We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to change the password for all those services. Luckily, it's happened twice in a three years span, but it's still a pain.

How do you deal with shared credentials when an employee leaves? Especially if you're in a large organization where people are coming and leaving on a monthly basis. Many of those services don't provide LDAP integration, so even if we disable their account, they still have access to the service.

  • More than a pain, it exposes a real security weakness if not done properly, consistently, and audited.
    – schroeder
    Jul 2, 2018 at 8:24

1 Answer 1


First, re-engineer your account management process, where possible, so that users have personal admin accounts and the built-in admin account is disabled, or that built-in account password is stored in a secure location such that your admins cannot get unauthorised access to it (e.g. password vault).

Second, if you cannot use account separation on the device/service level, then consider using one of the many privileged access tools or Cloud Service Brokers (CSB) (e.g. CyberArc, Thycotic, etc.) so that only the system knows the password and account separation is achieved on a management layer. Blocking access to a user is a 1-click operation in the tool. Changing passwords is equally easy and the authorised users experience no change or inconvenience.

Third, even if you do the above, you have a manual documentation and audit process to engage:

  1. document all services that need to be managed
  2. document all accounts and users on each service
  3. review all accounts/users on a periodic basis (annually? quarterly? monthly?) to confirm fitness
  4. audit the completeness of all services and accounts

Obviously, a privileged access tool or a Cloud Service Broker is the way to go for consistency and uptime.

You must log in to answer this question.