I heard from quite a few people about how useful my post was about Employee Separations. As a bonus, I put together a document that breaks out the items into a checklist that you can edit to meet the needs of your environment. No matter how often you are removing user accounts or performing some other similar task, a checklist helps ensure you don’t miss anything in case your work is questioned at a later time.

Last week I wrote about employee separations and the list of things that often need to be considered when an employee leaves. To balance that, here is the list of information I’d like to have handy when a new employee needs access to corporate resources.

• Proper spelling of the person’s name (and if they have a preferred nickname) – Your company might insist that user accounts and email addresses be based on legal names, but if “Robert” always goes by “Bob” he may prefer “bjones” over “rjones” for his username. If your email global address book is sorted by first names, other staffers might look for Bob first under B, instead of R.
• Start Date – I want to make sure everything is ready on the proper day. But, it’s also important to let me know if the start date is change or delayed. Most accounts are created with a generic, easy password and I would prefer to not have an active account hanging out there for an extra 2 weeks before the new hire can select a more secure password.

After the name and the start date, everything else tends to drift quickly from the ideal “standard” setup and slips to every employee being just a little bit different. By default, I give every new employee a personal home directory on the file server, access to their departments file share and membership on their department distribution list and any generic office lists, like “All Staff” or “San Francisco Office”.

• Specialty Distribution Lists – Which other DLs do they need to be on? Contractors and employees might use different DLs. Managers, supervisors, special project lists, etc.
• Phone Number – Will any available phone number do? Sometimes a hire is destined to replace someone who needs immediate coverage. If that’s not the case, I like to give out a fresh DID or at least one that hasn’t been used in a while. No one likes to spend their first weeks on the job fielding calls that don’t pertain to them. If I’m reusing numbers, I like to keep recycled numbers in the same department if possible. This way the new person in accounting won’t be getting calls directed to the person who retired from HR. And what about calling privileges – local only, long distance, international calling? How about membership in special hunt groups, dial-by-name directory? Do they need call appearances to pick up calls for manager or executive?
• Applications and Security Groups – Which applications will they be using their first week or so? I know roles evolve and users always need their access adjusted. New hires usually will be learning 2-4 new applications immediately, so concentrate on finding out what those are. I don’t like to “make Bob the same as Joe”, because I know that Joe probably has membership in some security groups that Bob will never need. If the hiring manager can’t give you a list of which applications and data the new hire needs, remind them that security groups and application access are areas that are often looked at closely by auditors.
• Hardware – What’s standard for others in that department or role? If you have options for different mice or keyboards, let the newcomer know so they can request changes sooner than later. Make sure they are connected to the closest printer to their workspace, etc.
• Helpdesk Communications – Make sure they know the appropriate ways to submit help desk tickets or report problems. Should they use a ticketing-system? Send email? Call a special number? Pop into you cube? It’s a safe bet that people new to the office don’t want to annoy the IT folks, so set them up for success.
• Training Documentation – Many departments have manuals or documentation about how various tasks are performed, IT is no different. Voice Mail instructions, conference bridge information, document management system procedures, “how-to” information for common FAQs related to Outlook or other applications… make sure the new hire knows how and where to find those things. It’s much easier help someone do something right the first time than to bother your DBA with bulk corrections to database information that was improperly entered.

Finally, document, document, document! File any forms or emails related to access needs and who authorized the access. Note the date you added or changed access going forward. Not only will this help with any audit needs, proper documentation can make it easier to remove access completely when someone leaves the company in the future.

It happens at every workplace. Employees leave – layoffs, retiring, or just moving on to new things. As a systems administrator, I wish that managers understood how deeply integrated a staff-person is with the computer systems they work on daily. It’s not always a simple process to undo someone’s existence.

Processing exiting employees without identity lifecycle tools can be tedious, but it’s often the way things are done in small and medium sized businesses. I realize that several days notice isn’t always possible, but I can hope. I’ll even take a few hours of notice. However, we’ve all gotten that call at ten minutes to 5:00pm letting use know that someone won’t be coming in the next day.

I have my list of basic things I’d like a department manager to think about when it comes to seeing an employee off. The first couple can get me out out the door on time, the rest of them tie things up in a nice package.

Before beginning, it’s important to make sure the employee REALLY is leaving. It’s not unheard of to get several days of notice about a separation, complete account closure process, and then find out that the employee will be contracting from time to time and needs access when they are on-site.

• What time should their network account be disabled? – Ideally this is before someone in the NetOps department leaves for the day. Worst case is having to set an account expiration, as midnight often comes a long time after the employee has walked out with their final paycheck.
• Do they have remote access? – If yes, I disable that ASAP. This way if the network account has to stay active for longer than I’d like at least they have to be physically in the office log on.
• Email Forwarding – Is it needed? If so, I like to turn that on as soon as possible so that any incoming emails (especially over a weekend) are not missed.
  
• Phone and Voicemail – Is any call forwarding needed? For the same reasons as email, I don’t want any voicemail messages missed or left unchecked for too long.
• Building Access – Has the access to office space been removed? Network Operations isn’t always responsible for physical access and that needs to coordinated as well.
  

Now those are just my “get-things-under-control” checklist. Then comes the rest of the things that need to be considered, but most managers really don’t know to mention them ahead of time.

• Email History – Do someone need a copy of their email box? Does the user have any PST files that need to be located and preserved?
• Distribution Lists – Is the user the sole member of any distribution lists? If so, removing them and leaving the DL empty will cause messages to go undelivered and lost. A new contact person needs to be designated.
  
• Work Files – Does the user have a home folder or area where they store work products? Do these files need to be preserved?
• Phone System – Is the user a destination for any phone tree options, a member of a workgroup or hunt groups?
• Application Management – Is the user the sole owner/manager of other important enterprise products like databases or SharePoint sites? Those roles will need to be assigned to someone else. Is there any applications that regularly delegate specific tasks that would need to be reassigned to a co-worker?
• External Systems – Does the user have any accounts with third-party systems (not AD or Windows-integrated) or external systems with other partners or clients where access would need to be removed separately?
  
• Locally Installed Applications or Hardware – Do they have some special applications or hardware installed on their workstations that need to be set up for another staff member?
  

Finally, there is usually a change control process that documents what was done to close the network account of the user so items weren’t overlooked. In a perfect world, the manager in question would have filled out the necessary forms ahead of time, but I’ll settle for some quick answers over email that I can file in our document management system.

Every company will have it’s only list of tasks, but the premise is the same. Securing critical data and making sure that customers continue to be served after the departure of an employee are important aspects of any systems administrator’s job.