GAM Commands Cheat Sheet for Google Workspace (GAM7)

By Patronum

November 06, 2026

Read Time: 8 mins

GAM Commands Cheat Sheet for Google Workspace (GAM7) image

How to read this cheat sheet
User commands
Group commands
Organizational unit commands
Drive and shared drive commands
Gmail settings, signature and delegation commands
Calendar commands
License commands
Report commands
CSV and batch commands
Sending output to Google Sheets with todrive
Before you run a command that changes data
If you’d rather not script
Sources

The GAM commands most Google Workspace admins need fall into ten groups: users, groups, organizational units, Drive, Gmail settings, calendars, licenses, reports, CSV batch jobs and todrive output. This cheat sheet lists the common ones for GAM7, read-only commands first, with every command that changes data or creates a file marked. Each group links to the GAM wiki page the syntax comes from.

Version referenced: GAM 7.50.00, released October 31, 2026, with syntax checked against the GAM wiki at that release. GAM updates often, so check the GitHub Releases page or run gam version checkrc to compare your version with the latest.

Haven’t installed GAM7 yet? Start with our guide on how to install GAM7 on Windows, macOS and Linux. For how GAM7 relates to legacy GAM and GAMADV-XTD3, see our Google Apps Manager explainer.

Jump to: Users · Groups · Organizational units · Drive · Gmail · Calendars · Licenses · Reports · CSV and batch · todrive

How to read this cheat sheet

Commands use the GAM wiki’s example values: user@domain.com, group@domain.com, /Path/To/Ou. Swap in your own.
Read commands only display information. Reads source; creates report commands read your tenant and write a new Google Sheet. Changes data commands create, update, move or delete something in your tenant.
Most user commands also take a collection instead of one address: users a@domain.com,b@domain.com, group group@domain.com, ou /Sales or all users. The Collections of Users page lists them all.
Only some commands have a preview option. Where one exists, it’s shown below. For everything else, check the target with a print, show or info command first, then test on one test account before you point it at a group, an OU or all users.

User commands

Wiki pages: Users, Users – Deprovision

Command	What it does	Type
`gam info user user@domain.com`	Shows one user’s full record	Read
`gam print users`	Lists every user’s primary email	Read
`gam check suspended user@domain.com`	Says whether a user is suspended	Read
`gam suspend user user@domain.com`	Suspends one user	Changes data

Users in /Staff suspended more than 90 days ago (Read):

gam ou /Staff print users issuspended disabledbefore -90d

Create a user with a random password (Changes data). The default notification email includes the password in plain text, so send it only to an address the new starter controls. changepassword true makes them set their own at first sign-in.

gam create user user@domain.com firstname "First" lastname "Last" password random changepassword true notify user@home.com

Reset a password the same way (Changes data). The wiki notes that changepassword true signs the user out immediately.

gam update user user@domain.com password random changepassword true notify user@home.com

Rename a user’s primary address (Changes data):

gam update user userold@domain.com primaryemail usernew@domain.com

Deprovision a user (Changes data):

gam user user@domain.com deprovision signout

This deletes the user’s app-specific passwords, backup verification codes and access tokens and signs them out. It isn’t a full lockout: the account stays active with its current password. Run it inside a reviewed offboarding sequence, after ending any third-party SSO session, with a password reset and suspend straight after; if either fails, fix it before moving on. The wiki also offers an optional turnoff2sv flag; leave it out of a standard offboarding run. Run deprovision before you suspend, because the wiki notes backup codes can’t be processed for a suspended user. For the full order, see our Google Workspace offboarding process.

Group commands

Wiki pages: Groups, Groups – Membership, Users – Group Membership

Command	What it does	Type
`gam print groups`	Lists every group	Read
`gam info group group@domain.com`	Shows a group’s settings and members	Read
`gam print group-members group group@domain.com`	Lists one group’s members as CSV	Read
`gam user user@domain.com print groups`	Lists the groups a user belongs to	Read
`gam create group group@domain.com`	Creates a group	Changes data
`gam update group group@domain.com add member user@domain.com`	Adds a member	Changes data
`gam update group group@domain.com remove user@domain.com`	Removes a member	Changes data
`gam update group group@domain.com isarchived true`	Turns on conversation history	Changes data
`gam update group group@domain.com collaborative true`	Turns on Collaborative Inbox features (conversation history must be on first)	Changes data

Example output from the wiki for print group-members, using its sample group:

$ gam print group-members group testexternal
Getting all Members, Managers, Owners for testexternal@domain.com
group,type,role,id,status,email
testexternal@domain.com,USER,MEMBER,123406166545652215678,,user@external.com

Let anyone, including outside senders, post to a group (Changes data):

gam update group group@domain.com whocanpostmessage anyone_can_post

Outside senders also need an Admin console setting. Under Apps > Google Workspace > Groups for Business > Sharing settings, “Incoming emails from outside the organization” lets group owners allow external email, and Google ships it turned off.

Organizational unit commands

Wiki page: Organizational Units

Command	What it does	Type
`gam print orgs`	Lists your OU tree	Read
`gam info ou /Path/To/Ou`	Shows one OU	Read
`gam print orgs maxusercount 0`	Finds OUs with no users	Read
`gam update ou /Leavers move user user@domain.com`	Moves a user into an OU	Changes data

Create an OU (Changes data):

gam create ou /Leavers description "Accounts being offboarded"

Drive and shared drive commands

Wiki pages: Users – Drive – Files – Display, Permission Matches, Users – Drive – Permissions, Users – Drive – Transfer, Shared Drives

Command	What it does	Type
`gam user user@domain.com show filecounts`	Counts the Drive files a user owns	Read
`gam user user@domain.com show drivefileacls <DriveFileID>`	Shows who has access to one file	Read
`gam print shareddrives`	Lists every shared drive	Read
`gam print shareddrives query "organizerCount = 0"`	Finds shared drives with no manager	Read

Example output from the wiki for show filecounts showsize (first lines only):

$ gam user testuser@domain.com show filecounts showsize
User: testuser@domain.com, Drive Files/Folders: 261, Size: 13822521
  application/pdf: 1
  application/vnd.google-apps.document: 98

Find a user’s files by name (Read):

gam user testuser print filelist query "title contains 'Test'"

List a user’s files with any “anyone” permission (Read). This catches both “anyone with the link” and files that are public and discoverable on the web:

gam user user@domain.com print filelist fields id,name,permissions pm type anyone em

To narrow it to link-only sharing, add the allowfilediscovery false match (Read). In Google’s Drive API, allowFileDiscovery is what separates a file found through search from one that needs the link:

gam user user@domain.com print filelist fields id,name,permissions pm type anyone allowfilediscovery false em

Preview a Drive transfer as a CSV of the files that would move, without moving anything (Read):

gam user olduser@domain.com transfer drive newuser@domain.com preview

Transfer a user’s Drive files to another user (Changes data):

gam user olduser@domain.com transfer drive newuser@domain.com

For the Admin console route and what happens to sharing when ownership changes, see how to transfer Google Drive file ownership.

Gmail settings, signature and delegation commands

Wiki pages: Send As, Signature, Vacation, Forwarding, Delegates

Command	What it does	Type
`gam user user@domain.com show signature`	Shows a user’s signature	Read
`gam user user@domain.com show vacation`	Shows the vacation responder	Read
`gam all users print forwards enabledonly`	Lists every user with forwarding turned on	Read
`gam user user@domain.com show delegates`	Lists mailbox delegates	Read
`gam user user@domain.com signature htmlfile SigTemplate.html`	Sets a signature from an HTML file	Changes data
`gam user fred@domain.com add delegate bob@domain.com`	Gives bob access to fred’s mailbox	Changes data

Turn on an auto reply with dates (Changes data). The wiki recommends always setting a start and end date, since an old expired end date can stop a new message from working.

gam user user@domain.com vacation on subject "Out of office" message "I'm away until January 2." start 2026-12-24 end 2027-01-02

Calendar commands

Wiki pages: Users – Calendars, Calendars – Access

Command	What it does	Type
`gam user user@domain.com show calendars`	Lists calendars in a user’s list	Read
`gam calendar user@domain.com showacl`	Shows who can see a user’s primary calendar	Read
`gam calendar user@domain.com add reader user2@domain.com`	Shares a calendar as read-only	Changes data
`gam calendars <CalendarID> transfer ownership user@domain.com`	Transfers a secondary calendar to another user; it doesn’t apply to primary calendars	Changes data

License commands

Wiki page: Licenses

Command	What it does	Type
`gam show licenses`	License counts by product	Read
`gam print licenses`	Every user and their licenses as CSV	Read
`gam user user@domain.com delete license wsbizstan preview`	Previews removing a Business Standard license	Read
`gam user user@domain.com add license wsbizstan`	Assigns Business Standard	Changes data
`gam user user@domain.com delete license wsbizstan`	Removes Business Standard	Changes data

The Licenses page has the full table of SKU names and IDs, including Archived User SKUs such as wsbizstanarchived.

Report commands

Wiki page: Reports

All report commands below are read-only.

Command	What it does
`gam report login user user@domain.com start -7d`	One user’s sign-in events for the last seven days
`gam report admin start -7d`	Admin console actions for the last seven days
`gam report drive event create yesterday`	Drive files created yesterday

Users who have never signed in:

gam report users parameters accounts:last_login_time filters "accounts:last_login_time==#filtertimenever#" filtertimenever never

CSV and batch commands

Wiki pages: Bulk Processing, Users

gam csv runs one command per row of a CSV file, replacing "~column" with that row’s value. Whether it changes data depends on the command after the second gam.

Export every listed user’s files and sharing to one local CSV file (Read; writes a file on your computer, not in your tenant):

gam redirect csv ./filelistperms.csv multiprocess csv Users.csv gam user "~primaryEmail" print filelist fields id,name,mimetype,basicpermissions

Update users from a CSV and create any that don’t exist (Changes data). notfoundpassword sets a password only for the new accounts; existing users keep theirs. The wiki’s other version, with password "~password", also overwrites every existing user’s password, so avoid it unless that’s the goal. If notify is set, the notification goes to the altemail column.

gam csv Users.csv gam update user "~email" firstname "~firstname" lastname "~lastname" notfoundpassword "~password" ou "~ou" createifnotfound notify "~altemail"

Set signatures from one template, filled from each user’s directory fields (Changes data):

gam csv Users.csv gam user "~email" signature htmlfile SigTemplate.html replace FirstName field:name.givenname replace LastName field:name.familyname replace Phone field:phone.value.type.work replace Email field:email.primaryemail

Run a file of GAM commands and log output and errors (type depends on the commands in the file):

gam redirect stdout ./NewStudents.out redirect stderr ./NewStudents.err tbatch NewStudents.bat showcmds

Sending output to Google Sheets with todrive

Wiki page: Todrive

Add todrive to most print commands and GAM uploads the output as a new Google Sheet instead of printing it. These commands read your tenant and create a file, so they’re marked Reads source; creates report. By default the Sheet lands in the root of My Drive for the admin named in oauth2.txt; tduser picks a different owner and tdparent an existing folder. GAM doesn’t share the Sheet with anyone unless you add tdshare <email> reader, but anyone with access to the folder you put it in can open it, so keep sharing reports out of widely shared folders.

Put a user list in a timestamped Sheet in a chosen folder (Reads source; creates report):

gam print users fields id,name todrive tdtitle "User IDs and Names" tdtimestamp true tduser usermgr@domain.com tdparent "GAM Reports"

One Sheet per user listing their files with any “anyone” permission (Reads source; creates report, one Sheet per row):

gam csv Users.csv gam user "~primaryEmail" print filelist fields id,name,permissions pm type anyone em todrive tdtitle "AnyoneShares-~~primaryEmail~~"

Before you run a command that changes data

gam version checkrc shows you’re on a current release
You’ve checked the target with print, show or info, or with preview where the command supports it
You’ve tested on one test account before a group, OU or all users
For CSV jobs, the column names in the file match the "~column" names in the command, and you know whether the command touches passwords
Output and errors are redirected to a file you’ll keep (redirect stdout ... redirect stderr ...)
For offboarding, deprovision runs before suspend, a password reset and suspension follow straight after, and the Drive transfer preview looks right
Any todrive report goes to a folder only the right people can open

If you’d rather not script

GAM is free, but someone has to write, schedule and maintain the scripts. Patronum is a Google Workspace management tool that takes the policy route instead: in the Patronum console you choose who a policy applies to (all users, an organizational unit or a Google Group), add conditions, and pick actions such as group membership, Drive file transfer, calendar and signature changes. A new policy stays inactive until you activate it, then runs hourly by default. Like GAM, Patronum works through Google’s APIs with domain-wide delegation, and there’s a 30-day free trial with no credit card. See our comparison of GAM alternatives for Google Workspace.