Back to all recipes

Level: JuniorLast updated: 2026-09-10

Offboard a leaver correctly

Disable-ADAccount -Identity jdoe
Set-ADUser jdoe -Description "Disabled $(Get-Date -f yyyy-MM-dd) - offboarding"
Move-ADObject (Get-ADUser jdoe).DistinguishedName `
  -TargetPath "OU=Disabled,DC=corp,DC=local"
Get-ADUser jdoe -Properties MemberOf | Select-Object -Expand MemberOf

Why it works this way

Deleting immediately breaks file and mailbox access. Correct: disable, kill sessions, move to a hold OU.

Caution

Disable, do not delete: deletion destroys the SID and with it historical access to files and the mailbox.

Watch out

Reset the password too — disabling alone leaves an issued Kerberos ticket valid for up to 10 hours.
Save the group list before removing it, in case they return.

Related events