We have been using a company to administer our (small office) IT infrastructure. We don't have complete records of what has been done or hasn't been done and don't know what we need to ask for in order to pick this up ourselves. Is there a good "checklist of things to make sure you get" for people in this situation? (Windows OS product keys, installation media(?), domain controller admin password, etc.)

  • 17
    You might consider having the old IT company overlap the new IT company for a month, if they will do it. – jftuga May 23 '12 at 19:49
  • 1
    This actually happened a year ago :-) Asking for future reference and figured it would be good to have this answer in the forum! – albiglan May 24 '12 at 2:36
  1. All passwords (for all devices, applications and accounts).
  2. All records relating to software, licensing and media (including purchase order history/proof).
  3. All media (including installation media and live data backups).
  4. All documentation, including,
    • Server, hardware, network (including IP addresses) and operating system configurations.
    • Details of processes and procedures (e.g. adding users, create new mailboxes, etc.)
    • Information on any automated / manually triggered jobs (backups, housekeeping, etc.)
    • Review the documentation beforehand and have them make improvements if you have questions or find missing/old information.
  5. Details of any third party contracts they might have taken out for support that you may need to take on / take out yourself (e.g. hardware maintenance).
  6. Any physical / VPN / secure access items (badges, keys, tokens, fobs, etc.)
  7. Information about telecom accounts
  8. Logins to any websites you might need. (Download software, open support cases.. )
  9. Account information related to domain name registrations, details of registrars used, etc.
  10. Copies of any security certificates, and the relevant key phrases. Ensure the old supplier also destroys their copies.

And once this is all done - change all the passwords.

  • 14
    Badge, keys, tokens, fobs for VPN/NOC/Building access. – jscott May 23 '12 at 19:22
  • 2
    Shamelessly copying bullet points from the other answers to this one, since this seems to be the favored answer so far. (also, IMHO, the other "in addition" answers should have probably been edits to this anyway) – EEAA May 23 '12 at 20:44
  • 5
    I've also seen a lot of companies install a customer remote desktop/support software on the company computers that you may want to have them uninstall. Sometimes these are customized VNC programs that were scripted on and can be clunky to manually remove. – Bad Dos May 23 '12 at 21:14
  • 2
    No, I was not directing that at you, I was commenting on my own action of shamelessly adding. :) – EEAA May 24 '12 at 0:05
  • 2
    @ErikA my apologies for being over sensitive. – EightBitTony May 24 '12 at 7:17

In addition:

Account information related to domain registrations.

  • +1 - this is a good one. I've just been through the situation of wrangling ownership of a domain back from a rogue IT person who registered it on behalf of a company. – Mark Henderson May 23 '12 at 21:52

in addition:

Logins to any websites you might need. (Download software, open support cases.. )


In addition to those that you mentioned...

  • static IPs of all devices/servers (so you know what devices you need to manage)
  • information about telecom accounts
  • all other passwords for all devices and services (the domain admin account isn't the only one)

All of the answers so far have been awesome.

Ensure that you have purchase records for Licenses. Some that you may not think of include Small Business Server (SBS) CALs, SQL Server Licenses, Terminal Services Licenses. Also if your servers have Out-Of-Band Management (HP's iLO, Dell's DRAC, etc), ensure that you are provided with those license keys.

Ensure that you have any SSL Certs for websites, email, logins, etc.

Be prepared to do a password reset fire-drill. I would audit services and scheduled tasks that don't run as a builtin account (such as Local System, Network Service accounts). (If I remember, I'll dig up the audit tools that I've written at a previous gig.)

Also, it behooves you to audit the licenses. Ensure that they are registered to your company, not the IT Service Provider. Also important is ensuring that they are appropriate licenses for the use; I am validating that MSDN SQL licenses are not being used in Production environments. Action Packs, Microsoft Subscriptions, Gold Reseller memberships and such give great benefits such as free licenses, but they are restricted as to where and how they can be used.

By way of enabling you to behoovulence, here's some help:

Here is a script that I've had sitting around that I've released that will report services running on machines that are not running under a builtin service account.


  • 2
    Nice addition! Like the license audit one especially... – albiglan May 24 '12 at 2:44
  • 1
    Many IT service providers will shamelessly register everything that belongs to their clients to themselves instead. Definitely something to watch out for. – Skyhawk May 24 '12 at 6:18
  • 4
    Upvoted for usage of "behooves" ;-) – mgorven May 24 '12 at 6:30
  • Not just Certificates, but the Private Keys corresponding to them, too. – mlp May 25 '12 at 5:34

PIN/Password for phone accounts if you have a corporate account with a cellular carrier.

If you have remote management tools for tablets/phones, software and passwords to the management console.

Not the answer you're looking for? Browse other questions tagged or ask your own question.