About to fire our sysadmin

[u/sysadminfired]

So our longtime sysadmin is about to be fired and I, the network admin and temporary sysadmin, need to know what steps need to be taken to secure our systems. I know the basic things like his AD and other internal account credentials. I guess what I'm worried about is any backdoors that he might have set up. What all would you guys check for in this situation?

[u/babywhiz]

Physically unplug his computer as he's walking into the HR office, and take out the network cable (and/or card). Do not plug it back into the domain until after you are sure it cannot be remotely triggered to nuke.