14

I'm going to terminate my employee contract with the company I work at soon, and they're asking for my work laptop's (it's theirs) username and password.

On this laptop, I have Chrome installed and logged in with my main Google account, and the Windows username and password (which they want) is actually my main Microsoft account.

I don't like the idea of giving them easy access to my files, even though it's their laptop and I gave it back.

I told them they can access the laptop without my account by formatting it. They said they can't do it.

Should I give it to them?

Can they format or at least gain administrator access to the laptop without my account? (If so, how? I want to raise this option in front of them.)

Improve this question
  • 4
    They can't do it? Is that from a lack of technical ability or against policy? If it's the former, perhaps offer to format it for them. – lewis Jan 10 '17 at 13:51
  • 6
    change your google password. – Max Jan 10 '17 at 13:52
  • 1
    This SuperUser question will come in handy for you... superuser.com/questions/416155/… – Moo Jan 10 '17 at 13:52
  • 3
    "Windows username and password is actually my main Microsoft account" - Does this mean you log into this computer using your personal MSA credentials? – user44108 Jan 10 '17 at 14:08
  • 7
    You never share your username/password with others; period. You can ask them what they need it for, and see if there's an alternative for that (there probably is) – Erik Jan 10 '17 at 14:09
29

It sounds like they want to see if you left any work in your docs. As you said, it has your chrome logged in and you don't want them to access that.

Here's the problem, an Admin user should be able to get logged in anyway, accessing your data without issue. You will need to change your google password and remove device access quickly.

Once you've secured your account and still don't want to share (y'know, in case you've filled the thing with NSFW material) you have 2 options.

  1. If the company IT policy said "do not share your password", tell them that, even though you have left, you still respect the IT policy.
  2. If no such policy, wait a week then tell them you forgot the password.

In future, try to keep your personal data off the company assets.

Improve this answer
  • 4
    On a work laptop that is likely part of a domain any domain admin should be able to log in. On a personal laptop this should work, though for it to be effective you would need full disk encryption. – Hennes Jan 10 '17 at 16:45
  • 1
    Forgotten password is good alternative. If they desperately need to get in, it puts the responsibility for not being able to on the IT department. – Prinsig Jan 10 '17 at 17:19
  • 1
    @Hennes Domain admin and "Windows username and password (which they want) is actually my main Microsoft account" are exclusive, I'd say (or did MS seriously change it that you can register a Microsoft account with an AD? That'd be seriously weird). Honestly both parties here have made serious mistakes. Never put private data on a work computer and never hand out work computers that are not part of a domain.. – Voo Jan 10 '17 at 19:34
  • 1
    No, they did not change that. But I (apparently incorrectly) assumed that you would log in with your work account on the work laptop. And for a windows environment that is almost always AD/domain. Without that laptop management gets a lot harder and I am not aware of any big company (as in >100 users) which does not use that. If it is a very small place without IT or where IT is shoehornerd next to another job then things might be quite different. – Hennes Jan 10 '17 at 19:39
  • 2
    Still, never give out your real password. Esp. not if it is linked to a personal account. You could offer to log in on the laptop (as admin) and to create a second account on it. Or you could replace sethc.exe by cmd.exe or similar. But handing in personal credentials so that others can use that is still a big no-no. – Hennes Jan 10 '17 at 19:41
24

Google gives you the option to log out of all your devices at once by accessing your account from a desktop pc.

Instructions on how to do this here: http://phandroid.com/2015/01/01/gmail-google-sign-out/

As for the Microsoft issue, I'm not sure I fully understand. You should have gotten a log in to access the work domain and have a separate username and password than your personal one. If this is not the case and you're using your personal account to access a works computer then there's not a lot you can do.

If you're just using the laptop to access OneDrive / Hotmail etc. then changing your password will deny them access to your personal information.

In future, make sure you log out / delete any files you don't want your former employer to see before handing back the laptop.

Improve this answer
  • 3
    I like your last sentence better than JohnHC's -- I've literally never met a person who followed through with never doing anything personal on a work laptop. (virtually everyone is on Facebook, etc. or checking their personal Gmail account) – Kirk Woll Jan 10 '17 at 19:05
  • @Kirk As convenient as that might be, using your work computer for private work opens you up to at least gigantic legal problems. What happens if while surfing on facebook you fall victim to a drive-by virus that then spreads through the company network? Best case you're terminated without notice (and you can only hope that no future employer ever asks for references from your ex-company), worst case you're on the hook for damages. Apart from that it's pretty much impossible without formatting the disk to get rid of all private data. – Voo Jan 10 '17 at 19:46
  • 2
    @Voo, say what you will, but I am sincere that I have never met someone who doesn't do this. – Kirk Woll Jan 10 '17 at 19:48
  • @Kirk Well you now know one person. Honestly if you want to check private email or surf facebook during work just use your smartphone, much less risk and privacy problems (if your computer is in a domain, if you log into gmail you potentially just gave your employer access to all your private emails - yeah I can do without that). – Voo Jan 10 '17 at 19:50
  • 2
    @Voo pretty sure StackOverflow (and Stack Exchange in general) would have exponentially less activity if people didn't sign on at work. :) (and no, unless your company has forced you to install a man-in-the-middle root cert -- which you can check -- they can't hack SSL) – Kirk Woll Jan 10 '17 at 19:56
9

I don't know who you talked to, but you should talk to your IT department.

Fact is, the company has the right to access the data on that computer, because it is their computer and data. And you have the right to keep your private password confidential, because it is your private password. Since these two rights clearly contradict each other, and the situation is messed up (your fault for using your private password), go to your IT department who should be able to fix things. This will be a bit of work so they are not going to be happy, but they are the experts.

Improve this answer
8

  1. If all they want is the hardware, then you can wipe it and give it back.

  2. If you have the admin access, then you can go in and uninstall things like Chrome and other things that might have personal information stored. Clear the history and cache in IE. Delete files that are personal. Remember to default to remove anything that isn't work. Remove not only anything NSFW, but also anything personal, private, or otherwise irrelevant to work such a fantasy football league. Use a good file and sector wipe tool, such as Eraser from eraser.heidi.ie or the portable version from PortableApps.com to wipe the empty space and empty sector space.

  3. Make a copy of all work/business files that are on it, and place them on a separate media, such as a CD/DVD or USB stick, or a company file share.

  4. Finally, you can change the password on the machine to a "generic" password, and when you turn in the laptop, provide this to them. At that point it isn't your personal password, it is for the device.

  5. Provide them with a good status report on your tasks and projects. Provide them with as much information and good will as you can. You never know when you will want to go back, or if your former boss or coworker leaves and needs to hire someone. Leaving in a professional manner will keep you in good light.

(You can check to see if there is another admin account on it, there might be, there might not be, but it isn't really relevant. The goal is to keep up a good reputation for doing what they want.)

Improve this answer
4

Change your personal passwords from another machine, so this machine can no longer access them. Then give them this machine's passwords.

If they will give you permission to do so (they may not), another solution would be to do a secure wipe of the disks and reinstall the operating system from scratch, giving it a new password, and deliver it to them in that form. That protects security, at the cost of not protecting data they may want to back up for disaster recovery purposes.

Improve this answer
  • 1
    Good advice, but the reinstallation part of not needed. Any IT department worth its salt will wipe and reinstall with a known safe image/OS before using it again. – Hennes Jan 10 '17 at 16:47
1

Here's what you do. It seems that you have an administrative account on the box. Few steps:

  1. Log in
  2. Clean up any personal files or installed programs, but leave any company related material as is. You can actually leave Chrome as-is.
  3. Create a NEW admin user. Give the company THAT user name and password. Do NOT give your Google and MS account information.

There's no need, at this point, to delete your user profile on the machine (which may probably delete all the files under that user's Documents folder). By way of the new account, the company will have all the access needed to create new accounts or access anything you left on the box. I think that if you are logged in with a MS account, it's not simple for anyone to change the password so you may be safe. (Research that!)

Improve this answer
1

There are several aspects here:

First of all: "they're asking for my work laptop's (it's theirs)"
This one is a no brainer. You will need to give the hardware to them.

"username and password."
Username is also easy; that is public information and the firm already knows what it is. The password on the other hand should not be given. Ever. To nobody. Period. Full stop.


Assuming a sane setup the following should happen:

  1. There is not relevant work information on the laptop which is not also accessible otherwise. Usually this is done to prevent information when the laptop break down, is stolen, etc. etc. So the company already has all relevant data. If not then make sure it is copied to a place where they can access it after the laptop is wiped. In any places I have worked the process of handing over data and pending jobs started as soon as you gave your two weeks notice or earlier.

  2. If you are able to use admin rights on the laptop then IT will now consider it not-clean. It is an unknown for them. They will usually keep the laptop for a few weeks in case it does contain some data which was not handed over or stored wrongly. After that they will bring it to a known-clean-state. In other words, IT will do a full erase and reinstallation of the laptop. Nothing you had on it will survive. This means that you do not do any harm if you wipe the machine yourself (e.g. a diskpart clean from an elevated command prompt).

  3. If you were not admin then either remove all your data before handing it in, log out where possible, tell browsers to forget stored passwords. I am still convinced that IT will reimage the laptop in this case though, of for no other reason than to load the latest version of their image and to remove cruft. So wiping it yourself (e.g. after booting from an USB pendrive) is still a very good idea.

  4. Lastly, IT people are thought to respect privacy. They will not look in folders marked 'private'. They will not search your laptop. Usually they will not even access your laptop until reinstallation. There should be no fear of them doing anything with data you left on the laptop. This does assume that you clearly marked items though. E.g. all private mail in a folder marked 'private'. Though I understand that people fear what IT can do, this does not actually mean that they do it. Depending on your country they may not even attempt to look at your data out of pure curiosity.*.


*. Disclaimer: They are allowed to look when there is a good reason. E.g. when a disk is full they can do a 'search all folders on disk and report the largest 10'. If that causes a 'pirate-bay-copy.xxx' folder to show up then that is though luck. For those things use your private laptop.

Improve this answer
0

It is their property, and as such the hardware belongs to them, sure.

What kind of paper did you sign when you borrowed the laptop? Read it again, and make sure there are no clauses.

But if the Google/Microsoft accounts are yours, you don't hand them the passwords I'd say. You may however format the computer and install it brand new.

Maybe all they are looking for is a computer in working condition. Usually it is the job of an IT department, but in case of small companies, web agencies and stuff, well, it can happen that it can be the job of the employee, especially in programming circles. For the rest I am pretty sure the accounts are yours to keep.

Also make sure to grant them access to any work you have done (through Git or internal CMSes).

Improve this answer
  • They have the laptop right now, so I can't format it. – David Jan 10 '17 at 13:51

Not the answer you're looking for? Browse other questions tagged .