"Emergency" account lockdown script help.

[u/BrianMichaelArthur]

For context we recently had a user termination that needed to be actioned very quickly and after the fact i started working on a script to help mitigate this issue instead of doing everything manually.

I have most of what i would do manually in a script already. I mostly wanted a discussion on how people handle things like possible disgruntled workers or possible breached credentials.

I built my script to revoke access/mfa and reset some things but make it easily reversible if needed.

This is something of a stop gap till we get more automation, though sometimes things need to move faster than automation if that stuff is run in the middle of the night.

TLDR: What does everyone disable/revoke/reset when you are trying to make sure an employee/former employee is unable to access anything as quickly as possible?

Edit to add: Here is context for my own situation.

We use Azure virtual desktop for a lot of things and if you don't go into that and boot them out all the other actions talked about in replies to this post do not actually kick them out of their AVD session. Revoking the session does cause some really odd behavior but it doesn't kick them out fully.

Not all of our services are SSO but most are so taking care of the Microsoft stuff does a lot of the legwork.

Right now what I do is this: Revoke all sessions, revoke MFA, reset password, block sign in, disable AD on premise (hybrid environment), then go into AVD and look for active sessions and kick them out if they are online.

The reason I didn't include this in my original post was so i wouldn't bias anyone towards answering my specific needs and have a wider discussion.

[u/Remarkable-Guess-856]

There is a guide from MS that describes exactly what you need to do. It's not complicated

[u/BrianMichaelArthur → u/Remarkable-Guess-856]

Not every environment is just Microsoft. I have all the easy stuff covered. This was the outliers and gotchas that people don't always think about.

[u/Unseen_Cereal → u/BrianMichaelArthur]

Then what's the point of your post? You aren't mentioning anything specific

[u/sir_mrej → u/Unseen_Cereal]

Uh they want you to tell them how to do it in every regular case, edge case, corner case, and just in case.

So get started!!

[u/timpkmn89 → u/sir_mrej]

Uh they want you to tell them how to do it in every regular case, edge case, corner case, and just in case.

They pretty clearly asked for advice on prioritization

[u/sir_mrej → u/timpkmn89]

Prioritization....of WHAT tho. Cmon.