Use the security investigation tool to end meetings

Supported editions for this feature: Frontline Standard; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus; Cloud Identity Premium. Compare your edition

As a Google Workspace administrator, you can use the End meeting for all action in the security investigation tool to remove all users from selected meetings within your organization. For example, you might want to prevent users from having unsupervised meetings when the meeting host isn’t present, or after an event has completed.

The End meeting for all action in the tool has the following effects:

• Prevents users from joining all future instances of that meeting if the host isn't present
• Requires users to knock to enter if they aren't on the Calendar invite

The effects of this action are very similar to the End meeting for all feature in Meet, which is available to meeting organizers and moderators. As an administrator, you can use the security investigation tool to end multiple meetings within your organization, search for and end old meetings that are being used inappropriately, or set up a rule to require meeting hosts to be present and users to knock if they aren't on the Calendar invite.

For more details about the effects of this action, see the section below, What happens when you end a meeting for all users.

End a meeting for all users

To use the security investigation tool to remove all users from selected meetings:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecuritySecurity centerInvestigation tool.
3. Choose the Meet log events data source for your search.
4. (Optional) Click Add Condition to add a condition for your search.
5. Click Search.
   In the search results, you’ll see a list of Meet log events.
6. Check the boxes for the meetings that you want to end for all users.
7. Click Actions.
8. Click End meeting for all.
9. To view the progress of the action, click View at the bottom of the page.

Note: You can also use the End meeting for all action by clicking Menu  next to each Conference ID in the search results.

About Meet log events

Search results for Meet log events include a list of events with details about each event—for example:

• Date of the meeting
• Meeting ID—Represents a potentially recurring Google Meet video call. This is a 10-digit code that corresponds to the same 10-digit code in a user’s browser address bar when attending the live meeting.
• Conference ID—Represents a single session of a meeting that corresponds to a Meeting ID. Each occurrence of a meeting can have a separate Conference ID. At any given time, a meeting can have only one active conference.
• Event—Reason for a meeting appearing in the search results—for example, if an abuse report was submitted by a user during a meeting, or if a user left the meeting.
• Actor—User who performed the event described in the audit log

What happens when you end a meeting for all users

When you use the security investigation tool to end a meeting for all as described above, the meeting will end for all users currently in the meeting, including those in breakout rooms associated with the meeting. Also, you’re preventing anyone from attending future instances of that meeting without the host being present. Additionally, all users must knock to be allowed into the meeting, except for users on the Calendar invite, and users invited in-meeting by the host.

By ending a meeting for all, you’re ending the specific conference—which is a specific instance of a meeting (possibly an old conference) that's identified by the conference ID. Ending the meeting for all also prevents users from joining future instances of that meeting if the host isn't present, and requires users to knock to enter if they aren't on the Calendar invite. 

For details about meeting access, see Control access to a video meeting.

Create an activity rule to automatically end selected meetings

By creating an activity rule, you can automate the End meeting for all action. 

To create an activity rule to automatically end selected meetings:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecuritySecurity centerInvestigation tool.
3. Choose the Meet log events data source for your search.
4. (Optional) Click Add Condition to add a condition for your search.
5. At the top, click Menu Create activity rule.
6. Enter a Rule name—for example, End meeting for all—and enter a Rule description.
7. For Action, select Conference IDEnd meeting for all.
8. Click Create Rule.

For more details and instructions about activity rules, go to Create and manage activity rules.