cgs-admin-google-apps

Administering Google Apps for Work

Course Overview Alright, let's talk about the course overview. For the best experience I would recommend that you watch this course in full screen. This is an intermediate level course, fairly easy to wrap your head around if you have a basic understanding of IT, and although anybody's free to watch this course and learn, it would be especially beneficial to IT admins like server administrators, people who have worked with Active Directory, messaging or communication or even those who are planning to become a Google Apps reseller, and lastly, I would not say it's mandatory, but you'll understand the course a lot better if you have a basic idea of user management, and DNS records in an enterprise environment because we will be working with user accounts, and occasionally playing with DNS records, so that would definitely help. Here's how the course will span out. I'm going to break this course down into eight modules. The one that you're watching right now is introduction module. In the next module we'll walk through how to setup a new Google Apps for Work account for the organization. Once we have that in place, the next step is to manage users, create, delete, and all of that. Next, we'll take a look at groups and organizational units. After that we'll talk about the mail flow, and how to create rules that can be applied to incoming or outgoing emails. Then we'll discuss communication, which will cover how to setup audio video conferencing among teams. Then we will work with storage for storing and sharing files, as well as collaboration, and finally, you'll learn how to maintain a Google Apps for Work infrastructure for day to day operations.

Certification Okay, so here's the exam that I mentioned in the second clip, the Google Certified Administrator. This exam essentially tests if you possess the skill it takes to administer a Google Apps account for an organization. Google recommends that you have at least six months of hands on experience managing a Google Apps account with at least 50 users before you decide to give this exam, but I would say if you are a quick learner you could do it in less with the help of this course, and total hands on practice of course, and I'll have to warn you, you will need hands on practice, no shortcuts there. If you think you'll clear the exam watching this course alone and maybe a little reading that's not going to happen because you should know that the exam is not theoretical, it's hands on, which means you actually have to do practical stuff, and not just choose answers in a multiple choice question. We'll talk more about the exam towards the end of this course. For now this is all you need to know, and if you don't plan on getting the exam that's fine as well, no compulsion there.

Introducing Google Apps for Work Alright, I think it's time that I come straight to the point and start talking about the product you are here to learn. As I mentioned in the first clip, Google Apps for Work is a completely cloud based SAS solution, which means it is hosted in the Google datacenters as opposed to traditional in house servers, and you get all the benefits of any typical SAS solution along with it, but it is paid, not free. I'll talk more about the pricing later. The products that you get as a part of the suite include, for communication you have Gmail, Calendar, Hangouts, and Google+. For collaboration you have Google Docs, Sheets, Forms, Slides, and Sites. For storage you have Google Drive, and for administration you have the Admin console, and the Vault. Gmail is used for, well, the most traditional method of digital communication known to mankind, emailing. Pretty sure you already knew that. Calendar is for scheduling events or meetings, and sharing them with your team. Hangouts is for audio/video conferencing. Google+ is a social network for use within the organization, and then Docs, Sheets, and Slides are online alternatives to Microsoft's Word, Excel, and PowerPoint. Forms is used for taking surveys or polls, and Sites is a basic SharePoint-like web-based portal for collaboration within teams or with customers, and Google Drive is for storing, sharing, and syncing files. Chances are that you've probably used one or more of these in your regular day to day work, but what you may have not heard of or used a lot is the Admin console and the Vault. The Admin console is from where all the administrative tasks, including access to all these services, is managed for users of an organization by the administrator, and that's primarily what we're going to do in this course, and so we'll be spending a whole lot of time navigating and exploring the different parts of the admin console. Although we will also look at the end user experience of using these services, but that it be comparatively less in proportion. We'll be more on the admin side than the end user side because, well, we are the all-powerful admins, not end users, but don't worry, you'll get a significant hold of both the perspectives in this course, and finally, the Vault is used for eDiscovery and archiving or basically in short, tools to enforce legal compliance policies over the products and corporate data in your Google Apps for Work account. We'll learn all of this in detail soon, but before that let me compare Google Apps for Work with a few other alternatives in the market.

Comparing GAFW with Free Google Services Comparing Google Apps for Work with Free Google Services. By now some of you are probably thinking, Hey Kunal, I have already used Gmail or Calendar or other stuff listed in the previous clip for free without paying, then why do I need to pay for Google Apps for Work? Isn't it essentially the same? Well yeah, at the core of the suite the products are more or less the same, but the business features that you get with the paid version do not come with the free version, like first and the most prominent one, a custom email domain. When you're using the free Google services your email id ends with the @gmail.com, which is not very professional looking if you're going to talk to customers or clients for business using a Gmail id, and that's why with Google Apps you get to use your own custom domain for emailing, an email id with your company name or your business identity in it, kind of like batman@gotham.com because nobody will take you seriously with an email id batman@gmail.com. You get the point right? Then you get more storage. We'll talk about the specific numbers later. Next, you also have round the clock phone and email support from Google. Then a 99.9% uptime guarantee. If Google fails to keep their promise you'll get free credit as compensation, and finally, the main distinctive feature administrative control over your employees accounts, when a user uses a Gmail id it's a personal account, nobody except the user himself has control or authority over it, but with Google Apps you create corporate accounts for your employees, and the company has authority over those accounts, and its data. You can freeze, delete, reset access or do anything with that account as the organization deems fit. You can't do that for the users Gmail account can you?

Comparing GAFW with Office 365 Now let's compare Google Apps with Office 365. If you haven't' heard about Office 365 it's a Google Apps competitive product from Microsoft, and a lot of people ask me, which is the better among the two, and in my experience of administering both Google Apps and Office 365, I would say it really depends on what the requirement is. For example, in general, Google Apps is more suited for small to medium size businesses. Office 365, on the other hand, is more suited for medium to large enterprises or IT companies in particular. Google strikes the right balance between simplicity and features, whereas Office 365 has a lot of high density packed IT features that not every organization may need for their ideal operations. Then Google Apps has limited hybrid cloud capability as compared to Office 365. Since Microsoft is known to have a tremendous on-premises presence, whereas Google hardly has any enterprise on-prem products, then with the higher plans of Office 365 you get complimentary copies of Office desktop suite, Word, Excel, and PowerPoint, and all of the other products that come with it. You don't get that with Google Apps. Google Apps is browser based only with no independent desktop products. The upside is that Google Apps is simpler to setup and manage compared to Office 365. You can easily train a non-IT person with the basics of Google Apps Administration, but for Office 365 you will probably need a person with an IT background, and finally, a really powerful feature that all the Microsoft admins will miss in Google Apps is PowerShell. With Office 365 you have ready-made PowerShell commandlets for common administrative tasks, but with Google Apps using scripts is not that simple. you do have APIs that you can leverage, but you will have to build their custom scripting solution. No official out of the box option here. By now it may seem Office 365 has a lot more stuff that Google Apps does, then why prefer Google Apps? The top most reason to prefer Google Apps is like I said, its simplicity and pricing, and Google nails it when it comes to that. Google Apps works out to be a lot cheaper as compared to Office 365, and that's one of the main reasons why more number of businesses run on Google Apps than they do on Office 365.

The ServerBaba Scenario Alright, I hope you are pumped up and excited to learn more about Google Apps. Here is the scenario that we'll build this course around. We'll talk about a fictitious company called ServerBaba. I chose this name only because I had a spare domain serverbaba.com that I'll make use of in this course. This newly setup company, ServerBaba, is trying to make a tinder-like app for geeks. Yeah, a dating app exclusively for the geeks. Now I'm not sure how viable that idea is, but that's not our problem. That's between the developers and management. We are in the IT operations team. In terms of the infrastructure what we have are a couple of servers for the dev teams, for their software builds, the networking, and all the computing devices needed by the employees, and I've already recommended the CEO, given the size and type of our organization, to use cloud-based Google apps for other internal use. That way we can minimize the on-premises infrastructure, minimize costs, and scale as and when needed. Mark is the CEO of this company. Jim is the VP of Product, Lisa, VP of Legal, Steve, VP of Finance, Heather, VP of human resources, and Chris, VP of marketing. These guys will occasionally keep sending us emails to make changes to our Google Apps environment, and our job is to try to ensure we are able to fulfill their requests. You and I will work as a team to accomplish this together.

Summary You have reached the end of this introductory module. You got to know that this course will have eight modules, and what each of those will cover. Also, that this course is aligned to help you prepare for the Google Certified Administrator certification exam. Google Apps for Work has tools to help you communicate, store, collaborate, and manage your environment. We then compare Google Apps with free Google services and Office 365. After that I give you a little background of how this course is designed to be scenario based for a fictitious company called ServerBaba. In the next module, Setting Up a New Google Apps for Work Account, we'll talk about the various plans, sign up for an account, and do the initial one time configuration needed to get started with Google Apps. I'll see you in the next module.

Setting up a New GAFW Account Agenda Welcome back to the course, Administering Google Apps for Work. You are watching the second module setting up a new Google Apps for Work account, and I'm your same old instructor, Kunal. In the previous module you got an idea of what Google Apps for Work is, and how it compares to other alternatives in the market. In this module first we'll do a basic, preliminary comparison of the two subscription plans that are available in Google Apps. It's always a good idea to check what features you get with which plan, and if they can meet your business requirements. After that comparison we'll sign up for an account, and do the initial runtime setup and configuration needed in order to get our Google Apps for Work account running. Starting from this module there'll be a whole bunch of demos packed into each module, so that you get a better picture, and enjoy the course a little more, so let's quickly get started. Here's the agenda for this module. First, we'll understand the two subscription plans, pricing, and how billing works. After that we'll zero in on a subscription plan, and I'll walk you through the signup process for it. Then, once we have signed up for an account, we will add and verify our custom domain, which is serverbaba.com. We'll also configure some DNS records to enable emailing, and finally, we'll fill in the details in the company profile section of our admin console in Google Apps.

Subscription Plans Understanding subscription plans. Anyone among you who has ever had to deal with Microsoft licensing will really appreciate how simplified Google Apps licensing is. You just have two subscriptions plans, Google Apps Standard, and Google Apps Unlimited plan. The standard one costs $5 per user per month, and the unlimited one costs $10 per user per month, which means if there are 10 users in an organization it'll cost you $50 a month in total for the standard plan or $100 for the unlimited plan. You'll get all the details if you visit this URL. The main difference at a high level between the standard plan and the unlimited plan is the amount of storage you get, and the fact that you do not get the vault in the standard plan, whereas with the unlimited plan you do get the vault. Remember the vault used for eDiscovery and archiving? Yeah, that one, and since we are here to learn as much as we can about Google Apps we'll sign up for the unlimited plan, so that we also get a chance to experience the vault. The difference between the two subscription plans will become clearer as you proceed through the course.

Billing Plans Before we get to the signup demo let's also take a look at how billing works. If you go to this link you will get all the details, but for convenience here is a basic overview. Google gives you a 30 day free trial to play with. No credit or debit card is required to sign up. You may choose to enter the payment details later if you like Google Apps and decide to continue after the free trial is over. There are two billing plans. Don't confuse them with the two subscription plans. These are billing plans. These determine in what fashion are you going to pay your amount due to Google. The two choices that you have are the Flexible plan and the Annual plan. With the flexible plan you pay every month for the number of user licenses you have. You can add users or delete users, but you only pay for the user licenses that were in use for the month. You can also shut down your entire Google Apps for Work account if that's what you want at any point of time. There's no commitment involved, but with the annual plan you commit to Google to use Google Apps for at least one year for at least a certain number of users in exchange for a discounted rate per user. You pay monthly, and you can add users by paying extra, but there is no deduction in price if you delete users below the number that was agreed upon in advance. You also cannot shut down your account before the one year period ends. I mean you could stop using it, but you'd still have to pay for the entire year, so to summarize this, you either commit and get a discount or don't commit and pay a little extra, but get flexibility. You have to decide what is more important to you. Now in general, if you're sure your workplace is going to constantly grow from year to year it makes sense to choose the annual plan, but if you're uncertain about the growth prospect of your company, then flexible plan is what I would recommend, but here's the catch, you can choose between the flexible or the annual billing for the Google Apps standard subscription, but with the unlimited subscription the only option is flexible billing. I mean, you could choose the annual plan, but the discount that you'd expect does not apply with the unlimited plan. You can read more about this if you want to, but we'll not cover this in any more detail since this does not appear in the certification exam, so covering this in more detail will not exactly be in the scope of this course. Okay, so end of talking. Time for a demo.

DEMO: Signing up for Google Apps for Work Alright, so now let's sign up for a Google Apps for Work account. I'm on my Chrome browser, and I'm going to do a quick search to bring up the Google Apps page. Google apps for work, and then click on this first link over here. This is the official Google Apps homepage. You can scroll and look around to read more about Google Apps. Basically, this is all the marketing material that Google uses to convince and sell you subscriptions, get email for your business, and then features that you get along with it, tools, are if you scroll a little more down customers that have been using Google Apps, so I'm going to scroll up and hover on Products, so if I do that you can see all the products that are included with Google Apps. We talked about them briefly in the previous module, so what I'm going to do is I'm going to click on Pricing over here, and scroll a little bit, there you go, so on the right side you can see that the unlimited plan is for $10 per user per month, and there's no discount, even if you opt for it annually because 10 x 12 is $120 dollars, but on the left you see the monthly rate is 150 rupees, that's because I'm in India. Multiple 150 by 12, it gives you 1800, but with the standard plan with annual billing you get a discounted price, which I mentioned. You can see it says 1500 instead of 1800. If you open this link in your country it'll probably give it the rates in your currency, but for this course what I'm going to do is I'm going to click on the Get Started button under the unlimited plan. Okay, so here's the sign up form. I'm going to fill in all the details. First name, Kunal, surname, D. Mehta, my email address, serverbaba@hotmail.com, business name, ServerBaba, number of employees, for now 2-9, Country, India, and then I'm going to enter my full number here. Make sure you enter a valid email address because in case you forget your password this will serve as the alternate recovery address, and then adding a phone number will serve as an extra layer of security. After I'm done with page I'll click on Next. Now it asks me if I already own a domain that I'd like to use with Google Apps or do I want to buy a new one right now, and use that one. Since I already own the domain, serverbaba.com, I'll choose the first option over here, use a domain that I already have purchased. Enter my domain name, serverbaba.com, and then click on Next. Here on the third page I'm going to make the first user account in Google Apps, that will be mine. Since this is the first account in the domain it will serve the primary administrator role, that'll be kunal@serverbaba.com. Enter a password, and I'm going to do that. Okay, re-enter the password, that's fine, and put in the capture. Looks like it's 4731, then scroll a little down, and before I sign up you should know that this is the account I'll use to login and manage virtually everything there is to manage in Google Apps. I'll have full control with these credentials, so make sure you remember your password, and keep it safe. Do not share it with anyone. Finally, I'll read and accept the service agreement, the purchase agreement, and then click on accept and the sign in button. Now it'll take a few seconds to provision a new account with all the information we just furnished. It shouldn't take long, only probably a few seconds, so in the meantime what you can probably do is if you have a phone maybe ask Siri or Cortana to tell you a joke, I don't know. Okay, so here we are. It says the setup a business account is complete, and if your browser asks you to see the credentials do not do it. It's not a good practice, especially for a primary administrator account. Don't do it even if it's your personal computer that no one else uses. Next, it says add people to your Google Apps account. Now if I want to I could add up to 10 users from right here, although we're not going to do this right now. We'll do this in the next module, Managing Users. You can see that my account has already been created, so I'll click on this checkbox stating that I'm done adding users for now, and then move on to the next step. Now the third step here says, verify your domain and setup email, so we've completed the simpler part of the signup process. Now there are a couple of more things remaining before we complete the signup, so let me pause the demo right here, and go back to the slides to explain you what domain and email setup means, and then come back and continue with this demo.

Verifying Your Domain Verifying Your Domain. You have to complete this and the next step before your Google Apps account actually becomes functional. That's because Google needs to verify that you actually own the domain that you claimed to own during the signup process. It's just a precautionary measure that Google takes to ensure that nobody unauthorized uses your domain or you use someone else's. Now there are three primary ways in which you can do the domain verification. First, if you have access to the domains DNS pattern adding a TXT record or a CNAME record is the most efficient way to get a domain verified. It does not disrupt any existing services operating on the domain. This method is also suitable when you may not have a web hosting in place because all you need is a domain and access to its DNS panel. The second method is useful when you do not have access to the DNS panel, but you do have the permission to upload new files to the domains web server or web hosting. Here you upload an HTML file to your web server that Google uses to verify the domain ownership. The third method is useful when you do not have access to either the DNS panel or permission to upload files to the domains web server, but you do have the permission to edit files in the web server. In this case, you add a tag in the homepage's HTML file that Google will use to verify the domain ownership. Finally, there's one more way, but it may work for some of you, and it may not work for the rest of you, and that's automatic verification because this process depends on if Google has already worked with the company managing your domain to make the verification process easier. In my case it's GoDaddy, so how this works is that Google Apps will open up an authentication window where I can log in with my GoDaddy credentials, and give Google the permission to read the information in my GoDaddy account for verification of the domain. If it succeeds that's it, you're good to go, but the only problem is that if the company managing your domain is not a popular one Google may not have the preset capability for the verification process. In that case, you should try to go back and use one of the three methods listed above. Another important note, if you do purchase a domain from Google during the signup process the domain is automatically verified, you don't have to do it separately. We'll take a look at these methods in the demo.

Configuring DNS Records for Email This is the next step that you will have to take before your Google Apps account becomes functional, and that's configuring the DNS records for email because if there's no email, well what is the whole point right? This should be fairly simple. If you have ever worked with DNS records or MX records specifically, this should be a walk in the park for you. If you're not familiar with DNS I'd suggest you to take help from a DNS administrator to get this in place. You can see the table in front of you. The Name field needs to be left blank or filled in with the @ symbol. Time to Live field needs to be 3600 seconds, which is 1 hour. The Record Type is obviously the MX record, which stands for Mail Exchanger, basically what points to the Google mail servers for your emails to be routed and delivered correctly to the appropriate destination, and finally, the Value of the record. For redundancy we'll not just create one, but five records in varying values of priority. The value of the first MX record with priority one is ASPMX.L.GOOGLE.COM. Followed by that four other MX records with priorities of 5, 5, 10, and 10 with values ALT1.ASPMX.L.GOOGLE.COM, then ALT2, ALT3, and ALT4. Each one of these is an alternate mail server in case the upper ones are experiencing down time. You can see the amount of redundancy Google has in place to ensure that you do not lose any emails in transit. Take a few seconds to look at the values in this table once again. We'll move onto the demo after this.

DEMO: Configuring Domain and Email Setup Let's jump into the Configuring Domain and Email Setup demo. Now that you understand why domain verification is needed, and why you need to setup MX records for emailing, let's move on to the third step of the sign up process. As you can see, there's a Verify button down here, let me click on that. Google Apps opens up an authentication window on the GoDaddy website, so let me type in my customer number here on my GoDaddy account, password is already saved. Let me login. Now it asks me for a verification code that has been sent on my phone. I'm going to enter that (Typing), and click on Login. As you can see, on the third page that we have update for automatic verification because Google and GoDaddy have already worked together to make the verification process of the domain and setting up the MX records for emailing easier for us. Now before I click on Accept let me go back over here. You can see there's a line, it says we have detected that serverbaba.com is hosted at GoDaddy. If you're having trouble try to verify your domain here. Let us see what this link does. Now if I click on that it lists all the other three methods that we discussed. It says you can verify by adding a meta tag. Now what that meta tag is, that's this, so this is the value of the meta tag that you would have to add in the home page's HTML file to make sure that your domain gets verified or if you click over here and choose an alternate method it says, add a domain host record, either a TXT or a CNAME record, so let me click on that and see what happens. Now it gives me step by step instructions that I have to follow to make sure that my domain is verified. Now first it says login to your GoDaddy website. Now let me just click this and say I have successfully logged in. Now the second step says, go to the control panel of your domain, and open the DNS Management. Fine. Let us assume I've already done that. Now here it says add a TXT record to your domain. Now the name of the record is this, and the value of that TXT record is, as you can see over here, so this is the first method that we discussed, adding a TXT or a CNAME record. If I click on this link it'll also give you the CNAME record that you can add to your DNS to make sure the domain is verified. Now let's go back, uncheck these boxes, and see what the third method is. By clicking on this, choose a different method, and upload HTML file to serverbaba.com. Now if I click on that it gives me a direct button to download the HTML file that I'll have to take and upload it to the homepage of my website. I'm not going to follow any of these steps because I already have a simpler option, which is automatic verification, so let me go back to this window over here, which says, Google is requesting permission to make changes to your DNS for serverbaba.com, so Google will read the information in my GoDaddy account, and configure the MX records for emailing, so let me Accept, and see what happens. Alright, so it looks like Google now has access to my GoDaddy account, and it is now reading the information in my GoDaddy account to verify if I actually own the domain, serverbaba.com, which I do, and after it does that it'll go ahead and create the MX records automatically for the emailing. Now you can understand why the automatic verification is the simplest way out right, because Google does everything for you. You don't have to do anything manually, but in case your domain is not hosted with a popular domain registrar, like GoDaddy in my case, you could follow one of the three methods that I also showed you in the demo. I'm going to fast forward this video instead of waiting for three minutes by the time that Google verifies my domain. I'm going to fast forward it and we'll come back to once this process is done. Awesome, so it looks like our domain has been verified, so let's click on Next. It says you're almost done. You have successfully switched your email to Google Apps. This demo was successful, so let's click on Continue, and see what happens. Google sends you to the admin console. Before you move on it gives you a little introduction to the plan you have chosen, which was Google Apps for Work, the unlimited plan. We already know that, so I'll just go ahead and click on Get Started, but if you want to you could give this a read. Then it asks me to fill in the billing details, which I really don't want to do right now, so I can go ahead and cancel this, and then this free trial will work for 30 days. You can see on the right side it says, 30 days left for your Google Apps account to expire.

Filling Details in the Company Profile In the previous two demos we signed up for a Google Apps account, and did the initial one time setup of domain verification, and configuring DNS records for email. Now the next thing I would recommend doing is to fill in the details in the company profile section in the admin console. Here you tell Google Apps what your organization name is, who the primary administrator is, and his primary and secondary email addresses have to be filled in for recovery in case he forgets the password to his primary address. Then, depending on which part of the world you are in, you can set the language, the local time zone accordingly, and how Google releases and adds new features to your Google Apps account. You also have control over things like communication preferences to choose when and for what reasons can Google contact you. Then adding a customized logo of your company for branding, and adding generic URLs for common services. One more thing that you can do from here is delete your entire Google Apps account. I don't think that's a good idea to do right now since we have just got started, but if you ever wanted to you know where the option is.

DEMO: Walkthrough and Company Profile Now let's take a walkthrough of the admin console, and fill in the details in the company profile section. Here we are back in the admin console. You can see that the URL is admin.google.com. This is a URL that we can use to come back to the admin console at any later point of time. For convenience, I'm going to bookmark this, and save it. If you scroll down here are the most common administrative tasks that an admin of a Google Apps account will need to take. You can also customize the admin console by dragging the icons here and there according to what suits you, so what I'm going to do is I'm going to click on the company profile section for now, and see what we have here. You can see here's the company profile. I'm first going to click on Profile, scroll down a little bit, organization name, looks like this is correct, ServerBaba, then the contact information, the primary administrator account as well, yes. Kunal@serverbaba.com, that's me. My secondary email address looks great because this is the information that we filled in during the signup process. Let me scroll down a little bit. Here's a support message that you can add for your users in case they need help. It could be like support@serverbab.com, and write text, Please contact for any help. Now although we do not have this email id active currently, we'll probably create at a later point of time. Scroll down a little bit more. The language, well English (US) sounds good. The time zone. Let me see the time zone, if we have an India time zone. If we scroll around, go to I, E, F, G, H, I, okay, there's India here. I'm going to set that. Select time zone, India Standard Time, scroll down a little bit. Here in this section Google is asking you how new user features are added to your Google Apps account. Do you want them to be added automatically or do you want them to be scheduled. Similarly, here Google again, asks you, how do you want to new products to be added to your Google Apps account? Do you want them to be added automatically or manually, so I think this setting looks good because I automatically want new products to be added to my Google Apps account, but new user features to be scheduled. I'm going to scroll down a little bit more. You can see here there's an option to delete this account, although it is grayed out right now because I have active subscriptions. Now if I scroll down a little bit more I'm going to click on Save to save the changes I just made. It says, your settings have been saved. That's good. Secondly, I'll move on to the communication preferences. Scroll down. Now here I can choose what type of emails I'd like to receive from Google. Do I want performance suggestions and updates? Maybe, sure. Feature announcements? Maybe not. Offers? Nope. Feedback and testing? Not really. I'm just going to save this, and move on. Now third section over here says personalization. Now here do I want the default logo or the customized logo? It's always a good idea if you have a branding in place to customize the logo, which appears on the top side over here of your Google Apps account. Since I do not have the logo ready right now I'll probably do it at a later point of time. Then go to Custom URLs. Scroll down a little bit more. Now here I can add generic URLs for my services. For example, if I want users to open up the email I can just type in the URL, mail.serverbaba.com or to open the calendar, calendar.serverbaba.com, and then for storage, drive.serverbaba.com, and for sites, sites.serverbaba.com, and for groups, groups.serverbaba.com, and click on Save. Here on this page you have a set of instructions that you will have to follow by going into the DNS panel, and adding a few CNAME records to make sure that the generic URLs you just added work, so what I'm going to do is I'm going to go to my GoDaddy account, configure these records, and come back. Just to give you a peek, this is what my DNS look right now, so if I scroll down under the CNAME you can see calendar, drive, and then mail, groups, sites, all of them pointing to ghs.googlehosted.com, and that is exactly what it says over here in the instructions. It says, create these records, and then point them to ghs.googlehosted.com, so now that we've completed these steps by adding the CNAME records, let me go ahead and click on, I've completed these steps, and see what happens. It says, your changes have been saved. To verify this I am going to open up a new tab, and then type mail.serverbaba.com, and see if it works. Okay, so it looks like the generic URLs did work, and with that we'll finish the filling in details in the company profile section demo.

Just in Case You Have an Android or iOS Device One more thing before we get to the summary of this module. If you do happen to have an Android or an iOS device there's an app for Google Apps Super Administrators, which can be used to administer your Google Apps account. I think it's fantastic, and I would strongly recommend that you download and play around with it too. Makes your work a lot easier, and you can do tons of stuff from your mobile or tablet on the go. Cool stuff. At the time of this recording the app is only available on Android and iOS, not on Windows phone or Blackberry, sorry about that, but that might have changed depending on when you're watching this course, so a good idea would be to just go and check once. What I have done is that I have installed the Google Admin app from the App Store on my iPad. Carefully note the name of the app is Google Admin, and the publisher is Google, Inc. Chances are that you may find other unofficial apps, so try to avoid them. When I open the app it kind of looks like this on my iPad. Somewhere in the later patch of this course we might use the app, so just install, and keep it ready if you can.

Summary Alright, so it looks like we have reached the end of this module. Here we learned about the two subscription plans, standard and unlimited, and how the main difference between the two is one in terms of storage, and the other that the unlimited plan comes with the vault, whereas the standard one does not. After that we learned about the two billing plans, flexible and annual. After that we signed up for a Google Apps account, and learned that there are three primary ways for verifying your domain, TXT or a CNAME record, uploading an HTML file or adding a meta tag to your home page. Another way was automatic verification. Followed by the domain verification comes the configuration of MX records in the DNS for mail flow, and finally, filling in the information in the Company Profile section, and installing the Google Admin app. In the next module, Managing Users, we'll get started with other scenarios, and work with various user administration related tasks, so get ready, and gear up.

Managing Users Agenda Welcome to the third module in this course, Managing Users. Here we will learn all the tasks that an administrator is responsible for pertaining to user management in a Google Apps environment. We'll start right from creating the users, to the deletion, and everything in between, things like password resets, freezing an account or maybe giving them extra privileges, and so on. How we will go about this course is that I'll first give you a scenario, then we'll try to go ahead in the demo and try to solve the scenario, and after we are done with that we'll come back to the slides, and learn in a little more depth of what we did in the demo. I know it's unconventional, but it's closer to how we do it in production, so sit tight, and let's move on. Here's the agenda for this module. We'll start off with creating the users, and learn the different methods to do that. Followed by that we'll learn about admin rules, where you can give admin privileges to the users in your environment. Followed by that we'll learn about adding an alias. Alias is basically a duplicate name. Followed by that, resetting passwords because well, users forget password right? After which, we will learn about suspending user accounts, and finally, deleting user accounts. Now this module is going to be really important for the exam because this syllabus covers about 23% of the questions that appear in the certification exam, so you might want to pay attention, and maybe revise the module if needed.

Creating a User by Invitation Let's get into the first section, Creating Users. When you want to create users through the admin console there are three ways to do that. One is either by invitation, the second, manually, and the third, in bulk. In the coming clips we'll take a look at all these three methods, and in the end compare which method is suitable in which case. Creating a User by Invitation. After I was done with the last module I called up Mark, who is the CEO of the company, and updated him that design of process was successfully completed, after which, he calls me up and tells me, hey Kunal, do you have my account ready? I say, no, I'll need your email address for that, so he says sure, it's markgigadragon@gmail.com. Well that's kind of embarrassing, but we've all had embarrassing email addresses at some point of time right? It would be fun if you could comment your embarrassing email address in the discussion section. What I do is after he sends me his email address I respond back to him, thanks, I'll send you an invite. Here in this demo let us send an invitation to Mark, so that he can create his own user account. Here we are back in the admin console, and now let's try to create a new user account for Mark by invitation. Guessing where you would have to go among these icons I think the obvious choice is Users because we are creating a new user account, so let me click on that, and go to the user section. Here you can see there's only one account currently active, which is my own. This was created during the signup process, so what I'm going to do is I'm going to now create a new user account for Mark by hovering my icon over the plus sign over here you can see that there are three options. One is Invite users, the second, Add multiple users, and the third, Add user. Now since we are inviting Mark I'm going to click on the first option here, Invite users. When I do that a form pops up in front of me. It says, who would you like to work with? When you invite a person using this form they'll be invited to create a new user account on @serverbaba.com domain, and for the user to receive this invitation I'll have to enter his or her email address over here, so let me go ahead and do that. I think his email address was markgigadragon@gmail.com, and then Continue. Now here is a default template message that'll be sent to Mark. It says, I'm helping our business work better with Google Apps. It would be great if you could join me. That's good. I don't have to type out a new invitation, that saves me a little time, and then I'll go ahead and click on Send invitation. It says, Congratulations! You have successfully sent invitations to the following people. Now let us try to see how it looks on Mark's site when he signs up using this invitation. Let me click on OK before that. This is what the invitation in Mark's inbox looks like. This is the signup form that Mark sees once he clicks on the sign up now link in the email, so let us assume we are Mark for now, and fill in the details, so that we can create a new account for Mark. First name, Mark, followed by the surname, Scott. Username, mark @serverbaba.com, and let's choose a password. Oops. (Typing) Okay, and confirm the password. Now let's click on Next. Here it'll give me a page with all the Google's terms and conditions of service, so I'm going to read that, and then click on I accept, continue to my account. You get a Welcome screen, it says welcome to Google Apps, let's get started, so if I click on that it'll give me a little tour, but then I don't want to do that right now, I'm going to click on the cross. Here you can see it says, Hi Mark, and you have all the services listed on the homepage, so you're going to go right in, get started with nay service that you want to, let's say let's get into the inbox Gmail. Here's Mark's email inbox, so this is how the process of creating a new user account by invitation looks like.

Creating a User Manually Creating a User Manually. Now after Mark completes creating his own account he sends me an email saying, Thanks, I made my account. Could you now make Heather's account? She'll give you a list of all other users. Heather is the VP of HR. I say, Sure, I'll make her account and then the others. Now let us try to create Heather's account manually. Here we are back in the admin console, and I'm pretty sure you must have guessed by now where we'll have to go to create a new user account for Heather, so let me go to Users. You can see that there are two user accounts now, one, which was already created, that was mine, and in the last demo we created a user account for Mark, so now to create a new user account for Heather I'm going to hover my mouse over the plus sign over here, and click on the third option, which is Add user. Here it'll give me a form that I can enter the details. First Name, Heather, Last Name, Admin, and her primary email address would be heather@serverbaba.com, and when it comes to password there are two options. One, I can either let Google Apps choose a temporary password for me or I can set a password manually. I think a temporary password sounds fine for now, so I'll leave it as it is. If I click on Additional Info I can add in additional information for the user, like second email address, phone number, a street address, and so on. I'll probably not do that right now, I'll go to Previous, and create a new user account only with this information, so click on Create, so it says a new user has been created. They can sign in to ServerBaba services by going to this URL, the user name is this, and the password is this, so if I click on Show Password it'll show me the password, so if I want I can either note this password down, and then pass it onto Heather or I can send an email with this login information. It's my choice, so what I'm going to do is I'm going to note these login details in a paper, and then pass it on to Heather, and then click on Done. You can now see a new user account for Heather has also been created.

Creating Users in Bulk Creating Users in Bulk. Now Heather logs into her account, and then sends me an email saying, Thanks, Kunal. I respond back by saying, No problem, but could you fill in the details for other users in the attached csv file, and send it back? Now since Heather is in HR she has the information about all the other users with her, so I ask her to pass that information on in the format of a csv file. She says, absolutely. Now let's take a look at how we can get a hold of that CSV file that I was talking about, and pass it on to Heather, so that she can fill it in, and then pass it back onto my, and once I get it back how I can create new user accounts out of that csv file. I'm back in the Users section of the Admin console, so again I'm going to click on the plus symbol here, and this time I'm going to click on the second option, which say, Add multiple users. Let me click on that. It says Add multiple users. Here it says Download as a .csv file. Now we can download this csv file, pass it on to Heather, so that she can fill in the information about the users, and give it back to me. Now so that I understand the format of this csv file better I'm going to click on Pre-populate with existing users, so that you don't make a mistake, and you exactly know what to fill in in the csv file. I'm going to click on the download button, DOWNLOAD AS .CSV. It says the download has been initiated. Okay, the download is complete. Now let me open the csv file and see how it looks. To do that let me click on the file directly from here. Okay, so you can see that the csv file has been opened in Microsoft Excel, and it has a few pre-populated fields. I'm going to expand them. The First Name, Last Name, Email Address, and the Password, so this is the format I'll have to fill in the information for the remaining users, so that I can go ahead and use this to create their accounts. What I'm going to do is I'm going to pause the video here, fill in the details, and then resume the video. Here's the information that Heather has filled in the csv file. Up until now we have created three users, one was mine, the second was Mark's, and the third one was Heather's. The remaining users were Jim, Lisa, Steve, Chris, and you. Remember, you and I are in the IT team together, this is your account. The First Name, Last Name, Email Address, and the Password fields have been filled in, and remember, the password needs to be of eight characters or you will get an invalid password when you upload the file. This looks good. I'm going to make use of this file, which was filled in my Heather to make this new account in the admin console. I'm back here in the Admin console. I'm going to click on the Attach File button. You can see the file is over here in My Documents, I'm going to select that, and hit on the Open button. See it says this file has been selected, good, click on Upload. Okay, so you get the message, Adding 5 users. Full report will be sent to my email address when it's complete. That's good. Now let's wait for a few seconds and see if that happens. I think in the meantime I'll open my inbox to see if I get that message, mail.serverbaba.com. Looks like there's no email yet, so I'm going to pause this video, wait for the email to come, and then resume. Let me hit on the Refresh button to see if I have any new email. Looks like I do not have an email. Let me check if there's something in the Admin console. Okay, okay so I can see that the new users are appearing here under the Users in the Admin console. You can see Chris, you can see Jim, you can see Lisa, Steve, and your account, so maybe the email is taking a little bit of time to come into my inbox, but you can see that users have been created.

Summarizing Methods for Creating Users In the last three demos you saw that there are three ways to create new user accounts through the Admin console. One was by invitation, second was manual, and the third one was in bulk. Now let us try to compare these three methods, and see which one suits in which situation. Talking about the first one, the invitation, I'd suggest using this for top executives, so that they get the freedom to choose their own username. The second advantage is that it is super quick to implement. You saw that all you had to do was enter an email address, and Google would send a pre-defined template to the user to create a new account. Now the cons of this method are you do not have control over the username, so the end user is free to choose any username that they want to. The next disadvantage is that this invitation, if not accepted within 30 days, expires. Now the second method, manual, the advantage of this is it's really suitable for a few users, and simple to implement. All you have to do is enter the first name, last name, and email address, and Google will again, generate a temporary password for you if you want to, and boom, the user account gets created. Now the cons of this method, one, it's time consuming when you want to create a large number of users, and chances are that when you're trying to create multiple users using the manual method there is a slight probability that you might go wrong somewhere, and finally, the bulk method. This is really suitable when you have a large number of users, you saw that. You could fill in the information in the csv file, and Google Apps will read that csv file, and create all the users for you. The cons is that you will need to use a csv file. Using a csv file does not make sense when you have less number of users, so the third one is only suitable for a greater number of users, and remember, these three methods are accessed and implemented from the Admin console. There are a couple of more ways to create new users outside the Admin console as well. We'll talk about it in the coming modules.

Assigning an Admin Role Now moving onto the next section, Admin Roles. Here you will learn how you can grant administrative privileges, either partial or complete, to other users in your organization, so that you can delegate administrative tasks to them. This would be helpful particularly if you are either out of office or unavailable for any reason. Assigning and Admin Role. You get access to your inbox, and then send me an email. Because you belong to the IT team you ask me, Hey Kunal, how do I get administrative access to Google Apps in case you're out of office and I need to get something done? I respond by saying, let me take care of that right away. Here in this demo I'm going to grant you the permission to take care of the user management tasks for our environment. Here I am back in the Admin console. Now to give you administrative privileges for user management there are two ways that I can go about it. One is either by going to Users, and then clicking on Your Account. Once that opens up I can scroll down over here, I can see all the user properties associated to your account. Now when I click on Show More under Security I have this, which says, 0 Admin roles and privileges. I'm going to click on that. Now when I click on that I can click on Manage Roles button to assign you a role, so what I'm going to do is since you will now be responsible for user management I'm going to check this box, which is, User Management Admin. With this privilege you get administrative access to create, delete, and update users, so this looks good for now. Let me click on Update Roles. Awesome. It says Roles successfully assigned to the selected user. You should now have admin privileges for user management. Another way I could have done this was by going to the Home of the Admin console, scrolling down a little bit, and when I click on More Controls you can see I have more options over here, out of which the second one says Admin Roles. If I click on that this page should open up. Now here you can see all the different types of administrators that I can have in my organization. One is a Super Admin, that's only me right now. Now because I want you to be a User Management Administrator I'm going to click on that, and when I click on that I could have used this button to assign administrators to this User Management Admin role, but since we have already done that let me click on Cancel, and you can see to verify that you are already here under the User Management Admin.

Creating a Custom Role Creating a Custom Role. Now Heather has a new requirement. She sends me an email asking, Hey Kunal! I need the ability to stop or freeze a user account in case there's a direct instruction from the management. Is that possible? What Heather's asking me for is only one capability, to suspend or freeze an account. She does not want any other privilege like creating a user or deleting a user or resetting the password, nothing else. All she wants is the ability to freeze an account. Is that possible? I say, Yes, Heather. That is possible. Let me configure that and get back to you with an update. Now since Heather's requirement is a little different, and there's no pre-built rule which satisfies her requirement, what I'm going to do is I'm going to create a custom role, and then add Heather to it. Now let us try to create a custom role for Heather. Now since we're using the Admin role quite frequently let me drag this right here, so that it is convenient for me to access. Minimize this. Okay. Let me rearrange this first, Company profile, then Users, then Admin roles, and click on that. In the previous demo we saw at a very high level what User Management Admin was. Now if you want to see the exact details of what privileges each type of admin has I can go to this tab that says Privileges. I have selected the Super Admin, and then if I click on Privileges you can see the list of things that the Super Admin has rights on. He has full control over organizational units. If I expand this you can see he can Create, Read, Update, and Delete organizational units, and then if I expand users he can Create, Read, Update, Delete users, so basically you can see all the checkboxes here are selected, which means that the Super Admin has full control over everything in Google Apps. Now let's go to the User Management Admin that we just assigned in the previous demo, and see what privileges does the User Management Admin have. Here you can see that the User Management Admin only has Read control over organizational units, and full control over users, because that is exactly what the name says, user management admin. Let's see if he has control over anything else. Nope, not on the Groups, not on Domain Settings, and neither on any other thing. The only thing that User Management Admin can do is fully manage anything and everything that has got to do with users. Now to create a custom role I'm going to click on this button on the top which says, Create a New Role. I'm going to name it Suspend Only because I want Heather to be only able to suspend user accounts, and not do anything else, so I'm going to give a little description if you want. I'll just skip this for now, and click on Create. That gives me a little popup about the API access. I am not going to use the API access for now, so I can just skip that, and now it'll ask me what privileges do I want to give to the Suspend Only admin? For that I can expand Users over here, scroll a little bit down, you can see that none of the checkboxes have been selected. I don't want to give Create, not Read, not Delete, I think there's some options under Update. Let me expand the Update, and scroll a little bit down. Let's see if we have a suspend option. Rename, no, Move, Reset, Force Password, Add/Remove Aliases, no. Suspend Users, here it is, so I'm going to click this checkbox, and just verify if I have done this correctly. If I scroll down under users the only permission Heather has is Suspend Users. You can see this is a green checkbox, and I'm going to click on Save. Okay, so it says the Suspend Only has been created. Let me verify this by again, refreshing the page and going to Suspend Only, and seeing what the privileges are. It says under Organizational Units, Read, that's fine. Under Users it should only have one privilege, which is Suspend Only. Awesome, so it looks like this should work, and our Suspend Only role has been created, but there's one thing we haven't done. Do you remember what? The role has been created, but if I click on Admins there's nobody assigned to this role currently, so I will also have to add Heather to this role. Now under Administrators I'm going to type Heather's email address, heather@serverbaba.com, and click on Confirm Assignment. Okay, it says Admins successfully added to the Role: Suspend Only. You can see Heather's name has been populated over here, and her email address, so we've successfully given Heather the permission to suspend user accounts.

Types of Admin Roles In the previous two demos you learned how to assign a user to a specific admin role, and create a new custom role from scratch, but if you did observe carefully there are also four other roles that we didn't talk about. Now these roles are called Pre-built administrator roles or system tools. What we have setup under now is one, I'm the Super Administrator because I'm the one who signed up for the entire account, and have full control over our Google Apps environment. Next, I signed you the User Management Admin role, so now let us try to understand what the other roles that are there in Google Apps do. The Groups Admin is responsible for creating new groups in the admin console, adding members to the group, managing the access settings for the group, and deleting members from that group. Apart from that, a Groups Admin can also view the organizational units that are present in the organization. If you don't understand what exactly groups and organizational units are just remember them for now, we'll discuss them in the next module. Then next, the Help Desk Admin. He or she is responsible for password resets, that's pretty much it, so whenever a user forgets his or her password they call up the help desk guy, and then tell, well I've forgotten my password, and what the help desk guy does is they reset the password, and now the new password is passed onto the end user, so that they can login back into their account. Next, the Services Admin. This guy is responsible for turning on services or turning off services in your organization. You will understand more about services when we discuss services in the coming modules, and finally, the Reseller Admin. Now a Reseller Admin is someone who manages your Google Apps account on your behalf, so depending on how big your organization is you might want to delegate our specific tasks out to individual admins instead of you having the whole, sole responsibility of your entire account.

Adding an Alias Moving onto the next section, Using and Alias or also known as a nickname. Now an alias is basically nothing but a duplicate name, which refers to the same person or an entity. Now let us try to understand why creating an alias in Google Apps could be useful. Adding an Alias. Now Lisa, who's the VP of legal sends me an email saying, Hey Kunal! A lot of people try to send me an email on liza@serverbaba.com instead of Lisa, and end up with a delivery failure. Can we catch that? Now I'm assuming because Lisa is also known as Liz in the office a lot of people, by mistake, send her an email on Liza. I'm just guessing, so I respond her back saying, Yes, Lisa. Let me fix that for you. In this demo let us add an alias to Lisa's account, so that any email sent to Liza or Lisa both get to her. Here's the Admin console. What I'm going to do is I'm going to click on Users. You may notice something different. I've added pictures for all of these users, just so that things look a little better. Now to add an alias I'm going to scroll down and go to Lisa's account. Click on that. Here are the properties for Lisa's account. Now let's try to find if there's an option for alias. Let's read Account, View and manage profile, security, and aliases. Well, that's it. I'm going to expand that, scroll down a little bit, and you can see there's an Aliases option, so lisa@serverbaba.com already exists. Now what I have to do is add an alias. Click on that, scroll down a little bit more, and type in Liza because emails sent to Lisa are already being received by Lisa. What she's not getting are the emails which are inadvertently sent to Liza, so now that I've added an alias I'm going to click on Save. It says, Changes to this user have been saved. Now there's this primary address, and then there are two aliases. This alias is automatically created by Google Apps on the temporary domain that was assigned to us before we added our serverbaba.com domain, so now emails send to Lisa or Liza. Both should go to Lisa's inbox.

Uses of an Alias In the last demo you saw how we created an alias for Lisa, but what you have to understand here is that an alias is simply an alternate pointer with a different name pointing to the same inbox, which means if Clark Kent had an account on serverbaba.com adding an alias to his account would also enable you to send emails on superman@serverbaba.com. The inboxing question is only one, but with two different names. You should also know that an alias is only used for sending emails. You cannot use an alias for signing in or granting permission to data or other objects in Google Apps, and you're not limited to adding just one, but you can add up to 30 aliases for each user in the organization, and the good news is that an alias does not use an additional license, so although there are two different names with which Lisa can receive emails, those do not count as two different licenses, they are simply one single license.

Resetting a User Password Here is the next section, Resetting Passwords. Users forgetting passwords in an organization is one of the most common problems faced by IT teams, and the solution to users forgetting their password is either they try to recover it themselves, but if they aren't able to do so they ask the IT admins to do so, and we as administrators go ahead and reset their passwords and pass them onto the user, so that they can then login to their accounts. Now let us try to understand how resetting passwords works in Google Apps. Resetting a User Password. What Steve does is Steve calls you up, yes he calls you because you're also the User Management Administrator remember, so he calls you up and says, hey, I changed my password last night, and forgot what it was this morning. Could you retrieve it for me? Now you should know here that retrieving a password in Google Apps is not possible, so you reply back saying, unfortunately, I can't retrieve your old password, but what I can do is set a new one, and give it to you. Does that work? Steve says, sure. Now if you have a spare Google Apps test environment that you can play around with I want you to first pause this video, go there, try to see if you can successfully reset a user's password, and if you can, then come back to this demo or if you do not have a spare account, simply follow the demo. Since I'm doing this demo from your perspective what I'm going to do is I'm going to login to the Admin console from your account, so let me click on this bookmark here, enter your primary email address, which is you@serverbaba.com. Type in the password. If you remember, the password from the csv file demo was abcd@123 and click on Sign In. It'll again, give me the terms and conditions for users of the account. I'm going to accept and continue to my account. Now because that password was preset by the administrator, and because this is the first time you're logging into your account, it'll ask you to change the password. Let us change the password, and set it to something (Typing), and Change password. It will redirect me to the Admin console now, and this is what the Admin console should look like to you. Okay, so the Admin console kind of looks empty here. That's because you only have User Management Admin privileges. You do not have full control, you are not a Super Admin. Because I was the Super Admin I could see other stuff in the Admin console as well. Let us try to see if there is anything under More Controls. Nope, nothing here as well, so you only have control over Users, and that's the icon over here, so now let us try to go to Steve's account, and see if he can actually reset his password. Let me click on Users. Okay, so I can see Steve is over here, and I'm going to click on Steve's account. Here are the properties for Steve's account. Now let us see where the password reset option is. Uh, it does not look here, but I know it's kind of in the corner, so you'll have to find, but let me directly tell you. It's actually over here you know, because that is one of the most common tasks that you perform, it's put right on top. If I click on the Reset password icon a form will come up, so I can either auto-generate a new password, which I can pass it on to Steve or I can set a password manually on my own, so I am going to do that, type in a new password, retype the new password. It says this password strength is strong, that's good, and then I'll request Steve to change the password when he next logs in, and then click on Reset. Awesome, so the password for Steve has been reset. Then let me click on Done. You would now go to Steve and tell him what the new password is.

Ways to Reset a Super Administrator Password In the previous demo you saw how simple it was to reset a user's password, but things are a little different when you have to reset the password of a Super Administrator which, in this case, is me. Now let us see how that works. Let me first list out all the users who have some sort of admin privileges in the organization. I am the Super Administrator, you are the User Management Admin, and Heather has Suspend Only privileges, so when Heather forgets her password, well that's pretty simple to solve, I and you, both of us can take an action to go ahead and reset Heather's password, but what happens when you forget the password? Well, this is still not complicated enough because although Heather cannot reset your password because she only can suspend accounts, but I on the other hand can reset the password for you, but the real problem is when I forget the password. Well any idea what would you do in that case? If you think that because you are the User Management Admin you'd be able to reset my password, well that does not work. A User Management Admin cannot reset a Super Administrator's password. A User Management Admin can only reset password of other user's in the organization, so what would you do in this case? Let's take a look at that. Now a Super Admins password can only be reset by another Super Admin, so if there were two Super Admins in our organization I could have asked the other person to reset the password for me, but since we have only one Super Admin this will probably not work, and that's why it's very important that you fill in the recovery information like alternate email address that we filled in during the signup process and your phone number, so that Google can verify your identity, and in case, help you regain access to your account, but let's assume that you do not have access to either the email address or the phone number that you gave during the sign up. The last resort that you have is a domain verification method. Here you add a DNS record in the DNS panel of your domain to verify that you want to recover your account. Another important point is that if you have more than three Super Administrators or more than 500 users in your organization, a recovery by email or phone number will not work. Since you have other Super Administrators there's always a possibility that you can take their help to regain access to your account. It's kind of a security measure to ensure that a disgruntled ex-employee who was a super admin will not try to regain access to his account, and cause any harm to the organizations data.

Resetting a Super Administrator Password Now let me try to show you what'll happen if I forget my own password. It seems that I'm not able to login to my account. It says, no matter what password I enter, the email and password you entered don't match, so let's see if there's any other way that I can try to regain access to my account. I can see there's a Need help? Let me click on that and see if there's anything over here. Now it says enter the last password that you remember. Well, I don't remember any password. I'll say I don't know. It says, reset your password using the verification method listed below. Confirm access to my recovery email address, so you now understand why I was emphasizing on ensuring that the secondary email address that you enter during the signup be valid. Now let's assume I don't have access to this email address, so you can see there's a little hyperlink here which says, Reset your administrator password by domain verification. Let me click on that and see what happens, so this page says that using this method will require access to the DNS. That's fine. I have access to the DNS, and add a CNAME record. That does not sound like a problem, and it says, please consider contacting other admins in your domain before proceeding. Well since I'm the only Super Administrator there are no other admins to contact, so I'm going to click on Proceed. On this page Google asks me for a valid email address outside of serverbaba.com, so that it can send the password information to this address after the domain verification process is complete, so let me enter an email address that I have (Typing), @live.com, and hit on Continue with domain verification. Now here's what I have to do in the DNS. Sign in to the domain host, which is GoDaddy.com, and then follow instructions to create a CNAME record. Use the following unique code for the record, and point it to google.com, so I'm going to add a CNAME record with this value in the DNS, so that if I was at this URL I'll be redirected to google.com. You could also read that it says this process can take up to 48 hours for the DNS records to propagate through the DNS servers, so once I complete these steps I can click on this button, I've completed the steps, continue, but since I have not really forgotten my password I'll not go ahead with this, but you know how to do this just in case.

Suspending a User Account Suspending Users. Sometimes there are situations where you do not want to delete a user's account because you also lose all the associated detail with it, but at the same time you also want to ensure that the user cannot login to the account, and change anything that is there, which means you want to completely freeze an account. In that case, the option that Google Apps gives you is to suspend the user's account. Now let's see in a little more detail what happens when you do that. Suspending a User Account. Jim, who's the VP of product sends me an email saying, An intern - Alan, that was hired for summer internship is now going back to college, so is there a way to keep his data intact in case we choose to retain him, but at the same time we also want to ensure that he is not able to login to his account when he is in college. Is there a way to do that? I say, sure, we can suspend his account in this case. In this demo let us go ahead and suspend Alan's account, who was just a summer intern, until a final decision is made if he's going to be hired permanently or not. As you know by now, again, we'll have to go to Users, and then search for a user named Alan, okay, it's right here, so this is the Alan that Jim was mentioning who was a summer intern. Now we'll have to go ahead and suspend his account, so let me click on him. here at the User properties for this account you can see that the email address is alan.harper@serverbaba.com, so to suspend his account you'll have to hover your mouse over these three dots, and here you get an option to suspend the user. I'm going to select that option. Now it'll say, when you suspend Alan he'll not be able to login to the domain or access any services, but at the same time, the data will also not be deleted. Everything will be frozen. Alan will also not be able to receive any new emails sent to him or any calendar invites, and a user license fee will still be applied because his data is still intact, so once I've read this, and I'm clear what I am exactly doing I'm going to suspend the user. You can see it says, alan.harper has been suspended. You can see that the status over here says suspended. This rectangle which was previously white has turned into gray. There's an exclamation mark on the top, which represents that the account has been suspended. Now let us try to see what happens when Alan tries to login. Here I am. Let's assume I'm Alan, and I'm trying my password to login, and see what happens. You're given an error message that says, account access temporarily disabled by the administrator.

Properties of a Suspended Account Attributes of a Suspended Account. In the previous demo you saw that an account was suspended by an administrator, but there are possibilities where an account is directly suspended by Google. That could be reasons like violation of terms of service that was accepted during the first login. There was a case in my previous company where a user, in a hurry, entered the wrong year of birth, which made them less than 12 years of age, and one of the terms of service that Google has in place is that you have to be at least 13 years of age to use a Google Apps account. Now I'm pretty sure very few of us actually know that because well, we're generally all over the age of 13, but since he entered the wrong year of birth his account was automatically suspended because he violated the terms of service of Google. In that case, I had to go in and manually change his year of birth, and unsuspend his account. When you suspend an account the account is completely frozen. The user cannot login, he cannot receive any new emails or any new calendar invites, but the documents that they uploaded and shared with the other team members stay the way they were. If required, this account can be restored at any point of time, and the account will continue exactly from where it was left off. Now some people would argue, well instead of suspending an account, why can't you just reset the password? Well there are a couple of reasons for that. One, when you reset the password the integrity of the user account from the user perspective is lost because the user cannot be sure when the password was changed, was it accessed by someone else? Secondly, when you reset the password all the new emails and calendar invites are still being sent to that account, so if the user logs in after let's say a certain amount of time he'll be overwhelmed with a whole bunch of emails and calendar invites that were not responded to, so that is why suspending an account sometimes makes more sense than simply resetting the password to an account, which is inactive. The only problem with the suspended account is that it still counts as a license, so although you are not using this account, this account is frozen, it still counts as a license because Google preserves all the data for the account, and you end up paying for this account every month, so having a large number of suspended accounts is not recommended because they'll only add to your cost, and not yield anything productive.

Consequences of Deleting an Account Deleting Users. Employees come, and employees go, and when employees go you have to reclaim any important data that might be present in their account, and delete their account altogether, so that you can get back the license that was assigned to them, and reuse it for someone else. I know you were probably expecting a demo at this moment, but then since deleting an account is serious business I want to make you aware of the consequences of deleting an account. First, when you delete an account it deletes everything. It wipes out any trace of the account existing whatsoever, so that is why it makes sense to download and archive or transfer ownership of any important data, which was present in the account to be deleted. Also, make sure to check non-core services like YouTube. One of my friends who was working in a startup deleted the account of a social media manager who was also the owner of a YouTube channel for their company, so although there was nothing important in his inbox, but they lost the entire YouTube channel because he was the whole sole owner of that YouTube channel. The advantage of deleting an account is that you free a license that can be then reused or be assigned to someone else, and we all make mistakes. It's completely understandable if you've deleted an account by accident, and that's right, Google gives you a five days recovery time to recover any deleted account. Once those five days have passed, then there's absolutely no way you can recover the account in question. Even Google will not be able to help you out with that, and if you do choose to recover an account after it was deleted you should know that Google does not guarantee 100% data recovery. There is a possibility that some of the data, which was deleted may not be recoverable, and that is why Google and I both recommend that you create a policy for deleting and restoration of accounts, like a checklist that you go through before you're deleting or restoring an account. It could be like, first check the username, transfer any important data, check non-core services, add a reminder in your calendar for five days just in case you want to recover that account in that time, confirm with the new owner to whom the data was transferred, and if they're able to access it the way it is expected to, and then if everything is working as expected, then you can go ahead and delete the account, and similarly, you can create a checklist for restoration as well.

Deleting a User Account Deleting a User Account. Jim again emails me saying that, turns out Alan is not coming back. You can go ahead and delete his account, and whenever you get an instruction to delete an account you have to reconfirm asking them, are you sure? All the data will be lost. Once that he confirms saying, yeah, there's nothing important in his account, you say, okay, I'll delete his account. In this demo let us delete Alan's account. I'm back in the Admin console. Now I'm going to go to Users and try to find for Alan's account that we suspended in the last demo, so you can see there's Chris, Heather, Jim, oops, I'm not able to find Alan's account. Now you might be confused. Well where did Alan's account go? That's because on the left if you see there's a filter. Now this filter is only listing the active users, so I'll have to select this dropdown, and click on the Suspended users list. When I click on that you'll see that Alan's account shows up. I'll click on this to open up the user properties again, and then again, click on the three darts. Here you can see there's an option to delete the user account. I'm going to click on that, and when I do a confirmation window pops up. It says, before deleting this account you have the option to transfer data associated with the account to a new owner, so if I want I can select this checkbox to transfer all the data in the drive. I can select this checkbox to transfer all the data in any Google+ pages that were being managed by this user, and then transfer them by clicking this button, which says, Assign a New Owner For This Data, but since Jim already said that there's no important data in Alan's account I can uncheck these boxes, which means I'm not transferring any data from Alan's account, and I'll directly Delete Account Without Data Transfer. I'll click on that. It says the user account has been deleted.

Summary It looks like we've reached the end of this module. That was a long one. Now let's try to summarize what we learned in this module before we forget. What we learned in order was first, how to create users. You saw there were three ways to do that, one was by invitation, second one was manual, and the third one was in bulk. After which, we learned about admin roles. There were six types of system roles or pre-built admins roles, and you also saw how you can create custom roles from scratch. After that we learned about aliases, which are basically alternate names that appears in the same inbox. Then you learned about resetting passwords either for end users or Super Administrators. Then we suspended accounts. Remember Alan, who was a summer intern, we suspended his account, after which we also deleted the user account, and learned about how we can transfer or archive the data or create a policy around deletion of users. You should also remember that if you ever want to recover a deleted user you have to do it within five days, after which, nobody will be able to help you out. Now one task that I have for you after this module is we've seen right from creating to deleting a user, but how would you go about renaming a user? Let me give you a scenario. Now let's say someone gets married and they change their surname, so there is a need to change the surname. I want you to do a research on how you would go about renaming a user. In the next module, Managing Groups and Organizational Units, you learn how you can group your users together, and configure services based on the organizational units they belong to.

Managing Groups and OUs Agenda Alright, so welcome to the fourth module in this course, Managing Groups and Organizational Units. Up until the last module we created a whole bunch of users, but the problem there was they were not really organized, so what we'll do in this module is that we'll clear the hierarchy, and then categorize a set of users into groups and organizational units. The benefits of doing so are that you can then collectively manage a whole set of users instead of managing each user individually. You can also grant different permissions to different groups of users or apply different settings to different users or give access to different services or apps depending on which group of users need them, and which group of users don't, so let's take a look at how that happens. Here's what we will learn in this module. First, I'll talk about the two different type of groups that Google Apps allows you to create. One is the admin managed group, and the other is user managed group. After that we'll learn about organizational units, how they differ compared to groups, and what are the use cases of groups and organizational units? Then, we'll learn about managing services, settings, and applications based on organization units, and finally, we'll summarize the module. All the topics that we cover in this module weigh about 20% of the certification exam, so again, pay attention, and revise if needed.

Creating Admin Managed Groups Let us jump right into the first section here, Groups, and try to understand the different type of groups that you can create with Google Apps, what is the difference between the two, and which one to use in which case? I get up early in the morning to see an email from Mark, which says, Quarterly strategy meeting tomorrow at 9 AM, please be there, and when I carefully observe the to field of the email I can see that Mark had to individually type out each persons address to send them this email. Now I figure that this is not the most efficient way of sending an email to a group of users because being a good IT admin is not just being able to fulfill your users' requests, but also being able to foresee what changes or improvements you can make in your environment to make your user's life better, so what I'm going to do is from the next time Mark needs to send an email to all of us, it should be easier for him to do so. That brings us to Creating Admin Managed Groups. What happens today is when Mark wants to send an email to all the VPs he has to type out each address individually in the to field of the email, and since I said this is not the most convenient way to do so, let us see what is. Now to make this process easier, what I can do is I can create a group of all the VPs, and collectively represent them using a single email address, which is also called the group email address. Now since the CEO and the VPs together from the executive team, I could probably name this group email id executives@serverbaba.com, so from now on whenever Mark wants to send an email to all the VPs instead of typing each address individually he can just send an email to executives@serverbaba.com, and all the VPs will get his email, and while we're at it, since we are already talking about group of users, why not create a group called product@serverbaba.com for Jim, so that he can send an email to all the developers in his team or how about creating a group legal@serverbaba.com for Lisa, so that she can talk to her team members more efficiently or let's say finance@serverbaba.com because Steve is the VP of finance. Similarly, hr@serverbaba.com for Heather, and marketing@serverbaba.com for Chris, but that's not exactly what we'll do. What we'll do for now is we will create four groups for executives, legal team, the finance team, and the HR team, but not for the product and the marketing team. You'll understand in the later part of the module why I'm doing so, but for now we'll only create these four groups, and plus another group, support@serverbaba.com for the two of us, so that whenever users have any technical queries they can send an email to support, and we both get that email, and anyone among us who's free can respond to that. Now let us create the five groups that I talked about, executives@serverbaba.com, support@serverbaba.com, legal, finance, and hr@serverbaba.com, so here's the Admin console again. Let me see if I can find an option to create groups. I don't see any right now, so maybe it's under More Controls. There you go. Here's the option to create groups, and since I'll be using this icon a lot I think it'll make sense to drop it over here, and then minimize more controls. Now to create the groups that I talked about I'll have to go into Groups, which is kind of obvious, and if I go there it says, you don't have any groups. Well that's obvious because we haven't created any 'til now, so what I'm going to do is I'm going to click on this neat little hyperlink, which says, Create a Group. A form should come up on the screen, which will look like this. It says, name of the group, group email address, an optional description, and an access level, so let us fill in this information first. Name of the group is going to be Executives (Typing), Executives Team, the group email address is going to be executives@serverbaba.com, the description, this group has the CEO and the VPs, and then when I click on the dropdown under Access Level you can see there are four options. The first option here says Public, which means that anyone in the organization can join this group, post messages, and view the members list. Now since this group is intended for communication within the executive team, that is the CEO and the VPs, I don't think it makes sense to allow anyone in the organization to join this group, because there can be potentially confidential information being exchanged or sent through this group, so I'll probably not set the public as the access level. Now let me see what the Team says. It says, only managers can invite new members, but anyone in the organization serverbaba.com can post messages, and view the member list, and read archives. This sounds okay, but just in case let's also see the other options that are available. Now Announcement-only says only managers can post messages and view the member list, but anyone in serverbaba can join and read the archives. Now I do not want anyone in the organization to be able to join, so I'm not going to select this, and the fourth option that you have is Restricted, which says, only managers can invite new members, only members can post messages, view the members list, and read the archives, and since my requirement is that only the executive teams be a part of this group, and be able to send messages to each other, the restricted access level setting suits my need, so I'm going to select that. You can see now the access level says restricted, and then if I wanted I could have added all users within the group, which I'm not going to do right now. I'm going to click on Create. Okay, it says the group has been created, that's good, but users haven't been added yet, so what I'm going to do is I'm going to click this icon here, which says, add users to this group, and then type in the email addresses of all the VPs. Let's start with the CEO, Mark, and then Jim, then Lisa, you can see the alias we created also shows up, then Steve, Heather, and finally, Chris. I have the CEO and the VPs added to this group. Finally, click on the Add button. Awesome, so six users added to the Executives Team group, so the team name is Executives Team, the group email address is executives@serverbaba.com, and there are six users in this group. That looks good. Now let us go ahead and create the support group. Let me go back to groups over here, let me click on the plus sign here, which is Create group. Now name of this group is going to be Technical Support Group. The group email address, support@serverbaba.com, description, please contact us for any technical assistance. Oops, let me correct that, yup. Now coming to the Access level over here, now since this is the technical support group for the entire organization I want anybody to be able to send messages to this, but when it comes to joining only you and me are going to be members of this group, so let us see which options suits over here. Public, it says anyone can join, we don't want to do that. Team, only managers can invite new members, but anyone can post messages. This sounds like an option right now. Announcement-only says managers can only post messages, which is not what we want, so let me select the Team. Now it says Access Level Team. That should work for this group, and if I want I can also allow anyone on the internet to be able to post messages. I'm going to select that because just in case people forget their passwords and are logged out of their account they'll probably be sending me an email for password reset from outside the domain serverbaba.com, so I want to allow those messages as well, so I'm going to click this checkbox. You can see that, and then click on Create. It says a group has been created, Technical Support Group, email address, support@serverbaba.com. Now let me go ahead and add you and me to this group. My name, Kunal, your name, your account, and then click on Add. Let me go back to Groups. Now you can see these two groups have been added. Now I'm going to pause the video, follow the same set of steps to create the other groups, and then un-pause once I'm done with that. Here are the six groups finally created, the two that we created before pausing the demo were the technical support group, and the executives team. The executives team's access level was restricted because you only wanted the CEO and the VPs to be able to write messages and join the group. Then the technical support team access level was set to Team, and then also allowed people outside the domain to send an email to us in case they had technical queries or were seeking any sort of support. Now what I've done is I've created three more groups, one is legal@serverbaba.com for Lisa, set the access level to public, so that anyone within the company can send an email to legal@serverbaba.com, then created hr@serverbaba.com for Heather, and with the Access Level Team, and allow people out there on the internet to send an email to this id, because there are people who will write to the HR to be hired by the company, so I'm assuming those people are obviously outside serverbaba domain. Then I created finance@serverbaba.com for Steve, and set the access level to Restricted because I assume the finance team might have sensitive data about the financial numbers of the company. I wouldn't want outside people to be able to join the group or send messages to this group, and apart from these three I also created another group for all the employees of the organization, and give it an email address, company@serverbaba.com, and set the Access Level to Announcement just in case Mark wants to send a companywide announcement to all the employees together, so these are the groups that generally exist in any company. We have created all of them.

Features of an Admin Managed Group In the previous demo you saw we created six different groups with different access levels, and added members to those groups. The four access levels that we saw there, public, restricted, announcement, and team. If you do not remember the difference between them by now I suggest you go back to the video and review them once again. Now let us talk in a little more detail about the features of an admin managed group. Now any group in general is created to facilitate communication with a group of users or a set of users, and when we talk specifically about the admin managed group it is more suitable when it comes to intra-team communication or inter-team communication, and an admin managed group cannot only be used for sending emails to a group of users, but can also be used to share resources like documents on Google Drive or calendars or sites with a group of users, so it's not just for email. One of the top advantages of using an admin managed group is that it supports Google Apps Directory Sync and Admin APIs, so that you can manage your users and groups not only from within the admin console, but also from outside it, like using an LDAP server or a custom user management solution that you may have in place. Finally, to be able to play around with admin managed group you should have a Create the groups admin tool assigned to you or anything higher than that.

Creating User Managed Groups You might remember we left out creating two groups, one for the product team, and the other for the marketing team. Here's why. I send an email to Jim and Chris asking them, do they have any specific requirements when it comes to intra-team communication? They say they have a few things that I could help them out with. How about discussing it over lunch? I say, absolutely. After my lunch meeting with Jim and Chris I understand their requirements a little better, so to give you a gist of what they said was they need a little more intuitive space to interact with their team, a place to discuss their ideas, share their marketing material, make banners, posters, screenshots of the user interface of the product, and stuff like that, and that is why User Managed Group is a little more suited to them than the Admin Managed Group, so let us now go ahead and create User Managed Groups for both the teams. Here we are exactly where we left off in the previous demo. Now to create a user managed group I can either click on this icon over here, which says, View in Groups Services or I can click on this, and then go to Groups. Now this is like the workspace that is given to you for any user managed group. Now if I click on Browse all you can see there are no currently created user managed groups, so I'm going to create one right now for Jim. Let me go back to Home, click on this button at the top that says Create Group. I'm going to fill this in. The group name is going to be Product Team. The group email address, I don't want it to be product-team, I just want it to be product@serverbaba.com, and then a group description if I want to. I'm not going to do that right now. Groups primary language, English (United States), that's fine. A Group type. Now here there are four types of groups that can be created. Now since Jim is in the product team, and he'd like to work efficiently with his team together to work on different types of ideas for the product, like different designs or discuss improvements or features, so I think in that case a web forum type of a group is more suitable for the product team. I'm going to click on Web forum, so you can see it gives you a little description. It says, web forum allows people to interact with the group, and have engaging and interactive discussions on the web. That is exactly what we want for the product team, so after I've selected the web forum I'm going to scroll down. Basic permissions, view the topics, all members of the groups, and all organization members. Now I would want to restrict that. Now I click on this dropdown and then uncheck all organization members, so I want only the members of this group to be able to view the topics in this web forum. When it comes to posting messages, that is sending an email to this group or sending messages to this group, I think all members should be able to send messages to this group just in case they have any feature requests or maybe suggestions or like a bug fix request, and the third setting here, Join the group, only invited users. I don't want any random people to come join the product group, so I think this setting looks good to me right now, so I'm going to click on the Create button on the top, and then this group, which is of a web forum type should be created for the product team. Now that I've created this product team group I can go ahead and invite people to join to the group. Now first person I'm going to join is obviously going to be Jim because he's the VP of product. I'm going to select Jim, and then click on Send invites. Oops, I think an invitation message is necessary. Hello Jim, welcome to your group, and then click on Send invites. Right now we only sent the invitation to one person, which was Jim. I could also send that to the entire product team if I wanted to. On the left you can see that you can scroll through the properties and all the settings pertaining to those groups. If you click on all the members it'll list all the members. Now because I created the group I'm already an owner on this group. Now I can use this form to invite more people to this group. I can then click on Direct add members. I do not want to save any changes. Now if I wanted to add users without them having to accept the invitation I could directly put in their email addresses there that would directly add the members to this group, then click on Outstanding Invites, I don't want to save any changes. You can see that Jim has already been invited, he has not yet accepted the invitation, so it shows pending over here, and then Join requests is of the people who request to join the group, but have not yet been approved. I can click on Messages, Settings. There are a whole bunch of settings you can see. The main ones are over here. Now basic permissions, who can view the topics, who can post, who can join the group? We've configured this when we created the group. Roles, when we click on Rules there are three roles, one is the owner, the manager, and the member. I am the owner. Now what I'll do is I'll make Jim the manager of this group. You can see that all eyes opened up here, now on the members, once Jim has accepted the invitation and become a member of this group I can go ahead and type his name here, and make him the manager of this group. It says, no members found because he has not yet accepted the invitation. I'm going to go back, scroll down here, and under Information, General Information, you can see all the basic information that we filled in when we created this group, so in case you want to change any setting, it's all available right here in the properties of that group. This is a user managed group for Jim. Let me see how the web forum looks. Let me copy and paste this URL into a new tab. You can see here is the web forum. I can start a new topic, add a subject, New Feature Request, then add a little text to it, Hey guys, which features can be added to make our product better? Then post. Then people could respond to this, and then go on, and then the discussion could be carried forward, so you can see how a user managed group is different from an admin managed group. Here you get your own workspace to work together and collaborate. Now similarly, I could create another group for Chris, and the marketing team. I'm going to name this Marketing Team, and the group email address is going to be marketing@serverbaba.com. A description if you want. Scroll down. In the Group type this is going to be a collaborative inbox because Chris needs the ability to work together with his team to see which clients have been approached for a sales pitch, which clients have not been approached for a sales pitch, and so creating a collaborative inbox will ensure that all the team members in the marketing team can see which clients have been taken by which team members. I mean you get the point right? How the sales and marketing teams generally work. Now scroll down a little bit. Participants, all members of this group. That's fine. Basic permission. Again, view topics, uncheck all organization members. I only want members of the group to be able to see the topics. Post to all the members of the company, that seems fine, and join group again, only invited users, so once I've selected all these options I'm going to click on Create on the top, and it says the Marketing Team group has been created. I'll again, go to invite people to join this group, and then invite Chris to join this group by typing an invitation message, welcome to your group, Chris, and then sending the invitation to him. Similarly, all the settings that we saw for the previous group are again, already here, and with that we've created two user managed groups for both Jim and Chris.

Features of a User Managed Group Now coming to Features of a User Managed Group. First, you should also know that a user managed group is also known as Groups for Business, so when you go through Google's documentation there'll be several places where they'll talk about Groups for Business. Don't be confused. When they say Groups for Business they basically mean a user managed group. Coming to the features, a user managed group is more suitable when you need a workspace to work together as a group, and generally this is more suitable for intra-team communication rather than inter-team communication because, as you saw, it is feature rich, which means it has multiple applications. It can either be used as an email list or a web forum for discussing ideas or a Q&A forum for taking care of polls or used as a collaborative inbox to work together as a team. This is something that an admin managed group does not offer, but the downside to using a user managed group is that it does not support Google Apps Directory Sync or admin APIs, which means if you have to manage a user managed group you have to do it from within the admin console. You cannot use APIs or a custom solution or use Google Apps Directory Sync to create a user managed group and, as the name suggests, to play around with the user managed group all you need to be is a user within the domain. You necessarily do not have to have any admin privileges, so the two groups that you saw that I created in the last demo for Jim and Chris, they could have as well be created by Jim and Chris themselves. It was not necessary for me to be involved there.

Need for Organizational Units By now we have a thorough understanding of groups. Now in this section let us try to understand how we can create a hierarchy of users using organizational units, and how it's different from groups, and why it's necessary. Up until now you saw how easy it was for a user to communicate with a set of users either for sending an email or sharing resources using the concept of groups, but when it comes to apps or services within Google Apps, all of them are equally accessible to all the members irrespective of their group membership. This is the default behavior, so when you want to segregate this, and give one set of users' access to certain apps, and at the same time restrict another set of users from accessing those same apps, the concept of groups will not work here or maybe you want to apply different security settings to different groups of people depending on either they work on-premises or maybe if they are traveling, so when you want to do this you cannot do it using the concept of groups, and that is why you categories the users into organizational units. Let me repeat that again. When you want to segregate access to services and apps within Google Apps for different users, you create organizational units, and when you want to facilitate user to user communication with a set of users you create groups, so here's the distinction between the use case of an organizational unit, and the concept of groups.

Organizing Users into OUs Organizing Users into Organizational Units. Now Mark sends me an email saying, good job with the groups, but after we posted our last promotional video for the product on YouTube a few of our product team members got into an online argument. Can we organize users in a way that we can turn on selected services and apps for some, and turn it off for the rest? I say, luckily that is possible, let me create a hierarchy and get back to you. Now you could argue saying that YouTube could probably be blocked at the firewall level. Why do we have to do it within Google Apps? Let me remind you that the marketing team needs access to YouTube, and you just want to ensure that the product team or anybody else does not use official accounts to access YouTube. As long as they're using personal accounts it's their choice, and that is why what we'll do is we'll just make sure that nobody's able to access YouTube with their official Google accounts, so now let us organize our users into organizational units depending on which team they belong to. I'm back here in the home page of the Admin console. Now to create organizational units I'll have to go to Users, and then once this is loaded on the left side you can see, when you see By Organization, there's only one, which is serverbaba.com. Now we'll try to create a tree-like hierarchy below serverbaba.com, and then put users into each sub-organization that they belong to, so to do that let me hover the mouse over here on the three dots, click on that, and click on Add sub organization. Now first I'll create a sub organization for the product team, and say Product Team, and then place this organization under serverbaba.com, and then click on Create Organization. Now you can see that under serverbaba.com the Product Team organizational unit or OU has been created. Similarly, let me repeat this process for the other teams as well, and then un-pause the video. Okay, I've un-paused the video, and now you can see on the left side I have created five sub organizations, the Finance, Human Resources, Legal, Marketing, and the Product Team under the main top of the level, serverbaba.com. Now what I'm going to do is I'm going to add users to these organizational units, so let me go back to the top of the hierarchy, serverbaba.com, and then select users, select Chris, and then hover on this icon, which says, move to another organization, and then move Chris to the Marketing Team. A confirmation window should pop up. Are you sure you want to move Chris to the marketing team? I go ahead and say yes, and then I repeat the process to put all the individual users into their respective sub organizations. Now I have moved all the VPs to their respective sub organizations. Now the only people we have under the root organization, which is serverbaba, are you, me, and the CEO, Mark. Now before I get any further I get an email from Chris. Let us see what that is.

Managing Services by OUs Word spread about the YouTube incident within the company, and maybe Chris called to know that we are doing something about it, so just to make sure he sends me an email saying, Hey Kunal! I've heard you're blocking YouTube and Google+ for all employees, but we in the marketing team will need access to these for our sales and marketing. To which I say, the marketing team will have access to YouTube and Google+, don't worry, and that is the whole reason why we created separate organizational units, so that we can then turn off YouTube for a few organizational units, and then let it be on for the others, so let us go ahead and see how we do this. In this demo let us try to see if we can switch off YouTube for the entire organization except for the Marketing Team. This is where I had left off in the previous demo. I had just finished creating sub organizations for the five teams that we have in serverbaba. Now let me continue what I was doing, and try to turn off YouTube for the entire organization, except for the marketing team. For that I'll have to go back to the Home. I think my session got expired, so let me type in the password and re-login. Okay, so now to turn off YouTube for the entire organization, except for the marketing team I'll have to go into apps. When I click on Apps you'll see that there are nine Google Apps. If I click on that let me see YouTube, if it's here, so YouTube is not here because YouTube is not a part of the core products that you get with Google Apps, so I'll have to back to Apps, and then click on 14 Additional Google services, so when I click on that I should probably find YouTube down here. Here it is. Now, as you can see, next to YouTube here it says it is on for everyone. Now this is the setting that we'll have to change to make YouTube accessible only for the marketing team, so if I hover my mouse on the three darts over here, and click on that you can see there's an option, ON for everyone, ON for some organizations, and OFF. Now I don't want to switch it off altogether, I just want it to be on for some, and off for the rest, so I'm going to click on this second option, so you can now see that there's the root organizational unit, which is serverbaba.com, and all the other sub organizations are under serverbaba, and they have inherited the permission from the master. Now to change this what I am going to have to do is I'm going to have to first switch off the Master setting by clicking here, click on the Apply button. Now it says YouTube will be turned OFF for serverbaba and it's sub organizations, but then you'll still be able to override the settings, and it may take about 24 hours for this setting to propagate. I'll click on Turn Off, so now by turning off YouTube at the root organization I have turned off YouTube for all the sub organizations as well because they inherit the permission from the root organization. Now what I'll do is you can see Finance Team, turned off, Human Resources, turned off, Legal, turned off, Product Team, turned off. That's looks fine, but I'll select the Marketing Team. Now I want to turn on YouTube for the marketing team, so I'll click on the Override button that I see here, and then I can now drag the button on the right side to enable YouTube for the marketing team. I'm going to click on Apply here. Now it says, turn on YouTube for users in the Marketing Team, and the same message that we got previously, I'm going to turn it on, and we are done, so you can see for the root, serverbaba.com it's off. For all the other organizational units in the organization YouTube is turned off, but for the marketing team, if I click on Marketing, you can see it's turned on, and that is exactly what we wanted.

Managing Policies by OUs By now I'm assuming the difference between groups and organizational units is a little more clearer to you, but in case it's not don't worry. I have another example to explain how you can use organizational units. Chris again, emails me saying that one of the sales guys in his team lost his laptop, and unfortunately the password to his Google account was saved in his browser. He's afraid that someone could misuse that information, so I say, thanks for the update. As a precaution, let me reset his password, and enable Multifactor Authentication to prevent any damage in the future. Now again, you could argue that you could encrypt the hard drive in case laptops lost, but that's a different situation altogether. Let us try to focus on how we can prevent someone unauthorized using our Google account by changing policies within Google Apps itself. You already know by now how we reset a user password, so let's just assume we've already reset the password for the user who has lost his laptop, and then we'll go ahead and implement a policy to enable Multifactor Authentication to all the sales and marketing teams in our company. That is because the sales and the marketing team are generally traveling and roaming around with their laptops, so the risk of losing a laptop or misplacing a laptop is the highest with sales and marketing team, so let us implement a policy for them, which will enable Multifactor Authentication. I'm back in the home page of the Admin console. This time around to enable Multifactor Authentication I'll have to go to Security. Now when I click on Security, if I scroll down, you can see under Basic settings it says, set password strength policies, and force 2-step verification. Basically, 2-step verification is Multifactor Authentication, so let me expand that part. Scroll down a little bit, so you can see these are the password settings, the minimum length, 8, maximum length, 100, and if I scroll down a little bit more here is the option for 2-step verification. The checkbox is already selected to allow users to turn on 2-step verification which is fine because it only adds to security, which is always good. Now if I click on Go to advanced settings to enforce 2-step verification it should open up a new page. Now here you can see that for authentication under 2-step verification it says turn off enforcement, and on the left you can see that you can choose an organizational unit to which this setting applies to. Right now the root, serverbaba organizational unit is selected, which means any setting or changes we make over here will be implemented company wide, but since we want to make this change only on the marketing team I'll click on the Marketing Team on the left side. Here under Authentication you can now see it says Inherited. Basically, it's inheriting the permission from the root organizational unit, but we will override this setting. With this turned off right now, I click on turn on enforcement. A confirmation window pops up asking me, do I want to force users to enter a verification code each time they sign in? I click on OK. On the bottom you can see that these changes may take up to 24 hours to propagate, that's fine, and you can see there's a Save button, so what I'll do is I'll click on Save. It says, your settings have been saved, so if I go back to the root organizational unit, serverbaba, I can see that the setting is turned off. For the finance team or any other team the setting is turned off, but when I click on the Marketing Team the setting for Multifactor Authentication is turned on, and that is exactly what I wanted.

Properties of OUs Now let us try to understand the properties of organizational units. As you saw, organizational units are used to control access to services and apps. You can turn on a service for some users, you can turn off a service for some users or apply different security policies for different set of users. Something that you may not not allow is that you cannot just add users to organizational units, but also their devices, so that you can apply different security policies on different set of mobile devices because today in the smart phone generation laptop is not the only device that can be lost. You could also lose a cellphone, which could have all the emails belonging to the company. We'll take a look at this in more detail when we talk about mobile device management, and unlike groups, a user or a device can only be a member or a single organizational unit. This is one way in which organizational units is different from groups. Groups is not limited to a single group membership, so you could probably be a member of the marketing team, and simultaneously also be a member of the product team, but when you talk about an organizational unit you can only belong to one organizational unit. Again, talking about who gets to play with organizational units, it can only be managed by a Super Admin. There are no pre-built admin roles which have the permission to play around organizational units, let it be creating, editing or changing any organizational structure.

Summary Okay, so it looks like we've reached the end of this module. What we learned here is that there are two types of groups, one the admin managed group, which is basic, and the other is user managed group, which is a little more feature rich. Then we also learned the difference between them, we created those groups, added members to them, and learned about the group settings that each of the groups have. Then they also explained the use cases for groups and organizational units, and when would you use groups, and in which cases would you use organizational units? Then we saw the create OUs, manage services and policies built on organizational units, and demos pertaining to each of these scenarios. Now one thing that I want you to do after this module is explore user managed groups in a little more depth. We'll move onto the next module, Configuring Mail Flow. In mail flow we'll see how you can apply different transport rules to incoming and outgoing email of your organization, and configure a white listing or a black listing or various other settings that could apply to the content of the email or how it's routed to the destination.

Configuring Mail Flow Agenda Alright, so welcome to the fifth module in this course, Configuring Mail Flow. Up until now you've finished four modules, which is roughly half way through the course. We have another four modules remaining, including this one. Email, as we know, has been the primary mode of formal communication for ages, and it is exactly the same today, so in this module let us take a look at Gmail, which is the email service of Google Apps. We'll see what kind of settings you can apply or what configuration you can apply to mail flow, either incoming or outgoing, and how you can filter those emails based on rules that apply to either the content or the source or destination or other parameters of the email. Here's the agenda for this module. Like I said, Gmail is the email service of Google Apps, and so this module will be primarily focused around that service overall. We'll talk about various advanced Gmail settings that cover either end user settings and access or, at the mail server level, the span settings, the compliance settings, and email routing. Now even though the agenda looks really short, but there's a whole lot of stuff to talk about in this section. What I'm going to do is I'm going to cover the most popular settings and configurations in each one of these categories, and show you how to configure them, and remember, these topics will cover about 18% of the certification exam, so again, this is a big chunk. Make sure you're thorough with everything that I am going to show you in this module, and the other minor settings that are out there.

End User Settings and Access Let us start off the module with something simple, End User Settings and Access. These settings and configurations are those that apply to an end user mailbox. They determine how the inbox looks, feels, and functions to an end user. Now although there are several settings in this section we, for now, will be specifically interested in two specific settings, one the email delegation, which lets someone else manage your inbox on your behalf, this is really helpful when like the CEO hires a secretary, so that secretary can reply to and respond to emails on CEOs behalf instead of CEO having to go through each every email. Then the next setting that we'll talk about will be disabling automatic forwarding because of the company's corporate policy. What automatic forwarding allows you to do is it allows end users to automatically forward all emails to an external mailbox, which could be their personal account, and we don't want that, so in the end user settings and access section we'll first enable mail delegation, and then disable automatic forwarding.

Enabling Mail Delegation and Disabling Automatic Forwarding Alright, time for a demo. Now let us go ahead and enable mail delegation, and disable automatic forwarding in Gmail's advanced settings. We are back in the home page of the Admin console. Now let me scroll down a little bit, and since you know that Gmail is a service in Google Apps it should probably be under the apps section, so let me click on that, and then you can see there are 9 Google Apps, and then 14 additional Google services, and since Gmail is a part of the core suite it should be over here. You can see it says, Gmail, Calendar, Drive & more, so let me click on this, and there's Gmail. Now to go to Gmail settings I'll have to click on this, which'll open up the Properties page for Gmail. You can see there are a whole bunch of properties, and to expand this I'll click on any section, and when I do that it should open up a new page with all the settings expanded. Now in this module we'll try to go through as many settings and configurations that you see in front of your screen possible. I'm going to scroll back up. Don't worry if you didn't get to see them, we'll cover them in this module. Also, in the last module as we discussed about organizational units you can see that you can apply these things to either the root organizational unit or an individual organizational unit. What we'll do is for now we'll apply all these settings to the root organization unit throughout this module. Let us go to what we were looking for, mail delegation and automatic forwarding settings. This is what we have already done. We have configured custom addresses, we have configured the MX record, that's why email is working, and then if I want I can uninstall Gmail from here, but I'm not going to do that right now, I'm going to scroll down to the End User Settings. Now under Themes you can see that the checkbox, Let users choose their own themes is selected, that's fine because we want our users to have that level of freedom to choose whatever team they want to apply to their inbox, so we'll not change this, we'll let this be as it is. We'll scroll down a little bit. The second setting here says, Inbox by Gmail. From what I've heard is Inbox by Gmail is like a new way to email, but since we are not really exactly aware of how it works, so I'm not going to enable inbox with Gmail, and just scroll down directly below that. Email Read Receipts. Do not allow Email Read Receipts to be sent, that's fine. Scroll down a little bit more now under Mail Delegation. This option says, let users delegate access to their mailbox to other users in this domain. This doesn't affect existing delegations. Now this is the setting I am looking for. I'm going to enable this checkbox, so what will happen when I enable this checkbox is that users who get a lot of emails can delegate their mailbox to other users in the organization, which in turn can manage it on their behalf. This is what the top management in most of the companies do. People like the CEOs or the VPs, they delegate out their mailbox to their secretaries or assistants, so that they can go through all the emails, and filter out which ones are important, which ones are not, and then maybe if there's something that they can respond to on their own they'll go ahead and do that. That's why I go ahead and enable this setting, just in case Mark plans to hire an assistant in the future. Now the next section, if I scroll down a little bit more, you see it says End User Access. Now the first setting here says, disable POP and IMAP access for users. I'm not going to do that because if I disable POP and IMAP access users who use email clients like Thunderbolt or Outlook will not be able to access Gmail using their email client. They'll be forced to login to the web version of Gmail, and that is not something that I want, so I'm going to skip this setting, and move down to the one that I'm looking for, so you can see here this automatic forwarding. Now this checkbox has been selected by default. It says, allow users to automatically forward incoming email to another address. Now this is something that I do not want my users to be able to do, so I'm going to uncheck this box, and since the two settings that I was looking for have been configured, so you see I've disabled automatic forwarding, and if I scroll up I've enabled mail delegation, so what I'm going to do is I'm going to click on the Save button here to save these changes that I've made. It says, your settings have been saved. Awesome.

Spam Settings Now let us talk about how we can tackle the most common problems we face in emailing today, which is spam. I'm sure all of us have gotten emails which say, you've won like a bazillion dollars, please come and collect it, but the truth is, as we know, they're all spam emails or I can at least hope so they are. While we have spam filters fighting against those sort of emails at a default level, you might want to tweak those settings to meet your needs better. If you're still getting a lot of spam emails you can go ahead and make the spam settings a little more restrictive or lower down your spam settings to a little more leisure level, and instruct Gmail how to handle spam. The few settings that I'll walk you through in this demo are first we'll see how to whitelist IP addresses, which means any email that originate from these IP addresses will bypass the spam filters, and will never be marked as spam. This setting is useful when you know that a client is probably going to send you an email, and do not want his email to end up in your trash or junk folder. Then, in case we are using email forwarding, which is forwarding emails to our Google Apps environment, we can configure that using this setting, then we'll learn how to whitelist domains or email addresses and blacklist domains or email addresses. Now the difference between the first, the third, and the fourth setting is that the first one works on IP addresses, whereas the third and the fourth setting works directly on domains or email addresses.

Bypass Spam Filters Setting for Potential Investors Since we are a startup company we are expecting potential investors to talk to us and, if they're interested, invest money in our company, and mark has forwarded me a list of potential investors who may be interested in investing in our company, so what I'm going to do is I'm going to configure our spam filters to make sure that they never mark any email sent from those potential investors as spam. I want all emails from the investors to bypass the spam filter altogether, so let us go ahead and do that in this demo. I'm back exactly in the same place that I left off in the last demo, Advanced Settings of Gmail. Now to configure the spam settings I'm going to have to scroll down a little bit further, a little bit further, and here it is, so you can see that the Spam section is over here. Now to allow our potential investors to bypass our spam filters I'll have to know either one of two things, one, either the IP address from where the emails originate or second, the email domain using which they're going to send us an email, and luckily we already know the domain, I've noted it down over here in a Notepad file, so I'm going to scroll down a little bit, and if I see over here under the Spam section it says, create an approved list of senders that can bypass the spam folder, and under that it says, not configured yet, and on the right side there's a configure button, so what I'm going to do is I'm going to click on the configure button. Now here it requires a little short description, so I'm going to type in that Don't mark emails from investors as spam. This is a little description which'll help you remember what the setting was, and then I'm going to scroll down here, bypass spam filters for messages received from internal senders. That's fine because I do not want emails sent within the company to go through the spam filter, and if I see the setting below that it says, bypass spam filter for messages received from addresses or domains within these approved senders list, so I'll have to add the email addresses of our potential investors over here by creating a new list. Let me name that list first, Investors, and click on Create. Here's the list that I've created, but then there are 0 entries added to that list. Now I'm going to edit that list, and when I scroll down it'll allow me to add email addresses to this list. Now one of the companies that Mark told me was interested in investing in our company was Pluralsight.com, so I'm going to make sure any emails sent to me from this domain will not be scanned for spam, and thereby pass the spam filter altogether, so let me click on the Save button. I can see that Pluralsight is now showing up here, and then click on Add Setting. You can see a new setting has been added over here, and in case you know their IP address, but you do not know the domain they're going to send you an email from, what you can do is you can also add an IP address over here under this section over here, which says, Email whitelist, and luckily I also managed to have their IP addresses, which is this, and put it over here. What we did so far in the demo was any email sent to us from @Pluralsight.com will bypass the spam filter or any other emails sent to us from this specific IP address will also bypass the spam filters. I added this IP address in the whitelist separately because in case the investor chooses to send me an email from his personal address, and not @Pluralsight.com address I'll still be able to get his email delivered to me, provided this is the public IP address of the network he's going to send me an email from. To save these settings I'm going to click on the save button. It says, your settings have been saved. Pretty good.

Compliance Settings Now let us talk about the compliance settings in Gmail. These setting ensure that mails that are sent or received adhere to the organization's corporate policy. There are several settings that you can configure under this section, but for this module we'll be interested in a particular few of them. Let's take a look at them. First, will be restrict delivery where we can confine the scope of mail exchange to particular domains that we specify. The next setting, append footer for disclaimer or do not print messages, so I'm pretty sure you must have seen this disclaimer messages, which is appended to most of the emails that are sent from corporate accounts. This email is for intended recipients only, do not forward, do not do this, do not do that. Appending this footer is important from a legal standpoint, so these are a couple of things that you can configure under compliance settings. What we'll do is we'll first jump to a demo, configure this footer, and then come back and look at the other compliance settings that are available.

Appending Footer to Outbound Emails You saw the disclaimer message in the previous clip. Now what I'm going to do is I'm going to take that exact same disclaimer message, and make sure that it is appended to all the emails, which are going out of the company. In the previous demos you saw the Setup section, then followed by that was the End User Settings section, after which you saw the End User Access section, and finally, the Spam section. Now, let us scroll further down to the Compliance section. Here it is. Now we are here to append the disclaimer message on the footer of all the emails, which are going out of the company, so let me scroll down, and see if there's an option for that. Email auto-deletion, no. Comprehensive mail storage, no. Let me scroll down. Okay, I can see something here, which is Append footer. It says, set up outbound footer text for legal compliance, informational or promotional requirements, so I'm going to configure this setting, click on Configure, it requires a short description of what I'm doing, I'm going to type, This is the disclaimer message. I'm going to add the text. I think it's saved in our Notepad file over here. I'm going to copy this, and then paste it over here, so I made sure that I've customized the message according to my organization. I put in my email address in case anybody has any questions. I've added the line, Do not print unless and until necessary to support the Go Green initiative. I do not want to configure any additional parameters like the background, foreground, size or the font, but in case you want to you can do that. I think the default looks good. I'm going to add setting. You can see now it says, this is the disclaimer message. If I click on Edit it'll show me the message that I saved, and if I scroll down further I can see that I have an option to append the footer to messages being sent within the organization. I don't want to do that because everybody who works within the company already knows what our corporate policy is, so I do not want the footer to be attached to, emails sent within the company, so I'm going to click on Cancel, so you can see here that the setting has been added. Now to save it I'm going to have to click on the Save button over here. Okay, so it says, your setting has been saved, so we are done.

Compliance Settings - Continued Let us continue discussing where we left off in the compliance settings slide. So far I explained what restricted delivery was, and we saw how to append the footer to all the emails going out of the company. Now apart from these two you can also configure settings for objectionable content, so that you can filter emails based on specific keywords that you define. Because you maintain the dignity and the decorum of the company sometimes it's important to filter out emails which could be considered to be explicit or obscene. I hope you understand what I mean. Those kind of words need to be blocked, so you can do that as well from the compliance settings, and then you can go deeper into the content compliance, so that you filter emails not only based on keywords, but also phrases or specific patterns, and you can also apply compliance settings on attachments, which will filter emails based on specific attachment attributes depending on what the type of attachment is or from whom it's coming or whom it's going to, and things like that. I think it's better that I get into a demo and explain you how the content compliance and the attachment compliance settings look like.

Configuring Content and Attachment Settings In this demo I will restrict the user of the word fish in emails exchanged with serverbaba, and also ensure that employees do not use attachments in the email to send multimedia files. I'm back in the Compliance part of the Advanced Settings in Gmail. Now before you go ahead and configure the content and attachment settings let us walkthrough the other options that are over here. First option is email auto-deletion. By default, emails are configured not to delete automatically, but if I want I can configure that to automatically delete email messages, which are older than 30 days. Since today most of the email inboxes come with sufficient storage I do not see a reason why you would really need to use that, so I think the default setting of do not delete email messages seems to be fine to me. I'm going to scroll down. Here's the footer that we attached in the last demo. If I check the checkbox next to Comprehensive mail storage it'll ensure that a copy of all the emails sent or received are stored in the user's mailboxes, and then if I scroll down this is the first point we discovered in compliance settings where you can restrict delivery of emails that your users are allowed to exchange, so if I click on Configure you can see that you can add an address or a domain that you want to allow. I'm not going to do that for now, I'm going to click on Cancel. Here's Content compliance where you can configure advanced content filters for words, phrases or patterns. That is not what I'm going to use. I'm going to scroll down a little bit further, so here under Objectionable content you can see it says configure content filters based on word lists. Now this is what I'm looking for, so if I click on Configure here I can type in a little summary of what the setting is. Now I'll be a little descriptive, so that I understand by reading what the setting is, Filter emails or let's say, filter outgoing emails using the word 'fish'. Now all these settings generally have a pattern of if, then, that, which means if the criteria is this, matching this condition, then do that. Now first what I'm going to do is I'm going to apply the setting all the outbound emails because I do not want any employee in our company to use obscene language with anybody who belongs to outside the company, so I'm going to apply this on outbound emails, scroll down. Here is says, add words you want to search for in each message. This checkbox has been selected, which says custom objectionable words, and if I click on Edit right now it says no words added yet. I'm going to add a word here, which is fish, and then click on Save. Now I've configured if condition and this condition. If the email is outbound, and it matches this condition, in fact the email contains the word fish, then take the following action. Now I can either modify the message, reject the message or quarantine the message. Look to see what settings are available in each one of these, so if I click on Modify message I can change the header, prepend the custom subject line, change the route, change the envelope, bypass it through the spam filters, and remove any attachments. If I scroll down, add to more recipients or require secure transport for onward delivery. Let me scroll back up again, and see what other options are available if I click on reject message. I can directly reject the message and let the sender know that this message was rejected because of so and so causes or if I click on the third option, which is quarantine message, I can move the message to the following quarantine zone, the default quarantine zone. Now what I think suites the best in my situation is that I'm going to reject the message and tell them, the language used in this email was found to be non-standard, and against the company guidelines. I mean this is just a random message that I've typed out right now, but you can probably think of something which makes more sense, and then notify the sender that their message was rejected for so and so reasons, so I'll scroll up and check everything once again, before I save the setting. Outbound, correct, the word fish, and this is what will be notified to the sender, and click on Add Setting. Here you can see the setting, filter outgoing emails using the word fish. Now the next setting that I need to configure is the attachment compliance, so I'm going to click on Configure, and then type a little description (Typing), do not send multimedia files within the company. Oops, okay. That looks great. Now implementing this rule because the employees already have Google Drive that they can use to share multimedia files like audio or video files. I do not want them to attach them as attachments and send it in an email, and then it ends up cluttering the inbox, and using up previous space, so what I'm going to do is after I write the description I'm going to apply this to internal - sending, which means any email sent within the company, this rule will be applied to that, and if I scroll down a little bit it says, add expressions that describe the content. Now here, no expressions are added yet, I'm going to click on that, and click on Add, so if I scroll down a little bit you can see that I can categorize my attachments. Now I want this rule to be applied to all the emails, which contain the attachment of type video and multimedia, so I'm okay with employees sending documents or PowerPoint presentations or Excel sheets, that is okay or images is still fine, but I do not want them to be exchanging multimedia files like either movies or videos or music, so I'm going to click on these two options, and then scroll down, and click on Save. Right now this setting applies to all the emails sent within the company internally where the type of attachments is multimedia, either a video or an audio file. Now the action that I'll take here is scroll down, select modify message, and if I scroll down a little bit further, click on this checkbox, which is, remove attachments from message, and if I scroll down I can again, inform the users why the attachment was removed, so I'm again going to type a custom message here which says, please use Google Drive to share multimedia files, so that way I also notify the users of the corrective measure that they can take, so that their messages are not rejected from the next time, and then once I confirm if the settings look good, internal - sending, that's right, two types of attachments, multimedia and audio, and remove attachments, and notify the users with this message, so I'm going to click on Add Setting here, and then you can see I have both the settings here, so now the next thing to do is click on the Save button here, and once I do that I think the settings should be saved. Awesome, so it says, your settings have been saved.

Email Routing Now let us talk about email routing. Up until now you learned about end user settings and access, which determined how the end users inbox looked and functioned. Then we talked about spam settings where it could whitelist specific senders or blacklist specific senders, then in compliance you learned how you could alter the content of the messages based on particular conditions, and based on if they were incoming or outgoing. Now in email routing we'll actually learn how you can alter the part of the delivery of the email itself based on certain conditions. Google Apps gives you a wide range of flexible capabilities for email routing. You can implement these rules either at the domain level or at the user level, either for incoming or outgoing or inbound internal only or outbound internal only. Out of all those permutation and combinations we'll be specifically interested in a few settings that I'll talk about in this clip. The first setting is email routing where we can configure domain level routing for inbound emails, including a catch-all address. A catch-all address is a generic mailbox, which receives all the emails sent to addresses that are nonexistent in a domain. Let's say if an email was sent to info@serverbaba.com, and right now we haven't created a mailbox for info@serverbaba.com or let's say admin@serverbaba.com, so any emails which are sent to addresses, which do not currently exist, will be received by a catch-all inbox, so if we can configure that at the domain level in the email routing section, and we can also configure Google Apps to receive mails from a mail server in this section. Then in the outbound gateway setting we can weed out outbound emails at the domain level to another mail server for additional processing, so assuming you do not want to use Gmail's spam filters, but you want to implement your own custom spam solution, so what you can do is configure an outbound gateway, so that Gmail will forward all the emails where it can do all the additional spam checks or archiving or whatever it is that you want to, and then after you're done with that send the email to its appropriate destination. Then we can use the routing setting for user level routing subjected to specific use cases, which means depending on if the email is incoming or outgoing, and specific to a particular users inbox, in that case, we can again choose to weed out the message to a specific part that we desire. Then there's receiving routing, which applies to all the inbound or mails received internally, and similarly, there's sending routing, which applies to all the outbound emails or mails, which are sent within the company. I know right now it may seem very confusing, but to understand this better we will have to take a look at the demo, so let's go there.

Enabling Catch All and Configuring Routing Now let's enable catch-all address, and configure routing. I'm back in the Advanced settings for Gmail. Now to go to email routing I'll have to scroll down to the last part on this page, so if I do that it says Routing, okay, so this is the section I'm looking for. Now the first option here says email routing. This setting is used to route inbound emails that are coming in to your Google Apps account. Now, as you can see, the default destination is whenever someone outside the organization sends you an email it directly is delivered to Google Apps email, but if you want you can add another destination by clicking on this link, which is Add another destination, which means whenever an external identity sends an email to serverbaba it should have that email directly going into the user's inbox. Google can forward it to another mail server for preprocessing, so like I said, you can either scan for spam or any other malicious content or for archiving or any other legal compliance reasons, so if I had a main server in place for that additional pre-processing before the email is delivered to my user's inbox I could enter the name of the server over here. I could also configure the setting to apply to only those emails which are sent to unknown mailboxes or emails sent to known mailboxes or a known unknown both combined, but since I do not have this additional email server for processing I will not be able to configure the setting, so I'll leave this field blank, and then click on the Remove button, and then click on Save. I'm going to scroll back down again, to routing, and go to the next setting, outbound gateway. Now here I could have entered the SMTP address off of an email server, to which Google Apps will forward all the outbound emails. This SMTP server can be used for post-processing, which means processing of the email after it has been sent from our organization or from the user's our organization. Now if I scroll further down you can see there's an option for routing, the receiving routing, and sending routing that we discussed in the clip. What I'm going to do is I'm going to configure routing, and click on this button. Now here I can enter a short description, and then messages to affect inbound, outbound. Messages sent internally or messages being received internally. After that whom should the setting affect? Should it affect only specific senders? Here you can put in the senders email address or do you want the setting to affect specific recipients only, you can enter their email addresses over here, and then if I scroll further down, what to do with it? You're already familiar with these options. We saw this in the compliance section. I'm going to scroll back up, and hit on Cancel. Now I know at first it might seem a little confusing, but there's a clear distinction between these settings, so let me tell you what that is once again. Email routing applies to inbound emails at the domain level. Outbound gateway applies to outbound emails at the domain level. If I scroll down a little bit further, routing applies to, routing applies to either incoming or outgoing emails, which can be configured at a user level because you can see these options here, and if I click on Cancel. Receiving routing applies to all messages which are being received, either from outside or within the company, and sending routing is for mails which are sent either within the company or outside the company. I assume that once you do a hands on of these I think you'll understand them a little better, but for now what I'm going to do is I'm going to scroll back up, and configure a catch-all address, so to do that I'm going to click on this radio button over here, type in a catch-all address. That is going to be catch@serverbaba.com, so any emails which are sent to an address which do not exist on the serverbaba domain they'll all be redirected to catch@serverbaba.com. I've already created a mailbox, catch@serverbaba.com before this demo. Now to save this I'm going to click on the Save button over here. Okay, so it says, your settings have been saved. Let me scroll down and see where that is, so the catch-all address has been set to catch@serverbaba.com. With that we conclude this demo.

Summary Looks like we've reached the end of this module. Let us recap on what we did here in this module. First, in the end user settings and access we configured mail delegation and automatic forwarding. Then in the spam section we learned about whitelisting or blacklisting based on an IP address or a domain. In the demo we whitelisted our potential investors IP address and domain. Then in compliance we learned how to add a disclaimer message in the footer by using the append footer setting, and rules that govern the content and attachments sent within the email, and routing at the domain level, at the user level, inbound our outbound. Now this is one of those modules, which is very easy to forget if you do not get hands on practice totally on the topics we discussed here, so I would strongly recommend that everything that you learn here in this module you go ahead, sign up for a trial account of Google Apps, and then try them out on your own, all of them if you can. In the next module, Managing Communication, we'll take a look at Gmail from the end user perspective, talk about calendars, hangouts, and Google+.

Managing Communication Agenda Welcome to the sixth module in this course, Managing Communication. The last few modules have been pretty administrative focused, and since I do not want you to be overwhelmed with a lot of information what I'm going to do is I'm going to make this module and the next one a little simpler for you, so what we'll do in the next two modules, including this one, is that we'll focus on part administrator responsibilities, and part end user perspective of using the products in Google Apps, so in this module let us start off with the products that form the communications suite in Google Apps. Here's the agenda for this module. First, we'll take a look at Gmail, which is the email service in Google Apps. You might remember we went through all the advanced settings of Gmail in the last module, but in this module we'll try to understand the features of Gmail from an end user perspective like how much storage you get, how do you compose emails, how do you organize your emails more efficiently, a walkthrough of your inbox, and general account settings. Then we'll talk about contacts, how you can organize your contacts, and delegate permissions for someone else to manage your contacts, then we'll talk about Calendar, how you can schedule meetings, join a meeting, create a group calendar, manage permissions in it, and so on. Then we'll talk about Hangouts and how you can use Hangouts to start all your video calls, and join meetings or conferences, and then finally, we'll talk a little bit about Google+, which, as you might be aware, is a social networking tool from Google, and since this module is a little simpler than the previous ones it'll only constitute to about 12% of the questions in the certification exam, and those questions will be primarily focused around the calendar, just so that you know.

Using Gmail Using Gmail. I'm pretty sure most of us have already used Gmail for their personal accounts, but things are a little different when we talk about Gmail in Google Apps for Work because well, Google Apps for Work is paid, so obviously the Gmail service in Google Apps for Work should in some way be better, and of course, it is. Let me explain you features of Gmail in general, and how it is different in Google Apps for Work. First of all, I prefer Gmail over any other email service provider is because it's incredibly fast. I don't know exactly how it works, but a lot of emails are already preloaded, so the moment you click on an email it opens up. It gives you a very seamless experience, and that is one reason why I really love Gmail. Then with the standard plan of Google Apps for Work you get 30GB of storage, which is shared across Gmail, Drive, and Photographs, which means that the size of your emails, plus the documents on your Google Drive, plus the photographs you have uploaded all combined together can be a maximum of 30GB. Beyond that, if you need additional storage you'll have to pay for it or even better, if you opt for the unlimited plan you get unlimited storage for each user. Although there is one exception, if the number of users are less than or equal to four you get 1TB of storage each in the unlimited plan, but if you have five or more number of users you get unlimited storage for every user, and that I think is fantastic. Another really unique feature in Gmail is the concept of labels. It's like folders, but it's better because unlike folders where one email can only belong to one folder, with labels you can apply multiple labels to any email, and then search them using any label that you apply to that email. I make extensive use of labels to organize my emails, and make sure that I efficiently respond to people in a timely fashion. In the next demo you'll see how that works, and finally, Gmail gives you a lot of personalization options to choose from, so that your account reflects your personality. You can choose your own theme, your own font for default messages that you compose, and the color of the text, so these are the few features which make Gmail stand out among the rest in the competition.

Creating Labels in Gmail Now let us take a walkthrough of how a Gmail account looks to an end user, and learn how to create labels, which will make your life a lot easier. Before I get into my Gmail account there's one thing that I wanted to show you. Let me go to the Company profile section, and scroll down to Personalization, so you can see my marketing team finally managed to give me the complete logo, I've uploaded that here, and now it shows up in most of the places. On the top left hand corner you can see it says ServerBaba. It adds a branding value and personalization to your Google Apps account. Now let me go to Apps, go to the core apps, and open Gmail. As an administrator when you go to the Admin console to manage Gmail for your organization this is the page that you see, but for end users Gmail looks something like this, so you can see this is my inbox. I've customized it a little bit, so that it looks a little better. On the top left hand corner you can see that the logo appears in my inbox now. I've added a theme, which kind of gives a little wooden background to my inbox, so now let me walk you through the most common tasks we do in a Gmail inbox. To compose an email you can see there's a button here, which says compose. I can go ahead and compose an email, Mark, suggestions from the directory popup. I can select Mark, type in a subject, Hello, This is my first email, and at the bottom we can see you can select different formatting options like the text size, bold, italics, all of those controls, and then using this button you can attach files. You can insert files using Google Drive, insert images inline, add a hyperlink or add emoticons. Pretty basic stuff, so I'm just going to send this email to Mark. You can see how snappy that is. Now if I want to customize how my inbox looks and feels like I can go to this gear icon on the top right side corner, and then click on Settings. It should give you a wide range of options to customize how your inbox looks and works, so you can see I can set a language, then the number of conversations per each page, default text when you compose a new email, your picture, your signature. I think since I do not have a signature let me add that (Typing). This looks good, and then let me switch to the Labels section. Here you can manage your labels. We'll create that once I'm done with this walkthrough. Then Inbox, then the inbox settings, they are pretty much self-explanatory, then if I go to accounts I can add another email address that I own, so that I can manage both accounts from one single place. If you remember in the last module we configured email delegation, which allows you to delegate access to your account, so that someone else can manage it on your behalf, so if you had to delegate your inbox this is the setting that you'll have to configure. If you run out of the 30GB storage that has been allotted to you you can purchase additional storage from here, then Filters and Blocked Addresses. You can apply filters to incoming emails, so that they automatically categorize themselves with specific labels. POP and IMAP Download. If you were using an email client like Outlook or Thunderbolt you could enable POP and IMAP access from here, then you can go to Chat, turn on or turn off chat. Go to Labs to add additional apps to your inbox, use Gmail offline, and then customize your themes. let me click on Cancel, and directly go ahead and create a new label, so if I click on More here you can see it says, Create a new label. I'm going to click on that, so what I do as an IT administrator is that since I get a lot of emails for support I categorize the emails into hardware issue and software issue or as a priority issue, so that I can cater to more important problems first, followed by the problems that I can, so let me create a new label, hardware, Create, scroll down, create another label, software, click on Create. Now I'm going to apply color to these labels, so if I click on hardware, Label color, again, select that red. Then I can do the same thing for software, choose another color. Let's say blue in color, and now when I go to Inbox, so now what I can do is I can apply these labels to my emails, so let us assume that this email is for a hardware issue, so what I can do is I can select the label Hardware, and then apply that to this email. I can go back to the inbox, go to another email. Let's assume that this email is for some software issue. I can go ahead, apply the software label, and then apply, and then if I go to the inbox it'll give a consolidated view of all the emails with all the different labels, and then if I want to sort them according to the label, if I click on the label on the left, Hardware, it'll show me all the emails which have the Hardware label applied to it. If I go to the Software it'll show me all the emails which have the Software label. Let me go back into the Inbox, so this is one way how I personally, as an IT administrator, keep track of all the issues, either hardware issues or software issues, and then prioritize them based on if and when I can. Let me create another label here, which is resolved, save it, and then once I resolve the issue I go ahead, remove the hardware label, apply the resolve label, and click on Apply, so when I go back to the inbox I can see all the resolved issues. I think the color is not really standing out here, so let me change the color of the resolved label. Label color, let me make it green, so I can see all the resolved issues show up with a green tag, which is resolved, so having this visual aid in the inbox makes it a lot easier for you to organize your emails and know how many issues you have, how many issues have been resolved in a very visual way.

Using Contacts Now coming to contacts. As you know, contacts help you keep track of people, including their phone numbers, email addresses or street address, and other attributes. To help you organize your contacts Google Apps allows you to create a group of contacts. You can have a different group of contacts for your friends, you can have a different group of contacts for your family, and another group for your coworkers. To help you with that Google Apps, by default, creates a group of contacts called the directory, and automatically adds all your coworkers to it, so that it's easy for you to find the contact information of another coworker without having to go hunt for it. Then the people that you contact more frequently can be added to My contacts, and the important contacts among them can again, be starred. You can apply a nice golden star to that contact, and similar to email delegation, you can also configure contact delegation if you want someone else, like your secretary, to manage your contacts on your behalf.

Adding a New Contact Now let us see how to add a new contact in your Gmail account. Now all the apps that have been provisioned by the administrator to be used by an end user can be found over here on the top right side corner, so if I click on this icon you can see all the apps that are available here. Now for this demo I'm going to go to the Contacts, let me see where that is, over here, here's Contacts, let me click on that. It says, welcome to contacts. To add a new contact click the New Contact button, so currently, there are no contacts added to my contact section. You can see how I also have other sections, Friends, Family, Acquaintances, and so on, and if I click on Directory over here you can see that by default all the members of the organization are added to the dedicatory group of contacts. This is helpful because I don't have to go hunt for somebody's contact, I can directly click on let's say Jim, and see his contact information. Let me click on this popup. As you can see, there's no phone number or other information because Jim hasn't added that information to his account, so once an end user adds all that information to his account you'll be able to see it all over here. Now if I go back to Directory Contacts, and since I directly report to Mark, and I contact him frequently, what I'll do is I click on the start button over here next to Mark. I can simply go to Start, and Mark's contract should show up here, so it's generally a good idea to add all the people that you contact frequently by marking them with a star, so let me go back to my contacts, and now let me create a new contact. If I click on this button on the top left side corner I can add a name, let's say Ken Adams. I can add his email address, Ken Adams@ let's say Hotmail.com. Then add his phone number. Since I'm in India the default country code is +91 that's already been put there by Google. I'm going to type in a random phone number. If I click on the Add button I can add additional information, his nickname, company name or his birthday, his relationship, handles for instant messaging, and so on, and plus, if I had a picture I could also add his picture from right here it says. On the top you can see that it gives me a confirmation that all the changes I have made to Ken's contact details have been saved automatically. That's good. If I go back to My Contacts you can see Ken Adams shows up here. If I wanted to delegate my contact I could click on the More button, and here you can see Manage delegation settings. By clicking on that, and then entering the email address of the people I want to delegate my contacts to, I could do that, and give them edit permissions, but I'm not going to do that, I'm going to click on Cancel and then done, and optionally, if the default groups do not suffice you can also click on the New Group button to create a new group of contacts, so you can see how easy and simple the whole experience of managing your contacts is.

Using a Calendar Now let us talk about Calendar, and specific features of using Calendar in Google Apps for Work. Now, in general, you know that a calendar is used to keep track of events like either business meetings or birthdays of friends or family members or know about the holidays, so that you can plan your vacation accordingly, but apart from just keeping track of events you can also schedule events using a calendar in Google Apps. In my previous company we used Google Apps calendars to schedule the meetings, and invite people to join those meetings, and the access to the calendar is not just limited to yourself, but you can also share your calendar with coworkers or other external people, so that they're aware of how your schedule looks like or when you're free or available. That makes it easier for other people to plan events, which include you without having to ask you each single time if you're free or busy or available for a given slot of time, and that reminds me of a really cool feature, which is Find a time. When you want to schedule team meetings, and you want to ensure that you can figure out a timeslot which works for everybody in the meeting, the Find a time tool will go through the calendars of all the coworkers, see who's busy, who's available, and suggest you a timeslot of when a meeting can be held, so that most of the people are able to join, and I've seen a lot of people undermine the value of using a calendar, but trust me, once you start using a calendar on a day to day basis your life will be a lot more organized.

Creating and Sharing a Group Calendar Now let us try to create and share a group calendar. Now in this demo let me show you how to create and share group calendars. Now to do that I'll again, have to go back to this icon and then go to Calendar, so you can see my calendar opens up, I can see the daily view, I can see the weekly view or the monthly view of any upcoming events that I may have. To create a new event I can click on the Create button on the top left corner. I can name the event, set the timing, set the location, create a link for the meeting in case I have remote workers or people working from home to be able to join the meeting using a conference call. There's a description. I could add an attachment, like the Agenda for the meeting, add a specific color to this event, which shows in the calendar, and set my status as available or busy during that time, so you can see how easy it is to create an event, but this is not what I'm going to do right now. What I'm going to do is I'm going to create a group calendar, but before I do that let me also show you that on the left under My Calendars I have multiple calendars. I have my own personal calendar, I have secondary calendars, so here's a birthday calendar for all my friends or family members or other coworkers. I have a tasks list, and then under other calendars I can add a coworker's calendar, so that I can see his schedule of when he's free or busy. Now since I frequently report to Mark, let me add his calendar. Now I can see that Mark's calendar has been added. Now if I click on Mark's Calendar it'll show me all the upcoming events that Mark has in the nearby future. Similarly, if I wanted to share my calendar I could click on this dropdown, and then select the option which says, Share this Calendar. You can see that my calendar is, by default, shared with everyone in the organization serverbaba. That is why I could view Mark's calendar by adding it to my list of calendars, and if I wanted to specifically share this calendar with individuals I could put in their email address here. You can see Ken Adams. I added his contact in the contacts demo that's why it shows up, and after I do that I can set the permission of what Ken can do, and so on, so instead what I'm going to do is I'm going to click on Cancel. I do not want to save the changes, and then under My Calendars I'm going to click on Create new calendar. Now I'm going to create a new team calendar for the support team, as a Support Team calendar. That little description, this is basically for me and you to collaborate together, so that if I have an upcoming off I can put it down in the calendar, then you can see it, and make sure that you do not apply for an off on the same day. Location if you want, time zone, and then I'll go ahead and select the checkbox, share this calendar with others, and make sure this checkbox would say share this calendar with everyone in the organization, ServerBaba, where they can see all the event details is selected, and if I scroll down, and that's it, I'm done with most of the settings, I'll go ahead and create calendar. Now on the left you can see support team calendar also shows PRINCE2, let me click on that, and let me add an event on the eighth saying it's going to be my day off. Make sure in the dropdown I select the Support Team Calendar, so that the event is added to this calendar, and then click on Create Event, so you can see that an event, Kunal's Day Off, has been added to the support calendar, and to figure out that this is in the support calendar you can compare the color. You can see the color of this, and the Support Team Calendar match. If I uncheck this box, if I uncheck this box, and if I check this box right now it only shows me the Kunal D Mehta, which is my primary calendar. If I click on this it'll show me the birthday calendar. If I click on this it'll also show me Mark's calendar, and finally, if I click on this it'll also show me the Support Team Calendar, and again, see this event again, comes back into view, so this is how you create events, create group calendars, and share your calendar with other team members in the organization.

Using Hangouts In this clip let us talk about using Hangouts. Now although the name Hangouts sounds really casual, because it started off as an experiment, a product that Google built as a successor to Google Talk, and then once it got better it was integrated into Google Apps. Now Hangouts is really simple. One, it allows you to do instant messaging with your coworkers or people outside the organization, which I think is more convenient at times than emails because when you have short conversations it makes less sense to send an email, so for example, if I wanted to ask a coworker where he's at I would prefer instant messaging him than sending him an email for it. Hangouts in Google Apps for Work is mainly used to make audio/video calls and conference calls for meetings. The current limit on the number of people that can participate in a conference call on Hangouts is 15 users. This is pretty much a summary of what Hangouts does. Now to understand this better let us go into a demo.

Making Calls Using Hangouts Now let us see how you can make calls using Hangouts. Now to start a Hangouts call I can either go to the Hangouts dedicated app, so if I click on the Apps icon, and then select Hangouts you can see here is the dedicated Hangouts page. On the top left side if I click on this button I can search for contacts, and then start a conversation with them directly or click on this icon for the recent conversations that I've had with people. If I want to make phone calls on landlines or mobile devices I can do that from here. I can type in their phone number, but I do not have credit right now, so I'll not be able to do that, so let me go back to the recent conversations, and if you see, I already tried having a conversation with Mark previously. If I click on this I can open up the recent conversations that I've had with Mark. I can type in a message, Hello, are you there? Then when Mark sees this, let me switch to Mark's inbox, this is what Mark sees. He can then reply, sure, I am in the office, and click on Send. Let me switch back to my inbox, close this conversation, close the dedicated Hangouts page. Now every time you want to start a conversation it's not necessary that you go to the dedicated Hangouts page. Instead, there are quick controls on the left side here, which will allow you to start a Hangouts call or a conversation directly. You can see right now there's only Mark. If you want to add new people to your Hangouts list you'll have to search for them. Let's say I want to invite Jim to have a Hangouts conversation. I can select Jim, and click on Message, so we can see it says Jim is not on Hangouts right now because he's offline, I can close the conversation in that case, and if I adjust this a little bit you can now see Mark Scott is online, Jim Wilson is not online. I can also hover my mouse on that name and perform various operations like see their contact information, the emails I've exchanged with Mark, start a video call, send an instant message or send an email. Let me try to see what happens when I start a video call. You can see I can name the Hangout. You can see that this is currently a ServerBaba only meeting, which means people outside ServerBaba cannot join, but if I want to change that I can select this, and allow people outside ServerBaba to join, but I'm not going to do that, I'm going to click on Cancel. If I want to I can add more people to this call right from here. I can click on Jim, and then select him. I'm not going to do that. I can configure the dial in information if people want to join this Hangout using a phone, and in case the agenda of the meeting is sensitive I can also require guests to be 18+ to be able to join this call. Now to start this call I'll directly click on the Invite button, and once Mark accepts the phone call I'll be able to see him on video over here, and he'll be able to see me on video. Now because I do not have web cams, unfortunately, I'll not be able to show that to you, but you get the idea. If you have a web cam you can then turn it on. You can mute the call, add more people to this call, check the bandwidth settings, configure a different playback or microphone from here, end a call, and not only that, you can also see this icon over here. If you click on that it'll allow you to share your screen, so that you can share a presentation that you have or another app, so if I click on this, and click on Share it'll start sharing the PowerPoint presentation that I have in front of me. I can stop sharing by clicking on this button and going back. You saw how easy and convenient it is for teams to collaborate together using audio/video calls and share presentations, which gives the users the ability to work together more efficiently.

Admin Settings for Communication To every app that is available for an end user to make use of there is a corresponding admin side setting that can be configured and applied to it. In the last module, Configuring Mail Flow, you saw all the admin side settings that apply to Gmail, and in the demo so far you have seen how the end user experience looks like for Gmail, contacts, calendars, and Hangout. Now in the next demo let us take a look at the admin settings for Contacts, Calendars, and Hangout. Since the settings here for the Contacts, the Calendars, and the Hangouts app are very basic, self-explanatory I'm going to consolidate them into the next demo. Let us quickly glance through the admin settings for Contacts, Calendar, and Hangouts. To configure admin side settings for Contacts, Calendars, and Hangouts you have to go to Apps, and then Google Apps. You may remember this place from the last module where we went into the Gmail's advanced settings for configuring mail flow options. Apart from that, you can also see there's the Contacts app, the Calendars app, and if I scroll down, the Hangouts app. I have already opened the settings for these in new tabs. If you remember, here's the place from where you configure settings with Gmail, and you can see, just like all services, you can turn off any service on for the entire organization or for specific organizations. All the options that we configured in the last module are here, User settings, Email addresses, Routing, and all of that stuff, so since we have seen Gmail settings in the last module I'm going to skip this. Now let us go to the Contacts settings. Here there is one section which says, Sharing settings. I'm going to click on that to expand it. Now when I do that there are a few options over here you can see. Do I want to enable contact sharing? Now this setting is important if you automatically want your coworkers contact information to be shared with other users in the organization you can enable contact sharing, and under contact sharing there are a couple of more options. You can choose which email address belonging to the user is visible to others who are looking up for their contact information, either all addresses or only the alias, except for the primary address or only the primary address or do you want this contact to be discoverable only in the user's primary domain? What that means is right now we only have a single domain environment in our Google Apps, which is serverbaba.com. In case you have a multi-domain environment, you can choose if the user's contact information is shared across domains or within the primary domain. Then you can also choose under Directory Contacts what exactly is to be seen. Only the domain profiles, shared contacts or both the domain profiles, and shared contacts or if you want to turn off contact sharing altogether you can select this option over here, and then click on Save, but I'm not going to do that. I'm going to discard these changes. If I go back you can again, see I can configure these settings either for everybody in the organization or only for some specific organizational units. Now let me switch to the Calendar settings. Here if I scroll down you can click on Sharing settings. If I scroll down a little bit you can limit the sharing options for your user's primary calendars. If someone is outside the ServerBaba domain, what information off an employee's calendar can they see? Now next you have internal sharing options for primary calendars. Now this applies to users who are trying to see other user's calendar within the ServerBaba domain, and then if I scroll down a little bit further you have the option to enable video calls within the calendar event. You probably remember this from the calendar demo, and if a user should be warned if he invites a person who belongs to outside the ServerBaba domain to a calendar event. I can scroll down, then you have options to create resources. I'm not going to save the changes, so if I scroll down a little bit further. Now in this section you can configure resource management, so if you have conference rooms that you want to book you can create a new resource here, and integrate that within the calendar, and once you schedule a meeting at this location other users will be able to see that the conference room is already booked for that particular time slot, so it makes it easy for you to align meetings in the conference room when it is free and available. Now if I go into the Hangouts settings over here, again, you can also see that even this app can be managed either at the domain level or at an organizational unit level. Now if I click on Advanced settings, and scroll down a little bit further, now in this part I can choose which app can the users use for the communication, either Hangouts, Hangouts or Google Talk or Goggle Talk only. Now since Hangout is newer and better the default settings of Hangouts chat only is perfect. I can then scroll down, enable chat history or disable chat history by default, and if I want I can ensure that users cannot override the history settings. Now here in this part I can configure if the users belonging to the ServerBaba domain can chat with other users outside the ServerBaba domain using Hangout. Now if I see there's this checkbox where it says, users can chat with other users outside ServerBaba, now I do not want that, so I'm going to uncheck that box. I'm also going to uncheck this box, which says, display users chat status outside ServerBaba because I want to limit Hangouts only to users within the ServerBaba domain, I don't want them to be chatting outside the company, so I've unchecked both those checkboxes, and if I scroll down from here, if you uncheck this box you can limit Hangouts to instant messaging only, and do not allow users to make audio or video calls. These are the admin side settings of Contacts, Calendars, and Hangouts.

Google+ Finally, the last product that I'd like to talk about in the communication section is Google+. Google+ that is bundled with Google Apps for Work can be used for social networking within the company. Everybody today's already used to social networking, and so giving the users the ability to communicate with each other over a social network can be a little more fun, and a colorful experience because using emails all the time can be a little boring, so adding that social aspect within the coworkers we'll be able to give them that modern feel of today. You can use Google Apps to share updates like text, pictures or videos. I'm 100% sure that all of us have been using Facebook, and we know exactly how it works. Google+ is no different. The concept is pretty much the same, except that this social network can be limited to employees in the company. Creating a company page on Google+ can also be a strategic part of managing your social media presence because I have seen a lot of product companies today, which have their own Facebook pages and Twitter pages, and Google+ pages. Having the social media presence is really important when you want your users who are using the product to be able to communicate back with the company, so that they're updated about any latest updates, bug fixes or feature releases. Alternatively, this also works as a channel for the customers using your product to provide you feedback, but since Google+ is not important from the certification exam standpoint right now I'm going to leave it up to you to explore how Google+ works.

Summary It looks like we've reached the end of this module as well. Now let us take a look at what we learned here. First, I showed you how you can organize your emails in your Gmail account using labels. Then we talked about organizing contacts and delegating contact management to other users in your domain. Then I showed you how you can create events on a calendar, create a group calendar, share it with your team members, and configure a meeting. Then we saw how instant messaging and audio/video calls work on Hangout, and finally, we took a look at the admin side settings in the admin console for all the communication apps that we discussed in this module. Now in the next module, Managing Storage and Collaboration, we're going to talk about Google Drive, and other collaboration tools that you get in Google Apps like slides, sheets, forms, and sites. I'm going to see you in the next module.

Managing Storage and Collaboration Agenda Welcome to the seventh module in this course, Managing Storage and Collaboration. In this module we're going to talk about the tools that Google Apps gives you to store your files, documents, and help you collaborate together as a team to create new documents, save them up on the cloud, and share them with other team members. For storage you get Google Drive, and for collaboration you have docs, sheets, slides, forms, and sites. I'm going to talk about each of these products in this module, and try to show you a demo of the key tasks and operations for these products. Here's the agenda for this module. First, we'll take a look at Google Drive, how you can organize your files online, create folders, apply permissions, and share them with your team members. Then we'll also take a look at how it is closely integrated with docs, slides, and sheets. Now you can create all these types of documents directly on the cloud without the need to install any software on your machine. Finally, we'll take a look at forms and sites, which you can use to create surveys or questionnaires, and a basic website for your own company or your team. This is going to be a really simple module. It'll cover just about 3% of the questions that appear in the certification exam.

Using Drive Let us start off the module by talking about how to use Google Drive. If you have used products like Microsoft's OneDrive or Dropbox you would exactly understand what Drive is, but if you don't that's fine. Let me explain it to you. Google Drive is basically online storage for your files and folders. By default, it supports a wide variety of file formats that you can upload to Google Drive. It can include PDFs or documents or presentations, audio files, video files, and so on, so the choice of file formats here is very diverse, and then you can not only upload your files, but then also organize your files into folders, and apply different permissions to different files or folders, and share them with people that you want to share them with, either an individual or a group of members together, and Drive is tightly integrated with docs, sheets, and slides. You can create online documents, spreadsheets, and presentations without having the need to install any software on your computer, and plus one advantage of using Docs, Sheets, and Slides is that it does not count in the total GB storage quota that you're given. I think one of the reasons why Google is doing that is to promote the use of docs, sheets, and slides over the traditional Word, PowerPoint, and Excel, and finally, you can access the documents on your drive from anywhere, either on the web, on a mobile device or you can sync it offline on your computer. You can also maintain multiple versions of a single file on Drive, and preserve them, and go back to a previous version if you want to or keep the newer version.

Organizing Files and Folders on Drive Now let us take a look at the demo on how to organize files and folders on Drive. Now to open Google Drive I'll have to click on the Apps icon, again on the top right side corner of my account, and then select Drive. Let me click on that. You can see it gives me a little walkthrough. I'm going to just skip that walkthrough, and then on the left side you can see there's a button which says New. If I click on that I can create a new folder, upload a file from my computer or upload an entire folder from my computer or I can go ahead and create these files directly on Google Drive. For now what I'm going to do is I'm going to try to upload a file from my computer. I have a quotations.pdf file in my Documents. I'm going to select that and click on Open. You can see it is uploading that file, and it's done uploading, and now it should shortly generate a preview for that file. You can see here's the quotations.pdf file. Now let me try to create a folder such as that I can better organize my files. Now again, to do that I'll click on the new button. I can also do it by clicking on the My Drive icon over here, then selecting the New folder button. I'm going to go ahead and name this folder, and I'm going to say, Client Quotations, and then click on the Create button. Now you can see our folder has been created. Now if I want I can drag drop this file into the folder like this, and then if I double-click on the folder I can open the folder's content, and then if I select any file I can click on this button to get the link of the file or I can click on this button to share the files with other people in my organization and set permissions. Now let's say I want to give Chris the permission to edit this file. I can add more people if I want to, and maybe a description, so that Chris knows which file it is that I'm sharing with him. Now you can see there's another icon. If I click on that I can preview the content of the file or I can delete the file altogether by clicking on this trash icon, and when I click on these three dots I can open this file with either Google Docs online or open it on Word on the desktop or I can move it to another folder, mark it as a favorite by adding a star to it, rename the files to something else, view the details, manage all the versions, create a duplicate copy of the file or download it back on my computer, so if you wanted to download the file on some other computer, which did not have this file you could download a copy of this file using the download button. Here you saw how you can apply permissions on file. Now if I go back to my drive I can also select the folder and directly apply the permissions at the folder level, so if I click on the share icon on the top over here I can now type in the email address of the person I want to share the entire folder with, so I'm going to share the entire folder of client quotations with Mark, and send him a little note, here is the folder to the client quotes, and then click on the Send button. You saw how easy it is to upload your files, organize them into folders, and either share files or folders with the person or you can also share folders of files with a group of users altogether instead of single people, so let me try to share this folder with the finance team. Let me see if I can get that right. Here's the finance team. If I want I can also give them view only permission, so that they cannot make any changes to the files in the folder, so I'm going to click on Can View, give them view permission, add a little note if I want to, and then click on Send. This folder has now been shared with the group, and then if I want to review with whom this folder has been shared I can again, click on the folder, select the Share button, and then here under the email address box it says, shared with Mark and one group, and if I click on that it'll open up the details of whom this folder has been shared with. Now you can see Kunal D. Mehta who's the owner, which is me, is the owner, Mark can edit, and the finance team can view. It gives a very nice and crisp view of who has what permissions over this folder. Now again, if I want I can change the permissions from here, either remove the permissions or add new permissions or whatever change that you think is appropriate you can do that from here, but for now I'm going to click on Cancel, and then click on Done. In this demo you saw how you can upload files, organize them into folders, apply permissions to either folders of files, and share them with a single person or a team of people.

Using Docs, Sheets, and Slides Now let us talk about Using Docs, Sheets, and Slides. Now these experimental products were developed by Google to give people alternative options to the Microsoft's Office Suite. It boasted about being cloud only, which meant users did not have to install any application on their machines, and it came free with any Google account, so given that situation, then Microsoft also came up with Microsoft web apps for Word, PowerPoint, and Excel, which afford a little higher fidelity for documents compared to Google Apps, so Docs is mostly used for text documents, and if I had to compare it with a corresponding product in the Microsoft suite I would say it works a little bit like Word, and then Sheets is mainly used for tabled data, like numbers, financial data, columns, rows. It's basically a spreadsheet software, so if I had to compare it with a product in the Office suite it works like Excel, and finally, Slides are mostly used for presentations, and I'm sure that you must have guessed it mostly works like Microsoft PowerPoint except that these three are tightly integrated with Drive, so that you can create, edit, and save any of these documents or sheets or slides directly online without having to install any separate application on your computer.

Creating a New File in Docs Now let us try to see how to create a new file in Docs. To do that I'll have to go to New, and then click on the Google Docs button. You can also see that instead of a document I could also create a spreadsheet or a slide from right here, but for this demo I'll stick to Docs by clicking on Google Docs. You can see a new page opens up within the browser. Now I can type in my information here. This is a document, oops, I seem to make a lot of mistakes when I'm typing. This is a document, which, oops, is really important, and then I could name the file by clicking on the title here, which is Untitled Document, and name it Important Data. This is a random name for now, but you get the point. If I want I can either star the file from within here or I can move it to a specific folder by clicking on the folder button. You can see I have only one folder right now, so if I want I can either save it in the root folder or in the Client Quotations folder. I'm going to let it be in the root folder of My Drive, and since it's already there I'm going to click on the Cancel button. Now you should know you will not see a save button because all the changers are automatically saved. You can click on the File button on the top, and then download it in a format of your choice, Word or PDF or a .txt file or a rich text format file or if you want you can add comments to the file or share the file with other people in your organization. Again, the way this works is exactly the same. You either type in the name of individual people or you can type in the name of a group that you want to share this file with. I'm not going to share this file for now, and hit on the Cancel button, and click on Done. You can see the changes are automatically saved, so if I add a new text, which is Edit, and then directly close this tab, and then if I open the file again, by clicking on right-click, Open with Google Docs, you can see that the update I made to the document was automatically saved, so this is how you can create a new document in Google Docs.

Using Forms and Sites Now let us talk about the last two products in this module using Forms and Sites. Now this is really simple. Forms is basically used to fill in surveys, questionnaires or polls. This is really useful when you want to collect a set of responses from users or from people and automatically have those responses consolidated in the form of a file. In my previous company we made extensive user forms for new user onboarding, so whenever we hired new users, and on their first joining day we made them fill a form with their complete personal information, including the name, the phone number, the address, the hardware assets that have been assigned to them, the serial number of their laptop, and in case the company was issuing them a cellphone number, the IMEI numbers, and so on, so it really made the process of keeping track of that assets a lot easier for us using Forms. Then Sites are basically used to create very entry level websites directly from templates, and to be honest, I'll tell you sites is not very popular. It is very limited in terms of the capability it has. It is not very customizable, and that is why most of the people prefer to create their own company website from a dedicated web developer instead of using Sites.

Creating a Questionnaire in Forms Now let us see how to create a questionnaire in Google Forms. Now to create a questionnaire using Forms I'll again, have to go to the New button, and then select More, and then click on Google Forms. Now if I do that a new page will come up in front of me. Now this is the form that I can use to create a questionnaire for my users. Now if I expand Form Settings you can see I have multiple settings here. I can either configure this form to be available only to the employees of ServerBaba or make this form public by unchecking this box, which says, Require ServerBaba login, so if I uncheck that now anybody who has the link to this phone will be able to fill in the information, and respond to the questions in the survey, but let's assume I'm trying to make a user onboarding form, which means the person filling in the form is going to be an employee of ServerBaba. I'm going to check this box, and then to make things easier for the end user I can also automatically collect the respondents user name. I can show the progress of how many questions have been filled in at the bottom of the page, and I can also make sure that the person does not fill in this form multiple times. I can check this box, and if I want I can shuffle the order of the questions. I'm not going to shuffle the questions. I can create the questions that I want. Let's saw first question, Full name, and then under Help Text I can give a little description, which will help the user understand what kind of an answer I'm looking for. I can put in First name, Second name format, and then I can select the type of the question. This is going to be a text only, so the users will be given a little text box where they can fill in their name, and then I can make this a required question if I want, and if I click on Advanced settings, I can also validate the data that they entered. Now data validation can be helpful in places like when you are trying to ask them for their email address, and you want to make sure that they enter a valid email address, but since it says the name I'm not going to enable data validation, so there's the first question. Now if I scroll down I can click on Add an Item, I can type in my second question here, I can make this phone number, Help Text, exclude the country code, and then in the question type I'm going to again, select Text, and then in advanced settings I can enable data validation, make sure the format is a number, and since phone number is a 10 digit number here in India I'm going to select the Between, and then I'll enter the first 10 digit number, which is 1 followed by nine 0s, 000000000, and the second number, the largest 10 digit number, which is 999999999, and in case the data entered by the user is not valid is can enter a custom header text, which says, Enter a valid 10 digit phone number. Again, make this a required question, and then click on Done. You can see, this is how the form looks like. This is a simple two question form. If I want I can add more questions, but for now I really wanted you to get a feel of how this looks, and then if I wanted to see how this form looks like to an end user I can click on the view live form button, and if I do that this is the form that the end user will see. He'll be able to enter his first name, and let's say enter a random phone number, 9000000001. Now let's say I do not enter a valid phone number. Now let's say I do not enter a valid phone number. It'll give me the custom error message, which says, enter a valid 10 digit phone number, so if I put in 1 it'll become a 10 digit number, which is fine. The form also says that it is automatically recording my user name, kunal@serverbaba.com, and that's fine. I can click on Send me a copy of the responses, and click on Submit. It says your response has been recorded. Now I'm going to close out of the form. If I want I can name this form, let's say User Onboarding, and then at the bottom excerpt is shown to the end users after the responses are recorded can be changed. Let's again, change this to Thank you for your time! This form is automatically saved. Now if I want to view the responses that people have filled into this form I can click on the View responses button over here. Now it'll give me an option to create a new spreadsheet with the responses. I'm going to click on the Create button, and when I do that it should open up a new file in Google Sheets with the responses. You can see there's a timestamp, my username, my full name, and the phone number that I entered, so this is how forms work.

Summary Looks like we've reached the end of this quick and short module, so let's do a little recap of what we learned. In this module we learned how to upload, organize files and folders in Google Drive. We also learned how to apply permissions based on individual files or folders, and share them with either specific users or a group of users. Then explain to you what Docs, Sheets, Slides, Forms, and Sites are for and how they look like. Now one thing that I want you to do after this module is to download the Google Drive app, and try to see how it works to automatically synchronize files between your desktop, and your Google Drive account. Now most of the questions that'll appear in the certification exam based on this module will be around Google Drive, so make sure you're thorough with organizing files, and configuring permissions for users or groups based on individual files or folders. In the next module, Maintaining a Google Apps for Work Infrastructure, we'll take a look at various day to day maintenance activity that you may need to perform in a Google Apps for Work environment, and that is going to be the last module in this course.

Maintaining a GAFW Infrastructure Agenda Welcome to the last and the final module in this course, Maintaining a Google Apps for Work Infrastructure. In this module you'll learn about the tasks that you'll have to perform once your infrastructure starts to scale. Right now we have a very few handful of users, but once the number of users grow what you're going to learn in this module will become more and more important. You will learn how you can perform common administrative tasks on the go, then you'll get an understanding of the tool that is used to synchronize user identities from an LDAP server to Google Cloud. Then we'll learn a little bit about how to troubleshoot a problem, how you can enforce mobile device management on your Android and iOS devices, then what protocols to follow in case of a legal incident, and ensuring that your users and data are secured. Here's the agenda for this module. First, we'll learn about domains, what's a primary domain, what's a temporary domain, and secondary domains? Then, I'll show you how to use the Google Admin app on your iPad or your Android device. Then we'll talk about Google Apps Directory Sync, which is the tool that you install on your LDAP servers to synchronize users from an on-premise server to the Google cloud. Then we'll learn how to see the health status of apps in case you're experiencing downtime, and how to resolve an issue by contacting support. Next, we'll learn about mobile device management, and how you can enforce policies and settings on your Android or iOS devices. Then, in case of a legal incident, how you can use the vault to retain and search for the information that could be critical in solving that case, and then going through reports to ensure that everything is functioning smoothly in your environment, taking care of the security for your users and the data, and finally, we'll summarize what we learned in this entire course, and this final module will cover about 24% of the questions that will appear in the certification exam, and if needed, go through the course once again.

Domains Up until now we didn't talk a lot about domains after getting our primary domain, serverbaba.com, verified in the second module, but if you thought that was it there's more to it than that, so when you sign up for a Google Apps for Work account you are provisioned with a temporary test domain. All the Google services run on this temporary domain until the point of time you get your primary domain verified, and we call it the primary domain because that is not the only domain that can exist in a Google Apps account. Google also allows you to add secondary domains in a single subscription. This scenario is generally applicable when you want to manage multiple sister companies from a single Google Apps subscription because maintaining multiple subscription for each company may not be the most efficient way to administer Google Apps, and then in the users module you saw we could add aliases to users, but we are not limited there. We can also add aliases to domains altogether. Now this scenario is applicable when you have mergers or acquisitions, so if one company takes over another company, let's say company A takes over company B, so initially all the employees' accounts were @companyB.com, but now they have been moved to @companyA.com, and to ensure that users do not lose any emails sent to their old address you can create a domain alias, so that all emails sent to @companyB will directly be forwarded to the corresponding users in @companyA.com, and from domains you can also whitelist external domains for partner companies. The limit here is 50. In the Managing Storage module you saw how you can share files and folders with other users or groups within the company, but when you whitelist an external domain you cannot just share files and folders within the domain, but you can also grant permission to users outside the domain to be able to access those files. To understand this better let's get into a demo.

Domain Settings Overview Now let us take a walkthrough of domain settings. To configure domain settings I'll have to go into Domains in the Admin console, so now if I expand Add/remove Domains by clicking on it, it shows me a summary of all the domains that are currently associated to my Google Apps subscription. You can see when I signed up this was a temporary domain that was assigned to me by Google, and after that I added my own primary domain, and got it verified. If you wanted to add a secondary domain you could click this button on the top which says, Add a domain or a domain alias. Now here if I click on the second option I could add another domain, which means that I could simultaneously have user accounts belonging to two different domains. For example, I already have serverbaba.com. I could also add, let's say, cloudbaba.com, and the users having both those email addresses would coexist in my single Google Apps subscription. Now another option is to add a domain alias. Now let's assume the company serverbaba.com has been acquired by a company, cloudbaba.com, and now the company CloudBaba wants to give all the users a new email address, which ends with @cloudbaba.com, but the problem here is a lot of people who have the old email address of the users belonging to the old domain @serverbaba.com will have a risk of their emails failing to deliver, and that is why we can add a domain alias, so that anybody who sends an email to @serverbaba.com automatically reaches the inbox, @cloudbaba.com. I'm going to click on Cancel, so this was the overview of domain settings.

Using the Google Admin App You may remember from the second module that I made you install the Google Admin app on your iOS or Android device, so when I login the app gives me options to modify users, groups, view audit logs, or contact support, so when I choose the first section, Users, this is what I see. I see a list of all the users on the left with their email addresses, and any privilege or their active or suspended status on the right side. You can see next to my name it says, Super Admin. Next to Heather it says Admin because, if you remember, we granted her the suspend only admin privileges in the third module. Notice that if I tap on any user it'll also take me to a page from where I can reset his account, delete his account, suspend his account or change any account details. Plus, I can also add new users from within the app. Then if I navigate to Groups it will list out all the groups that I currently have in my organization, and then if I tap on the plus icon on the right side bottom corner it gives me an option to create new groups as well. Then, if I navigate to the Audit section it'll give me an audit log of all the recent administrative activities that were performed on our Google Apps subscription, and then if I tap onto a specific one of these I can also get into a little more detail of that particular log, so you can see what the event was, who performed this activity, and what was the IP address that it was performed from? Finally, if you navigate to the Support section you get telephone numbers and email address of Google Apps Support. It's just amazing how powerful this app is, and how much stuff it allows you to do from your mobile device on the goal.

Google Apps Directory Sync (GADS) Google Apps Directory Sync. The scenario that we talked about in this course, the ServerBaba company, was really simple because the entire infrastructure was setup from scratch, but then the case is not always so simple. Sometimes companies already have their existing infrastructure in place with a functioning identity and access management solution. In that case, you can use this tool, which is Google Apps Directory Sync, to synchronize user identities, groups, and organizational units from an LDAP server like Active Directory to Google Apps. Typically I have mostly seen this implemented in medium to large size businesses because not a lot of small companies are interested in investing and maintaining a centralized identity and access management solution. Even a vault group configuration works well for them, so what you do with Google Apps Directory Sync is that you download this utility and install it on a server in your on-premises environment, and once it connects to the domain controller it initiates a one way synchronization of the user identities from your LDAP server to the Google Apps account. What you must remember here is that this is a one way synchronization only, which means Google Apps will never change any data on your LDAP server. If you make any changes on your LDAP server they will reflect it in Google Apps, but the reverse is not true, and when you have a Google Apps Directory Sync and an LDAP server in place the obvious next choice is to configure Single Sign-On. This will simplify the authentication process for your end users because they'll be able to use a single set of credentials to login to their machines, as well as all the Google Apps services. Without Single Sign-On they would have to manage two different credentials, one for their machine login, and the other for the Google Apps account login, and when there are multiple credentials it generally creates a mess.

App Status Dashboard and Support In IT you'll run into situations on a recurring basis where things will probably not work as expected. In such cases, you must know the exact series of steps you have to take to try to resolve an issue, and luckily for us, since Google Apps is hosted in the cloud there are very few situations where we face a technical difficulty, so the general rule of thumb is whenever you face a technical issue that should not exist you try to first troubleshoot it. For example, if you are not able to access files, which ideally should be accessible, the problem often lies in misconfigured permissions, so the first step would be to go and check that, if the permissions have been configured correctly. If all of that looks good, then you can check the App Status Dashboard to see if an app is experiencing outage from the Google side. If that does not seem to resolve your issue either, then you can try to contact Google Technical Support.

Using the App Status Dashboard and Contacting Support Now let us see how to use the App Status Dashboard, and if needed, how to contact support. Here's the admin console. On my right side if I scroll down you should be able to see there's an Apps Status Dashboard hyperlink, so if I click on that a new page will open up. Now if I scroll down a little bit more on the left I can see all the services. A green highlight next to those services indicate that those services are up and running as expected. Any service outage that they may have failed in the past can also be seen here, so you can see Gmail was facing temporary problems on the second of February, so if I click on this orange button I can see exactly what the problem was. You can see at 10:22 PM there was a reported issue with Gmail, and then by 10:56 PROJECT MANAGER, which is roughly in about 34 minutes, the problem with Gmail was resolved. I can go back to the Apps Status Dashboard, and then you can see the whole list of services. There's Gmail, there's Calendar, Google Talk, Google Drive, Docs, Sheets, Slides, Google Hangouts, and Google Vault. Now these are the services which are covered under the Google Apps Service Level Agreement. If you click on this you'll be able to see the detailed service level agreement, and if I scroll down there are other products who are here, which are not covered by the Google Apps Service Level Agreement, so more critical things like Gmail have a higher level of service agreement, and less critical things like YouTube or maybe Blogger, and those products have a more leisure service agreement, so this is the app status dashboard from where you can see the health of any app or service at any given time. Now I'm going to close this, and then go back. Now let's say I'm facing an issue. I tried troubleshooting it, I couldn't do it. I tried to see if it was being caused because of a service breakdown, which is not the case, then in that case what I can do is I can contact Google Technical Support, so you can see it'll give me all the phone numbers, so here's the phone number for India, I can call on this number and talk to a Google technical representative to discuss the issue I am facing. To verify my identity, Google will need this pin to be quoted over the call. If you do not want to contact them by phone you also have an option to write an email to Google Technical Support, so I would say these are the general steps that you would take in case you were to troubleshoot an issue. First try to figure it on your own, see if there's a permission or some minor misconfiguration because if its things are not working as expected, if you can't seem to find it, then check the Apps Status Dashboard. If you don't find anything there either, then contact Google technical support.

Device Management Device management in Google Apps, generally the first two, managing the end devices, which I used to access the Google Apps account. This can include your laptops, your desktops or your mobile devices. You can use device settings in device management to configure networking and Chrome policies. By that I mean you give your end user the necessary information they need either to connect to a VPN or a Wi-Fi or some other corporate connection. With device settings you can also enforce policies on their Chrome browsers to either restrict the user of extensions, ability to download files, Javascript, and things like that. Then under device management you also have mobile device management, also referred to Auto Deploy MDM. Currently, Google only supports managing of Android or iOS devices. By managing I mean you can remotely manage your phones that are used to access your Google Apps account. You can either approve the access, block the access or, in case the phone is lost, remotely wipe the data on the phone, so that you do not compromise any confidential information or delete the data on the phone altogether. You can also have managed apps installed on the company phone, which may be needed by users. The other things that you can do with mobile device management is to enforce policies, like require a passcode to be set, enforce encrypted backups, and enable or disable iCloud access for iPhones.

Managing an iOS Device Since I do not have an Android phone I'm going to show you what you can do with mobile device management on an iOS device. To manage an iOS device I'll have to scroll down, and then go to device management. As I mentioned in the previous clip, you can configure the network and Chrome settings under device settings, but for now we'll stick to mobile device management. Let us see what options you have to manage an iOS device. Now if I go to Password Settings under Password Policies I can check this box, which requests users to set a password, and then if I scroll down I can configure the minimum characters, after how many days the password expires, how many previous expired passwords are to be blocked, and after how many failed attempts should the device be wiped off. I don't want to do that. For now I'll only stick to the minimum characters, and make that from 0 to 4, and then click on the Save button. You can see the settings have been updated. Now let me go back to device management. On the left, again, if I go to iOS Settings, and scroll down, and expand the second section, which is Backup and iCloud Sync, scroll down a little bit further. You can see I have the options to govern how my iPhone backs up data to iCloud. Do I want to allow the backup to iCloud or do I want to prevent the device from backing up to the cloud or I can enforce the device to use encryption for backups, and if I scroll down a little bit, expand the Lock Screen, section, scroll down a little bit, I can configure what options are available on the Lock Screen. Do I want to allow the control center, notification center, and all that basic stuff? When you get a new email you get a nice pretty notification on the Lock Screen, so if you think that information being on the Lock Screen might also not be a good idea from a security standpoint you can disable the notification center on the Lock Screen, and then click on the Save button. Now let me go back to device management. Now if I click on this icon here, which says, 1 Mobile Device, you can see that my iPhone has been added here, and if I select that I can either block, remote wipe wipe the account on that phone or delete the entire data on the phone. This feature can be extremely useful when an employee loses his phone containing confidential Company information, and you do not want any unauthorized person to get a hold of that phone. In that case, you can remotely wipe off the data off of that phone, so that if even if anybody finds that phone there will be no company data on it.

Vault Now let us talk about the Vault. As I mentioned in the first module, vault is used for eDiscovery and archiving. It comes bundled with the unlimited plan, but is not a part of the standard plan. The primary reasons for using a vault are when a legal inquiry is being conducted or like an investigation or someone has requested for records of a certain activity happening in other Google apps account. What gives you the ability to retain, search, and export either emails, chats, and files, which are stored on Google Drive, so once you get a hit of the problem or there's a suspicion that something wrong is happening you can create a matter. A matter is basically a case specific to a particular incident. Then once you create the matter you can search for the conversation or data in question, save the query, and then if you find anything positive you can report it to the higher authorities in the company or the HR. Using the vault is not an everyday tool. An administrator typically only has to use the vault when there's a criminal action against an employee or in some way he or she has violated the company policy, so all in all, to summarize this, when someone asks you to go do something in the vault it basically means that someone is in trouble.

Creating a Matter and Searching on Vault Now let's see a demo on creating a matter and searching on Vault. Now to go to the Vault I click on the apps icon on the top right side corner, and then click on Vault. Now, as you can see, here it says there are no matters to view at this time because this is like the first time I'm using the vault, so what I will do is I will click on the Create button to create a new matter. Let's assume there was a data leak case, I'm going to name the matter, Data leak case, give a little description if you want, and then click on Create new matter. Now it has directly brought me into the data leak case. Now to gather evidence for the case I can click on the Search button, and do an exhaustive search or data exchanged in our Google Apps account. You can see under source it says All data, under Type it can either be email or Drive, I've currently selected email. Search method can either be Accounts or Organizations. I'm going to select Accounts, type in a user's mailbox who is under the radar right now. Let's assume it's Lisa. Select her account. If I leave the Sent date and the to date blank and the term blank, and click on Search, it'll return me an exhaustive list of all the emails that Lisa has exchanged so far. We can see these are the emails that Lisa has gotten. If I want to dig a little deeper I can click on it, and see what the text exactly says. Go back, and let's say I find some evidence that Lisa has been leaking private, confidential information of the company. I can directly go ahead and click on the Save query button, enter the name of the query, Gotcha, and click on Save, You can see under Search the new query, Gotcha, has been saved. Now if I want I can click on the Export results button, name the export, let's say evidence, and then Begin export. Now this evidence that I found against Lisa will be exported, and then I can escalate this issue to the higher authorities in the company or the HR using this as evidence, so this is just a very high level overview of how the world works. Vault is not something that you would use on an everyday basis, but having a rough idea of how it works will certainly be helpful in those rare situations where something goes wrong, and you have to figure out what.

Reports Reports paint a very visual picture of how your overall infrastructure is running and being utilized by your users. Under reports you have audit logs for admin activities, login activities, and app activities, so if you remember the clip that I showed you, the Google Admin app on the iPad, from there we saw the audit logs. Those are basically a subset of reports. Then using Reports I can also keep track of the app usage activity. Then I can supervise overall account activity, see the account status of all the accounts in the organization, if any of them are administrators, and which users have enabled Multifactor Authentication, and which users have not done so, and plus, for security you can also discover and generate reports of what files or apps have been shared with people belonging to outside the company, so these are just a few popular ones out of the whole bunch of reports that you have under reports. Let's take a walkthrough of these reports in the demo.

Reports Walkthrough Now let's get an overview of how reports look like. Now to go into Reports I'm going to have to scroll down, and then click on this icon here, which says Reports. If I click on that the default page brings me to the Highlights. Here you can see a graph of the service versus the date. You can see as of 1st February there were about 7 users using Gmail, 0 users using Drive, and 1 user using Google+. Then if I go to Apps usage activity I can see which user owns how many files on the drive or how many emails are in their inbox, and the total space they're occupying. Then if I go back to reports, and next click on Account activity, I again, get a nice little graph of how many users were active, suspended or blocked at any given date, so you can see as of February 1st there were 8 active users, 0 suspended, and 0 blocked, and if I scroll down over here I can see users account status, if they are an administrator or not, and if they have enrolled in Multifactor Authentication, so you can see Chris, account status active, no administrator role assigned to him, and he's not enrolled in Multifactor Authentication either. If I scroll down here next to my name I can see account status active, admin status, Super Admin, and not enrolled in 2-step verification. Then if I go back to Reports, click on the Security button, here I can see how many files users have shared with people belonging to outside the company ServerBaba. Here I see how many external apps are using or accessing other Google Apps accounts. Now next to my name it sys two because one, I'm accessing my Google account from the phone, and second, I've installed the Google Admin app on my iPad, so this 2 represents those 2 external apps, which are accessing this Google account, and then if I go back to reports you can see there's an Audit log for Admin activities, for Login activities, changes made to Drive, and so on, so if I click on Admin, here's the list of all admin activities. Here's the event name, description, which administrator made those changes, the date, including the time, and from which IP address he or she made those changes. Now if I go back to Reports, and click on Login, here's the entire audit log for every login that has been made into Google Apps. You can see I logged in multiple times, and then Chris logged in, and then Mark Scott logged in. Now here under IP Address they are all the same because I am using a single computer to make this entire course, so you can see how reports help you get a quick overview of the entire Google Apps account.

Security The one topic without which no course is ever complete, Security. With Google Apps you also get a Security app, which helps you manage basic security parameters. Things like password management, the minimum length requirement and the maximum length requirement of the passwords that users can set, then enforcing Multifactor Authentication or 2-step verification for increased security. You probably remember doing this from the organizational unit demo where we enabled Multifactor Authentication for the marketing team. Then you can also use the Security section to monitor for password strength, and if you see that a user has set a weak password you can force him to change that password. You don't get to see exactly what the password is, you get to see the strength of that password, and from Security you also configure API access to allow or deny programmatic access to the Admin console, so the Google Admin app that you saw in the previous clip, that would invoke if I did not have API access enabled. Apart from that, there are also settings for Single Sign-On or Off, and other security settings, but we don't need them for the ServerBaba scenario right now.

Monitoring Password Strength and Forcing a Reset Now let us monitor the password strength of users, and if you find a user using a weak password let us force him to reset his or her password. To monitor password strength I'll have to go into Security, and then if I scroll down you can see there's a section here which says password monitoring. I'm going to expand that, and when I scroll down you can see name of the users, the length of the password they have set, and the password strength. A green full bar indicates that the password is strong, whereas this red bar indicates that the password is weak. You can see Jim, Lisa, and Steve's password is weak because when we created their accounts using the csv file we put in a very common password, which was abcd@123, so now let me force Jim to change his password next time he logs in, so if I click on Jim it'll take me to the Users property page, and then if I scroll down, and then expand accounts here, and scroll down a little bit further, under Password you can see there's a checkbox, which I can check to make sure that Jim changes his password at next sign-in, and I'm going to click on Save. You can see it says, changes to this user have been saved, so that is how you monitor the password strength of users and, if needed, force a user to change his password.

Module Summary And with that we have reached the end of this final module, but before we wrap up let's look at the summary for this module. Here we got an overview of how domains work. I showed you how to use the Google Admin app. I explained to you what Google Apps Directory Sync was, and when and why you may need to use it. Then I explained to you the basic steps for troubleshooting by looking at the health of the apps in the Apps Status Dashboard and, if needed, contacting Google Support. Then you saw how you can manage an iOS device using mobile device management. After that we created a Matter on Vault, and tried to search for an email from Lisa, which allegedly leaked some company's private, confidential information. Then we saw an overview of reports, and finally, how to monitor password strength of users for security.

Course Summary Now that we've concluded the course, let us also do a recap of what we learned in the entire course. In this course we navigated into each one of these icons, one after another, in the admin console. During the signup process we went into the Company profile section, then in Users we saw the different methods to create a user, and either reset their passwords, suspend them or delete them. Then in Groups we saw how you can create admin managed groups and user managed groups. In Admin roles we saw how you can assign admin privileges to users in your organization. Then in Domains we saw how you can add a domain alias or secondary domains in Google Apps. Then under Apps we saw a whole bunch of app settings. We saw the settings of Gmail, Calendar, Contacts, Hangout. Then under security we saw how you can monitor password strength of users. Under Device management you saw how you can manage your Android or iOS device. In Reports you saw how you can get a high level overview of how you Google Apps for Work account is running, and finally, we saw when you cannot troubleshoot an issue how to contact Google Technical Support, so these are the components of the admin console that we covered, and then in terms of apps, we saw the admin side, as well as the end user side of Gmail, Calendar, Hangouts. I introduced you to Google+, so a demo of how to create a docs file on Drive, create a form for user onboarding, Google Drive to organize your files and share them with your teams, the admin console to configure all of this, and the Vault, in case there's a legal incident.

Final Conclusion And with that, congratulations! I now pronounce you a Super Admin! Good luck for a certification exam.