- [Instructor] Account administrators are responsible
for managing the provisioning and deprovisioning
of user accounts.
This involves two core activities.
When a new user joins the organization,
administrators ensure that they go
through the appropriate onboarding process,
and then they provision a user account
for that individual.
This involves creating authentication credentials
and granting the user appropriate authorizations
based upon their job function.
Then when a user leaves the organization,
administrators ensure that they go
through an offboarding process that includes
deprovisioning the account to remove their credentials
and authorizations at the appropriate time.
For example, the normal workflow for a planned departure
should automatically begin when a supervisor
informs the human resources department
that an employee is resigning or retiring.
The account administration team
should configure the user's account
to automatically expire on the date
he or she is leaving the organization.
The second workflow is for emergency situations
when a user is unexpectedly terminated.
This may occur under adverse circumstances
when a user is fired.
In those cases, the IT department
should carefully coordinate with human resources
to time the account termination precisely.
If account administrators fail
to precisely time the access revocation,
two undesirable situations may occur.
First, if the account is terminated
before the employee is informed of his or her termination,
the employee may gain advance notice
of the impending termination
and take retaliatory action against the employer.
Second, if the account is not terminated immediately
upon the user being informed of his or her termination,
the user may gain access to the system
after being fired and take retaliatory action.
Let's take a look at how we can perform these actions
in Windows.
From Server Manager, open the Active Directory
Users and Computers tool and locate the account
of the user that you wish to terminate.
We'll terminate Alice Jones.
Right-click on the user
and choose Disable Account.
You'll see a pop-up informing you
that the account has been disabled.
And notice a very small arrow next to the Alice Jones icon.
There's a down arrow there that indicates
the account has been disabled.
Disabling the account provides a way
of temporarily suspending the user
and can be reversed by re-enabling the account.
It is normally a good idea to disable the account first,
even when a user is being permanently terminated
just as a safeguard against error.
When you're ready to actually delete the account,
you can return to this window and delete it.
You'll see a warning when you try to do this
from Active Directory just making sure
that you want to delete the user.
And when you do, the user disappears.
You can also use the Active Directory Users and Computers
tool to schedule the future expiration of an account.
Let's say that Carol Adams announced her retirement
for the end of 2016.
We can go ahead and schedule her account to expire
on the last day of the year
by right-clicking her name and choosing Properties.
Then on the Account tab,
we can enable account expiration
in the Account Expire section
and set the expiration date to December 31st, 2016,
by scrolling through the calendar here
and choosing the last day of December.
When we click OK, Carol's account is now scheduled
for expiration on December 31st, 2016.
Suspending and terminating accounts in a timely manner
boosts enterprise security by reducing the risk
of unauthorized access.