Windows Forum

Ask something
Discussion Locked

User Account best practices.

0 helpful
7 replies

by dr_d_2k

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am at a location with ~130 NT4 or Win2K machines and ~150 users. Due to recent layoffs and the changing economy users are being RIF'd, rehired and possibly RIF'd again.

My plan was to diasable accounts, archive files and profiles and wait. Within 3 months, if the user doesn't come back, delete the account from the domain and carry on. If the user comes back after that, well they probably won't be in the same position so old rights and group assignments wouldn't apply.

Other techies said to keep All OLD User Accounts disabled-only forever and never delete them. To me that just dumps a boat load of users in my user manager.

Any thoughts are greatly appreciated.

7 replies

by timwalsh

An advantage to keeping old user accounts is that they can be renamed. If you have a new user come in that needs the exact same rights and permissions that an old account already has, its just a matter of enabling the account and renaming it to match the new user. However I don't view this as an exuse to keep ALL old accounts. As you mentioned, it can eventually make for a very cluttered user list.

Instead of keeping ALL old accounts you might try the tack of keeping one old account for each major grouping of rights and permissions your use. The other advantage you have working in your favor is the ability to copy accounts. If you have multiple new users that need the same user rights/permissions mix, you can take one old account and copy it as you need.

The bottom line is that it really is a function of how you, as the administrator, like to work.

Hope this helps.

by joseph moore

If your company does not have an official policy, they it is really does just depend on how you want to do it.
Personally, I keep the accounts for terminated employees Disabled for 1 month. In User Manager, I open the account for the terminated employee, click the Account Disabled checkbox, then I update the Comments field with a messge like, "DELETE ACCOUNT END OF *MONTH* 2002" where I replace *MONTH* with that month.
So today an employee was let go. I changed their description to DELETE ACCOUNT END OF SEPTEMPBER 2002. Sure, this is August, but it is mid August. Close enough!
That way, with the Comments field filled out, any time I go in User Manager, I see these comments (all in CAPS does make them stand out). And if I see one that says I should delete, and it is time, I then delete it.
It is a good enough system for where I am at. There is no company policy at my employer for this.

My 2 cents.

by gigelul

Hi,
I use most of time "groups" to grant permissions. So, when a user go out from company I delete this account after I save docs from profile. Is not so hard to define a new user when I need, and I'm sure that I don't make any mistake in group assigment or other permissions. Simply I add this new user in the correct group.
Also I use roaming profiles and they are different because I have different hardware workstations and different software configurations on workstations. To keep an old profile and use it later, means to know from wich workstations was this. To hard. I prefer to have a new clean profile for a new user.

This discussion is closed to new replies.