From b107afc13c9a25d23defd0ee9ccd1c315e8f6170 Mon Sep 17 00:00:00 2001
From: Ross Scroggs <taers232c@users.noreply.github.com>
Date: Mon, 27 Aug 2018 15:26:06 -0700
Subject: [PATCH] Add ability to specify suspended/not suspended users for
 groups and ous (#786)

Simplify specifying ChromeBooks by serial number
---
 src/GamCommands.txt |  50 +++++++-----
 src/gam.py          | 183 ++++++++++++++++++++++++--------------------
 src/var.py          |  10 ++-
 3 files changed, 138 insertions(+), 105 deletions(-)

diff --git a/src/GamCommands.txt b/src/GamCommands.txt
index 9c1123c2..971fe5d5 100644
--- a/src/GamCommands.txt
+++ b/src/GamCommands.txt
@@ -41,14 +41,14 @@ If an item contains spaces, it should be surrounded by ".
 <FileFormat> ::=
 	csv|html|txt|tsv|jpeg|jpg|png|svg|pdf|rtf|pptx|xlsx|docx|odt|ods|openoffice|ms|microsoft|micro$oft
 <LabelColorHex> ::=
-        #000000|#076239|#0b804b|#149e60|#16a766|#1a764d|#1c4587|#285bac|
-        #2a9c68|#3c78d8|#3dc789|#41236d|#434343|#43d692|#44b984|#4a86e8|
-        #653e9b|#666666|#68dfa9|#6d9eeb|#822111|#83334c|#89d3b2|#8e63ce|
-        #999999|#a0eac9|#a46a21|#a479e2|#a4c2f4|#aa8831|#ac2b16|#b65775|
-        #b694e8|#b9e4d0|#c6f3de|#c9daf8|#cc3a21|#cccccc|#cf8933|#d0bcf1|
-        #d5ae49|#e07798|#e4d7f5|#e66550|#eaa041|#efa093|#efefef|#f2c960|
-        #f3f3f3|#f691b3|#f6c5be|#f7a7c0|#fad165|#fb4c2f|#fbc8d9|#fcda83|
-        #fcdee8|#fce8b3|#fef1d1|#ffad47|#ffbc6b|#ffd6a2|#ffe6c7|#ffffff
+	#000000|#076239|#0b804b|#149e60|#16a766|#1a764d|#1c4587|#285bac|
+	#2a9c68|#3c78d8|#3dc789|#41236d|#434343|#43d692|#44b984|#4a86e8|
+	#653e9b|#666666|#68dfa9|#6d9eeb|#822111|#83334c|#89d3b2|#8e63ce|
+	#999999|#a0eac9|#a46a21|#a479e2|#a4c2f4|#aa8831|#ac2b16|#b65775|
+	#b694e8|#b9e4d0|#c6f3de|#c9daf8|#cc3a21|#cccccc|#cf8933|#d0bcf1|
+	#d5ae49|#e07798|#e4d7f5|#e66550|#eaa041|#efa093|#efefef|#f2c960|
+	#f3f3f3|#f691b3|#f6c5be|#f7a7c0|#fad165|#fb4c2f|#fbc8d9|#fcda83|
+	#fcdee8|#fce8b3|#fef1d1|#ffad47|#ffbc6b|#ffd6a2|#ffe6c7|#ffffff
 <Language> ::=
 	ach|af|ag|ak|am|ar|az|be|bem|bg|bn|br|bs|ca|chr|ckb|co|crs|cs|cy|da|de|ee|el|en|en-gb|en-us|eo|es|es-419|et|eu|
 	fa|fi|fo|fr|fr-ca|fy|ga|gaa|gd|gl|gn|gu|ha|haw|he|hi|hr|ht|hu|hy|ia|id|ig|in|is|it|iw|ja|jw|
@@ -145,7 +145,6 @@ If an item contains spaces, it should be surrounded by ".
 <CourseParticipantType> ::= teacher|teachers|student|students
 <CourseState> ::= active|archived|provisioned|declined
 <CrOSID> ::= <String>
-<CrOSItem> ::= <CrOSID>|(query:<QueryCrOS>)|(query:orgunitpath:<OrgUnitPath>)
 <CustomerID> ::= <String>
 <DomainAlias> ::= <String>
 <DriveFileACLRole> ::= commenter|editor|organizer|owner|reader|writer
@@ -211,6 +210,7 @@ If an item contains spaces, it should be surrounded by ".
 <RoleAssignmentID> ::= <String>
 <SchemaName> ::= <String>
 <Section> ::= <String>
+<SerialNumber> ::= <String>
 <S/MIMEID> ::= <String>	
 <StudentItem> ::= <EmailAddress>|<UniqueID>|<String>
 <TeamDriveID> ::= <String>
@@ -520,7 +520,7 @@ Items, separated by spaces, with spaces, commas or single quotes in the items th
 <CourseIDList> ::= "<CourseID>(,<CourseID>)*"
 <CourseStateList> ::= "<CourseState>(,<CourseState>)*"
 <CrOSFieldNameList> ::= "<CrOSFieldName>(,<CrOSFieldName>)*"
-<CrOSList> ::= "<CrOSID>(,<CrOSID>)*"
+<CrOSIDList> ::= "<CrOSID>(,<CrOSID>)*"
 <DriveFileList> ::= "<DriveFileItem>(,<DriveFileItem>)*"
 <EmailAddressList> ::= "<EmailAddress>(,<EmailAddress>)*"
 <EmailItemList> ::= "<EmailItem>(,<EmailItem>)*"
@@ -549,6 +549,7 @@ Items, separated by spaces, with spaces, commas or single quotes in the items th
 <ResourceIDList> ::= "<ResourceID>(,<ResourceID>)*"
 <SKUIDList> ="<SKUID>(,<SKUID>)*"
 <SchemaNameList> ::= "<SchemaName>(,<SchemaName>)*"
+<SerialNumberList> ::= "<SerialNumber>(,<SerialNumber>)*"
 <TeamDriveIDList> ::= "<TeamDriveID>(,<TeamDriveID>)*"
 <UserFieldNameList> ::= "<UserFieldName>(,<UserFieldName>)*"
 <UserList> ::= "<UserItem>(,<UserItem>)*"
@@ -557,9 +558,14 @@ Items, separated by spaces, with spaces, commas or single quotes in the items th
 
 Specify a collection of ChromeOS devices by directly specifying them
 
+<CrOSEntity> ::=
+	<CrOSIDList> | (cros_sn <SerialNumberList>) |
+	(query:<QueryCrOS>)|(query:orgunitpath:<OrgUnitPath>)|(query <QueryCrOS>)
+
 <CrOSTypeEntity> ::=
 	(all cros)|
-	(cros <CrOSList>)|
+	(cros <CrOSIDList>)|
+	(cros_sn <SerialNumberList>)|
 	(crosfile <FileName>)|
 	(croscsvfile <FileName>:<FieldName>)|
 	(crosquery <QueryCrOS>)|
@@ -573,9 +579,13 @@ Specify a collection of Users by directly specifying them or by specifiying item
 	(all users)|
 	(user <UserItem>)|
 	(users <UserList>)|
-	(group <GroupItem)|
+	(group|group_ns|group_susp <GroupItem)|
 	(ou|org <OrgUnitPath)|
+	(ou_ns|org_ns <OrgUnitPath)|
+	(ou_susp|org_susp <OrgUnitPath)|
 	(ou_and_children|ou_and_child <OrgUnitPath>)|
+	(ou_and_children_ns|ou_and_child_ns <OrgUnitPath>)|
+	(ou_and_children_susp|ou_and_child_susp <OrgUnitPath>)|
 	(courseparticipants <CourseID>)|
 	(students <CourseID>)|
 	(teachers <CourseID>)|
@@ -710,7 +720,6 @@ Specify a collection of Users by directly specifying them or by specifiying item
 <UserAttributes> ::=
 	(address clear|(type work|home|other|(custom <String>) [unstructured|formatted <String>] [pobox <String>] [extendedaddress <String>] [streetaddress <String>]
 		[locality <String>] [region <String>] [postalcode <String>] [country <String>] [countrycode <String>] notprimary|primary))|
-	(admin <Boolean>)|
 	(agreed2terms|agreedtoterms <Boolean>)|
 	(changepassword|changepasswordatnextlogin <Boolean>)|
 	(crypt|sha|sha1|sha-1|md5|nohash)|
@@ -863,7 +872,7 @@ gam create org|ou <Name> [description <String>] [parent <OrgUnitPath>] [inherit|
 gam update org|ou <OrgUnitPath> [name <Name>] [description <String>] [parent <OrgUnitPath>] [inherit|noinherit]
 gam update org|ou <OrgUnitPath> add|move <CrOSTypeEntity>|<UserTypeEntity>
 gam delete org|ou <OrgUnitPath>
-gam info org|ou <OrgUnitPath> [nousers] [children|child]
+gam info org|ou <OrgUnitPath> [nousers|notsuspended|suspended] [children|child]
 gam print orgs|ous [todrive] [toplevelonly] [from_parent <OrgUnitPath>] [allfields|(fields <OrgUnitFieldNameList>)]
 
 gam create alias|nickname <EmailAddress> user|group|target <UniqueID>|<EmailAddress>
@@ -889,8 +898,8 @@ gam calendar <CalendarItem> wipe
 
 gam calendar <CalendarItem> modify <CalendarSettings>+
 
-gam update cros <CrOSItem> (<CrOSAttributes>+)|(action deprovision_same_model_replace|deprovision_different_model_replace|deprovision_retiring_device|disable|reenable [acknowledge_device_touch_requirement])
-gam info cros <CrOSItem> [nolists] [listlimit <Number>] [start <Date>] [end <Date>]
+gam update cros <CrOSEntity> (<CrOSAttributes>+)|(action deprovision_same_model_replace|deprovision_different_model_replace|deprovision_retiring_device|disable|reenable [acknowledge_device_touch_requirement])
+gam info cros <CrOSEntity> [nolists] [listlimit <Number>] [start <Date>] [end <Date>]
 	[basic|full|allfields] <CrOSFieldName>* [fields <CrOSFieldNameList>] [downloadfile latest|<Time>] [targetfolder <FilePath>]
 
 gam print cros [todrive] [(query <QueryCrOS>)|(queries <QueryCrOSList>)] [limittoou <OrgUnitItem>]
@@ -953,11 +962,11 @@ gam print mobile [todrive] [(query <QueryMobile>)|(queries <QueryMobileList>)] [
 
 gam create group <EmailAddress> <GroupAttributes>*
 gam update group <GroupItem> [admincreated <Boolean>] [email <EmailAddress>] <GroupAttributes>*
-gam update group <GroupItem> add [owner|manager|member] [notsuspended] <UserTypeEntity>
+gam update group <GroupItem> add [owner|manager|member] [notsuspended|suspended] <UserTypeEntity>
 gam update group <GroupItem> delete|remove [owner|manager|member] <UserTypeEntity>
-gam update group <GroupItem> sync [owner|manager|member] [notsuspended] <UserTypeEntity>
+gam update group <GroupItem> sync [owner|manager|member] [notsuspended|suspended] <UserTypeEntity>
 gam update group <GroupItem> update [owner|manager|member] <UserTypeEntity>
-gam update group <GroupItem> clear [member] [manager] [owner] [suspended]
+gam update group <GroupItem> clear [member] [manager] [owner] [notsuspended|suspended]
 gam delete group <GroupItem>
 gam info group <GroupItem> [nousers] [noaliases] [groups]
 
@@ -966,7 +975,8 @@ gam print groups [todrive] ([domain <DomainName>] ([member <UserItem>]|[query <Q
 	[members|memberscount] [managers|managerscount] [owners|ownerscount]
 	[delimiter <Character>] [sortheaders]
 
-gam print group-members|groups-members [todrive] ([domain <DomainName>] ([member <UserItem>]|[query <QueryGroup>]))|[group <GroupItem>]
+gam print group-members|groups-members [todrive]
+	([domain <DomainName>] ([member <UserItem>]|[query <QueryGroup>]))|[group|group_ns|group_susp <GroupItem>] [notsuspended|suspended]
 	[roles <GroupRoleList>] [membernames] [fields <MembersFieldNameList>]
 
 gam print license|licenses|licence|licences [todrive] [(products|product <ProductIDList>)|(skus|sku <SKUIDList>)]
diff --git a/src/gam.py b/src/gam.py
index 84923d10..162aeb74 100755
--- a/src/gam.py
+++ b/src/gam.py
@@ -1595,7 +1595,7 @@ def doAddCourseParticipant():
 def doSyncCourseParticipants():
   courseId = addCourseIdScope(sys.argv[2])
   participant_type = sys.argv[4].lower()
-  diff_entity_type = sys.argv[5]
+  diff_entity_type = sys.argv[5].lower()
   diff_entity = sys.argv[6]
   current_course_users = getUsersToModify(entity_type=participant_type, entity=courseId)
   print
@@ -8388,17 +8388,17 @@ def doUpdateGroup():
     return emailAddress
 
   def _getRoleAndUsers():
-    checkNotSuspended = False
+    checkSuspended = None
     role = ROLE_MEMBER
     i = 5
     if sys.argv[i].lower() in GROUP_ROLES_MAP:
       role = GROUP_ROLES_MAP[sys.argv[i].lower()]
       i += 1
-    if sys.argv[i].lower() == u'notsuspended':
-      checkNotSuspended = True
+    if sys.argv[i].lower() in [u'suspended', u'notsuspended']:
+      checkSuspended = sys.argv[i].lower() == u'suspended'
       i += 1
     if sys.argv[i].lower() in usergroup_types:
-      users_email = getUsersToModify(entity_type=sys.argv[i], entity=sys.argv[i+1], checkNotSuspended=checkNotSuspended, groupUserMembersOnly=False)
+      users_email = getUsersToModify(entity_type=sys.argv[i].lower(), entity=sys.argv[i+1], checkSuspended=checkSuspended, groupUserMembersOnly=False)
     else:
       users_email = [normalizeEmailAddressOrUID(sys.argv[i], checkForCustomerId=True)]
     return (role, users_email)
@@ -8500,7 +8500,7 @@ def doUpdateGroup():
           except (GAPI_memberNotFound, GAPI_invalidMember) as e:
             print u' Group: {0}, {1} Update to {2} Failed: {3}'.format(group, users_email[0], role, str(e))
     else: # clear
-      suspended = False
+      checkSuspended = None
       fields = [u'email', u'id']
       roles = []
       i = 5
@@ -8509,8 +8509,8 @@ def doUpdateGroup():
         if myarg.upper() in [ROLE_OWNER, ROLE_MANAGER, ROLE_MEMBER]:
           roles.append(myarg.upper())
           i += 1
-        elif myarg == u'suspended':
-          suspended = True
+        elif myarg in [u'suspended', u'notsuspended']:
+          checkSuspended = myarg == u'suspended'
           fields.append(u'status')
           i += 1
         else:
@@ -8529,12 +8529,14 @@ def doUpdateGroup():
                                page_message=page_message,
                                throw_reasons=GAPI_MEMBERS_THROW_REASONS,
                                groupKey=group, roles=listRoles, fields=listFields, maxResults=GC_Values[GC_MEMBER_MAX_RESULTS])
-        if not suspended:
+        if checkSuspended is None:
           users_email = [member.get(u'email', member[u'id']) for member in result if not validRoles or member.get(u'role', ROLE_MEMBER) in validRoles]
-        else:
+        elif checkSuspended:
           users_email = [member.get(u'email', member[u'id']) for member in result if (not validRoles or member.get(u'role', ROLE_MEMBER) in validRoles) and member[u'status'] == u'SUSPENDED']
+        else: # elif not checkSuspended
+          users_email = [member.get(u'email', member[u'id']) for member in result if (not validRoles or member.get(u'role', ROLE_MEMBER) in validRoles) and member[u'status'] != u'SUSPENDED']
         if len(users_email) > 1:
-          sys.stderr.write(u'Group: {0}, Will remove {1} {2}{3}s.\n'.format(group, len(users_email), [u'', u'suspended '][suspended], roles))
+          sys.stderr.write(u'Group: {0}, Will remove {1} {2}{3}s.\n'.format(group, len(users_email), u'' if checkSuspended is None else [u'Non-suspended ', u'Suspended '][checkSuspended], roles))
           for user_email in users_email:
             items.append(['gam', 'update', 'group', group, 'remove', user_email])
         else:
@@ -8606,23 +8608,27 @@ def doUpdateAlias():
       callGAPI(cd.groups().aliases(), u'insert', groupKey=target_email, body={u'alias': alias})
   print u'updated alias %s' % alias
 
-def doUpdateCros():
-  cd = buildGAPIObject(u'directory')
-  deviceId = sys.argv[3]
-  if deviceId[:6].lower() == u'query:':
-    query = deviceId[6:]
+def getCrOSDeviceEntity(i, cd):
+  myarg = sys.argv[i].lower()
+  if myarg == u'cros_sn':
+    return i+2, getUsersToModify(u'cros_sn', sys.argv[i+1])
+  if myarg == u'query':
+    return i+2, getUsersToModify(u'crosquery', sys.argv[i+1])
+  if myarg[:6] == u'query:':
+    query = sys.argv[i][6:]
     if query[:12].lower() == u'orgunitpath:':
       kwargs = {u'orgUnitPath': query[12:]}
     else:
       kwargs = {u'query': query}
-    devices_result = callGAPIpages(cd.chromeosdevices(), u'list', u'chromeosdevices',
-                                   customerId=GC_Values[GC_CUSTOMER_ID], fields=u'chromeosdevices/deviceId,nextPageToken', **kwargs)
-    devices = list()
-    for a_device in devices_result:
-      devices.append(a_device[u'deviceId'])
-  else:
-    devices = [deviceId,]
-  i = 4
+    devices = callGAPIpages(cd.chromeosdevices(), u'list', u'chromeosdevices',
+                            customerId=GC_Values[GC_CUSTOMER_ID],
+                            fields=u'nextPageToken,chromeosdevices(deviceId)', **kwargs)
+    return i+1, [device[u'deviceId'] for device in devices]
+  return i+1, sys.argv[i].replace(u',', u' ').split()
+
+def doUpdateCros():
+  cd = buildGAPIObject(u'directory')
+  i, devices = getCrOSDeviceEntity(3, cd)
   update_body = {}
   action_body = {}
   orgUnitPath = None
@@ -8721,11 +8727,13 @@ def doUpdateOrg():
   cd = buildGAPIObject(u'directory')
   orgUnitPath = getOrgUnitItem(sys.argv[3])
   if sys.argv[4].lower() in [u'move', u'add']:
-    if sys.argv[5].lower() in usergroup_types:
-      users = getUsersToModify(entity_type=sys.argv[5].lower(), entity=sys.argv[6])
+    entity_type = sys.argv[5].lower()
+    if entity_type in usergroup_types:
+      users = getUsersToModify(entity_type=entity_type, entity=sys.argv[6])
     else:
-      users = getUsersToModify(entity_type=u'user', entity=sys.argv[5])
-    if (sys.argv[5].lower().startswith(u'cros')) or ((sys.argv[5].lower() == u'all') and (sys.argv[6].lower() == u'cros')):
+      entity_type = u'users'
+      users = getUsersToModify(entity_type=entity_type, entity=sys.argv[5])
+    if (entity_type.startswith(u'cros')) or ((entity_type == u'all') and (sys.argv[6].lower() == u'cros')):
       for l in range(0, len(users), 50):
         move_body = {u'deviceIds': users[l:l+50]}
         print u' moving %s devices to %s' % (len(move_body[u'deviceIds']), orgUnitPath)
@@ -9368,20 +9376,7 @@ def _getFilterDate(dateStr):
 
 def doGetCrosInfo():
   cd = buildGAPIObject(u'directory')
-  deviceId = sys.argv[3]
-  if deviceId[:6].lower() == u'query:':
-    query = deviceId[6:]
-    if query[:12].lower() == u'orgunitpath:':
-      kwargs = {u'orgUnitPath': query[12:]}
-    else:
-      kwargs = {u'query': query}
-    devices_result = callGAPIpages(cd.chromeosdevices(), u'list', u'chromeosdevices',
-                                   customerId=GC_Values[GC_CUSTOMER_ID], fields=u'chromeosdevices/deviceId,nextPageToken', **kwargs)
-    devices = list()
-    for a_device in devices_result:
-      devices.append(a_device[u'deviceId'])
-  else:
-    devices = [deviceId,]
+  i, devices = getCrOSDeviceEntity(3, cd)
   downloadfile = None
   targetFolder = GC_Values[GC_DRIVE_DIR]
   projection = None
@@ -9389,7 +9384,6 @@ def doGetCrosInfo():
   noLists = False
   startDate = endDate = None
   listLimit = 0
-  i = 4
   while i < len(sys.argv):
     myarg = sys.argv[i].lower().replace(u'_', u'')
     if myarg == u'nolists':
@@ -9736,10 +9730,11 @@ def doGetNotifications():
     print u'--------------'
     print u''
 
-def orgUnitPathQuery(path):
-  if path != u'/':
-    return u"orgUnitPath='{0}'".format(path.replace(u"'", u"\\'"))
-  return None
+def orgUnitPathQuery(path, checkSuspended):
+  query = u"orgUnitPath='{0}'".format(path.replace(u"'", u"\\'")) if path != u'/' else u''
+  if checkSuspended is not None:
+    query += u' isSuspended={0}'.format(checkSuspended)
+  return query
 
 def makeOrgUnitPathAbsolute(path):
   if path == u'/':
@@ -9807,6 +9802,7 @@ def getTopLevelOrgId(cd, orgUnitPath):
 
 def doGetOrgInfo(name=None, return_attrib=None):
   cd = buildGAPIObject(u'directory')
+  checkSuspended = None
   if not name:
     name = getOrgUnitItem(sys.argv[3])
     get_users = True
@@ -9820,6 +9816,9 @@ def doGetOrgInfo(name=None, return_attrib=None):
       elif myarg in [u'children', u'child']:
         show_children = True
         i += 1
+      elif myarg in [u'suspended', u'notsuspended']:
+        checkSuspended = myarg == u'suspended'
+        i += 1
       else:
         systemErrorExit(2, '%s is not a valid argument for "gam info org"' % sys.argv[i])
   if name == u'/':
@@ -9840,11 +9839,16 @@ def doGetOrgInfo(name=None, return_attrib=None):
   print_json(None, result)
   if get_users:
     name = result[u'orgUnitPath']
-    print u'Users: '
     page_message = u'Got %%total_items%% Users: %%first_item%% - %%last_item%%\n'
     users = callGAPIpages(cd.users(), u'list', u'users', page_message=page_message,
-                          message_attribute=u'primaryEmail', customer=GC_Values[GC_CUSTOMER_ID], query=orgUnitPathQuery(name),
+                          message_attribute=u'primaryEmail', customer=GC_Values[GC_CUSTOMER_ID], query=orgUnitPathQuery(name, checkSuspended),
                           fields=u'users(primaryEmail,orgUnitPath),nextPageToken', maxResults=GC_Values[GC_USER_MAX_RESULTS])
+    if checkSuspended is None:
+      print u'Users:'
+    elif not checkSuspended:
+      print u'Users (Not suspended):'
+    else:
+      print u'Users (Suspended):'
     for user in users:
       if show_children or (name.lower() == user[u'orgUnitPath'].lower()):
         sys.stdout.write(u' %s' % user[u'primaryEmail'])
@@ -10896,7 +10900,7 @@ def doPrintGroupMembers():
   todrive = False
   membernames = False
   customer = GC_Values[GC_CUSTOMER_ID]
-  usedomain = usemember = usequery = None
+  checkSuspended = usedomain = usemember = usequery = None
   roles = []
   fields = u'nextPageToken,members(email,id,role,status,type)'
   titles = [u'group']
@@ -10904,7 +10908,7 @@ def doPrintGroupMembers():
   groups_to_get = []
   i = 3
   while i < len(sys.argv):
-    myarg = sys.argv[i].lower()
+    myarg = sys.argv[i].lower().replace(u'_', u'')
     if myarg == u'todrive':
       todrive = True
       i += 1
@@ -10935,10 +10939,17 @@ def doPrintGroupMembers():
         else:
           systemErrorExit(2, '%s is not a valid role for "gam print group-members %s"' % (role, myarg))
       i += 2
-    elif myarg == u'group':
+    elif myarg in [u'group', u'groupns', u'groupsusp']:
       group_email = normalizeEmailAddressOrUID(sys.argv[i+1])
       groups_to_get = [{u'email': group_email}]
+      if myarg == u'groupns':
+        checkSuspended = False
+      elif myarg == u'groupsusp':
+        checkSuspended = True
       i += 2
+    elif myarg in [u'suspended', u'notsuspended']:
+      checkSuspended = myarg == u'suspended'
+      i += 1
     else:
       systemErrorExit(2, '%s is not a valid argument for "gam print group-members"' % sys.argv[i])
   if not groups_to_get:
@@ -10956,10 +10967,8 @@ def doPrintGroupMembers():
                                   soft_errors=True,
                                   groupKey=group_email, roles=listRoles, fields=listFields, maxResults=GC_Values[GC_MEMBER_MAX_RESULTS])
     for member in group_members:
-      for unwanted_item in [u'kind', u'etag']:
-        if unwanted_item in member:
-          del member[unwanted_item]
-      if validRoles and member.get(u'role', ROLE_MEMBER) not in validRoles:
+      if ((validRoles and member.get(u'role', ROLE_MEMBER) not in validRoles) or
+          (checkSuspended is not None and ((not checkSuspended and member[u'status'] == u'SUSPENDED') or (checkSuspended and member[u'status'] != u'SUSPENDED')))):
         continue
       for title in member:
         if title not in titles:
@@ -11743,7 +11752,7 @@ def _getRoleVerification(memberRoles, fields):
   else:
     return (set(), memberRoles, fields)
 
-def getUsersToModify(entity_type=None, entity=None, silent=False, member_type=None, checkNotSuspended=False, groupUserMembersOnly=True):
+def getUsersToModify(entity_type=None, entity=None, silent=False, member_type=None, checkSuspended=None, groupUserMembersOnly=True):
   got_uids = False
   if entity_type is None:
     entity_type = sys.argv[1].lower()
@@ -11754,7 +11763,11 @@ def getUsersToModify(entity_type=None, entity=None, silent=False, member_type=No
     users = [entity,]
   elif entity_type == u'users':
     users = entity.replace(u',', u' ').split()
-  elif entity_type == u'group':
+  elif entity_type in [u'group', u'group_ns', u'group_susp']:
+    if entity_type == u'group_ns':
+      checkSuspended = False
+    elif entity_type == u'group_susp':
+      checkSuspended = True
     got_uids = True
     group = entity
     if member_type is None:
@@ -11773,44 +11786,51 @@ def getUsersToModify(entity_type=None, entity=None, silent=False, member_type=No
     for member in members:
       if (((not groupUserMembersOnly) or (member[u'type'] == u'USER')) and
           (not validRoles or member.get(u'role', ROLE_MEMBER) in validRoles) and
-          not (checkNotSuspended and (member[u'status'] == u'SUSPENDED'))):
+          (checkSuspended is None or (not checkSuspended and member[u'status'] != u'SUSPENDED') or (checkSuspended and member[u'status'] == u'SUSPENDED'))):
         users.append(member.get(u'email', member[u'id']))
-  elif entity_type in [u'ou', u'org']:
+  elif entity_type in [u'ou', u'org', u'ou_ns', u'org_ns', u'ou_susp', u'org_susp',]:
+    if entity_type in [u'ou_ns', u'org_ns']:
+      checkSuspended = False
+    elif entity_type in [u'ou_susp', u'org_susp']:
+      checkSuspended = True
     got_uids = True
     ou = makeOrgUnitPathAbsolute(entity)
     users = []
     if ou.startswith(u'id:'):
       ou = callGAPI(cd.orgunits(), u'get',
                     customerId=GC_Values[GC_CUSTOMER_ID], orgUnitPath=ou, fields=u'orgUnitPath')[u'orgUnitPath']
-    query = orgUnitPathQuery(ou)
+    query = orgUnitPathQuery(ou, checkSuspended)
     page_message = None
     if not silent:
       printGettingAllItems(u'Users', query)
       page_message = u'Got %%total_items%% Users...'
     members = callGAPIpages(cd.users(), u'list', u'users', page_message=page_message,
-                            customer=GC_Values[GC_CUSTOMER_ID], fields=u'nextPageToken,users(primaryEmail,suspended,orgUnitPath)',
+                            customer=GC_Values[GC_CUSTOMER_ID], fields=u'nextPageToken,users(primaryEmail,orgUnitPath)',
                             query=query, maxResults=GC_Values[GC_USER_MAX_RESULTS])
     ou = ou.lower()
     for member in members:
-      if (ou == member.get(u'orgUnitPath', u'').lower()) and not (checkNotSuspended and member[u'suspended']):
+      if ou == member.get(u'orgUnitPath', u'').lower():
         users.append(member[u'primaryEmail'])
     if not silent:
       sys.stderr.write(u"%s Users are directly in the OU.\n" % len(users))
-  elif entity_type in [u'ou_and_children', u'ou_and_child']:
+  elif entity_type in [u'ou_and_children', u'ou_and_child', u'ou_and_children_ns', u'ou_and_child_ns', u'ou_and_children_susp', u'ou_and_child_susp']:
+    if entity_type in [u'ou_and_children_ns', u'ou_and_child_ns']:
+      checkSuspended = False
+    elif entity_type in [u'ou_and_children_susp', u'ou_and_child_susp']:
+      checkSuspended = True
     got_uids = True
     ou = makeOrgUnitPathAbsolute(entity)
     users = []
-    query = orgUnitPathQuery(ou)
+    query = orgUnitPathQuery(ou, checkSuspended)
     page_message = None
     if not silent:
       printGettingAllItems(u'Users', query)
       page_message = u'Got %%total_items%% Users...'
     members = callGAPIpages(cd.users(), u'list', u'users', page_message=page_message,
-                            customer=GC_Values[GC_CUSTOMER_ID], fields=u'nextPageToken,users(primaryEmail,suspended)',
+                            customer=GC_Values[GC_CUSTOMER_ID], fields=u'nextPageToken,users(primaryEmail)',
                             query=query, maxResults=GC_Values[GC_USER_MAX_RESULTS])
     for member in members:
-      if not (checkNotSuspended and member[u'suspended']):
-        users.append(member[u'primaryEmail'])
+      users.append(member[u'primaryEmail'])
     if not silent:
       sys.stderr.write(u"done.\r\n")
   elif entity_type in [u'query', u'queries']:
@@ -11829,11 +11849,10 @@ def getUsersToModify(entity_type=None, entity=None, silent=False, member_type=No
                               customer=GC_Values[GC_CUSTOMER_ID], fields=u'nextPageToken,users(primaryEmail,suspended)',
                               query=query, maxResults=GC_Values[GC_USER_MAX_RESULTS])
       for member in members:
-        if not checkNotSuspended or not member[u'suspended']:
-          email = member[u'primaryEmail']
-          if email not in usersSet:
-            usersSet.add(email)
-            users.append(email)
+        email = member[u'primaryEmail']
+        if (checkSuspended is None or checkSuspended == member[u'suspended']) and email not in usersSet:
+          usersSet.add(email)
+          users.append(email)
       if not silent:
         sys.stderr.write(u"done.\r\n")
   elif entity_type in [u'license', u'licenses', u'licence', u'licences']:
@@ -11888,15 +11907,15 @@ def getUsersToModify(entity_type=None, entity=None, silent=False, member_type=No
     users = []
     entity = entity.lower()
     if entity == u'users':
+      query = u'isSuspended=False'
       if not silent:
         printGettingAllItems(u'Users', None)
       page_message = u'Got %%total_items%% Users...'
       all_users = callGAPIpages(cd.users(), u'list', u'users', page_message=page_message,
-                                customer=GC_Values[GC_CUSTOMER_ID],
-                                fields=u'nextPageToken,users(primaryEmail,suspended)', maxResults=GC_Values[GC_USER_MAX_RESULTS])
+                                customer=GC_Values[GC_CUSTOMER_ID], query=query,
+                                fields=u'nextPageToken,users(primaryEmail)', maxResults=GC_Values[GC_USER_MAX_RESULTS])
       for member in all_users:
-        if not member[u'suspended']:
-          users.append(member[u'primaryEmail'])
+        users.append(member[u'primaryEmail'])
       if not silent:
         sys.stderr.write(u"done getting %s Users.\r\n" % len(users))
     elif entity == u'cros':
@@ -11915,11 +11934,13 @@ def getUsersToModify(entity_type=None, entity=None, silent=False, member_type=No
   elif entity_type == u'cros':
     users = entity.replace(u',', u' ').split()
     entity = u'cros'
-  elif entity_type in [u'crosquery', u'crosqueries']:
-    if entity_type == u'crosquery':
-      queries = [entity]
-    else:
+  elif entity_type in [u'crosquery', u'crosqueries', u'cros_sn']:
+    if entity_type == u'cros_sn':
+      queries = [u'id:{0}'.format(sn) for sn in shlexSplitList(entity)]
+    elif entity_type == u'crosqueries':
       queries = shlexSplitList(entity)
+    else:
+      queries = [entity]
     users = []
     usersSet = set()
     for query in queries:
diff --git a/src/var.py b/src/var.py
index 0fd18a00..00f0d0e1 100644
--- a/src/var.py
+++ b/src/var.py
@@ -24,10 +24,12 @@ TRUE = u'true'
 FALSE = u'false'
 true_values = [u'on', u'yes', u'enabled', u'true', u'1']
 false_values = [u'off', u'no', u'disabled', u'false', u'0']
-usergroup_types = [u'user', u'users', u'group', u'ou', u'org',
-                   u'ou_and_children', u'ou_and_child', u'query', u'queries',
-                   u'license', u'licenses', u'licence', u'licences', u'file', u'csv', u'csvfile', u'all',
-                   u'cros', u'crosquery', u'crosqueries', u'crosfile', u'croscsv', u'croscsvfile']
+usergroup_types = [u'user', u'users',
+                   u'group', u'group_ns', u'grooup_susp',
+                   u'ou', u'org', u'ou_ns', u'org_ns', u'ou_susp', u'org_susp',
+                   u'ou_and_children', u'ou_and_child', u'ou_and_children_ns', u'ou_and_child_ns', u'ou_and_children_susp', u'ou_and_child_susp',
+                   u'query', u'queries', u'license', u'licenses', u'licence', u'licences', u'file', u'csv', u'csvfile', u'all',
+                   u'cros', u'cros_sn', u'crosquery', u'crosqueries', u'crosfile', u'croscsv', u'croscsvfile']
 ERROR = u'ERROR'
 ERROR_PREFIX = ERROR+u': '
 WARNING = u'WARNING'