For IT teams whose joiner-mover-leaver process is mostly manual
Offboarding Cleanup: Catching the Accounts Leavers Left Behind
Offboarding fails quietly. The ticket gets closed, the account gets disabled, and the parts nobody put on the checklist — group memberships, a second admin account, a shared service credential the person owned — stay exactly where they were. Nothing breaks, so nothing draws attention.
Where the gaps usually are
- The leaver who was never disabled
- HR offboarded them, IT never got the ticket, and the account is still enabled with a valid password months later.
- The second account
- The primary account was handled. The admin account, the test account, and the account they used for a project in another domain were not.
- Privilege that outlives the person
- Disabled accounts sitting in Domain Admins, or a nested group that still grants the departed contractor rights on paper.
- Nobody re-checks
- The process is only verified when it fails visibly, which for a dormant account is approximately never.
Closing the gap
The fix is not a better checklist — it is a report that independently checks the checklist’s work, on a schedule.
Find enabled accounts nobody is using
An enabled account with no logon in 60 or 90 days is the signature of a missed leaver. Bucket by age and hand the list to the managers who can confirm.
Cross-check disabled accounts against privileged groups
Disabled is not the same as removed. Any disabled account still holding privileged membership is a finding regardless of how long ago the person left.
Sweep the second accounts
Group by naming convention and OU to catch the admin and test accounts that share a leaver’s name but not their offboarding ticket.
Reclaim the machines too
Computer objects for laptops that never came back look exactly like stale accounts, and are found the same way.
Schedule it monthly
Offboarding gaps compound. A monthly report keeps the backlog to whatever accumulated in the last thirty days.
What you end up with
- A short monthly list of accounts your process missed, instead of an annual archaeology project
- Privileged access that ends when employment does
- Evidence that leaver removal is verified independently of the ticket queue
- A shrinking baseline rather than a permanent backlog
Frequently asked questions
- Will it disable or delete leaver accounts for me?
- No. It is read-only by design. It tells you what your process missed; the action stays inside your change control, where an automated deletion of the wrong account cannot happen.
- How do I tell a missed leaver from a dormant service account?
- Service accounts are excludable by OU or naming pattern, so they stop appearing in the report once you have classified them the first time.
- Can I send each manager only their own team?
- Reports can be scoped by OU, which in most estates maps closely enough to team or business unit to be useful without any additional integration.
Get SysFlint AD
Free, forever. No license keys, no per-user pricing, no seat counts, no trial timer.