Back to Checks
googleworkspace

Google Drive for desktop is disabled

drive_desktop_access_disabled
Service: driveSeverity: medium
OfficialBuilt-inVerified
Resource Type:NotDefined

The domain-wide default disables Google Drive for desktop for the organization. The Drive for desktop client synchronizes Drive content to local devices and uses its own "offline" mechanism that does not respect the central offline-access device policy, so disabling it closes a synchronization channel that would otherwise place organizational content on potentially unmanaged endpoints.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

When Drive for desktop is enabled, organizational files are synchronized to local devices and remain accessible if the device is lost, stolen, or compromised. Because Drive for desktop bypasses the central offline-access controls, this channel is a frequently overlooked path for sensitive data to leave organization-managed environments.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks drive_desktop_access_disabled

Recommendation

Disable Google Drive for desktop to prevent local synchronization of organizational content. This reduces the risk of data loss when devices are lost or stolen and closes a channel that bypasses central offline-access controls.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Drive and Docs**
3Click **Features and Applications** > **Google Drive for desktop**
4*Uncheck** *Allow Google Drive for desktop in your organization*
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.drive.drive_client import drive_client


class drive_desktop_access_disabled(Check):
    """Check that Google Drive for desktop is disabled

    This check verifies that the domain-level Drive and Docs policy disables
    Google Drive for desktop. The desktop client synchronizes Drive content
    to local devices and bypasses the standard offline access controls,
    so disabling it reduces the risk of organizational data being lost or
    stolen along with an end-user device.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if drive_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=drive_client.policies,
                resource_id="drivePolicies",
                resource_name="Drive Policies",
                customer_id=drive_client.provider.identity.customer_id,
            )

            allow_desktop = drive_client.policies.allow_drive_for_desktop

            if allow_desktop is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Google Drive for desktop is disabled in domain "
                    f"{drive_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                if allow_desktop is None:
                    report.status_extended = (
                        f"Google Drive for desktop is not explicitly configured "
                        f"in domain {drive_client.provider.identity.domain}. "
                        f"Drive for desktop should be disabled to prevent local "
                        f"synchronization of organizational content."
                    )
                else:
                    report.status_extended = (
                        f"Google Drive for desktop is enabled in domain "
                        f"{drive_client.provider.identity.domain}. "
                        f"Drive for desktop should be disabled to prevent local "
                        f"synchronization of organizational content."
                    )

            findings.append(report)

        return findings

References