Offboarding an employee — the list of things to close

An account left by a former employee is rarely a threat because somebody wants to do harm. It is a threat because it has no owner who would notice something happening to it. Nobody checks whether anyone logs in. Nobody changes the password. Nobody reports that odd mail is arriving there.

On top of that comes something simpler: passwords get reused. A breach at an entirely different service three years ago is enough for a stranger to get into an account nobody at the company remembers.

This note is a list to copy. There is nothing revelatory in it — its value is that it is complete and exists before the day it is needed.

The same day

Order matters: what grants access from outside comes first.

• Remote access — VPN, remote desktop, anything that gets into the company network from outside the office.
• Domain / directory account — disabled, not deleted. More on that below.
• Mail — sign-in blocked, mailbox retained.
• Multi-factor authentication — registered devices removed, otherwise the former employee’s phone still generates valid codes.
• Active sessions — signed out everywhere. Disabling an account does not end sessions already open; in some services they last for weeks.
• Cloud services bought outside IT — design tools, storage, chat, CRM, the invoicing system. This is the most common gap, because users set those accounts up themselves.

Within a few days

• SSH keys and access tokens — removed from servers and repositories. A key does not stop working because a domain account was disabled.
• Shared passwords this person knew. With a password manager, revoking access is enough. Without one they have to be rotated, because a password shared once is a password burned.
• Physical access — door card, keys, alarm code.
• Equipment — laptop, phone, storage media. Record serial numbers at issue, because at return nobody remembers what was given to whom.
• Mail forwarding to whoever takes over, with an agreed end date. Without a date such forwards run for years.
• Company phone number — transferred or retired, but deliberately: numbers are often tied to account recovery.
• Banking signatures and permissions, if the person held any.

The things most often forgotten

Automations and scheduled jobs running under their account. A backup script, a scheduled task, an integration between systems, a rule forwarding reports. Disabling the account stops all of them — sometimes silently, and the company finds out a month later.

So before disabling, check whether that account runs anything. If it does, move it to a service account first and disable afterwards.

Accounts at external providers registered to a company address — domains, hosting, certificates, vendor accounts. This is the most painful one, because recovering a domain registered to a former employee’s address can take weeks.

Access to documents shared with “anyone with the link”. Disabling the account does not invalidate those links.

Disable, do not delete

The account should be disabled and left, not removed straight away. Three reasons:

1. In some systems deleting an account also deletes history, file permissions and associations that cannot be reconstructed afterwards.
2. Through the first weeks it regularly turns out that something was tied to that account.
3. In a dispute or an audit, access to the correspondence may be needed.

A sensible deletion date is a few months after departure, agreed in advance and written down. Without a written deadline the account stays forever — and we are back where we started.

How to make this work

The list above is useless if it is written on the day of the parting. Two things make it work:

Tie it to the HR process. Whoever handles employment matters knows about a departure before IT does. If the information does not pass automatically, it passes by accident.

Keep the access list at hiring, not at leaving. Reconstructing after the fact who had access to what is far harder than adding to it as you go. It is the same document read from the other end.