GWS-ADMIN Troubleshooting — 20 Questions

Question 1

A user is receiving an 'Access Denied' message when attempting to log into a SAML application managed via Google. Which log should you check first?

Accepted Answer

SAML application logs. SAML application logs specifically record authentication and authorization events for SAML-based applications, including the exact reason for an 'Access Denied' error, such as attribute mapping failures or invalid assertions. These logs are part of the Google Workspace SAML audit logs and provide detailed error messages that directly correlate with the user's login attempt. Checking them first isolates the issue to the SAML application configuration or user assignment, rather than unrelated admin or OAuth activities.

Answer

Admin Activity logs

Answer

OAuth token logs

Answer

Drive Audit logs

Question 2

A user reports they accidentally deleted a shared folder in Drive. How can you restore it?

Accepted Answer

Restore the file from the Admin Console user management page.. Administrators can restore deleted items from the Drive Audit logs or by searching for the file ID if needed.

Answer

Use the 'Restore' option in the User's Drive.

Answer

Ask Google Support to restore the file.

Answer

Recreate the folder manually.

Question 3

An organization is using Google Workspace Sync for Microsoft Outlook (GWSMO). A user is experiencing sync delays. What tool should you use to check the GWSMO status?

Accepted Answer

GWSMO Status tool on the user's machine.. The GWSMO 'Set up a Google Workspace Sync user' tool or local log files are used to monitor and debug sync status.

Answer

Google Drive sync tool.

Answer

Password reset tool.

Answer

Admin Console Reports

Question 4

A user reports that a meeting invite is not showing up on their calendar. What should you check?

Accepted Answer

The user's Gmail spam folder.. The user should first check their spam folder in Gmail, as invites are often sent as email notifications.

Answer

The user's calendar sharing settings.

Answer

The organization's MX records.

Answer

The user's password.

Question 5

A user is experiencing 'Storage full' errors. What is the best way to determine which files are using the most space?

Accepted Answer

View storage usage in the User management page.. The Drive storage management tool provides a clear breakdown of file usage by size for each user.

Answer

Check the Gmail Audit logs.

Answer

Delete all files and re-upload.

Answer

Use the Security Investigation Tool.

Question 6

A user is seeing an 'Unable to verify account' error when signing in. What is the first thing to check?

Accepted Answer

Account suspension status. Checking if the account is suspended in the Admin console is the most common reason for this error.

Answer

User's password

Answer

Domain's DNS records

Answer

User's mobile phone number

Question 7

A user is unable to access a newly created Google Group. What is the most likely reason?

Accepted Answer

Propagation delay.. Group propagation can take up to 24 hours, meaning the user may not have access until the change has fully propagated.

Answer

The user's browser is outdated.

Answer

The group email is invalid.

Answer

The group needs to be added to an OU.

Question 8

You are a Workspace administrator. A user in the Sales OU reports that after a recent Google Workspace update, the 'Google Meet' video call link is no longer appearing in Google Calendar events they create. Other users in the same OU can create Meet links without issue. You verify that the user's Calendar settings show 'Automatically add Google Meet to events I create' is enabled. What should you check next to resolve this?

Accepted Answer

Verify that the Google Meet service is turned ON for the Sales OU in the Admin console.. The most likely cause is that the Google Meet service is disabled for the Sales OU, overriding the user's individual Calendar setting. Service status in the Admin console controls whether users in an OU can use Meet. Since other users in the same OU can create links, the issue is specific to this user's OU service setting or a subset. Checking the service status is the correct first step.

Answer

Confirm that the user has the 'Google Meet' app installed on their mobile device.

Answer

Check the user's Google Calendar sharing settings to ensure they have 'Make changes to events' permission.

Answer

Review the user's Google Drive storage quota to ensure they have not exceeded their limit.

Question 9

You are a Workspace administrator. A user reports that they are unable to access a shared drive named 'Project Phoenix' that they were previously able to access. The shared drive still exists, and other members can access it. The user's account is active and they are a member of the shared drive with 'Content manager' access. What should you check first to troubleshoot this issue?

Accepted Answer

Verify that the user is not a member of a group that has been denied access to the shared drive.. The most likely cause is an explicit deny via group membership. In Google Drive, if a user belongs to a group that has been denied access to a shared drive, that deny takes precedence over individual membership. This can happen if the group was added to the shared drive with 'No access' or if a deny policy exists. Checking group memberships and access policies is the correct first step.

Answer

Ensure that the user has the 'Drive and Docs' service enabled for their OU.

Answer

Check the user's Google Drive storage quota to ensure they have not exceeded their limit.

Answer

Confirm that the shared drive is not set to 'Restricted' in the sharing settings.

Question 10

A Google Workspace administrator receives reports that messages sent from a user's Gmail account to an external recipient are being rejected with the SMTP error '550 5.7.1 Message rejected due to DMARC policy'. The domain's DMARC record is set to p=reject, but the administrator has not configured DKIM. What is the most likely cause of the rejections?

Accepted Answer

DKIM is not configured, so messages fail DMARC authentication and are rejected by the recipient's server.. DMARC evaluates SPF and DKIM for alignment with the From domain. When the policy is p=reject and DKIM is absent, only SPF can provide authentication. If SPF fails or does not align, the message is rejected. Enabling DKIM signing in Google Workspace and publishing the public key in DNS provides an additional authentication path, resolving the rejection.

Answer

The external recipient's server is misconfigured and is incorrectly enforcing DMARC.

Answer

SPF is not aligned because the sending IP is not included in the domain's SPF record.

Answer

The domain's DMARC record is incorrectly formatted, causing all messages to be rejected.

Question 11

You are a Workspace administrator. A user reports that they are not receiving email notifications from an external application that sends via SMTP through Google Workspace. The application uses the user's email address as the sender. You have verified that the application's SMTP settings are correct and that the user's Gmail inbox is not full. Which TWO of the following should you check to troubleshoot this issue? (Choose two.)

Accepted Answer

Ensure that the user's account is not suspended and that the password has not expired.. The two most likely causes are Gmail filters that divert or delete the messages, and account issues that prevent SMTP authentication. Filters can silently remove messages from the inbox, while a suspended account or expired password would cause the application's SMTP login to fail, stopping delivery. Checking these two areas directly addresses the missing emails.

Answer

Check the Google Workspace SMTP relay service settings to ensure the application's IP is allowed.

Answer

Verify that the user has 'Send email as' permission for the application's domain.

Answer

Verify that the application's sending IP address is included in the user's SPF record.

Question 12

A Workspace administrator at a healthcare company enables Google Vault for a new organizational unit. A compliance officer needs to search for and export all email messages from a specific former employee's account for a legal hold, but the searches return no results even though the user's account still exists and had mail activity. Which Vault configuration issue is the most likely cause?

Accepted Answer

The Gmail service is not turned on for the organizational unit that contains the former employee, so Vault has no mail data to index for that user.. Vault searches depend on the relevant service being enabled for the user's organizational unit. When Gmail is off for that OU, no mailbox data is indexed for Vault, so searches for that user's mail come back empty even though the account exists. Verifying service enablement for the OU is the first troubleshooting step before assuming data loss or retention misconfiguration.

Answer

The former employee's account is suspended rather than active, and Vault excludes suspended accounts from mail searches.

Answer

The former employee's account was moved to a different organizational unit that is not covered by the Vault matter's search scope.

Answer

Google Vault was enabled after the messages were sent, so only messages sent after Vault was turned on are indexed and searchable.

Question 13

A Google Workspace administrator at Acme Corp receives reports from several users that when they attempt to share a Google Drive file with external partners, the sharing dialog shows 'Sharing is disabled for your organization' and they cannot proceed. Internal sharing works fine. The admin verifies that the organizational unit (OU) for these users has Drive sharing settings set to 'On' for 'Sharing outside of your organization' and that no user-level sharing restrictions are applied. Which is the MOST likely cause of this error?

Accepted Answer

An allowlist for external sharing is enabled in the sharing settings, and the external partner domains are not included in the allowlist, causing sharing to be blocked for those domains.. When external sharing is enabled but an allowlist is configured, only domains or email addresses on that list can receive shares. The error 'Sharing is disabled for your organization' appears when a user tries to share with a domain not on the allowlist. Since internal sharing works and the OU setting is 'On,' the allowlist is the most likely cause. The admin should review the allowlist under Apps > Google Workspace > Drive and Docs > Sharing settings.

Answer

The users are not assigned a Google Workspace license that includes Drive, so they cannot use external sharing features.

Answer

The domain-wide setting for external sharing in the Google Admin console under Apps > Google Workspace > Drive and Docs > Sharing settings is set to 'Off' for the top-level organizational unit, and the child OU inherits that restriction.

Answer

The external partners are using a different Google Workspace domain, and cross-domain sharing is blocked by a default security setting that requires domain verification.

Question 14

Employees in the marketing team report that when they open Google Drive on the web, files shared with them by a partner domain appear under 'Shared with me', but double-clicking a file shows an 'Access denied' page. The partner confirms the files are shared with the correct addresses. Which Workspace setting is most likely preventing access?

Accepted Answer

The 'Sharing outside of your domain' setting is set to 'Off' for the organizational unit, so external files cannot be opened.. The key differentiator is that the files are visible but unopenable. Visibility in 'Shared with me' is governed by the share itself, while the ability to open externally owned content is governed by the 'Sharing outside of your domain' policy for the user's organizational unit. Disabling external sharing produces exactly this split behaviour, so the marketing team's organizational unit has that policy turned off.

Answer

The partner domain is on the blocked senders list, preventing Drive shares from that domain.

Answer

The Drive sharing setting for the organizational unit is set to 'Off', blocking all external sharing.

Answer

The user's Google Workspace license does not include Drive, so external files cannot be opened.

Question 15

A Google Workspace administrator is investigating why a user's Google Calendar events are not syncing to their mobile device. The user has multiple calendars shared with them, and some events are missing. Which TWO of the following should the administrator check to resolve the issue? (Choose two.)

Accepted Answer

Verify that the user has enabled sync for each shared calendar in the Google Calendar app settings.. Missing events from shared calendars on mobile often stem from per-calendar sync toggles being off or insufficient permissions. The administrator should ensure each shared calendar is set to sync in the mobile app and that the user has 'See all event details' permission. These two checks directly address selective missing events.

Answer

Check the user's Google Workspace Calendar sharing settings to ensure external sharing is allowed.

Answer

Verify that the user's Google Workspace account has Google Calendar enabled as a service.

Answer

Confirm that the user's mobile device has a stable internet connection and is not in battery saver mode.

Question 16

You are a Workspace administrator. A user reports that they are unable to sign in to their Google Workspace account from a new mobile device. They can sign in from their laptop without issue. The user has not changed their password recently. What is the most likely cause of this issue?

Accepted Answer

The mobile device is not compliant with the organization's device policy, and access is blocked.. The most likely cause is that the new mobile device does not meet the organization's device policy requirements. Google Workspace mobile management can block access from devices that are not compliant, such as lacking a screen lock or encryption. Since the laptop works, the issue is specific to the mobile device's compliance status. Checking device policy status in the Admin console would confirm this.

Answer

The user has exceeded the maximum number of devices allowed for their account.

Answer

The user's Google Workspace password has expired and must be changed.

Answer

The user's account requires a security key for two-step verification, and the mobile device does not support it.

Question 17

A user reports that they are not receiving any email at all, including internal messages. They can send email successfully. What is the most likely cause?

Accepted Answer

The user's account is not correctly configured in the email routing settings.. When a user can send but not receive any email, the problem is typically with inbound mail routing. Google Workspace routing settings can redirect or reject messages before they reach the user's inbox. Checking the routing configuration for the user or their organizational unit is the first step. Other causes like storage or filters would not completely block all incoming mail without affecting sending.

Answer

The user's password has expired and they need to reset it.

Answer

The user's Gmail storage is full.

Answer

The user has a Gmail filter that is archiving all incoming messages.

Question 18

A Google Workspace administrator is troubleshooting a user's inability to access a Google Drive file shared by an external user. The file is shared with the user's email address, and the user is signed in with the correct account. The administrator has confirmed that the user's organizational unit allows external sharing. What is the most likely cause of the access issue?

Accepted Answer

The external user's domain has a policy that prevents sharing with the user's domain.. External sharing requires both domains to permit it. Even if the recipient's domain allows external sharing, the sender's domain may block outbound sharing. The administrator should check the external domain's sharing settings or coordinate with the external user's IT team to ensure sharing is allowed. This is a common cause when internal policies are confirmed to be permissive.

Answer

The user's account is not verified, so they cannot access external files.

Answer

The file is in a shared drive that the user is not a member of, and the shared drive restricts access to members only.

Answer

The user's Google Drive storage is full, preventing them from opening shared files.

Question 19

An administrator is troubleshooting why a user's Google Calendar invitations sent to an external attendee are being marked as spam by the recipient's mail system. The administrator confirms the Workspace domain has SPF, DKIM, and DMARC records published and passing for normal mail. Calendar invitations are being sent by Google on behalf of the user. Which action should the administrator take to improve deliverability of these calendar invitations?

Accepted Answer

Ensure the domain's SPF record includes the Google Calendar sending infrastructure or that calendar mail is aligned through DKIM.. Calendar invitations travel a different sending path than ordinary user mail and must be authenticated for the sending domain. If the SPF record does not include the calendar infrastructure and the messages are not DKIM-signed with an aligned key, receivers observe an authentication gap and treat the invitations as suspicious. Ensuring SPF coverage or aligned DKIM for that path restores trust and moves the invitations out of spam.

Answer

Disable the 'Automatically add invitations to my calendar' setting for all users.

Answer

Publish a DMARC record with a p=reject policy to force recipients to trust the domain.

Answer

Add the recipient domain to the Workspace email allowlist so invitations are delivered.

Question 20

A Google Workspace administrator is troubleshooting why a user cannot join a Google Meet video call scheduled by an external partner. The user clicks the Meet link but sees a 'You can't join this call' error. The admin confirms the user's account is active and has Meet enabled. Which TWO of the following should the admin check to resolve the issue? (Choose two.)

Accepted Answer

The external sharing settings for Google Meet in the Admin console.. The inability to join an external Google Meet call is often due to external sharing restrictions. Admins should verify that the organizational unit's Meet settings allow joining external meetings and that external sharing is enabled. These two settings directly control whether users can participate in calls hosted outside the domain.

Answer

The domain's SPF record for Google Meet.

Answer

The user's Google Calendar sharing permissions.

Answer

The user's Gmail delegation settings.