A new client wanted us to set up Chromebooks, but during the process we discovered that their business domain was already attached to an existing Google Workspace tenant. Nobody at the company knew who the administrator was, and the client had been unable to identify the person or account that originally created it years ago.
While investigating domain recovery, we found a process that appeared to start removing the domain from the old tenant. However, the business owner received a warning at his personal Gmail address saying that the account could be deleted unless the process was canceled. His Gmail account could not sign in to the admin console because it was not an administrator account, which made the situation even more confusing. The recovery tools also did not show that the Gmail address belonged to the Workspace tenant, so we suspected it might only have been configured as a backup or notification address, or that the messages were being forwarded.
We have access to the company's DNS and need to either recover the existing tenant or safely create a new one so the Chromebooks can be configured. Has anyone dealt with an unknown Workspace administrator or recovered a tenant when the original admin account could not be identified?
4 Answers
If the business can prove ownership of the domain, Google support may be able to help recover the tenant. Having control of DNS and being able to publish the requested verification records is usually important. Recovery can take several days, especially if the original administrator is no longer with the organization.
If the old tenant truly contains no data and the client approves it, moving to a new tenant may be an option, but don’t do that until you’ve checked mail, Drive, device management, billing, aliases, and any security settings. Removing or abandoning a domain can have consequences that are difficult to reverse.
We considered starting over, but once the old administrator account was found, recovery was the safer route. Everything is now being configured properly.
Before abandoning the old tenant, check the company’s old documentation, billing records, password manager, registrar history, and former employees or vendors. Also inspect the notification email headers and the exact recipient address. In this case, the owner eventually found that he had created the administrator account himself several years earlier.
That was exactly what happened. After a lot of digging, the owner found the old admin account. We got access and discovered the company had been paying for Workspace for years without really using it.
The personal Gmail address was probably configured as the tenant’s backup or recovery email. Workspace can send important notices there even though that address is not an administrator and cannot sign in to the admin console. Check the actual To and Reply-To addresses in the messages, along with any forwarding rules, because that may reveal which account or service generated them.
That explains why the owner received the warnings, but it still didn’t identify the administrator. We eventually had to keep digging through the company’s history.
The problem was that the recovery process still wanted the administrator’s account information, which we didn’t have. DNS access alone wasn’t immediately enough.