The account is still logged into the intranet on the day of resignation: Why a checklist is mandatory for account and permission revocation

At 4 p.m. on Friday, HR sent the resignation notice to the IT group. When Operation and Maintenance Engineer Li checked, he found the employee’s domain account was still online: email kept synchronizing, SSH connections to the code repository remained active, and query permissions for the financial system were not disabled. The employee was already completing handover procedures, yet their intranet access privileges were still valid. This security gap of “employee gone, access unlocked” can last for days in many enterprises. In some cases, old accounts can still access internal systems even one month after resignation.

1. Permission revocation: The biggest risk is relying on memory

The difficulty of revoking permissions for departing staff lies in the uncertainty of all access rights the employee holds. R&D staff may have access to code repositories, test environments and production release platforms; finance personnel can access capital systems and report databases; administrative staff are connected to access control and monitoring backends. Some employees cover multiple systems and hold cross-department temporary permissions. Authorization records are scattered across independent business systems with no interconnection.

If IT staff rely on memory or manually check each system, omissions are almost inevitable. Without a permission revocation checklist, it is equivalent to failing to count all keys before locking the door. Every uncollected permission creates a security opening. Worse still, many temporary and cross-department permissions are inconspicuous in daily work and only discovered overdue when an employee resigns.

There are also shadow permissions: access rights that are not revoked after project closure or role transfer. Over time, these accumulated permissions may outnumber the ones the employee was explicitly assigned.

2. Unified account and permission management: Consolidate all permissions into one dashboard

For campuses with multiple buildings and heterogeneous systems, manual checklist maintenance is impractical. AINOPOL Dream Gateway delivers unified account and permission management, aggregating accounts and permissions from discrete business systems into a single visual console. Administrators can view each user’s roles, accessible systems and permission validity periods on one screen. For group enterprises, accounts across multiple stores and buildings are centrally managed under one backend, eliminating isolated management on separate platforms.

With this consolidated dashboard, resignation permission revocation no longer requires tedious checks across dozens of systems. Administrators pull up the corresponding user profile and verify privileges item by item. All permission granting, modification and revocation operations are logged for audit traceability. Permission views can be exported for filing, ready for inspection without scrambling for screenshots from individual systems. The same dashboard also guides new account creation to prevent over-authorization and block risks at onboarding.

3. Revocation checklist: Revoke privileges immediately upon resignation, with item-by-item verification

In practice, attach a revocation checklist to every resignation workflow, covering these high-risk categories at minimum:

• R&D: Code repositories, test environments, production release platforms, artifact repositories
• Finance: Capital systems, report databases, invoicing and reconciliation permissions
• Infrastructure: VPN, bastion hosts, access control & monitoring backends, domain name and certificate management

Stick to the principle of least privilege for core permissions: only grant access required for daily work, avoid excessive permissions reserved “just in case”, which simplifies the revocation process. Each item on the checklist must be checked off and signed by the responsible person to close the workflow, preventing false confirmation that “permissions have been revoked”. Trigger the IT revocation task the moment HR initiates the resignation process, instead of waiting until all paperwork finishes. Shorter gaps mean lower security risks.

4. Periodic audits: Identify risks before resignation incidents

Checklists handle one-off revocation, while regular audits sustain long-term security. Unified operation and maintenance supports scheduled audits, re-matching onboarding status against actual permissions: dormant accounts with long-term inactivity, overprivileged access beyond job requirements, and expired temporary permissions for outsourced workers and visitors can all be detected.

Audit anomalies are rectified directly in the unified dashboard, keeping permission records aligned with HR status. The next time an employee resigns, the generated checklist is clean and free of emergency fixes. This mechanism is especially valuable for fast-growing teams with frequent staff turnover. Manual oversight is error-prone; visual dashboards and standardized checklists deliver reliable risk control.

An active intranet account on an employee’s resignation day is not merely a one-off oversight. It reveals that permissions have never been managed in a checklist-based manner. Built on all-optical infrastructure, powered by audio & video engine, and protected by robust security capabilities, AINOPOL delivers an integrated “connectivity & security” solution. Unified account and permission management consolidates privileges into one dashboard, revocation checklists enable verifiable instant access termination for resignations, and periodic audits remove overprivileged and dormant accounts in advance. Only when all access locks are secured can we truly confirm an employee has left the system.

FAQ

Q: How to manage temporary permissions for outsourced personnel and visitors?
A: Create independent user groups in the unified dashboard with preset expiration times for automatic invalidation. Include these permissions in the revocation checklist during filing, to stop temporary access from turning into long-term vulnerabilities.

Q: What risks come with leaving historical dormant accounts uncleaned?
A: Dormant accounts serve as potential springboards for lateral penetration. They should be prioritized in regular audits and removed promptly to reduce the attack surface.

Q: Should we regenerate permission checklists for internal transfers?
A: Concurrent review is recommended. Unrevoked old roles after job transfers lead to residual overprivileges. Use the unified dashboard to match permissions against the requirements of the new role, removing redundant access and supplementing required privileges to maintain least privilege.