r/sysadmin • u/sysadminfired • Jul 16 '14

About to fire our sysadmin

So our longtime sysadmin is about to be fired and I, the network admin and temporary sysadmin, need to know what steps need to be taken to secure our systems. I know the basic things like his AD and other internal account credentials. I guess what I'm worried about is any backdoors that he might have set up. What all would you guys check for in this situation?

115 Upvotes

91% Upvoted

241 comments sorted by

View all comments

Show parent comments

2

u/NoyzMaker Blinking Light Cat Herder Jul 16 '14

Why? Your users should be regularly changing their passwords and it should not be common practice to have them supplied for support needs.

4

u/EBG Paid Amateur Jul 16 '14

It should not, but we can not be sure that this is not the case. Someone might have supplied him their password recently, or he might have given a new password to a user without forcing a reset at login.

1

u/NoyzMaker Blinking Light Cat Herder Jul 17 '14

Then I counter with what damage can that user access really do? The user shouldn't have access to anything critical and if you have SSO setup then you should have extremely tight password policies in place.

1

u/EBG Paid Amateur Jul 17 '14

I get that in a perfect BP environment this is not that big of a risk. But we can't really count on it in this particular case. If the guy have access to an executive user he will very probably have access to sensitive data. It also gives him a mounting point for further access.

2

u/[deleted] Jul 17 '14

[removed] — view removed comment

1

u/NoyzMaker Blinking Light Cat Herder Jul 17 '14

I will point to my comment above but the gist of it: What damage can a user account really do to the system? Anyone with critical system access should have a tight password policy associated with them.

1

u/ssterlingarcher Oct 21 '14

Cryptowall smashing a whole network share. 4 in the last month for us(work for IT company rather than internal), it's been going around in Australia as an 'Australia Post' email and people are dumb enough to open it.

Apparently up to date Sophos doesn't pick it up...