Manage

Creating a user account management policy to delete old accounts

If you're not deleting orphaned accounts, you may be leaving the door wide open to attackers. In this expert response from Randall Gamby, learn how to create an effective user account management policy for getting rid of old accounts.

Randall Gamby, HP

Our enterprise is creating a policy for disabling inactive accounts. The CIO believes we should contact these individuals' supervisors before disabling; is this a good idea? It seems like having to contact all supervisors before deactivating might really complicate and lengthen the disabling process. Would it be better to have a default deactivation policy after a certain period of inactivity?

Actually, when it comes to a user account management policy, I think you should have both a default deactivation policy for inactivity, along with a verification process involving local supervisors to ensure deactivation is necessary. If a user hasn't accessed an account after a specific period of time, the account should be orphaned -- the user no longer needs access but the account is still active -- and it's important to delete old accounts.

However, with that said, workers take maternity leave, projects get delayed due to budget constraints, employees...

Step 2 of 2:

You forgot to provide an Email Address.

This email address doesn’t appear to be valid.

This email address is already registered. Please log in.

You have exceeded the maximum character limit.

Please provide a Corporate Email Address.
- I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.
Please check the box if you want to proceed.
- I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.
Please check the box if you want to proceed.

come down with unexpected illnesses or need to care for loved ones, etc. No system can recognize these cases; only supervisors, and possibly HR. So, when it comes to people, make sure to consider the human issues, which are the domain of supervisors: They'll know whether an employee will return tomorrow, in a few days, or never.

In the worst-case scenario, such as you disable an account just in time to find out that the worker is returning the next day, and you need to re-enable it, experience says that re-enabling doesn't simply involve making a call, but rather following a process that could take hours or days. I'd suggest following your CIO's advice.

This was last published in April 2010

What you need to know to manage multiple AWS accounts

Twitter breach caused by social engineering attack

401(k) plan

orphan account

Related Resources

Dig Deeper on Privileged access management

What you need to know to manage multiple AWS accounts

Twitter breach caused by social engineering attack

401(k) plan

orphan account

Related Q&A from Randall Gamby

Manage unsuccessful login attempts with account lockout policy

For minimum password length, are 14-character passwords sufficient?

How has enterprise SSO technology evolved?