Keys get handed back. Passwords get changed. And the VPN profile on a personal laptop quietly keeps working — because nobody's checklist mentioned it. Here is the short routine that closes the VPN door on the same day someone walks out of the office one.
Of all the ways ex-employees retain access to a small company's systems, a forgotten VPN profile is the most common and the most preventable. The .ovpn file does not know its owner resigned. It sits in a laptop at their home, fully functional, until the firewall is told otherwise. The good news: with Untangle's per-client design, telling the firewall takes about five minutes — if it is on the leaving checklist.
Most departures are friendly, and the routine should still be same-day — not from suspicion of the person, but because access that outlives employment is a liability for both sides. If anything ever goes wrong on the network later, a still-active ex-employee profile muddies every investigation and can unfairly point at someone who simply never had their access closed. Same-day revocation is not an accusation; it is tidiness with a timestamp.
Then do the same sweep for the person's other doors while you are in admin mode — email, Tally or application accounts, shared passwords they knew. VPN is one item on the leaving checklist, never the whole list.
Everything above assumes the departing person's access is theirs — a named client you can delete alone. If the office runs one shared profile on every machine, there is nothing to revoke individually: your choices are leaving the leaver's access alive or reissuing profiles to the entire staff on the same day. Offices discover this at the worst possible moment. Treat a departure on a shared profile as the trigger to finally migrate everyone to per-person clients — painful once, protective forever.
Four times a year, put the Remote Clients list next to the current staff list and reconcile them. Every profile should answer three questions instantly: whose is it, which device, and is that person still here? Any profile that fails a question gets deleted or explained. The same review catches the quieter debris — the test profile from setup day, the contractor from last year, the old laptop in a drawer whose profile still works. Doors you can enumerate are doors you control.
The video shows how a client is created — picture the reverse happening promptly on someone's last day, and you have this page.
▶️ Watch Full VideoEither stops the access. Disabling is a reasonable first step if there is any notice-period or record-keeping reason; delete it once you are sure. What matters is that it happens the same day, not which of the two buttons you use.
Deleting the client guarantees their certificate will not authenticate again. To be thorough, check the OpenVPN Status view straight after and confirm no live session under their name remains before you consider the job done.
You can ask, and a decent exit process does. But your security should never depend on it — once the client is deleted on the firewall, the file on any machine is inert. Revoke on the server; treat device-side deletion as courtesy, not control.