Home · Lessons

Account lifecycle

How to offboard an employee's account

When someone leaves, their access has to end on time, in the right order, and with a record of what was done. This lesson walks through the steps help desk teams use, with the Active Directory commands for each one.

1. Get the request and the leave date

Offboarding starts with a request from HR or the manager, not from the employee. Confirm three things before you change anything: the person's name and username, the date their access should end, and whether they're leaving on good terms. A request that arrives early, or for the wrong person, is the most common cause of a mistake here.

2. Disable the account

Disable the account first. Disabling blocks sign-in straight away, and it can be reversed if the request turns out to be wrong. Deleting the account is a separate decision, usually made later under the organisation's retention rules.

Disable-ADAccount -Identity jdoe

3. Remove their group memberships

Disabled accounts still belong to their groups, and group membership is what grants access to shares, applications and mailboxes. Remove every group, not only the obvious ones. Get the list first and write it in the ticket, because once the groups are removed you cannot see what the person had, and an audit or a returning employee will need to know. Then pipe the list into the removal command:

Get-ADPrincipalGroupMembership -Identity jdoe | Remove-ADGroupMember -Members jdoe

Check the list before you remove anything. Some groups may need to stay for a handover, such as a shared mailbox the team still uses. Those decisions belong to the manager, so ask before removing them.

4. Reset the password

Reset the password so the old one stops working, even if the account is disabled. A leaver may still know it, and a stored password on a phone or server can keep trying it.

Set-ADAccountPassword -Identity jdoe -Reset -NewPassword (ConvertTo-SecureString 'Temp!2026' -AsPlainText -Force)

5. Check the account and write it down

Confirm the account is disabled and has no groups left. Then record in the ticket what was done and when: the account, the time it was disabled, the groups removed, and anything left in place on the manager's request. The record is what someone will check if the person's access comes up again.

What about Azure and Microsoft 365?

Many organisations also sign people in through Microsoft Entra ID (formerly Azure AD) and Microsoft 365. The steps are the same: disable sign-in, remove licences and group memberships, revoke active sessions, and record the change. The commands are different. Entra ID uses Microsoft Graph PowerShell rather than the Active Directory module. This lesson covers the on-premises directory only.