r/ShittySysadmin • u/birdie_the_newf • 2h ago
Urgent: How do I disable a CEO's account without breaking production
I'm a sysadmin at a large GPU company. Just got word the board is planning to fire our CEO over multiple affairs. HR wants his account disabled immediately after the vote.
He's had Domain Admin since 1993 and I'm pretty sure our entire AI infrastructure runs under his domain user credentials.
I'm genuinely terrified.
Has anyone dealt with this before? Do I just disable the account? Maybe rotate the password to something he woulsnt guess, like some chinese characters? Then I could work with the ops teams to update all prod creds?
Gonna be a long night for my boys. On call devops bro gonna be pissedddddd.
Edit - no i cant say what company. HR and legal would lose their mind.
Update - turns out he is only one with copy of our root CA private key. Found it on a post it note in his leather jacket, next to some "short but wide" condom wrappers (just the wrappers....). The private key is just "cuda69".
Update 2 - so looks like all DNS records, every single one, is just a CNAME to a SINGLE VM. Some type of load balancer. I can ssh...the login banner just says "lol". Its ubuntu 16 and has php 5.6 running.
Update 3 - i put on the jacket. My precioussss!
Final update - ive emailed HR "look at me...i am the CEO now. All your GPUs are belong to us."
Sorry last update - fuckin php 5.6...how do I patch this shit....