# Who still has an administrator account in your company?

In an SMB, the account that opens the firewall, the backup, the VPN or the switchboard often belongs to someone who no longer works there. A former integrator, the accountant or a password shared in a spreadsheet is enough to get in. The day the assignment ends, those accesses come off. Mail and MFA are a separate file, covered on 27 January 2027.

Host Technology takes over estates from Nice to Monaco. The first finding is not a virus. It is a list of administrators nobody can reread: the director, the supplier who left last year, and an 'admin' account used by three people. ANSSI's IT hygiene guide asks for dedicated admin accounts, separate from everyday accounts.

## What an administrator can open

A firewall administrator changes a rule and publishes a server. A backup administrator deletes a copy or points it somewhere else. A VPN administrator enters the network as if they were in the office. A switchboard administrator forwards the calls. A Wi-Fi administrator reads traffic or adds an access point. These consoles are not the mailbox. Protecting them with the director's everyday password mixes reading mail and holding the key to the building.

The everyday account must not be an administrator. A separate admin account, with no day-to-day mailbox and with a second factor, is used for changes. It is named. 'admin', 'support' or the previous supplier's name does not say who clicked.

## Suppliers, the accountant, the previous integrator

A supplier's access has an end date. The accountant who drops the files, the agency that ran the website, the technician who installed the switchboard, the previous integrator: each was given an account on installation day. That account outlives the contract if nobody removes it. The right pattern is an account in their name, limited to the consoles they need, removed the day the assignment stops, not at next year's review.

An access 'for the audit' is closed the same evening. Leaving a reactivated admin account, with a weak password and a VPN, is a scenario already documented in healthcare. The detail of those attacks is in the 1 November article. Here the rule is the same for an SMB in Sophia, Cannes or Monaco: an account that is no longer used does not stay open.

## The list to keep

- Firewall, VPN, directory, Microsoft 365, backup, switchboard, Wi-Fi controller, hypervisor: one named owner for each console.
- No shared administrator account. The password is not in a spreadsheet on the file server.
- Each supplier has an account in their name and an end date. On that date the account is disabled and sessions are closed.
- The director's account reads mail. It does not administer the firewall or the tenant.
- A break-glass account exists, offline, and is not used to fix a Monday morning. If it is used, the secret changes afterwards.
- Two reviews a year: who is still admin, who has left, which rule changed.

The list fits on one page. It does not replace MFA on mailboxes, an immutable copy, or a firewall someone maintains. It says who is allowed to change everything. Without it, the other controls rest on a person who is no longer there.

## What managed IT keeps, and what it does not

On Pro or Full, Host Technology keeps this list with the estate: the hotline knows which accounts exist, monitoring sees a rule change, the monthly note names supplier access still open. Essential answers when you call. It does not reread administrators on its own. The three formulas are detailed in the 13 January 2027 article.

Host removes the access it holds. It does not close the accountant's contract or another supplier's mandate. The director says who may still enter. The integrator acts the same day, then writes it down. An exception with no end date is an account that stays.

## Sources

ANSSI IT hygiene guide, dedicated administration accounts, separate from office accounts: https://cyber.gouv.fr/publications/guide-dhygiene-informatique. The finding on suppliers who are still administrators comes from estates Host Technology takes over in PACA and Monaco, not from a national figure.

## FAQ

### Can the director's account stay as administrator?

Not for the consoles. They read mail with the everyday account. A separate administration account is used for changes, with a second factor.

### Should the accountant be cut off?

They keep the access they need, in their name, and it is removed when the assignment ends. A shared 'accounts' login has no owner.

### Does the previous integrator still have the firewall?

Often yes, until someone takes the consoles back. The takeover starts by changing those secrets and disabling their accounts, on the day of the handover.

### Is mailbox MFA enough?

It protects the mailbox. It does not remove an administrator from the firewall, the VPN or the backup. That piece is covered on 27 January 2027.

### Where does Host start?

With the list of consoles and the name of each administrator. Accounts with no owner are disabled. The rest of the estate comes after.

- [Managed IT: who runs the estate](https://www.hosttechnology.fr/en/it-management)
- [SMB cybersecurity](https://www.hosttechnology.fr/en/cybersecurity)
- [Admin accounts and continuity of care](https://www.hosttechnology.fr/en/resources/cyberattaque-hopital-clinique-continuite-soins)