When an Employee Leaves Rotate Keys and Access Properly
Offboarding usually covers accounts and ID cards. The BitLocker side is quieter and easier to forget: the leaver knew a PIN, the laptop is coming back (or is not), and the recovery key situation needs a decision — not a shrug.
✍️ Technical Anshu🪟 Windows 10 / 11🏢 Offboarding
🎥 Watch the full walkthrough in the video — ManageEngine BitLocker management, step by step
Encryption keys outlive employment unless someone deliberately retires them. An employee who leaves on good terms is not a threat — but the credential knowledge they carry is real: they know the laptop's startup PIN, they may have handled a recovery key during some long-ago support call, and they know exactly how your office names and stores things. In a managed fleet with Endpoint Central, closing this off is a short, calm routine rather than a forensic project. This guide runs it in order: access, machine, PIN, recovery key, and the retention question for the machine that does not come back. Graded honestly throughout — the goal is proper hygiene, not theatre about former staff.
Leaver Checklist — Laptop and Keys (illustration)
☐ Accounts disabled, sessions ended
☐ Laptop physically returned and logged
☐ Recovery key rotated after retrieval check
☐ PIN changed or machine re-imaged
☐ Key retention position confirmed for the record
Illustration: the encryption half of an offboarding checklist. The HR half (accounts, cards, contracts) runs in parallel, not instead.
1
Step 1 — Access First, Hardware Second
Disable the leaver's accounts and sessions on schedule — AD, email, VPN, and the Endpoint Central console if they had any admin role there.
If the person could retrieve recovery keys (helpdesk or IT staff), treat that as the sensitive case in this guide: key rotation below stops being optional.
Confirm the laptop's return is logged like any other asset handover — date, condition, who received it.
Order matters: a returned laptop with live accounts is a bigger gap than a late laptop with dead ones.
2
Step 2 — The PIN Must Change
The startup PIN is a shared secret the moment it is known by someone who has left:
If the laptop will be reissued, change the BitLocker PIN as part of the rebuild or handover checklist — do not let the next user inherit a PIN an ex-employee knows.
If the machine is wiped and re-imaged, confirm the new setup ends with a fresh protector and PIN, and that a new recovery key has landed in escrow for the new installation.
If the laptop stays in a drawer as a spare, change the PIN anyway. Drawers have a way of becoming deployments.
3
Step 3 — Rotate the Recovery Key
The recovery key is the master proof for that drive. If there is any chance the leaver saw it — a support call, a printout, a photo of a screen — rotate it:
Endpoint Central gives you a natural mechanism: per ManageEngine's documentation, viewing a recovery key in the console generates a new key, which the agent applies at the machine's next startup. A deliberate retrieval therefore retires the old key.
Verify after the next boot that the console holds the new key — retrieve it fresh and confirm the old one no longer matches the drive.
For IT-staff leavers, widen the lens: rotate keys for machines they personally handled, and review who else holds key-retrieval rights in the console.
Honest grading: for an ordinary user who never saw a recovery key and whose laptop came back on time, a PIN change plus rebuild is proportionate. Rotation is for exposure — people who handled keys, or machines that spent time unaccounted for.
4
Step 4 — The Laptop That Does Not Come Back
Sometimes the machine is lost, kept by mistake, or part of a dispute. Handle the encryption side factually:
Record the machine as removed from management, and note the retention position: with recovery key retention enabled, the key stays retrievable on the server for up to one year after removal; with it disabled, keys are discarded after 30 days.
If the leaver knew the PIN and has the machine, be honest internally: BitLocker no longer protects that data — the person holds both the device and a working unlock. Escalate through HR/legal as a data matter, not an IT setting. No console feature fixes this after the fact; the fix was the PIN-and-return discipline before the exit.
If the PIN was never shared and the account side is closed, an encrypted, PIN-protected laptop in the wild is a hardware loss, not a data breach — record it that way.
5
Write It Into the Exit Checklist Once
None of this should depend on anyone's memory during a busy exit week. Add five lines to the standard leaver checklist — accounts, laptop return, PIN change, key rotation decision, retention note — the same five this page opened with. In the console, removing the machine from Scope of Management is a thirty-second step; the checklist is what ensures the thirty seconds are spent on the right things, in the right order, every time.
🔴 The one case that is a real incident: a leaver who keeps the laptop and knows its PIN. Encryption cannot help after that combination exists — deal with it immediately as a data-protection matter through management and HR, not as a settings problem.
🎥 See It Done Live in the Video
The complete walkthrough — policies, key backup and the console — is shown step by step in the video.
Does every leaver require a recovery key rotation?
No — proportion matters. Rotate when the key may have been seen: IT and helpdesk staff, anyone present during a recovery, or a machine that was unaccounted for. For a standard return, a PIN change and proper rebuild are the proportionate baseline.
How does rotating a key work in Endpoint Central?
Viewing a recovery key in the console generates a new key, which the agent applies at the machine's next startup. So a deliberate key retrieval after a leaver, followed by a reboot and a fresh check, retires the old key.
The laptop was never returned. Is the data safe?
It depends on the PIN. If the leaver never knew the PIN and accounts are closed, BitLocker is doing its job and the loss is hardware. If they knew the PIN and hold the machine, treat it as a data incident — the encryption cannot protect against someone who has both.
This guide is based on the Technical Anshu video on managing BitLocker • Stuck on a step? Ask in the video comments — answers happen there 🙏