How to Audit Google Drive Sharing Permissions Without Workspace Admin Access
- NeatDrive Team
- Aug 4
- 9 min read
Updated: Aug 9
I built a Drive auditing tool. Then I pointed it at my own Drive.
204 publicly-linked files. Among them: my 2014 tax returns, bank statements, and paystubs. Files that anyone holding the URL could open, no sign-in required, no notification to me, no record I'd ever see.
I want to be clear about what that means. I hadn't been careless in some dramatic way.
I'd been using Google Drive normally, for years, the way most people do — sharing a document with an accountant, sending a link to a landlord, dragging a folder into a shared space, generating a link for someone on a phone call and then never thinking about it again. Every one of those choices was reasonable in the moment. The problem is that Drive has no memory of your intent and no expiry on your decisions. A link you created in 2014 to send one PDF to one person is still live in 2026.
The full scan, run on 3 August 2026, came back like this: 8,052 files, 2,404 findings, health score 61 out of 100. 204 publicly-linked files. 75 shared with domains outside my own. 305 duplicate clusters. 919 empty folders. 908 MB of recoverable space.
I'm the person who built the scanner. I still didn't know.
Why this is genuinely hard without admin access
Here's the thing that surprised me when I started researching this space: every serious Google Drive security tool assumes you're an IT administrator.
Google's own Security Investigation Tool requires a paid Workspace tier and super admin privileges. The same is true of the Drive audit log, DLP rules, admin sharing reports, and Vault. The third-party security platforms are built the same way — they install at the domain level, authenticate as an admin, and enumerate the whole organization.
That's a perfectly sensible way to build an enterprise product. It just leaves out an enormous number of people:
Solo practitioners — attorneys, accountants, therapists, consultants — running on consumer Gmail or a one-seat Workspace account, where "the admin console" is a page they've never opened and wouldn't have much to look at if they did.
Small-firm partners whose Workspace tier doesn't include the audit tooling, and who aren't going to upgrade the whole firm to investigate a hunch.
Ops and finance people at companies where IT exists but won't install a third-party tool, won't grant domain-wide access, and won't run a report on request.
If you're in one of those categories and you suspect your Drive is oversharing, the honest answer from the security tooling industry right now is: escalate to your admin.
Which is not an answer.
And even the admin path is more fragile than people assume. Standard Drive access logs are retained for six months. Admin restore of deleted items expires 25 days after Trash is emptied. "Ask IT to pull the logs" only works inside a window that's shorter than most people's memory of when they shared something.
So let's talk about what you can actually do yourself, for free, today.
The manual method — and it does work, up to a point
Google gives every signed-in user, on every tier, a handful of real tools. They are not marketed, they are not assembled into anything resembling an audit, but they exist and they're worth learning.
1. Start with the storage page
Go to drive.google.com/drive/quota. This lists your files sorted by how much storage they consume, largest first.
This is not a security view — it's a storage view — but it's the single most useful starting page in Drive, because size correlates with importance more often than you'd think.
Video recordings of client calls. Exported database backups. Scanned document archives. The things at the top of this list are frequently the things you'd least like to find a public link on.
Work down the first two or three pages. For each item, ask: do I know why this is here, and do I know who can see it?
2. Scope your search to what you actually control
In the Drive search bar, owner:me restricts results to files you own. This matters, because a large fraction of what appears in your Drive is other people's files shared with you — and you can't change permissions on those anyway. Anything you can meaningfully fix is something you own.
Everything below assumes you've added owner:me.
3. Search by recipient
The to: operator finds files you've shared with a specific person: to:name@example.com owner:me.
This is the most direct sharing query Google offers, and it's the one I'd reach for first.
Make a list of everyone you can remember sharing with — former accountants, ex-contractors, previous employers, that agency you used for six months — and run each one.
The catch, and it's a significant one: to: only surfaces files shared after February 2021. Anything you shared before that is invisible to this operator. If your Drive predates 2021, and mine does by a decade, this operator covers only the recent slice of your exposure.
It's still worth running. Just don't read a clean result as a clean Drive.
4. Find the files sitting loose at the root
is:unorganized owner:me surfaces files that aren't inside any folder.
These are worth attention because they're usually the accidents — things dropped in from an email attachment, a mobile upload, a "save to Drive" click. Files nobody deliberately filed are files nobody deliberately reviewed.
5. Narrow by type and by age
type: filters by file kind — type:pdf, type:spreadsheet, type:document, type:folder.
Combine it with what you know about your own risk: if your sensitive material is PDFs from a scanner, type:pdf owner:me is a meaningful subset.
before: and after: filter on modification date, in YYYY-MM-DD format. owner:me
before:2020-01-01 gives you the old stuff — files you haven't touched in years, which are exactly the ones whose sharing settings you're least likely to remember setting.
6. Open the Share dialog
For any individual file, the Share dialog is the ground truth. It tells you exactly who has access, at what level, and whether general access is set to "Restricted" or to "Anyone with the link."
This is the only place Google will tell you a file is publicly linked.
7. Know your safety net
Anything you remove goes to Trash, and Trash holds it for 30 days before permanent deletion. That's a real safety margin, and it means the manual cleanup is less scary than it feels. But it's 30 days from deletion, not 30 days from when you notice — so if you're going to review your own cleanup, do it soon.
That's the full manual toolkit. Used well, it's genuinely enough for a Drive of a few dozen files. You can open every Share dialog in an afternoon and come out the other side actually knowing where you stand.
Past a few hundred files, it collapses. Not because it gets tedious — though it does — but because of a structural problem I want to name precisely.
What you cannot do manually, at any effort level
There is no search operator for "publicly linked."
Read that again, because it's the whole reason this article exists. Google gives you to: for named recipients, but it gives you nothing at all for the far more dangerous category: files set to "Anyone with the link." You cannot query for them. You cannot sort by them.
The only way to find out whether a file is publicly linked is to open that file's Share dialog and look.
Which means the manual audit for public exposure is: open every file, one at a time. On my 8,052-file Drive, at a genuinely optimistic ten seconds per file, that's just over 22 hours of clicking. And 204 of those files would have been worth finding.
Three more things Google does not offer at any tier, admin or not:
No duplicate detection. None. Not in consumer Drive, not in Workspace, not in the admin console. Google will happily store the same file forty times and charge you for all forty. My scan found 305 duplicate clusters.
No cross-Drive access view. There is no page that answers "who has access to everything I own." Permissions in Drive are queryable one file at a time, in a dialog, by a human.
No bulk permission remediation. Even once you've found the problems, there is no "revoke public access on these 204 files" action. It's one file, one dialog, one setting, 204 times.
Where NeatDrive fits
I built NeatDrive to close those specific gaps — not to replace the manual method, but to do the parts of it that don't survive contact with a real Drive.
It connects to your Google account as an ordinary user. No admin console, no domain-wide delegation, no IT ticket. Then it enumerates every file the signed-in account can reach and reports eight finding types: public_link, external_share, loose_root_file, stale_file, large_file, empty_file, junk_file, and naming_violation. The first two are the ones that matter for sharing; the rest are why the storage page exists.
Because the accuracy of this claim matters more to me than the marketing of it, here is exactly what the scan touches.
Scanning uses a single Google scope: drive.metadata.readonly. I'm going to be pedantic about this, because we spent a week removing a sloppier version of it from our own documentation. drive.metadata.readonly is not the same as drive.readonly. The latter grants access to file contents. The former grants only metadata — names, sizes, dates, owners, permissions, checksums. Scanning cannot read what's inside your files, because the token it holds is not capable of it. Calling this "read-only access" would blur two different Google scopes, and the difference is the entire point.
Write access is separate, later, and optional, with its own token and its own consent. You can scan and never grant it.
Two optional features read a short snippet of file contents — content-aware renaming and duplicate verification — and only on files you specifically select, only after you've granted write access. Scanning never reads contents.
Duplicates are matched on Google's md5Checksum field, taken from metadata, with a name-and-size fallback for Docs, Sheets and Slides, which Google does not checksum. It is not byte-for-byte content hashing, and I'd rather describe it accurately than impressively.
Nothing is deleted. Items move to a quarantine folder inside your own Drive, or to Google Trash. Quarantined items are restored from their quarantine batch. For deletions, the in-app restore expires at 7 days, while Google's Trash keeps the file for 30 — a retention we don't control and can't extend. The in-app undo dies three weeks before the file does.
One limit I'd rather state plainly than bury. NeatDrive scans everything the signed-in account can reach, and that includes files stored in Shared Drives. What it cannot do is enumerate a workspace's Shared Drives as separate containers for you to pick between — that requires Google's drives.list endpoint, which will not accept a metadata-only scope. Getting that picker would mean asking for a broader scope than scanning needs.
That's a trade I made deliberately, and I'd make it again.
50,000 files per scan, identical on every tier including Free. That's a cost guardrail on our side, not a paywall — upgrading does not lift it.
NeatDrive has been through an independent security assessment: Google's CASA, carried out by an authorized lab under the App Defense Alliance, against the OWASP ASVS standard. A product that audits your security posture should be able to survive an audit of its own.
I'm not going to claim NeatDrive is the only tool an individual can run. It isn't — there are several good Drive tools that work on personal accounts. What I haven't found elsewhere is the specific combination: security-focused auditing rather than storage cleanup, a metadata-only scanning scope, remediation you preview and approve item by item, and no admin access required at any step.
If you only do one thing to audit Google Drive permissions, do this
If you take nothing else from this: open drive.google.com/drive/quota right now, and open the Share dialog on your ten largest files. Ten files, five minutes. That single exercise is what convinced me this was worth building, and I'd be surprised if it turns up nothing.
Then run to: against every recipient you can remember, remembering it only reaches back to February 2021. Then owner:me before:2020-01-01 and start reading.
If your Drive is small enough that the manual pass gets you a real answer — do the manual pass. It's free and it works.
If you got a few hundred files in and realized you were never going to open every Share dialog, that's the gap I built for. The Free tier will scan and show you the findings. There's also a one-time Drive Exposure Audit at $59 if you want the full picture without a subscription, and Pro at $49/month if this is a thing you need to keep current.
Either way, please go look. I built the scanner and I was still wrong about my own Drive.
Correction (9 August 2026): this post originally said quarantine and Trash were "reversible for 30 days" and described NeatDrive's remediation as reversible. That's only accurate for one action. Revoking a share or a public link has a 30-day undo; quarantined items are restored from their quarantine batch; a bulk rename cannot be undone once the post-apply drawer closes; a delete has a 7-day in-app restore while Google Trash holds the file for 30; removing your own access and transferring ownership cannot be undone at all. What holds for every action: NeatDrive is read-only by default, previews every change, changes nothing unless you approve it, and keeps a full activity log you can export.
Comments