Well the title says it all really. Obviously if they return it's easy to enable but I'm talking specifically about leavers where there is no intention of returning.

Many places simply disable accounts rather than delete them. Is there a security reason for this? I'm not sure I see any risks with disabling the account rather than deleting it.

marked as duplicate by PwdRsch, Steve, Xander, CaffeineAddiction, Matthew Feb 24 '17 at 21:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Can sometimes be indicative of wanting to preserve an audit trail for actions that the leaver took, where this trail is linked to the account. Quite common in some CMS products, for example. – Matthew Feb 24 '17 at 15:06

This depends on the context of course but in general, leaving an account helps with accountability, and like Matthew mentioned, with audit trails. Imagine the scenario where usernames are formed of the first letter of the first name, and the full last name, John Smith becomes "jsmith", but John decides to leave the company and soon after he is replaced by Jane Smith, her username would be "jsmith" as well. Preserving the previous user would stop an accidental impersonation from happening, which may also not be accidental in every situation.

Another situation may happen if the process of deleting a user removed everything linked to that user, recently Gitlab had a hard time partly because a staff user was flagged for removal and in the process a major database was taken down, in this case the decision of deleting a user was costly.

In general, if there is uncertainty on what would happen when deleting a user, the best option is to disable the user instead of deleting it. So yes, while there are security considerations, there are also operational concerns.


It mainly depends on what the account represented. If it is only a grant access, invalidating or deleting it does not make much difference.

But it turns different as soon as resources can be associated with accounts. Think of posts or comments. They are normally associated with the account that created them. If the account is deleted, what should become the associated resources and how should they be displayed?

And the problem is even worse with logs. Normally logs are kept for a time for many reasons, and for example for researches in case of a technical or legal incident. If the account has been deleted, the site admin will no longer be able to associate a logged action.

For that reasons, the common usage is to first invalidate a leavers account. In fact the account should not be deleted untill it has no traces in the logs and no resources are associated with it. Only at that time it can be safely deleted. And if archives are kept for longer periods of time, the account should persist (even if in a deleted state) all the time the archives could be used

Not the answer you're looking for? Browse other questions tagged or ask your own question.