Every security upgrade in this series earns its keep on one ordinary day: the day somebody resigns, is transferred, or is let go. With named accounts, removing their VPN access takes two minutes and actually works.
Under the old config-only setup, a leaver's access ended when someone remembered to care - which is to say, often never. The file kept working because nothing about it knew the person had gone. Named local directory accounts change the physics completely: disable the account and the door closes, whatever copies of the config still exist. Here is the leaving day routine, in order, with the details that decide whether it truly worked.
Open the local directory, open the leaver's account, and disable it before you delete anything. Disabling is instant, reversible if HR has made an error, and it kills new logins immediately. Deletion can follow after a week or a month, once you are certain no investigation, handover or dispute needs the account's history. Also drop any active session - a connected user may stay connected until they disconnect, so check the active connections and end theirs. A disabled account with a live session is a door you have locked while someone is still inside the room.
This is the quiet triumph of the upgraded design. The leaver may still hold a config file on a personal laptop, may remember their password perfectly, and their phone still generates codes every thirty seconds - and none of it connects, because the account those three factors belonged to no longer accepts logins. Compare that with the shared config era, where leaving day changed nothing at all. When you explain the upgrade to management, this page is the explanation: access now ends when employment does, provably, in minutes.
Company laptops and devices come back through the normal exit process, and their local copies of the config go with them. Personal devices are different: you generally cannot compel a wipe of someone's own phone or home PC, and you do not need to - the disabled account is the control that works. Record in your register what was disabled, when, and by whom. If the departure was unhappy, also review the connection logs for the final weeks while they are still available; unusual download hours are a conversation for management, not for the firewall.
Access removal fails through vagueness, not malice: HR assumes IT knows, IT assumes the manager said something. Fix the ownership in writing - the manager or HR informs one named person, and that person disables the account the same working day, ideally before the person leaves the building on their last day. Add it to the exit checklist next to keys and the ID card. A VPN account is a key to the building that works from another city; it deserves the same ceremony as the physical one.
The same routine covers the external CA whose engagement ended, the vendor who finished the migration, and the intern from the summer. Temporary accounts rot into permanent ones unless their review date is real. Once a quarter, read the directory against current reality - anyone you cannot place in the organisation today gets disabled first and explained afterwards. It is much easier to re enable an account for a surprised legitimate user than to explain why a stranger's name was still active.
Every revocation in this page is one click because the video's setup gave each person their own account first.
▶️ Watch Full VideoNot always instantly - an already established session can persist until it reconnects. Check the active connections on the server and disconnect their session as part of the same job.
Disable immediately, delete later. Disabling is reversible and preserves the account's history for any handover or investigation. Delete after a few weeks, once you are sure nothing references it.
Yes - that is the point of the upgrade. You cannot wipe their laptop, but the disabled account rejects the login whatever device, config file, password or phone code it presents.