Ending company IT Admin relationship

Question

We have been using a company to administer our (small office) IT infrastructure. We don't have complete records of what has been done or hasn't been done and don't know what we need to ask for in order to pick this up ourselves. Is there a good "checklist of things to make sure you get" for people in this situation? (Windows OS product keys, installation media(?), domain controller admin password, etc.)

Answer 1

1. All passwords (for all devices, applications and accounts).
2. All records relating to software, licensing and media (including purchase order history/proof).
3. All media (including installation media and live data backups).
4. All documentation, including,
   • Server, hardware, network (including IP addresses) and operating system configurations.
   • Details of processes and procedures (e.g. adding users, create new mailboxes, etc.)
   • Information on any automated / manually triggered jobs (backups, housekeeping, etc.)
   • Review the documentation beforehand and have them make improvements if you have questions or find missing/old information.
5. Details of any third party contracts they might have taken out for support that you may need to take on / take out yourself (e.g. hardware maintenance).
6. Any physical / VPN / secure access items (badges, keys, tokens, fobs, etc.)
7. Information about telecom accounts
8. Logins to any websites you might need. (Download software, open support cases.. )
9. Account information related to domain name registrations, details of registrars used, etc.
10. Copies of any security certificates, and the relevant key phrases. Ensure the old supplier also destroys their copies.

And once this is all done - change all the passwords.

Answer 2

In addition:

Account information related to domain registrations.

Answer 3

in addition:

Logins to any websites you might need. (Download software, open support cases.. )

Answer 4

In addition to those that you mentioned...

• static IPs of all devices/servers (so you know what devices you need to manage)
• information about telecom accounts
• all other passwords for all devices and services (the domain admin account isn't the only one)

Answer 5

All of the answers so far have been awesome.

Ensure that you have purchase records for Licenses. Some that you may not think of include Small Business Server (SBS) CALs, SQL Server Licenses, Terminal Services Licenses. Also if your servers have Out-Of-Band Management (HP's iLO, Dell's DRAC, etc), ensure that you are provided with those license keys.

Ensure that you have any SSL Certs for websites, email, logins, etc.

Be prepared to do a password reset fire-drill. I would audit services and scheduled tasks that don't run as a builtin account (such as Local System, Network Service accounts). (If I remember, I'll dig up the audit tools that I've written at a previous gig.)

Also, it behooves you to audit the licenses. Ensure that they are registered to your company, not the IT Service Provider. Also important is ensuring that they are appropriate licenses for the use; I am validating that MSDN SQL licenses are not being used in Production environments. Action Packs, Microsoft Subscriptions, Gold Reseller memberships and such give great benefits such as free licenses, but they are restricted as to where and how they can be used.

---

By way of enabling you to behoovulence, here's some help:

Here is a script that I've had sitting around that I've released that will report services running on machines that are not running under a builtin service account.

GitHub:gWaldo:ListServices

Answer 6

PIN/Password for phone accounts if you have a corporate account with a cellular carrier.

If you have remote management tools for tablets/phones, software and passwords to the management console.