Employee Termination Process

Haui

Senior member
Feb 18, 2007
593
0
0
Hello AT! I am working on a huge project here for my company. It involves the employee termination process and what the "HelpDesk" does in terms of completing the task. I have found several loop holes and problems with our process and am trying to revamp the way we do things.

To make a long story short, I am trying to change the following in the process we take. Currently a request comes in to the HelpDesk and we send out email notifications, change network passwords, remove from scanners and set forwards and such. Here is where the problem lies.

From my own personal opinion, a PST of a user's mailbox should be created ASAP when the employee termination request is created (say within 12 hours). This is to capture any and all work that the user has done while employeed with the company. However, our company does the opposite. When an employee termination request comes in, the form filled out gives the requestor (generally the office manager) the option to "delete mailbox at a certain date and time". The problem is, some of the requestors use a 6 month to 2 year WAIT in allowing us to delete the mailbox. When that time finally comes, that is when OUR company decides to create the PST of the mailbox.

Now, my concern is this. While waiting so long to "delete the mailbox", we are also giving full mailbox rights to other users (as requested by requestor), thus allowing CHANGES to be made to the terminated employees mailbox. This could consist of deleting emails, moving emails, HIDING things, or any other kind of act that can manipulate what that employee actually did for the company. Before we can actually delete the mailbox and finish the request out, we have to contact the requestor and get permission to do so, EVEN THOUGH they have a requested date for this to happen. Most of the time, the requestor says NO and we have to wait longer to finish the ticket. This causes MANY problems for the HelpDesk, because at any given time, we have around 30-50 tickets sitting in the queue "pending" the creation of the PST and deletion of the mailbox.......and we have NO idea when we can actually do this.

Furthermore, as requested by the requestor (sometimes) we give "Send on Behalf" rights where another user in the company can send an email on behalf of the terminated employee. Is this NOT a legal issue here? Sending emails froma person that does not exist in the company anymore is in a sense illegal right, or is this common practice?

This is a VERY shortened blib of what we actually do when it comes to terminated employee's, but I am only describing the problems that I see. So I have been asked to come up with some ideas on how to change this. I have a very basic concept:

1. Request comes in
2. Complete initial tasks (email noticiations, password reset's, blackberry deactivation, etc)
3. Create PST ASAP (given a 6-12 hour grace period for the HelpDesk to do this)
4. Delete mailbox within 3 days
5. Create and alias under a departmental mailbox for terminated employees to catch any future emails that come to that "address", but not leaving the users actual account open. This part is the huge part because it would consist of creating a mailbox either for each office or even deaper as to each department in each office called something like "finacialservicesterminated@domain.com". All emails would be centralized for the office managers to manage these types of things in one place (rather than now where they have 23453435987 mailboxes opened in their own mailbox.
6. If "Sending on Behalf of Terminated Employee" is in fact a legal issue, we elimate that altogether

I have a few more ideas to go along with this, but this is all I wanted to address to all of you. I am looking for ideas, practices and models. What does your company do? If you could change the process, what would you change?

I know this is a long post, but I am looking for very imformative people that can help a fellow out! Exchange experts to the rescue.....what do you do here?
 

Connoisseur

Platinum Member
Sep 14, 2002
2,470
1
81
Does your company maintain and archive the exchange server? In that case, a backup of the local mailbox may be a moot point as all the email sent/received should be stored on the exchange system. In our company, in addition to archiving the exchange server regularly, we frequently create images of entire laptop hd's when an employee leaves (especially one who may have been involved in active projects). Additionally, if your company is public, it may be illegal to delete mailbox items without having them archived as per SOX (http://en.wikipedia.org/wiki/Sarbanes-oxley) requirements. I apologize if I misconstrued the workflow, but all emails for an employee should regularly be backed up. If you don't have an automated archival system in place, your suggested options seem to be the next best thing.
 

Haui

Senior member
Feb 18, 2007
593
0
0
Originally posted by: Connoisseur
Does your company maintain and archive the exchange server? In that case, a backup of the local mailbox may be a moot point as all the email sent/received should be stored on the exchange system. In our company, we frequently create images of entire laptop hd's when an employee leaves (especially one who may have been involved in active projects). Additionally, if your company is public, it may be illegal to delete mailbox items without having them archived as per SOX (http://en.wikipedia.org/wiki/Sarbanes-oxley) requirements. I apologize if I misconstrued the workflow, but all emails for an employee should regularly be backed up. If you don't have an automated archival system in place, your suggested options seem to be the next best thing.

Our company just implimented Mimosa Archiving back in January of this year. Before then, we were running tapes pretty regularly. However, as it stands right now, there is NOT a backup process for Mimosa, so if it goes down and we are NOT creating PST's, we lose it all. The thing is, the vendor promised us a ton of stuff, but we are running into a lot of problems (processing 20 million emails a day has the archive system behind by 8 days.)

Back to subject, what do you think of the workflow I am suggesting? What does your company do in terms of what I listed above?
 

Connoisseur

Platinum Member
Sep 14, 2002
2,470
1
81
Originally posted by: Haui
Originally posted by: Connoisseur
Does your company maintain and archive the exchange server? In that case, a backup of the local mailbox may be a moot point as all the email sent/received should be stored on the exchange system. In our company, we frequently create images of entire laptop hd's when an employee leaves (especially one who may have been involved in active projects). Additionally, if your company is public, it may be illegal to delete mailbox items without having them archived as per SOX (http://en.wikipedia.org/wiki/Sarbanes-oxley) requirements. I apologize if I misconstrued the workflow, but all emails for an employee should regularly be backed up. If you don't have an automated archival system in place, your suggested options seem to be the next best thing.

Our company just implimented Mimosa Archiving back in January of this year. Before then, we were running tapes pretty regularly. However, as it stands right now, there is NOT a backup process for Mimosa, so if it goes down and we are NOT creating PST's, we lose it all.

Back to subject, what do you think of the workflow I am suggesting? What does your company do in terms of what I listed above?

I'm not in the IT department so I don't know the exact specifics on what we do (but I do talk to them frequently). However, I do know the general workflow:
1) Request comes in
2) Domain access revoked
3) Email revoked
4) Delete local HD pst's and image the computer HD. This reduces the size of the HD image. We rely exclusively on exchange server backups. However, we do have a robust archival system. In the 2 1/2 years i've worked here, our worst accident was that we lost 1 day's worth of email. This was unavoidable as the connection to our exchange server was down and the mails never even got to the system.
5) We do NOT generally forward emails or create alias emails.

Bottom line, if you have a good archival system, there should be no need to backup the local email. You should, however, create images of the employees HD (with or without local pst's) in case they have any work product that needs to be preserved.
 

AMCRambler

Diamond Member
Jan 23, 2001
7,715
31
91
You must work for a huge company. 20 million emails a day? Either that or your spam filtering is non existant. That's a couple hundred gigs of mail per day if you're archiving all of it. Compression will help some, but that's still a large back up.
 

Haui

Senior member
Feb 18, 2007
593
0
0
Originally posted by: AMCRambler
You must work for a huge company. 20 million emails a day? Either that or your spam filtering is non existant. That's a couple hundred gigs of mail per day if you're archiving all of it. Compression will help some, but that's still a large back up.

We currently are sitting at around 20 million established emails. The way the archive system works is it has to process EVERY email every single day. This will be a problem in 2-5 years when our system doubles in emails and our archive system is a month behind.
 

AMCRambler

Diamond Member
Jan 23, 2001
7,715
31
91
Originally posted by: Haui
Originally posted by: AMCRambler
You must work for a huge company. 20 million emails a day? Either that or your spam filtering is non existant. That's a couple hundred gigs of mail per day if you're archiving all of it. Compression will help some, but that's still a large back up.

We currently are sitting at around 20 million established emails. The way the archive system works is it has to process EVERY email every single day. This will be a problem in 2-5 years when our system doubles in emails and our archive system is a month behind.

Ahh I see the issue. I'm not sure how many we've got sitting out there but I'm pretty sure our IBM Tivoli Storage Manager solution just does an incremental backup based on the modified and created dates attached to each file. We aren't running an exchange server though so perhaps a users inbox in exchange is all one file. In which case if the file changes and it's got thousands of emails in it, then it would have to back up every email all over again.
 

Haui

Senior member
Feb 18, 2007
593
0
0
So I am asking the everyone who deals with this in their company to take a little time to explain your process and share some ideas and practices. I really would appreciate it.
 

TreyRandom

Diamond Member
Jun 29, 2001
3,346
0
76
Usually, I'll just sneak up behind them and give their head a lil' twist, but if I've got gloves and a piece of piano wire handy, I'll use that, instead. If there's no way to sneak up behind them, I have to crawl up into the ceiling tiles, which is a huge pain... but who else is gonna terminate employees, huh? Someone's gotta do it.

Terminating entire departments is a lot easier... a little cyanide in the coffee and water cooler, and that usually takes care of 95% of them. I can then pick off the stragglers one-by-one.
 

Regs

Lifer
Aug 9, 2002
16,666
21
81
remove my profile from the system. Network log-in goes first and then they remove us from the global address book.
 

Goosemaster

Lifer
Apr 10, 2001
48,775
3
81
Depending on the employees level of access and department, certain guidelines are in place to prevent fraudulent requests and to expedite serious ones.

If it is serious, a VP and HR coordinate to make sure the employee is not a computer station and is supervised. call will be sent to a point man who will change AD/RAS passwords, and then disable the accounts . Then each additionally applicable admin is notified in a manner consistent with the severity (or potential severity) of the situation.
If we are talking about a and administrator themselves, or a situation where things might get dicey, you disable their network port from the switch and then confiscate the pc and go from there...

Basically you have initial incident response, escalation if necessary blah blah blah. The key is that not everything is always tied to AD or some sort of directory services, so it really depends entirely on the role of that employee as to what is done, as much of it might require significant effort to execute quickly.

As for what you do afterwards, have policy in place for situations that require review, where data needs to be preserved and remain untouched.

 

TreyRandom

Diamond Member
Jun 29, 2001
3,346
0
76
Originally posted by: Haui
Sounds nice, but I am looking for a professional approach.

For most employees, we disable their network login. If the employee was somewhat important or a troublemaker, we save a copy of their PST and network folders somewhere convenient, then we nuke their e-mail account and network folders. Plus, we've always got a brick-level backup we can restore if we need an account we didn't export to PST. If e-mails need to come to another person (again, typically when someone important leaves the company), then we set up an alias for their address on someone else's account.

That's about it... not much else needs to be done. Their computer gets reimaged for someone else to use.

Most of what you do when an employee leaves is based on company policy... not on technological necessity.