* Access Admin Console: Go to admin.google.com and sign in with your admin account.
* Navigate to Reports: In the Admin console, go to Reports > Audit > Login.
* Review Login Activity: Look for any unusual or suspicious login attempts, such as logins from unknown IP addresses or locations.
* Investigate Further:
* Check the user's activity for any signs of unauthorized access or unusual behavior.
* Use the Security Audit Log to find more details about the login attempts and other security events.
* Take Appropriate Actions:
* If unauthorized activity is confirmed, consider resetting the user's password and enabling two-factor authentication (2FA).
* Notify the user and possibly suspend the account if the threat level is high until the issue is resolved.
By investigating the login and security logs, you can identify and mitigate potential security threats effectively.
References
* View and analyze security reports and logs
* Audit and investigation page