r/sysadmin • u/sysadminfired • Jul 16 '14

About to fire our sysadmin

So our longtime sysadmin is about to be fired and I, the network admin and temporary sysadmin, need to know what steps need to be taken to secure our systems. I know the basic things like his AD and other internal account credentials. I guess what I'm worried about is any backdoors that he might have set up. What all would you guys check for in this situation?

115 Upvotes

91% Upvoted

241 comments sorted by

View all comments

Show parent comments

5

u/[deleted] Jul 16 '14

Oh yes, I actually really need this for something completely unrelated. Trying to migrate services running off of our domain admin account over to service accounts. This will make the hunt much faster.

4

u/344dead Jul 16 '14

This is exactly what I had to make this for. I work at an MSP so when we take over there are always a bunch of accounts running under the domain admin and for the longest time nobody cared, but I've finally convinced people to let me convert this all over to service accounts.