Former Employee Still Has Access to Your Files? Fix It Today

Someone left the firm months ago, and their name is still in your shared drive. That uneasy feeling in your gut is the right one. A person who no longer works for you can still get into your stuff.

Maybe you just found out. Maybe you are about to let someone go and want to cut access cleanly. Either way, this is one of those quiet risks that is easy to ignore until it bites.

Here is the short version. A former employee who still has access is a real risk: they can take client data and designs, delete things, or create liability you do not want. The fix is fast and complete: lock their main account right away, sign them out of everything, reset shared passwords, hunt down the logins that survive, transfer their files and email, get the devices back, and write down every step. Then put a real offboarding process in place so it never lingers again.

This is more common than you think

You are not the only firm with this gap. Beyond Identity, a login security company, surveyed former employees in 2022. 83% said they still had access to at least one account from a past employer. That is self reported, but it shows how often the door gets left open.

There is a sharper edge too. Researchers at Carnegie Mellon’s CERT insider threat team studied real cases of stolen work. Many of the people who took it did so within 30 days of leaving, when they had one foot out the door and still held the keys. This is not about assuming the worst of people. It is about not leaving the door unlocked.

The front door was locked, but two windows were wide open. The leftovers are the windows.

What a former employee can still reach

To cut access, you have to know what access exists. It is usually more than people realize. Their email may hold years of client conversations and project history. Your file share or cloud storage, where the projects live. Your design and project software, like Autodesk accounts or Procore. Remote access, like a VPN or remote desktop, which lets them in from anywhere. Any shared logins the team passed around. Outside apps you signed up for that are not tied to your main login. A company laptop or phone sitting in their car. And passwords saved in their browser.

Here is the scary part. Disabling one account does not close all of these. The shared logins, the apps that have their own separate password, and the saved credentials all survive. That is exactly how a former employee keeps getting back in.

Do this first, today

If someone with lingering access needs to be cut off now, here is the order. The first three steps matter most.

• Lock their main account. At most firms, that is their Microsoft 365 or Google account. In Microsoft 365, do three things in this order: reset their password, sign them out of all sessions, then block sign in. The order matters. Microsoft says blocking sign in can take up to 24 hours to kick in, but a password reset works right away.
• Check that they are really out. Even after you sign them out, Microsoft says someone already logged in can stay in for up to an hour. If the exit is tense, have your IT provider force an instant sign out instead of waiting.
• Reset shared passwords. If your team shared any logins, the former employee still knows them. Change every shared password they could have known: the plotter, the bank, the Autodesk account, the social media, all of it. We cover why shared logins are a trap in our post on what small firms get wrong about passwords.

Timing matters too. If you are letting someone go, lock the account during the conversation, not after it. If someone gives two weeks’ notice, most small firms keep access on so the work gets finished. That is a fair call. But if they are going to a competitor or the exit is tense, cut access the day they give notice.

The sneaky leftovers

This is where firms think they are done and are not. A few things survive the steps above, and you have to hunt them down on purpose.

Apps with their own separate login. Any tool your firm uses that the person signed into directly, not through your main account, still has them in it. Go through your list of software and remove them from each one.

Personal devices. If they used a personal phone or home computer for work, your files, email, or saved passwords may still be on it. Company email on a personal phone is a common one. You want that access removed remotely if you can. Use the account only wipe, which removes your company email and data. Never wipe someone’s whole personal phone.

Saved passwords and forwarding tricks. Check whether their account had email forwarding set up to a personal address, or auto-rules that quietly copy mail out. Those can keep leaking even after you disable the account.

Remote access. VPN and remote desktop logins are a direct path back in. Make sure theirs is gone, not just their main account.

Do not forget the files and the trail

Two more things, because cutting access is not the whole job. Get their work out before you delete anything. Their email and files may hold project history and client conversations you need. Transfer or archive their mailbox and files to someone who is staying, before you close or delete the account for good. And get the company devices back.

Watch the license, too. This is a trap that catches a lot of small firms trying to save money. Microsoft says that when you remove a Microsoft 365 license, their email, contacts, and calendar are kept for 30 days and then deleted for good. Convert the mailbox to a shared mailbox or move the content first.

Then write it all down. Note what you disabled, when, and who did it. If a question ever comes up later about a data breach, a client dispute, or a compliance check, that record is your proof that you handled it. Documenting the steps with dates turns “we think we got everything” into “here is exactly what we did.”

If the exit is tense, or you think they took something, slow down before you clean up. Do not wipe their laptop or delete their mailbox yet. Talk to your attorney first, because that may be your evidence. Depending on your license, Microsoft 365 can put a legal hold on their data so nothing gets lost.

The real fix: a real offboarding process

Putting out this fire is reactive. The proactive move is a simple, written offboarding process, so the next person who leaves gets cut off the same day, every time, with nothing missed. A good process has the parts in the same order every time: HR signals the last day, someone locks the main account and signs them out everywhere, shared passwords get reset, apps and remote access get removed, files and email get transferred, devices get collected, and the whole thing gets logged.

When that runs like a checklist, “wait, can they still get in?” stops being a question you ever have to ask. A small firm can cut access the same day, every time. It just takes a plan instead of hoping someone remembers. We dig into building that process, and protecting your data through every departure, in our post on what happens to your firm’s data when someone quits.

Frequently asked questions

We will close the door completely

Cutting off a former employee sounds simple and is easy to get half-right, which is the same as getting it wrong. Our managed IT services help small architecture and engineering firms cut access cleanly and completely when someone leaves, and set up an offboarding process so it happens the same way every time. Based in East Tennessee. Serving firms nationwide.

If someone left your firm and you are not sure they are fully locked out, give us a call for a free IT checkup. We will check every door, close the ones still open, and set things up so the next departure is clean.

Sources: Former employees continue accessing old employer accounts (Beyond Identity, 2022); Increased Monitoring for IP Theft by Departing Insiders (CERT, Carnegie Mellon); Remove a former employee (Microsoft); Prevent user sign in and block access (Microsoft); Wipe a former employee’s mobile device (Microsoft).