When an Employee Leaves: Accounts, Passwords, Devices
When someone leaves your business, their access does not leave with them. Their email login still works. Their saved passwords still work. The laptop they used is still full of your files. None of this is a sign of bad intent. It is just what happens when nobody closes things out on purpose.
This checklist is written for people with no IT staff. Work through it in order, ideally on the person's last day or the day after.
Before you change anything: make a list
Open a blank document and write down every place this person had access. Check these sources:
- Their work email and calendar
- Shared folders or cloud storage (Google Drive, OneDrive, Dropbox, or similar)
- Software your business pays for: accounting, payroll, customer records, scheduling, social media
- Anything they logged into on a shared password, such as the company bank portal or the website admin page
- Their laptop, phone, and any USB drives or external disks
- Their phone, if it had work email or a work app on it
If you are unsure, ask the person's manager what they did day to day. Also search your own inbox for messages about account sign-ups, since the confirmation emails often reveal tools you forgot about.
Step 1: Do not delete anything yet
It is tempting to wipe everything at once. Resist that. Files, emails and customer notes may still be needed. Deleting an account often deletes its contents permanently.
Instead, aim to block the person from signing in while keeping the data. Most email and cloud services let you suspend or disable a user without removing them. Choose that option first. You can delete later, once you are sure nothing is needed.
Step 2: Cut off sign-in
Start with the accounts that matter most.
Email. Reset the password and sign the person out of all devices. In most business email systems, the admin page has a sign out of all sessions option, which forces every phone, laptop and browser to log in again. Then set up email forwarding or give a manager access to the mailbox, so customer messages do not go unanswered.
Cloud storage and shared drives. Remove the person's access, then check who owns the files. If they owned folders that other people use, transfer ownership to someone staying before you disable the account.
Business software. Go through the list you wrote and disable the user in each tool. If a tool charges per user, removing them may also stop a bill you no longer need.
Two-step sign-in. Many accounts send a code to the person's phone as a second check. Remove their phone from any account where you can, so a leftover code cannot be used to get back in.
Step 3: Change shared passwords
Any password the person knew is now a password they could still use. This includes shared logins for the website, social media, the Wi-Fi router, the bank portal, and any account several people use.
Change each one, and give the new password only to the people who need it. Use a password manager (a program that stores passwords for you behind one strong master password) if you can, instead of a sticky note or a shared spreadsheet.
Also ask whether the person saved passwords in their browser. Those saved passwords belong to their login on the laptop, so they will stay on the device when you collect it. That brings us to the hardware.
Step 4: Collect the devices
Get back everything that belongs to the business: laptop, charger, phone, tablets, USB drives, key cards and any security tokens (small devices used as a second sign-in check).
Before you hand the laptop to anyone else, do these steps.
On Windows:
- Sign in with an administrator account, not the departing person's.
- Open Settings, then Accounts, then Other users, and note the person's account.
- Copy anything the business needs from their Documents, Desktop and Downloads folders to a shared drive or an external disk.
- When you are sure you have what you need, remove the account from the same screen and choose to delete the account and data, or reset the whole computer under Settings, System, Recovery.
On Mac:
- Sign in with an administrator account.
- Open System Settings, then Users and Groups, and note the person's account.
- Copy needed files from their Documents, Desktop and Downloads folders to a shared location.
- When you are ready, delete the user from the same screen, or erase the Mac using Erase All Content and Settings under System Settings, General, Transfer or Reset.
Resetting the computer returns it to a clean state for the next person. If the laptop was signed in to a business account, sign it out of that account before the reset, so the device is not still linked to the former employee.
Personal phones are trickier. If the person used their own phone for work email, remove the work account from it and ask them to confirm they have done so. You cannot reach into a personal device, so a clear request in writing is the practical step.
Step 5: Check, then keep a record
A week or two later, look at your list again. Check the sign-in activity page in your email system, which shows recent logins. If you see the old account trying to sign in, that is a sign something was missed.
Keep a short record of what you did and the date. A simple note in a shared document is enough. It makes the next departure faster, and it helps if someone asks later what was done.
The part that takes ongoing attention
Following the steps above closes the obvious doors. But the checklist is only as good as your list of accounts, and that list drifts. New tools get added, people share logins, and updates and security warnings pile up on laptops that nobody is watching.
An antivirus program or a setting can tell you something is wrong. It cannot fix it. Someone still has to read the warning, decide what it means, and act. If you would rather hand that work to someone who does it for a living, that is a reasonable choice, and it is the part most small businesses find hardest to keep up with alone.
Whichever route you take, do the checklist today while the details are fresh.
If you want small, safe fixes like these handled for you, iFixediT has Autopilot, which stays off until you turn it on.