The fastest click on a leaver account is Delete - and it is the one you will regret. This page gives the order that keeps mail, files and accountability intact while access ends on the spot.
When someone leaves, two things must happen at different speeds. Access must end immediately. The account itself must end slowly, because that account is woven into file ownership, shared mailboxes, application logins and the audit trail that answers "who changed this?" months later. Deleting on day one confuses the two speeds and always picks the wrong one. The routine below - disable, move, strip, wait, delete - is the one used by careful admins everywhere, and each step has a reason.
Access ends today. The account - and everything it proves - ends only after the waiting period.
Disabling is instant, total and reversible: right-click the account → Disable Account, or Disable-ADAccount -Identity "rahul.sharma". A disabled account cannot log on anywhere, but it still exists - its SID, its mailbox, its file ownership and its history all stay readable. If the departure turns out to be a transfer or a mistake, re-enabling takes five seconds. Un-deleting takes a restore operation. Choose the reversible action first, every time.
Move the account into the leavers OU with Move-ADObject so it stops receiving normal user policy and stands out in every listing. Then remove its group memberships - shares, VPN, application groups - after saving the list in the ticket or HR record. That saved list is gold if the person returns, and it is the proof of exactly what access was withdrawn if anyone asks later.
The leaver's mailbox and home folder usually hold live work. Give the manager access to what the business needs through groups, export or forward the mailbox by company policy, and only then let the waiting period run. Honest warning: deleting the account does not delete most of this data - it orphans it, leaving files owned by an unknown SID string and a mailbox nobody can open cleanly. Order matters more than speed here.
Thirty to ninety days is a sane window: long enough for the forgotten dependency - a scheduled task, a scanner, a report - to complain while recovery is still trivial. Pick one deletion day per month, work from the Disabled Users OU list, and delete only accounts whose waiting period has passed. If your company has legal or audit retention rules, those rules win over this page - ask before the first deletion round, not after.
Leaver day is when shared accounts expose themselves: if three people used one login, disabling it locks out two people who stayed. The routine above is your detection tool - before disabling, ask the manager who else uses the account. Where sharing is real, create individual accounts for the stayers first, then disable. It is extra work on the busiest day, and it is still cheaper than the alternative.
The full OU, user and group creation process - live on a real domain controller, step by step.
▶️ Watch Full VideoYes, in most setups mail keeps arriving in the mailbox even though the person cannot sign in - which is usually what the business wants during handover. If mail must stop or bounce, that is a separate mailbox setting; disabling alone does not do it.
The files stay, but their owner becomes an unresolved SID - a long number instead of a name - and permissions pointing at the account stop resolving. Administrators can take ownership, but it is slow, manual work that the disable-first routine avoids entirely.
Disabling already blocks sign-in completely, so a password change adds little. Some companies do both when the departure is disputed. What matters more: end their VPN, mail and application sessions the same day, because a live session can outlive the click.