What are the actions of a system administrator when an employee is fired?

Question

Active Directory

Hello.
Describe your algorithm of actions in case of dismissal of an employee.
1) Do I need a special OU in ActiveDirectory for retired and disabled accounts?
2) Do you delete the archive of letters after some time from the dismissed employees?
3) What to do if you need to prohibit logging into the domain system, but leave access to mail through the web interface?

Answer 1

1. Block the account in AD
2. Unload mail, archive the profile, set up mail redirection (usually given by the manager. If not, redirect to the trash so that mail robots do not arrange conferences)
3. Move the account to the OU for the fired (sometimes they return: ) )
4. Accept hardware
The archive of letters is stored for at least five years - I came across when it became necessary to get a letter two or three years ago.

Answer 2

These issues need to be coordinated with the business. Technically, I save disabled accounts in a separate OU DISABLED and remove them from participation in all groups.

Answer 3

In general, the answer is "in accordance with the regulations prescribed in the organization")
Well, from the general point - probably blocking accounts / accesses + it is possible to transfer archives / accesses to another employee.
1 - it's more convenient, especially considering that not all employees leave due to death -> they can return back
2 - well, actually, as it is accepted [according to the regulations]
3 - stupid option - uncheck "interactive login")

Answer 4

What are the actions of a system administrator when an employee is fired?

The regulatory actions adopted in this particular organization are carried out.
Which one depends on the organization.
There is no law governing this.
Only internal documents of the organization - regulations, job descriptions, etc.

Answer 5

It all depends on how it is accepted and how work is organized in the organization
It may be enough to simply change passwords for online services
It may require a complete redrawing of all
accounts then arrange a complete hemorrhoid with the reorganization of all accounts, when everything is closed by firewalls, and the user does not even know the password from TheBat / Exchange happens "from a cannon to sparrows"