Use the investigation tool to end meetings

Supported editions for this feature: Enterprise Plus; Education Standard and Plus

As a Google Workspace administrator, you can use the End meeting for all action in the security investigation tool to remove all users from selected meetings within your organization. For example, you might want to prevent users from having unsupervised meetings when the meeting host isn’t present, or after an event has completed.

The End meeting for all action in the investigation tool has the following effects:

• Prevents users from joining all future instances of that meeting if the host isn't present
• Requires users to knock to enter if they aren't on the Calendar invite

The effects of this action are very similar to the End meeting for all feature in Meet, which is available to meeting organizers and moderators. As an administrator, you can use the investigation tool to end multiple meetings within your organization, search for and end old meetings that are being used inappropriately, or set up a rule to require meeting hosts to be present and users to knock if they aren't on the Calendar invite.

For more details about the effects of this action in the investigation tool, see the section below, What happens when you end a meeting for all users.

Your access to the security investigation tool

• The security investigation tool requires a premium Google Workspace edition (Enterprise Plus, Enterprise Standard, or Education Plus).
• You can access logs using the Chrome browser for the Google apps you have installed. For example, Gmail.
• Your ability to run a search in the investigation tool depends on your Google edition, your administrative privileges, and the data source. If you're unable to run a search in the investigation tool for a specific data source, you can use the audit and investigation page instead. 
• You can run a search in the investigation tool on all users, regardless of the Google edition they have.

Note: To use the investigation tool to end meetings for users, you’ll need the following privilege: Investigation Tool > Meet > Update or Delete. For details and instructions, see Admin privileges for the investigation tool.

End a meeting for all users

To use the investigation tool to remove all users from selected meetings:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecuritySecurity centerInvestigation tool.
3. Choose the Meet log events data source for your search.
4. (Optional) Click Add Condition to add a condition for your search.
5. Click Search.
   In the search results, you’ll see a list of Meet log events.
6. Check the boxes for the meetings that you want to end for all users.
7. Click Actions.
8. Click End meeting for all.
9. To view the progress of the action, click View at the bottom of the page.

Note: You can also use the End meeting for all action by clicking themenu next to each Conference ID in the search results.

About Meet log events

Search results for Meet log events include a list of events with details about each event—for example:

• Date of the meeting
• Meeting ID—Represents a potentially recurring Google Meet video call. This is a 10-digit code that corresponds to the same 10-digit code in a user’s browser address bar when attending the live meeting.
• Conference ID—Represents a single session of a meeting that corresponds to a Meeting ID. Each occurrence of a meeting can have a separate Conference ID. At any given time, a meeting can have only one active conference.
• Event—Reason for a meeting appearing in the search results—for example, if an abuse report was submitted by a user during a meeting, or if a user left the meeting.
• Actor—User who performed the event described in the audit log

What happens when you end a meeting for all users

When you use the security investigation tool to end a meeting for all as described above, the meeting will end for all users currently in the meeting, including those in breakout rooms associated with the meeting. Also, you’re preventing anyone from attending future instances of that meeting without the host being present. Additionally, all users must knock to be allowed into the meeting, except for users on the Calendar invite, and users invited in-meeting by the host.

By ending a meeting for all, you’re ending the specific conference—which is a specific instance of a meeting (possibly an old conference) that's identified by the conference ID. Ending the meeting for all also prevents users from joining future instances of that meeting if the host isn't present, and requires users to knock to enter if they aren't on the Calendar invite. 

For details about meeting access, see Control access to a video meeting.

Create an activity rule to automatically end selected meetings

By creating an activity rule, you can automate the End meeting for all action. 

To create an activity rule to automatically end selected meetings:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecuritySecurity centerInvestigation tool.
3. Choose the Meet log events data source for your search.
4. (Optional) Click Add Condition to add a condition for your search.
5. From  themenu in the upper-right, select Create activity rule.
6. Type a Rule name—for example, End meeting for all—and type a Rule description.
7. Under Action, select Conference ID > End meeting for all.
8. Click Create Rule.

For more details and instructions about activity rules, see Create activity rules with the investigation tool.