How to prevent students from sharing docs?

[kosbornegs]

I would like students to be able to create documents in google docs however I would not like them to not have the  option to share any documents they create.  I have it set to prevent shared drive creation  and have Sharing outside of the organization OFF. Is there a way to remove the sharing option completely? 

[CloudGuardians]

This kind of goes against the collaboration philosophy of Google Workspace. Furthermore, if a student is unable to share a document with any other user it would create a problem: sharing a document with a teacher would also not work.

I can, however, suggest an alternative (that I wouldn't recommend either):

 - Create a compliance rule - affecting only students - to make sure that emails informing that a file has been shared with a user is not received.

This would not prevent sharing but it would "hide" it a little. And, if you create the rule correctly this wouldn't affect messages about file ownership originated from Classroom. It would, however, affect files shared by teachers (to students).

You should also note that students would always be able to copy the content of files they create and send it using a file on their private accounts (which you could also disable if you're managing devices, but it would never be as effective as you would like).

[jason_tech]

It's a problem for many schools. For external sharing, Admin Console has an option to block two-way sharing. Google does not provide the admin control to limit internal sharing. That said, there are a few options to address the problem. 

1. Remove the Share feature from Drive and Docs Editors. Students will share with the teacher using the Classroom assignment. 
2. Block the shared links. If student A shares a file with student B, it shall block student B from opening the link; If the teacher shares the file with student B, the link shall pass through. 
3. Auto revoke the sharing permissions. If student A intends to share a file with students B, C, D and the teacher, the permissions to students B, C, and D shall be revoked. 

You can find more information in this article Block Google Drive Sharing Files.

[kim_nilsson]

However, if I understand it correctly, SafeDoc (which is the paid service you are talking about) does absolutely nothing if the student uses a different browser, or a mobile phone when sharing. Unless you use the very advanced and somewhat risky Approach 3, which auto-revokes any such shares, after the fact. The file will be shared, but when the built system reacts, the share will be removed. Unless I misunderstood, and the system will only ever be able to react if the sharing is done on a device with the extension?

If it is a service that constantly runs in the cloud and listens to all users' share events, and then filters those by students and reacts on those, that's going to be maaaaany API calls in a large organisation, which could end up costing a lot more in GCP costs than the cost for the extension itself.

[CloudGuardians]

Maybe students' creativity should be praised instead of censured... When they are inventive and curious enough to find ways to achieve the results they want (especially when some users that use the same tools professionally fail to discover those same resources) they're showing resourcefulness and problem-solving mentality, which is a great skill to have.
In any case, students have plenty of ways to share thoughts and/or files outside the school's vigilance (they have dozens of messaging apps to do it) so maybe letting them do "inappropriate" things within the school's "realm" is not such a bad idea. It gives control to the school, which can use DLP rules, for instance, or the Investigation Tool, or even Google Vault, to monitor keywords and create a better understanding of what students are doing. And with those insights the school can define corrective plans and take measures based on actionable intel. And the school can also let the students know that it has visibility over the things they think they're doing in secret, effectively discouraging them from doing it again, and creating an education opportunity about vigilance, privacy, and cause/consequence.
Plain sharing prohibition would not solve the "problem". It would only keep reality away from the school's control.

[KAM]

@CloudGuardians re: "Maybe students' creativity should be praised instead of censured...", Amen and Lol.  The work arounds of cyber I have seen by many students is just brilliant.  -KAM

[dphelps]

These comments are clearly not made from people in education.  Their creativity is not what is being censured, it's their misuse of time and the inappropriate actions that follow.  Even more than that, it can even become a legal issue.  There are some students who are legally not supposed to be in contact with one another.  I don't think turning off sharing entirely is always needed but having a block list would be a possibility.  Taking the "block" feature in Drive that is available to outside sharing and Gmail accounts and extending it to internal users within a domain would be invaluable to schools.  Being able to designate that Student A cannot share files with Student B (or one OU can't share with another) doesn't inhibit their creativity, it just provides a route for them to stay on task.

[kim_nilsson]

I'm pretty sure most of us who answered work in education.

There is a coming feature called Drive Trust Rules which will be able to restrict internal sharing. 

[john_bello]

I did read about that feature and it sounds like it might be on the right track. Unfortunately it will not be available to Google Workspace Essentials, Business Starter, Business Standard, Business Plus, Enterprise Essentials, Enterprise Standard, Education Fundamentals, Frontline, and Nonprofits, as well as G Suite Basic and Business customers. So unless you are a Google Workspace Enterprise Plus or Education Plus customer it won't do most educational clients any good.

[kim_nilsson]

Yup. We switched to Education Plus just over a year ago.

[dphelps]

I was referring more to CloudGuardian and KAM.  I've seen SafeDoc and the Drive Trust Rules sounds like a great add but it would be nice if it was included in basic customers as it seems to be a pretty basic feature.  We can block people in Gmail but not in Docs.

[CloudGuardians]

Hi there,

I guess you saw my comment more like bad criticism... And honestly, I can understand how someone favourable to the idea of this topic might be bothered by my comment.

We are not a school indeed, but we have several EDU customers (in both free and paid editions), to which we provide free support, so Education is something we care about.

My intention is always to help, not to create conflict - otherwise, I wouldn't be in this forum -, but I confess that I'm not in favour of any type of censorship.

I do understand, however, that different companies/schools/domains have different needs, and I do not think that they are less important just because they are not my needs. In this specific topic, I simply believe that the things trying to be prevented can be achieved by students in a number of ways outside Google Workspace (therefore, without any control from the school). So, the "solution" will simply hide the problem.
Obviously, my opinion on this was more personal than technical. If you really want to use the Drive Trust Rules feature we can even help you out getting an extended trial (subject to approval) and the application to the beta program (also subject to approval), so that you can test this before committing to a paid edition. And, as I mentioned, our support is free, so there's nothing here for me except helping out someone that's looking for help.