What Happens When the One Person Who Knows Your IT Leaves?

How many people in your company know the router admin password, which registrar holds your domain and where last night’s backup went? In most offices the answer is one. It’s the colleague from accounting, the warehouse or sales who got the “good with computers” label and took over IT. While they do a decent job nobody asks. The question comes up when the resignation letter lands on the desk, and by then it is late.

How do you tell IT depends on one person?

Answer five questions quickly:

• Whose name is your domain registered under, the company’s or a personal email account?
• Who else can log in to Microsoft 365, the firewall and the backup console?
• Are passwords kept somewhere shared, or only in that person’s phone and head?
• Does a second person know the server or NAS admin password?
• Whose name are the internet line, licences and software contracts in?

If you answered “not sure” to more than two, keep reading. The person leaving doesn’t have to be malicious. The problem is knowledge living in one human memory, and that human eventually changing jobs.

What should the company hold before they leave?

The table shows the access that most often stays with one person, and what it should look like:

Access	Common situation	What it should be
Domain registration	Account opened with a personal email	Under a company officer or a shared mailbox
Microsoft 365 admin	One admin, the person’s own account	At least two admins plus a break-glass account not tied to a person
Firewall and modem	Unlabelled, password only with them	In a password vault, second person has access
Server and NAS admin	Shared “admin” account they alone know	Named accounts, local admin password in the vault
Backup console	Alerts go to a personal address	Alerts to a shared mailbox, second admin on the console
Carrier, licences, software contracts	In their name	In the company’s name

Microsoft’s own admin guidance points the same way: don’t pile up admins, but keep at least two emergency access accounts so you can’t lock yourself out of your tenant. Those accounts aren’t used day to day, their passwords sit in a vault and any sign-in triggers an alert.

A vault is not the same as a spreadsheet

Some offices tell me “it’s all in Excel.” If that file lives on one person’s laptop you have the same problem, plus the passwords are in plain text. A business password manager (company account, role-based sharing, an access log) does two jobs at once. Passwords stay with the company and you can see who opened what.

For local admin passwords, there’s a better way than tracking each machine by hand: a different, automatically rotated password on every computer. Windows has this built in as Windows LAPS, and small offices without a domain controller can use it with Entra ID.

Documentation: what to write, what to skip

Nobody reads or updates a fifty-page infrastructure document. Two pages do the job:

1. The map: which device is where, which providers you buy from, who to call (carrier, licence reseller, software vendor).
2. The crisis card: the first three things to check if the internet drops, backups fail or email stops, and who to phone.

Don’t write passwords into the document. Write which vault entry holds them. Review it every three months with someone other than the author.

Handover day: the first 24 hours

If the person is leaving for good, work through this order:

1. Change shared passwords and admin account passwords, reset and re-enrol MFA methods.
2. Remove admin roles from their own accounts. Disable the account rather than deleting it, since you may need the mailbox and files.
3. Point backup alerts, firewall notifications and the domain contact email to a shared address.
4. Close their personal access to VPN, remote desktop and cloud consoles. Remotely wipe company apps from their phone.
5. Restore one file from backup to confirm backups still work. Things sometimes break during a departure.

If they’re leaving on good terms and you have a month, have them hand over to whoever takes over. The most valuable knowledge is never in the document. It’s the note that says “this server slows down Monday mornings because…”.

What if you can’t afford an in-house team?

In a company of twenty or thirty people a full-time IT specialist often doesn’t make sense, which is exactly why the dependency on one person appears. One option is to keep your in-house person with proper rights and add outside support as a second pair of eyes. The other is to hand the work to a team under a maintenance agreement, so access sits with a team that keeps records rather than one individual. Either way the test is the same: your IT shouldn’t stop because one phone number goes quiet.

FAQ

Is asking the departing person for the passwords enough? No. They hand over the passwords but a second account, a mail forwarding rule or a personal console may remain that you don’t know about. Build an inventory first, give a second person access, then change the passwords.

What if the domain is registered in their name? Ask the registrar for an ownership transfer. It’s easy before they leave and can take weeks afterwards. Losing the domain stops both your website and your email.

How long does recovery take? In a prepared office, about a working day. Where passwords are unknown and nothing is documented, weeks. The difference comes from one hour of inventory done before they leave.

If you’d like to map out who holds which access in your office, you can get in touch.