What to do when a key staff member leaves with the passwords

Don't panic, and don't escalate yet

This situation is more common than people admit. The long-serving office manager who set everything up retires, the in-house IT person resigns after a disagreement, or a family member who ran the systems steps away from the business. Sometimes they simply forgot to hand over a list; occasionally they are reluctant or hostile. Either way, the business suddenly can't reach the admin settings for its own email, website or software.

If the departure was amicable, the fastest route is usually to ask. Arrange a handover session and have them sit with you or your IT provider while credentials are moved into a business password manager and ownership transferred. If the departure was difficult, it may still be worth a polite written request before anything else. If they refuse or you suspect they might misuse access, get employment or legal advice before contacting them further, and focus on securing systems.

Secure what you can reach right now

Make a list of every system you know of and mark which ones you can still administer. For anything you control, remove the departed person's access immediately: block their sign-in, reset their password, revoke their MFA methods and sign them out of all sessions. Change shared passwords they knew, such as Wi-Fi keys, alarm codes and supplier logins.

Check for less obvious routes back in. Are there mail forwarding rules sending copies of email to an outside address? Has a personal phone been registered for MFA on a shared account? Is there a remote access tool on an office PC they could still use? Are there app passwords or API tokens in their name? An IT provider can review sign-in logs and admin audit logs to spot recent changes worth worrying about.

Recover the domain name first

Your domain name controls your email and website, so it comes first if you've lost access. Find out which registrar holds it; a public WHOIS lookup or the .nz registry's search can show the registrar for most domains. Contact the registrar or reseller and explain the situation. For .nz domains, the registrant named on the record is the legal holder, and the registrar will usually need proof that the business is that registrant, such as company records.

If the domain is registered in the former staff member's personal name, the process is harder and may need their cooperation or a dispute process. That's why domain records should always name the business as registrant, with renewal notices going to a shared business address that more than one person reads.

Recover Microsoft 365, Google and other cloud systems

If nobody in the business has global admin rights in Microsoft 365, Microsoft has a process for verifying domain ownership and restoring admin access, which typically involves adding a DNS record to prove control of the domain. That is one reason to recover the domain first. Google Workspace has a similar admin recovery process. Expect it to take days rather than hours, so start early.

For accounting systems, payroll, banking and specialist software, contact each provider's support team. Most have a documented process for an organisation to regain control, usually involving proof that you are an authorised officer of the business, such as a director, along with company documents. Banks are typically the most cautious, which is reassuring even though it takes time.

Change everything they knew

Once you have regained control, treat every credential the person may have known as compromised. Change passwords, rotate shared secrets, re-register MFA methods and review admin lists in each system. Check for accounts they may have created, such as an extra admin user or a dormant account, and remove anything you didn't authorise.

Review what changed recently: payment details in the accounting system, forwarding rules, DNS records, website admin users. If you find anything suspicious, keep a record and talk to your lawyer. Unauthorised access to a computer system can be an offence in New Zealand, and the details matter if it ever goes further. Your cyber insurer may also want to know if there's any sign of misuse.

Make sure it can't happen again

The underlying problem is that one person held the keys. Fix it by giving at least two named people admin access to every critical system, storing credentials in a business password manager with shared vaults, keeping a sealed emergency admin account, and registering domains and subscriptions to business addresses rather than personal ones. Document all of this somewhere the owner can reach.

Then add a handover step to your leaver process: before anyone with admin rights leaves, they transfer ownership and credentials while still employed, and someone checks that it worked. A business that does this routinely will never face the same scramble again. If you need help with recovery, Office IT can work through the provider processes with you and set up the controls afterwards.