Policy implications of changing passwords versus disabling accounts in Active Directory

Question

Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is the only supported way to disable a user, but other hacks seem to be prevalent to support legacy apps or processes.

I ask because I believe this is the only secure way, but many guides and companies tend to follow an approach which changes the password for the user to something they don't know. I think other methods such as moving an account to an OU which cannot log in are even more flawed.

Historically this might have been a good practice when all applications where on-premises, but with cloud applications using many sync tools it seems like an AD account being disabled is the only safe indicator for upstream applications.

It seems like some applications like the latest versions of Outlook with O365 support invalidation of credentials with ADAL following a password reset, but I doubt this is universal.

Answer 1

You are correct, the ideal off-boarding process would be to disable the user. However there are situations where the user has company data that is located on his personal profile, be it on premise or in the cloud. Since cloud and on-premise services usually could have some kind disabled user data purging configured. You'd rather be on the safe side and change the password instead of disabling the user. Also even with cloud services you sometimes have glitches and can't change the user that is in charge of a certain process or task and you'd rather ride it out. In many organizations the IT manager is asked to take ownership of the user's account and to copy files that were left on the profile.

Answer 2

We do both: change password to something random AND disable the account.

Disable is the "proper" answer. However, if an account is accidentally re-enabled, you want to be protected. It could even be something innocuous like the former employee still had the company email account setup on their phone with a cached password.

Also, I have seen some third party apps that use LDAP for authentication but did not respect the "account disabled" flag. So the user could still log into the app with a disabled account. Changing the password guards against this.