What does a help desk do for a new starter?

Create the account in the organizational unit for their department, following the company naming convention, set it to require a password change at first sign in, add the groups their role needs, make sure a mailbox exists, and have a device built and ready. Everything else follows from the account existing in the right place with the right membership.

Should you delete an account when somebody leaves?

Almost never. Disable it instead. Deleting destroys the audit trail, breaks ownership of files and calendar items, and cannot be undone cleanly. Disable, remove group memberships, end active sessions, and let whoever owns retention decide when the object itself goes.

What gets missed most often when somebody leaves?

Access that was granted outside the normal groups: a shared mailbox, a distribution list, a third party application with its own sign in, a building pass, or a device at home. Disabling the directory account closes the front door and leaves those side doors open, which is why a leaver ticket is a checklist rather than a single action.

Why does a new starter ticket need approval?

Because creating an account is creating access. The request carries who approved it, which role the person is starting in, and which groups that role is entitled to. Working from a message that has not been signed off is how somebody ends up in a group nobody meant to put them in.

Guide

New Hire Setup and Offboarding on a Service Desk

By SysDesks Published August 30, 2026

Illustration of a checklist clipboard beside two ticked steps for joiners and leavers

Short answer

A new starter needs an account created in the right organizational unit with the right naming convention, the starting groups their role requires, a mailbox, and a device ready on day one. A leaver needs the account disabled rather than deleted, every group membership removed, sessions and devices signed out, and the mailbox handled according to policy. Both are checklists, and both fail in the same place: the access nobody wrote down.

Joiners and leavers look like the simplest tickets on the queue and they produce the longest tails. A new starter with a missing group cannot do their job and will be back within an hour. A leaver with access nobody removed is a finding in the next audit, and by then the person who closed the ticket has forgotten it.

A new starter, in order

Read the approved request and note the exact role, start date and department. These decide the organizational unit and the starting groups.
Create the account with the company naming convention rather than a convention of your own. A logon name that does not match the pattern will break something later.
Put it in the organizational unit for that department. Policy follows the unit, so the wrong unit is a real fault even when the account works.
Set the account to require a password change at first sign in, and set an expiry date if the person is a contractor.
Add only the groups the approved role entitles them to, and nothing extra because somebody similar has it.
Confirm the mailbox exists and the device is built, then write down what you created so the next person can see it.

A leaver, in order

Confirm the leaving date and the approval before you disable anything. Disabling early is its own incident.
Disable the account rather than deleting it, so the audit trail and file ownership survive.
Remove group memberships, and write down which ones you removed in case access has to be reinstated.
End active sessions and sign the account out of its devices, because a disabled account can still have a live session.
Handle the mailbox the way policy says, whether that is converting it, delegating it to a manager, or leaving it in place for retention.
Chase the access that lives outside the directory: shared mailboxes, distribution lists, third party applications, building passes and hardware.

The reason these two tickets are worth practising is that neither is technically hard and both are easy to half finish. A termination that leaves the account disabled but still in three groups is the classic partial close, and it grades as one, because the access is still there for anyone who reinstates the account.

Common questions

What does a help desk do for a new starter?: Create the account in the organizational unit for their department, following the company naming convention, set it to require a password change at first sign in, add the groups their role needs, make sure a mailbox exists, and have a device built and ready. Everything else follows from the account existing in the right place with the right membership.
Should you delete an account when somebody leaves?: Almost never. Disable it instead. Deleting destroys the audit trail, breaks ownership of files and calendar items, and cannot be undone cleanly. Disable, remove group memberships, end active sessions, and let whoever owns retention decide when the object itself goes.
What gets missed most often when somebody leaves?: Access that was granted outside the normal groups: a shared mailbox, a distribution list, a third party application with its own sign in, a building pass, or a device at home. Disabling the directory account closes the front door and leaves those side doors open, which is why a leaver ticket is a checklist rather than a single action.
Why does a new starter ticket need approval?: Because creating an account is creating access. The request carries who approved it, which role the person is starting in, and which groups that role is entitled to. Working from a message that has not been signed off is how somebody ends up in a group nobody meant to put them in.

New Hire Setup and Offboarding on a Service Desk

A new starter, in order

A leaver, in order

Common questions

Related guides