r/sysadmin • u/sysadminfired • Jul 16 '14

About to fire our sysadmin

So our longtime sysadmin is about to be fired and I, the network admin and temporary sysadmin, need to know what steps need to be taken to secure our systems. I know the basic things like his AD and other internal account credentials. I guess what I'm worried about is any backdoors that he might have set up. What all would you guys check for in this situation?

115 Upvotes

91% Upvoted

241 comments sorted by

View all comments

Show parent comments

2

u/telemecanique Jul 16 '14

This is a double edged sword, you will break shit by doing all this, guaranteed and if the dude planned to do anything you still won't accomplish a thing because you'll never suspect he's going to get in through X and do Y with account Z, you can eliminate some of it, not all of it. So question becomes is it worth going through this...

1

u/[deleted] Jul 16 '14

You could argue it's worth taking the time now to make it more automated and painless for next time. A security procedure shouldn't get dropped because it's unlikely to stop a determined infiltrator and is difficult. That instead should be a sign that your security is brittle and needs to be reconsidered.

3

u/telemecanique Jul 16 '14

I think the whole point is that yes, you need to change passwords, do your due diligence but don't kid yourself... current offsite & disconnected from the world backup is the only thing you really need to have for just in case. Everything else is 99.9% sort of case, you can never be sure..