1

What is the best practice if an employee leaves the company? Currently, we sync with AD, but don't use the MySites. In AD the user is made inactive but what will happen on SharePoint's side? I assume the metadata captured for that user (like create by and modified by) will remain. And in Permission settings per list/site - should I remove their names in the permissions?

1

should I remove their names in the permissions?

I would not remove their names from the metadata as that may be later needed for auditing. (who did what)

Removing them from custom permissions is not needed for security reasons as they are being blocked from logging in from AD. Removing them from permissions might have a minor impact on performance and may simplify future site security maintenance. It is not a bad idea to clean up any direct permissions and broken inheritance periodically. You can do this with PowerShell and some third party tools.

3

In terms of the metadata (Created By, etc), SharePoint leaves the accounts in. This can cause issues with workflows if your workflows rely on these columns. I would make the respective changes on those columns only if you have workflows or other procedures that rely on the column.

As for permissions, I wouldn't directly add users to the permissions. Instead I would create groups in AD and add the group to a SharePoint page/list, etc. This way you only have to add a person to one group in AD rather than 30 pages on the Hub sites. Also when creating people in AD, you can make them have the same permission levels as someone else in a similar position, which makes speeding up their on-boarding.

To clear this up, the first image I'm posting is our SharePoint groups that are created by default when making a subsite (in this case, our IT page). The second image our AD group which holds all the members that are supposed to have a specific level of permissions (for example, our IT Members group, which has Contribute access across the subsite).

Image 1: Image 1 Image 2: Image 2

Hope this clears things up a little. If you have questions, let me know.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.