Home · Lessons

Account lifecycle

How to re-enable an account for an employee returning from leave

Accounts for people on long leave are often disabled, so they cannot be used while the person is away. When the person comes back, the account has to be turned on safely: with a new password, a forced change at first sign-in, and a check that their access is still right.

1. Confirm the request and the return date

The request should come from the manager or HR, with a return date. Confirm the name and the account, and watch for duplicate names: one person may have a working account in another department, and that one should not be touched. Compare the department on each result before you act.

2. Check the account's current state

Look the account up so you know what you are starting from. It may be disabled, locked, or both.

Get-ADUser -Identity sokafor

3. Set a temporary password first

An account that has no valid password cannot be enabled, so set the password before you enable it. Use a value that meets your password policy and share it securely, not in an open chat or a ticket comment.

Set-ADAccountPassword -Identity sokafor -Reset -NewPassword (ConvertTo-SecureString 'Temp!2026' -AsPlainText -Force)

4. Enable the account

Enable-ADAccount -Identity sokafor

5. Require a password change at first sign-in

The person should choose their own password as soon as they sign in. Set this flag after the password reset, because the reset can clear it.

Set-ADUser -Identity sokafor -ChangePasswordAtLogon $true

6. Check their access, and add only what is approved

Offboarding or a long absence may have removed groups. Look at what the person has now, and compare it with what their role needs.

Get-ADPrincipalGroupMembership -Identity sokafor

Do not restore everything from memory. If something is missing, such as remote access, check that it is approved, then add it. In the lab, a returning employee asks for remote access after the account is working, which is a normal follow-up request.

Add-ADGroupMember -Identity VPN-Users -Members sokafor

7. Record the change

Write in the ticket who asked, the return date, that the account was enabled and a password change required, and any access you added. Do not put the temporary password in the ticket.

What about cloud accounts?

A user in Microsoft Entra ID is turned back on with the same command used to turn them off, with the account-enabled setting switched to true, and the same checks apply. This lesson covers the on-premises directory only.