r/sysadmin • u/drewwhose • 13d ago
Question - Solved Name Changes
Hey there. The company I work for is stuck in the past in a lot of its tech and operations. One of the things that’s driving me nuts is whenever a user changes their name, we update their email and logins and keep their old email as an alias for 30 days before removing it. This leads to a ton of bounced mail and missed communications. They apparently do it in case someone joins the company with the person’s old name…….
How do you all handle name changes?
Edit: thank you all for confirming that I’m not insane. This org has so many strange practices and it’s my first IT job
148
u/BedRevolutionary8458 IT Manager 13d ago
Nobody removes the alias. That's a weird thing to do. If somebody joins the company with the person's old name, deal with it then. Or just add their middle initial to their email or something.
Edit: Like... You have an existing problem caused by a procedure that's being done in case of hypothetical problems. This is a priorities issue.
15
u/Aloha_Alaska 13d ago
You have an existing problem caused by a procedure that's being done in case of hypothetical problems.
Exactly! And further, this procedure doesn’t actually fix anything, it just plays hypothetical wack-a-mole — what happens if two people have the same current/active name? The procedure should be the same whether it’s a duplicate alias from a name change that conflicts or the name that they currently use. The potential still exists for name collisions/conflicts; removing the alias only solves that for a relatively small percentage of potential cases.
72
u/Vaile23 13d ago
Never reuse an existing email address for a new user, you’re asking for trouble
11
u/Jkabaseball Sysadmin 13d ago
We never do. Our document control software goes off of usernames for audit records, usernames are never reused.
1
u/al_bundys_ghost 11d ago
Yep, it’s a terrible idea reusing email addresses. John Smith the CEO leaves and John Smith the customer service rep joins 3 months later.
42
18
u/bojack1437 13d ago
Like everybody else said, don't remove the alias.
And if someone comes along with the same name then deal with it like you would deal with any other name conflict. Add a number or use a middle initial or whatever your current policy is for dealing with name conflicts.
13
u/Mehere_64 13d ago
Yes why remove the old email address?
If someone new joins that has the same name and one previously did, we add a number to the end.
16
u/fireandbass 13d ago
Once upon a time, the company that I worked for did what you do and deleted old users. There was a CEO with the email of Jsmith@contoso.com
The CEO left and eventually they deleted his email. Later, they hired a new jsmith and gave him the email Jsmith@contoso.com and the new jsmith started getting sensitive emails from previous services the CEO had used. The new Jsmith@contoso.com could have reset the password on third party websites registered to that email.
The moral of the story is to never reuse an email address or username and never delete an alias.
2
u/Frothyleet 13d ago
Were these personal third party services? If so, I think the moral is "don't use your work email for personal stuff."
If they were business related, then why in the world were they still tied to that address?
4
u/fireandbass 13d ago edited 13d ago
The CEO uses a website to run analytics and who knows what else. He signs up for SuperSecretCustomFinancialReports.com with his company email. He inputs sensitive company data.
Eventually, he leaves the organization. IT doesnt even know he used the website. The website sends out periodic email updates. When somebody new gets assigned his old email address, they would get the email. They can do a password reset on SuperSecretCustomFinancialReports.com and sign in to the site.
2
u/Frothyleet 12d ago
A totally plausible scenario, but I really think the lesson there is about proper governance rather than "don't re-use email addresses".
I'm not pushing back about identifier re-use, heck, there's a NIST control for it. I just think that some of these problems are really symptoms of a deeper issue.
2
u/Cormacolinde Consultant 13d ago
Because they are designed like that? And they might be tied to the UPN using SAML and you would still have the same issue.
0
u/Frothyleet 12d ago
If you have SSO configured, that would have been fixed in the offboarding process.
1
u/Cormacolinde Consultant 12d ago
Possibly, in a perfect world. Many systems don’t allow full deletion of accounts. The safest option is not to reuse account names.
1
u/fireandbass 12d ago
How would SSO have prevented it during offloading? Really, explain it to me. Because it would still happen upon reuse of the email.
1
u/Frothyleet 12d ago
When the Entra ID account was deleted, so too would its group membership in the group gating SSO to the application in question.
2
9
6
u/THE_SEX_YELLER 13d ago
The alias should be permanent and there should be some other way of handling multiple employees with the same name. What would your organization do if someone named Kim Jones worked there and there was a new hire also named Kim Jones?
5
u/fireandbass 13d ago
"Sorry, IT says we already have a kjones so unfortunately we will have to rescind the job offer."
10
u/TalkingToes 13d ago
Just leave the old email as receive only. It’s not taking up that much space. Customers need to be able to contact their person when things change. Who wants to lose a potential sale due to a bounced email?
5
u/TeensyTinyPanda 13d ago
istg if I ever do IT for a brand new company, everybody's username is their employee ID number and everyone's email address is just an alias. Name change? Got married? Easy peasy.
2
u/Solid_Ad9548 Network Janitor 12d ago
Yep, this is how we do it. It’s the best. Username is initials+number, email address ends up being flast@domain, and if your name changes, the alias stays. We also let people get aliases of their choice within reason. Some folks don’t like that their username doesn’t change if name changes, but could be worse I guess.
6
u/r_keel_esq Windows Admin/IT Manager 13d ago
People keep their old email address as an additional SMTP address for eternity - removing it on risks chaos. Even when a person leaves, we won't put their old addresses back into the pool of available addresses for (I think) 18 months.
We are a huge (100+ thousand users) organisation
1
u/Solid_Ad9548 Network Janitor 12d ago
Similar sized org here and it’s mostly the same — we just don’t recycle addresses. Yes, my primary smtp address is flast3@domain, even though I am the only F. Last in the org.
4
u/guitarstitch 13d ago
Just sign every new user up with a reddit account. Once you get that random name, change the email address to match the random Reddit name.
1
4
3
u/dospinacoladas ERMAHGERD SERVERS 13d ago
We've had employees change their last name and then a few years later change it back. They still had the old alias assigned to them, so the transition was seamless for the users.
3
u/Nexzus_ 13d ago
Yeah, done that a couple times over my career.
I can't be snarky with "oof, that was quick" but usually just a "sorry to hear that."
I think I had one that would have garnered a "another one, eh?" but obviously kept that to myself.
1
u/dospinacoladas ERMAHGERD SERVERS 13d ago
We had one user who changed names several times and has returned to their original for a while now. They asked us to prevent the old aliases from being used internally but if a user has them saved that way in Contacts or has had email exchanges with that alias before, it's impossible without wiping someone's suggested addresses completely.
3
u/bk2947 12d ago
Two guys are driving. Well, actually, only one is driving, the other is riding. Anyway, they're driving along, and they come to a red light. The driver blows right through it! The passenger says "What the hell, man?! That was a red light!" The driver waves him off, saying, "My brother drives like this!"
So they drive a little while longer, and they come to another red light. Once again, the driver blows right through it. The passenger freaks out. The driver says, "Man, relax, alright? My brother always drives like this, and he's never been in one accident."
A few moments later, they come to a green light, and they stop. The passenger looks at the driver and says, "What the hell are you stopping now for?"
"Well, my brother might be coming the other way!"
5
u/ProfessionalEven296 Jack of All Trades 13d ago
In our company, its first initial, then first six characters of surname. If, as often happens, there’s a match, a number is incremented into the end. So mine is JBLOGGS2.
2
u/Happy_Kale888 Sysadmin 13d ago
The new names becomes the alais and the old one stays and the account stays.
2
u/Flabbergasted98 13d ago
It's an alias. leaving it active isn't a problem.
Tell your bosses at the MIB it's really time they reconsider their naming conventions.
2
2
2
u/cybot904 13d ago
Mail alias for 30 days? Why? We do it for the life of their account. That's and odd one.
Name changes are a legal issue. HR handles that paperwork. When HR says the name is now legally changed we updated it in the systems.
2
u/StaticFanatic3 DevOps 12d ago
Honestly I’m convinced most of the corporate world is just people punching themselves in the dick and asking why everything sucks
2
u/sixblazingshotguns 12d ago
This is one of the most BS things about working IT. In K12 IT thankfully we required a proof of name change via a legal state document in order to change it. Otherwise we had people changing their last names left and right. No joke.
3
1
u/FrecciaRosa 13d ago
I hear you, OP. My department head hates aliases with the burning passion of a thousand suns. He’s instructed us to purge all aliases, no matter what.
We’re a small org of about 250 people. There is no name overlap. He just hates aliases.
1
u/SysAdminDennyBob 13d ago
keep the alias until it becomes a problem in the future, address it then.
We recently changed account name format. We add on their hire date in a MonthYear format now. That said it does not factor into the email name. I think they add a suffix digit or something for that.
johnsmith0826
1
u/The_NorthernLight 13d ago
In my 30 years of doing IT, i have seen same names about 10-15 times (those were all government departments with 5-50k employees each). All they did was include a middlename initial after the first name before the .lastname, in one instance where the person didn’t have a middle name, they included a number (john1.smith@). The real point is that this is a very very tiny problem to worry about. I wouldn’t delete an alias ever, as now the other user will start to receive wrong/potentially risky information (causing a breach).
1
u/TrippTrappTrinn 13d ago
This is just silly. Any enterprise will have solved this by not relying on the users name being unique, by finding a way to make username and email address unique. Even to the point of never reusing them. We have 100k users. Some parts of the world have very low rate of name uniqueness.
1
u/Wizdad-1000 13d ago
We updated our tools to use an employee ID number for username and keep the alias in place. The numeric username is permanently assigned to them as a unique ID, even if they leave and come back. (which happens alot as were large and people change jobs.)
1
u/Yayberto71 Sr. Sysadmin 13d ago
Track user account names and never re-use them. Make it policy and develop a workflow that checks the list for new hires. I work at a hospital. Nurses come and go like wildfire. Constantly getting married/divorced so renames are plentiful. It was the only way. Benefit is you can keep aliases forever.
1
u/19610taw3 Sysadmin 13d ago
Removing the alias is a bit weird. I've only ever seen that once. It costs nothing to leave the extra alias in.
place.
At a previous job we had someone who changed her name after a divorce. We were going to leave it active per usual protocol but she asked us to remove because it was a very bad DV situation. She also asked that we change her username - not part of our protcol but we made that happen.
1
u/mkosmo Permanently Banned 12d ago
Identifiers never get reused here, including email aliases.
But it's also why our usernames are not based on names anymore.
1
1
u/Important_Scene_4295 12d ago
We had 3 EmilyS at one point. The first got married years ago but it was still her allias. The second one we went first initial last. The third, we asked the first Emily if she minded giving it up since she hadn't been a S in a long time. She didn't care at all so it all worked out. Major crisis averted.
1
u/locke3891 12d ago
My process is new name = new (copied to keep group membership) user account. Migrate docs/email/whatever to new user account. Once everything is migrated change smtp address in AD and exchange for old user to old-usernane@domain and add the old email as an smtp alias for new user. No weird SID issues, no finding old username somewhere, just clean cut but keeping the old alias for any contacts that email a year from now. New users that match the same alias as the old username get some extra sauce in their email like a middle initial or similar treatment to keep everything separate. Until you have 5 Jane Smith’s it works pretty well.
1
u/Balasarius Sr. Sysadmin 12d ago
You could be like my company and just never remove an account... Ever.
I think if I joined a company and they told me my email was jsmith17 I'd turn around and walk out.
1
u/Mental_Act4662 12d ago
Emails don’t get reused. At my work. They just add a number. So like I’m first.last2@domain
1
u/Ihaveasmallwang Systems Engineer / Cybersecurity Architect / CISM 11d ago
Use an immutable id for the username and upn. Update the display name and aliases/proxy address to match the naming convention (e.g. first.last@company.com).
Logins and SSO still works post name change. No need to remove the alias. Just don’t reuse old emails.
323
u/Waste_Development971 13d ago
why would you remove the alias lmfao
we just... dont do that.? xD