Ask a leadership team how many people can change anything in their systems, and you will usually get a small number. Two, maybe three. The owner, the IT manager, the MSP.
Then you pull the actual lists. Microsoft 365 shows eight global admins. The accounting system shows five. The file server, the firewall, the line of business app, the cloud backup console, each one has its own list, and the lists rarely match. Some names belong to people who left. Some belong to vendors who finished a project two years ago. Some are shared accounts with a password taped inside a drawer.
Admin access controls what a person can change, delete, export, and grant to others. A regular user account can cause damage in one workflow. An admin account can change the rules for the whole company.
Where extra admin accounts come from
Admin accounts accumulate during normal work. A migration needs temporary access, and the temporary part gets forgotten. A vendor needs to finish an install after hours, so someone grants admin rights and plans to remove them on Monday. An employee covers for a manager on leave and keeps the elevated access after the manager returns.
Each grant made sense at the time. The problem is the lack of a removal date.
Shared admin accounts add a second problem. When three people use the same login, logs will show the account name after an incident. They will not show the person.
What to pull this week
You can get a useful picture in one afternoon. Ask your IT lead or MSP for an export from each system that matters:
- Microsoft 365 or Google Workspace admin roles
- Server and domain admin groups
- Accounting and payroll systems
- Your main line of business application
- Firewall, VPN, and remote access consoles
- Cloud storage and backup consoles
- Any system that holds customer, employee, or financial records
Put the results in one spreadsheet. Columns: system, account name, person who uses it, business reason, last login date, and who approved the access. The last two columns do most of the work. Accounts with no recent login and no clear owner are your first review list.
Expect pushback on a few names. Longtime employees often treat admin access as part of their role, even when their daily work uses standard access 99 percent of the time. Keep the conversation on tasks. List the tasks that require admin rights, how often they happen, and whether a temporary elevation process can cover them.
Rules that keep the list short
Four rules handle most of what I find in these reviews.
First, every admin account belongs to a named person. Shared admin logins get retired, or they get stored in a password vault with check out logging so each use ties to a person and a time.
Second, daily work runs on a standard account. Admin accounts are separate logins used only for admin tasks. This limits what malware or a phished session can reach during normal email and web use, which is when most compromises start.
Third, every grant has a review date. Vendor access expires at project end. Temporary access expires in days or weeks, with a calendar entry to confirm removal. Permanent admin access gets reviewed quarterly, in a short meeting with the list printed out.
Fourth, departures trigger an admin check the same day. Standard offboarding lists cover email and file access. Add a specific line for admin roles in every system, and have a second person verify the removals.
A short test for your current list
Pick any admin account at random and answer three questions. Who uses it? What breaks if you disable it today? When did you last confirm it is still needed?
If you can answer all three from records, your process is working. If the answers depend on asking around, the list has outgrown informal management, and a one page register will fix most of it.
Admin access is powerful because it is useful. The goal is a short list you can explain, person by person and system by system, on any given day.
Not sure where your IT really stands? Start with a Clarity Audit: a focused assessment of your backups, security, vendors, and AI readiness. It's the first step in every engagement I take on.
About the author: Chris McGlasson is a fractional CIO and the founder of ClearStack Advisory, where he helps mid-market companies build AI governance, IT strategy, and technology roadmaps without the overhead of a full-time CIO. He previously built and sold LANPRO Systems, an IT services firm serving 350+ enterprise clients.