When an Employee Leaves, Their Passwords Should Too

May 5th, 2027

Someone hands in a resignation on a Friday. There is a card, a cake and a round of goodbyes. On Monday, the desk is empty and the email account is still active. The password has not changed. Nobody is quite sure who has the laptop.

This is one of the most common gaps in small business security, and it rarely comes from bad intentions. Offboarding happens in a hurry. The person leaving is often the one who knows which accounts exist. The manager is focused on the work that needs to be handed over. The IT provider may not hear about the departure until weeks later, if at all.

A departing employee is not automatically a threat. Most leave on good terms and never look back. The risk is not only the person. It is every account, device and shared password left behind, and every former contractor or vendor who still has a way in.

Start with the date, not the goodbye

The most important piece of information is the last working day. Everything else follows from it. Account access should end on that day, not after the next payroll cycle and not when someone remembers.

For a planned departure, the manager and the person leaving can build the handover list together. For an immediate departure, the manager needs a checklist that does not depend on cooperation. Both cases need the same categories.

The account checklist

Write down every system the person can reach. A typical small business list looks like this:

• Email. Disable the mailbox, set an automatic reply if appropriate, and decide who will monitor incoming messages. Do not leave the account active just so someone can read old mail.
• Microsoft 365 or Google Workspace. Remove the license, revoke sessions and transfer ownership of files and shared drives.
• File shares and cloud storage. Check both the company drive and any personal cloud account used for work.
• Accounting and payroll. Remove access to invoices, banking, payroll and expense systems. These are the accounts that move money.
• Customer and sales systems. Reassign open records so clients do not sit in a former employee's queue.
• Phone and voicemail. Remove the extension, change the voicemail PIN and decide where calls should ring.
• Remote access. Disable VPN accounts and any remote support tool installed on the person's devices.
• Shared passwords. Change any password the person knew, especially for accounts that do not support individual users.
• Badges and keys. Collect them, disable the badge and change codes if the person had one.
• Social media and website tools. Remove admin access and update the recovery email and phone number.

The devices are part of the account

A laptop, phone or tablet issued to an employee holds more than files. It may hold saved passwords, email sessions and access to cloud services. Collect the device on the last day when possible. Back up the work files, transfer anything the manager needs and then wipe the device before it is reused.

If the person used a personal phone for work email, remove the work account from the device and revoke the session from the server side. A polite request to delete the app is not the same as cutting off access.

Do not forget the accounts nobody owns

Every office has a few accounts that were created for a project and then forgotten. The shared login for the postage machine. The vendor portal that only one person used. The old bank account that still receives statements. The social media login tied to a personal email address.

These are the accounts that survive an offboarding because they are not on anyone's list. The fix is to build the list before someone leaves. An account inventory is not glamorous, but it turns a stressful Friday into a checklist.

Timing matters more than perfection

You do not need a perfect process to be safer. You need a consistent one. A simple rule works for most businesses: access ends on the last working day, the manager confirms the checklist within one business day, and the IT provider receives a copy of the completed list.

If the departure is sensitive, disable access first and sort out the handover afterward. It is easier to restore access than to undo a bad payment or a leaked client list.

Make it a habit

Offboarding is one half of a pair. The other half is onboarding, when accounts are created deliberately instead of being shared because it is faster. A business that gives every employee their own login, keeps an account list and removes access on the last day has solved most of this problem before it starts.

Seminole Office Solutions helps Central Florida businesses manage accounts, devices and access through our managed IT services and cybersecurity services. If you are not sure who still has access to what, contact our team in Longwood and we can help you find out.

Posted in: Cybersecurity