When a technician leaves, the dangerous part is not what they take with them, it is what they still know. A shared admin password, a VPN profile, an SNMP community string: all of it keeps working until someone changes it. This checklist is for ISPs, MSPs and IT teams. Use it for planned exits and for sudden ones.
Before or on the day
- Remove their access to your password system first. Take them out of every group and shared folder, and sign their devices out. Do this before anything else, so they cannot see what you change.
- List what they could reach. Everything in the folders they belonged to, plus anything they were told verbally.
- Check the access log. If you have an audit log or login trail, see which logins they used recently. Those come first.
What to rotate, in order
- Internet-facing and core devices: border and core routers, firewalls, VPN servers.
- Tower and backhaul routers and switches: everything with a shared admin login.
- Radios, access points and customer-facing gear: including SNMP community strings and management passwords.
- OLTs and fibre equipment: usually changed by hand, so plan the time.
- Remote access: VPN profiles, WireGuard keys and peers, RADIUS secrets, jump hosts.
- Cloud and vendor panels: controller logins, DNS and domain registrar, billing and monitoring tools, remote-support accounts.
- Client-owned systems where they had delegated access. Tell the client.
Prove it worked
- For each device, confirm the new password works and the old one is refused. A change that was never applied is worse than none, because you believe you are safe.
- Record the date and who changed it.
- Watch the next few days of the login trail for failed attempts with the old credentials.
How NettForge helps
On Business and MSP plans, Leaver Lockdown changes the password on RouterOS devices for you, then checks both the new and the old password. Access Pass gives contractors time-limited access so there is less to undo later, and Client Wall (MSP) means a technician who never had a client's key never had its logins at all. See password management for ISPs and MSPs.
Make leavers easy next time. Give each client or tower its own credentials, so one departure means rotating a small set, not everything. Use Keychain Login so technicians never need to know the passwords at all.
Questions people ask
As soon as their access is removed, ideally the same day, and before they leave if it is a planned exit. Start with internet-facing and core devices.
On RouterOS devices, yes: Leaver Lockdown (Business and MSP plans) changes the password using the saved login, then verifies that the new one works and the old one no longer does. Other devices, such as many OLTs, need a manual change, and the checklist below covers them.
Treat anything stored where they could read it as exposed, including shared documents and chat history. If in doubt, rotate it.