Managing User Accounts in Active Directory, from Onboarding to Offboarding

Most Active Directory security problems start with something simple: an account belonging to an employee who left months ago but is still active, an employee who moved to another department and still has access from the old one, or a shared account whose password half the company knows. The fix is a simple, consistent process for the whole life of a user account: joining, changing roles and leaving.

First: A Few Fixed Rules

• Naming convention: choose one pattern for usernames, for example a.ahmadi, and have a clear rule for duplicate names.
• OU structure: keep users in defined OUs by department or branch, and create a separate OU for disabled accounts.
• Role groups: define a group for each job role that holds the access that role needs.
• One personal account per person: avoid shared accounts such as reception used by several people. Otherwise there is no way to tell who did what.

Onboarding a New Employee

1. The account request should come from HR or the department manager in writing, with the person’s name, title, department and start date.
2. Create the account in the correct OU and fill in fields such as full name, Department, Title and Manager. This information is very useful later for reporting and access reviews.
3. For speed and consistency, create a template account for each role and copy new accounts from it; group memberships are copied along with it. Always keep the template account disabled.
4. Set a temporary initial password and enable User must change password at next logon. Give the initial password to the employee in person or through another secure channel.
5. For project staff and contractors, set an account expiration date (Account Expires) so the account disables itself automatically on schedule.

Role or Department Changes

A common mistake is to add new access when an employee moves while leaving the old access in place. After a few moves, one employee has access to everything. With every role change, move the account to the new OU, remove it from the old role groups, add it to the new role groups, and update the Department and Title fields.

Offboarding an Employee

1. On the employee’s last day, disable the account rather than deleting it right away.
2. Change the account password, and if the employee had VPN access or email on a mobile phone, cut those off as well.
3. Record the date and reason for disabling in the Description field, and note the list of groups the account belonged to.
4. Move the account to the disabled accounts OU.
5. Decide with the department manager what happens to the mailbox and personal files, for example handing them over to a successor.
6. After the retention period set by company policy, delete the account.

Make sure Active Directory Recycle Bin is enabled before any deletion. With it, an account deleted by mistake can be restored along with its group memberships.

Periodic Account Reviews

Every few months, find accounts that have not been used for a while. In PowerShell, the command Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly lists users who have not logged on in roughly the last 90 days. Check the list against HR records and disable accounts with no clear owner. Review membership of sensitive groups, especially administrative groups, as part of the same review.

Checklist

• A naming convention and OU structure are defined.
• Every employee has their own personal account.
• Accounts are created from a written request and a template account.
• Old access is removed when roles change.
• A departing employee’s account is disabled the same day.
• Recycle Bin is enabled and inactive accounts are reviewed regularly.

ITPlus724 engineers can define an onboarding and offboarding process for your company, review and clean up your existing Active Directory accounts, and automate part of the work with scripts.