1

Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is the only supported way to disable a user, but other hacks seem to be prevalent to support legacy apps or processes.

I ask because I believe this is the only secure way, but many guides and companies tend to follow an approach which changes the password for the user to something they don't know. I think other methods such as moving an account to an OU which cannot log in are even more flawed.

Historically this might have been a good practice when all applications where on-premises, but with cloud applications using many sync tools it seems like an AD account being disabled is the only safe indicator for upstream applications.

It seems like some applications like the latest versions of Outlook with O365 support invalidation of credentials with ADAL following a password reset, but I doubt this is universal.

Improve this question

2 Answers 2

Reset to default
2

You are correct, the ideal off-boarding process would be to disable the user. However there are situations where the user has company data that is located on his personal profile, be it on premise or in the cloud. Since cloud and on-premise services usually could have some kind disabled user data purging configured. You'd rather be on the safe side and change the password instead of disabling the user. Also even with cloud services you sometimes have glitches and can't change the user that is in charge of a certain process or task and you'd rather ride it out. In many organizations the IT manager is asked to take ownership of the user's account and to copy files that were left on the profile.

Improve this answer
1
  • I'd add to this, I recommend always changing the password in all cases. I've seen accounts get reenabled due to someone suddently realizing that the deactivated account was the only one with access to resource-x or it was used in some internal service somewhere. In these cases they rarely remember to reset the password of the reenabled account at this point.
    – Claus
    Feb 23, 2017 at 19:38
1

We do both: change password to something random AND disable the account.

Disable is the "proper" answer. However, if an account is accidentally re-enabled, you want to be protected. It could even be something innocuous like the former employee still had the company email account setup on their phone with a cached password.

Also, I have seen some third party apps that use LDAP for authentication but did not respect the "account disabled" flag. So the user could still log into the app with a disabled account. Changing the password guards against this.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.