Please help my administrator got canned!

I would get a list together of all the servers and software you run. (Exchange, Proxy, IIS, Checkpoint etc). Then diagram your network (domains, clients, IP address, etc).. That in itself will probably teach you alot.

Just be happy he didnt sabotage anything BEFORE he left.. I would probably change some admin passwords too, just in case he can "tunnel" into YOUR servers.

What is it you are looking to do? First this is to delete his account and maybe even change the administrators password. You must be carefull when changing the admin password you may have services that depend on the admin account. This is just a start. Don't worry you will do fine, I am sure your company does not expect to much.

I agree with the point the guy made about mapping out the network and thus learning a lot that way.

You also might want to consider getting as many "Cram" books as you can find on each particular subject. This will teach you a lot and since you guys are in such a state of emergency, there shouldn't be any problem with the company picking up the tab for them. Consider asking them to send you to training as well. You may get a pretty good salary/job out of the deal.

Good Luck!

If you are really in a bind and need help fast, look to hire a temp consultant. Good Luck!

Along the lines of pbanco's response, disable the ex-admins account(s) and change the main administrative password if possible (some services may depend on that user, as an aside, you should change this if at all possible, but that is a future consideration).

Check the Domain Admin group, and make sure only valid users are in the administrative groups.

You could also set a password policy to force all users to change their passwords. That way, if the ex-admin knew others' passwords, theywill be changed soon.

Next, look over the services on the NT systems. Again, if possbile, change the service account passwords and make sure to change the appropriate Service startup parameters.

Good Luck. I would ask if you could get an outside audit performed on your systems. This may give you a better idea of what needs to be done, and what state things are in.

First and foremost I would delete this guys account and start changing admin passwords. Since he left on bad terms he might try to sabotage the network to make a point. I would also look at setting up auditing that way if he does do something you will have a trace of what he did and how he got in. Just like stated before some things might not work once you change your admin passwords. Just remember this is set mostly in control panel - services. Get your hands on as many books as possibleand just start reading up on administration. A few good internet sites are http://www.microsoft.com/technet/default.asp
http://www.cramsession.com

Just remember to relax and take it one step at a time. Don't get overwhelmed and just remember if you need help to ask and we will do our best here to help you out. Good luck!!!!

While changing Admin passwords is a good idea in the near future, I would advise against it for reasons stated previously...namely: some services may not work afterwards!!!! Since you are new to this, you may not know all of the ramifications of completing such a task. MY FIRST STEP would be to go into 'User Manager for Domains' and make sure that all administrative accounts DO NOT have 'Dial in Privelages'. Then, as long as he can't get into the building physically, nor can he get onto the network.

Good Luck,
Eric
p.s. nice to be in the right place at the right time :)

All above answers apply, except those portions that advised you to DELETE the prev.Administrators account. DO NOT DELETE! (Yet). Answer from aaron.vandergiessen@maryville.com said it best. DISABLE the previous administrators account. Do not delete it until you are sure that you have access to all system services. Do an inventory of the system. Physical & Virtual. Communicate with the boss(es). Know what they expect. Know what you can deliver. You don't mention whether your actually stepping into the shoes of your ex-System administrator, or just a concerned manager that inherited the mess. I gather, you are the one that is feeling the hot seat. Be cool. You inherited the position, you needn't take on the excess baggage... mlv//Mark LeVeck, http://www.chm.net / 618.593.7439 / mailto:mark460@trdesk.com

All answers seems to lead to a point that the poor admin guy will do a revenge to your company or has the ill-feeling intentions of doing harm to the network systems.

It is only you and you yourself can assess this!

Nonetheless, 1) check the users or accounts in all your domain(s) and observe if there is a strange name/account. 2) check config on all remote access softwares that on on his PC or on all servers/gateways; i.e. PCanywhere, ControlIT, RAS accounts, etc. 3) disable his Exchange server account. 4) check that Backup goes on as this can save you somehow!

Cheers and it is not the end of the world!