How can I stop users from syncing Company folders to their Google Drive desktop?

Question

I do the admin for our 30 user company (Apps Premier account). We migrated from Exchange one year ago and I have gradually weaned people off their MS Office habits and now everyone uses GDocs/Drive for doc creation. I want to make Google Docs/Drive our File server.

There are several problems:

1. I don’t want people syncing Shared Folders (i.e. the company's files and folders) to their unsecured laptop which they may leave on a train. Does Google Drive allow me to “lock” folders to stop them from being synced? So far, the only security option I can find is Sync on or off. I have to keep it off. Surely I am not the only one who wants this granularity, but I cannot find any other posts about it.

2. To make things neater. Rather than me having to be the owner of all the folders, we want to set up a "Central System User" who will own all folders and then every other user, including myself, will have a clean My Drive—sort of like thier desktop. The idea is that everyone can create files and not share them but if they want to share then they deposit in the appropriate shared folder to which they have access. Problem is that the Central User will only have 5Gb of space, whereas we have 30 users and the collective space of 125Gb cannot be used.

The system seems a total mess of random disorganised sharing between users rather than a structure hub and spoke design we are all comfortable with. Why is noone else seeking this - have we totally missed the point of Google Drive? Right now we have over 5000 documents and growing every day and there is no order or way of enforcing granular permissions for storage.

P.S.: I have tried Cloudlock and GPanel and neither do much but tell you how disorganised everything is!

Answer 1

Re your point 2 You are heading in the same direction my company has gone. We have the equivalent of your 'Central System' as a Username, and have created three folders on its Drive - WORK, REFERENCE, EXTERNAL USERS - and shared them with our Sysadmin. Sysadmin shared WORK with Users on an Edit basis and our users built a sub-folder structure for our company to hold all our working files. Sysadmin shared REFERENCE with most Users on Read basis but with some Users granted Edit rights so they could create and maintain the folder/file structure for policy documents, manuals etc.

WORK is shared Edit and REFERENCE is shared Read to new starters as part of the User setup process and new Users immediately acquire inherited rights to all the contents of these folders.

Leavers, we change the User password immediately, use administration advanced tools to transfer ownership to their manager/colleague for any files/folders they may have created and then unshare them from WORK and REFERENCE.

We have not made WORK or REFERENCE to be the Owner of the sub-folders and documents which they contain because it would require that only someone logged into Central System would be able to delete them. We simply use our own version of Central System to provide a unified data structure for our Users. The Users each retain the 5gb of non-Gdocs storage space which is shared with other Users through WORK and REFERENCE.

We collaborate with external organisations and use EXTERNAL USERS as a portal. For example, our Auditors want access to our some of the data on our system. We created a sub-folder AUDITACCESS in the EXTERNAL ACCESS folder and granted our auditors' gmail accounts Read access to AUDITACCESS. We then use the Organise function to give them a View towards the files and folders which they need to access (but remember to hold the CTRL key down when you use the Organise function). This allows us to un-Organise files and folders, if necessary, since they are all listed in the AUDITACCESS folder and to un-share AUDITACCESS with our auditors email accounts, if necessary.

Hope this will give you a few ideas for organising your own system.