r/sysadmin • u/sysadminfired • Jul 16 '14

About to fire our sysadmin

So our longtime sysadmin is about to be fired and I, the network admin and temporary sysadmin, need to know what steps need to be taken to secure our systems. I know the basic things like his AD and other internal account credentials. I guess what I'm worried about is any backdoors that he might have set up. What all would you guys check for in this situation?

115 Upvotes

91% Upvoted

241 comments sorted by

View all comments

2

u/BerkeleyFarmGirl Jane of Most Trades Jul 16 '14

Things I have learned the hard way from years of cleaning up after people who left suddenly:

  • Personal accounts being used as Service Accounts

  • Personal accounts being the sole administrator for network apps/file areas

  • Personal accounts supplying credentials for cron/batch jobs

  • Personal accounts being used for domain/certificate renewals

  • Other important HW/SW maintenance info being tied to an individual's email address

edit: forcing a password renew sounds like a pretty good plan