively, just type your message in quotes, but this involves
using escape characters, and
\nfor new lines startdate— set tostartedby default, or you can set it in the future (YYYY-MM-DD format)enddate— not set by default (so forever), or you can set it (YYYY-MM-DD format)contactsonly— set tofalseby default; specify this flag to set it totruedomainonly— set tofalseby default; specify this flag to set it totrue
gam user "[email protected]" vacation on subject "Thanks for your message\!" file target_user.txt enddate 2026-09-08 contactsonly
Check which users have sharing disabled
Get a list of users:
gam info group "[email protected]" > users.txt
Then check how many have sharing disabled:
for user in $(cat users.txt); do echo "$user, $(gam info user $user nogroups noaliases nolicenses noschemas | grep -E 'Included in GAL')"; done > GALResults.txt
Then filter for the ones that are disabled:
grep "False" GALResults.txt
Change ownership of a file
Changing to owner will move the current owner to writer.
gam user "[email protected]" show drivefileacl "1234abcd"
gam user [email protected] add drivefileacl 1234abcd user [email protected] role owner sendemail
Change a calendar owner
List the current calendars to get the ID:
gam user [email protected] print calendars
Then list the current access control lists (ACLs) on that calendar:
gam calendar "[email protected]" printacl
Add the new owner (and add the calendar to the new owner’s list):
gam calendar "[email protected]" add acls owner "[email protected]" sendnotifications false
gam user "[email protected]" add calendar "[email protected]" selected true
Finally, double-check the permissions.
For events (requires new GAM):
gam calendar "[email protected]" show event before now matchfield status confirmed
gam calendar "[email protected]" show event after now matchfield status confirmed
Move a calendar event from one user/owner to another
First, get a list of events that you’d like to move. Here you’re looking for
the id field:
gam calendar [email protected] print events after 2026-08-01 matchfield organizeremail [email protected]
Example output:
Getting Events for [email protected]
calendarId,id,summary,status,description,created,updated,iCalUID,attendees,...
[email protected],abcd1234,<summary>,confirmed,<Description>,...
The <new_user> needs write access to the <old_user> calendar. Here, I’m
moving an entry from [email protected] to [email protected]:
gam calendar [email protected] show acls
Example output:
Calendar: [email protected], Show 2 Calendar ACLs
Scope: user:[email protected], Role: owner (1/2)
Scope: domain:example.com, Role: reader (2/2)
Add write access for the new user:
gam calendar [email protected] add acls writer [email protected] sendnotifications false
Example output:
Calendar: [email protected], Add 1 Calendar ACL
Calendar: [email protected], Calendar ACL: (Scope: user:[email protected], Role: writer), Added
Perform the move. Note: move the original invite if there’s a recurring event, and all following ones will move too!
gam calendar [email protected] move event id 1234abcd to [email protected]
Example output:
Calendar: [email protected], Move 1 Event
Calendar: [email protected], Event: 1234abcd, Moved to: Calendar: [email protected]
Check that the events have been moved:
gam calendar [email protected] print events after 2026-08-01 matchfield organizeremail [email protected]
Revert the write permissions:
gam calendar [email protected] delete user [email protected]
Example output:
Calendar: [email protected], Delete 1 Calendar ACL
Calendar: [email protected], Calendar ACL: (Scope: user:[email protected]), Deleted
List Google Drive contents by size
gam user "[email protected]" show filelist name filesize | tee target_user.csv
gam user "[email protected]" show filelist query "name contains <search term>"
gam user "[email protected]" show filelist description id filesize
gam user "[email protected]" show filelist allfields
Remove calendar entries
Use the Google portal if we can (https://admin.google.com/ac/apps/calendar/settings/manageevents), or:
gam user "[email protected]" deprovision
Search for email messages
Please use the email log search web interface
(https://admin.google.com/ac/emaillogsearch) instead, if possible. The
query to search in GAM is called delete, which is scary, but nothing is
deleted unless we add doit. Still, don’t risk it if you can.
gam user [email protected] print messages query "Activate your WP Engine account"
gam user [email protected] print messages
gam user [email protected] print filters
gam user [email protected] filter subject "Activate your WP Engine account"
gam user [email protected] delete messages query 'from:"[email protected]"'
List permissions for a calendar
Note: we should contact the (owner?) of the calendar to request changes, if possible.
gam user "[email protected]" info calendar "[email protected]"
gam calendar "[email protected]" printacl
gam user "[email protected]" print calendars
gam user "[email protected]" info calendar primary
gam calendar "[email protected]" showacl
List all accounts created by admins
List all accounts created by admins (excluding a service account):
gam report admin event CREATE_USER | grep -v [email protected] > accounts_created_manually.csv
List who created an account/mailbox
gam report admin event CREATE_USER | grep target_user
gam report admin event | grep target_user
Licences
Note: doesn’t work (at time of writing).
gam print licenses
gam print licenses sku 1010020026 # Google Workspace Enterprise Standard
gam print licenses sku 1010340004 # Google Workspace Enterprise Standard - Archived User
gam user "[email protected]" update licence 1010340004 from 1010020026 preview
Let me know what you think of this article on twitter @lukahn!