The IT Person Who Knows Everything Just Quit. Now What?

It usually starts with a surprisingly simple question.

“Does anyone know the admin password?”

The person who knew it left the company last Friday.

Then someone needs access to the firewall.

Nobody has it.

A software vendor asks for information about the server configuration.

Nobody knows where it's documented.

An employee can't access a business application, but the person who originally configured it is gone.

Then someone realizes the former IT administrator was also the primary contact for the internet provider, backup service, Microsoft 365 environment, phone system, domain registrar, and several software vendors.

Suddenly, the company isn't dealing with an employee departure.

It's dealing with an IT continuity problem.

For many small and midsize businesses, an enormous amount of technology knowledge can quietly become concentrated in one person.

Everything works—until that person isn't there anymore.

Every Business Has Someone Who "Just Knows"

Sometimes it's an internal IT manager.

Sometimes it's an outside consultant who has supported the company for 15 years.

Sometimes it's an office manager who gradually became responsible for technology.

And sometimes it's simply the employee who was there when everything was originally installed.

Need the Wi-Fi password?

Ask them.

Need a new Microsoft 365 account?

They know how.

Server acting strangely?

They'll take a look.

Need to contact the phone vendor?

They know the account representative.

Over time, that person becomes extraordinarily valuable.

But something else happens at the same time.

The business becomes dependent on information stored largely inside one person's head.

That's key-person dependency, and it can become one of the most overlooked risks in a company's technology environment.

The Problem Isn't That the Person Left

Employees leave.

People retire.

Consultants change careers.

IT providers are replaced.

Employees take vacations, become unavailable, or move into different roles.

That's normal.

The real problem is discovering that critical business knowledge left with them.

A well-managed technology environment should survive personnel changes.

Someone leaving may create inconvenience.

It shouldn't create a technology crisis.

Start With Administrative Access

One of the first questions after a key IT person leaves should be:

What could they access?

That list may be much longer than leadership expects.

• Microsoft 365.
• Google Workspace.
• Cloud infrastructure.
• Servers.
• Firewalls.
• Networking equipment.
• Backup systems.
• Endpoint security.
• Domains and DNS.
• Website hosting.
• VoIP systems.
• CRM.
• Business applications.
• Vendor portals.
• Remote-access systems.
• Cybersecurity platforms.

The objective isn't merely to disable one employee account.

The business needs to identify every system where the departing person had administrative privileges and decide whether to remove access, transfer it, or change credentials.

This becomes particularly important when shared administrative accounts have been used.

If three people know the same administrator password and one leaves, disabling their email account doesn't remove their access to that shared credential.

Who Owns the Microsoft 365 Environment?

For many businesses, Microsoft 365 has become one of their most critical technology platforms.

• Email lives there.
• Files may live there.
• Teams collaboration happens there.
• Employee identities may be managed there.
• Security policies may be configured there.

The company therefore needs appropriate administrative ownership that doesn't depend on a single individual.

There should be a clear process for administrative access, emergency access, multi-factor authentication, privileged roles, and recovery.

The same principle applies to Google Workspace and other major cloud platforms.

Your business shouldn't discover during an emergency that the only global administrator is someone who no longer works there.

Then Check the Domain

This one can become especially painful.

Who controls your company's domain name?

The answer should be easy.

Yet businesses sometimes discover that their domain was registered years ago using an employee's personal email address, an outside web developer's account, or credentials nobody can locate.

Your domain affects your website, email, DNS, and potentially other business services.

Losing administrative control can create serious disruption.

And make sure the business (not an individual employee or vendor) ultimately controls it.

This is closely related to something we explored in Your IT Provider Has the Keys to Your Business. Who Actually Owns Them?

Whether the administrator is an outside provider or an internal employee, the principle is the same:

The business should retain control of its critical technology assets.

What About the Firewall and Network?

The internet is working today.

So nobody thinks about the firewall.

Until something needs to change.

Perhaps a new office is being connected.

A security rule needs modification.

A VPN stops working.

A vendor needs temporary access.

The firewall needs an update.

Then someone asks for the administrative credentials.

Silence.

Network equipment is particularly easy to forget because well-designed networks can operate for years without leadership ever thinking about them.

That doesn't mean documentation isn't important.

The business should know what networking equipment it owns, where it is located, who manages it, how configurations are backed up, and how authorized administrators can gain access.

Backups Need More Than a Login

The company knows it has backups.

Great.

Now the IT administrator who configured them has left.

Do you know what is actually being backed up?

How frequently?

Where are the backup copies stored?

Who receives failure alerts?

How long is information retained?

What credentials are required to access the platform?

Who can authorize a restore?

Has recovery ever been tested?

If nobody can answer those questions, the existence of a backup product provides less comfort than it should.

Backups aren't valuable simply because they're running.

They're valuable because the business can use them to recover.

Vendor Relationships Can Walk Out the Door Too

Technology environments rarely involve one vendor.

There may be an internet provider, phone provider, Microsoft partner, software vendors, cybersecurity company, hardware supplier, copier company, web developer, cloud provider, and various specialized consultants.

The IT person may know all of them.

Leadership may know almost none of them.

• When that person leaves, the business can suddenly lose years of relationship history.
• Who is the account representative?
• What's the support number?
• What's the customer number?
• When does the contract renew?
• What services are covered?
• Who is authorized to make changes?
• Where are invoices stored?

Vendor information should belong to the organization rather than live inside one employee's contacts and inbox.

The Most Dangerous Sentence May Be "Only Alex Knows How That Works"

Replace Alex with whatever name applies inside your company.

Every organization has specialized knowledge.

That's unavoidable.

The warning sign is when a critical process has only one person capable of performing it.

Maybe only Alex knows how to restart the legacy application.

Only Alex understands the ERP integration.

Only Alex knows why the accounting software needs a particular server.

Only Alex has access to the cloud environment.

Only Alex knows how the warehouse system connects to corporate IT.

Now imagine Alex isn't available.

How long can the business operate?

The answer tells you something about the importance of documenting that process.

Documentation Is Business Continuity

IT documentation sometimes sounds like administrative busywork.

It isn't.

Good documentation reduces dependency on individual people.

That doesn't mean documenting every mouse click anyone has ever made.

It means capturing the information necessary for another qualified person to understand and manage the environment.

That can include system inventories, network diagrams, administrative ownership, vendor information, software dependencies, backup procedures, licensing information, cloud environments, important configurations, recovery procedures, and support contacts.

Our article The Hidden Cost of Poor IT Documentation explores this problem in greater depth.

The key idea is simple:

If something is important enough that the business can't operate without it, knowledge about it shouldn't exist in only one person's head.

Passwords Shouldn't Live in a Spreadsheet Called "Passwords.xlsx"

Or on sticky notes.

Or in someone's browser.

Or in a document stored on their desktop.

Or in a personal password manager the business cannot access.

As organizations grow, credential management needs to mature too.

A business password-management platform can provide controlled access, secure sharing, administrative oversight, and a more structured process when employees join, change roles, or leave.

The goal isn't for everyone to know every password.

It's the opposite.

People should have appropriate access, while the organization can manage it centrally.

Offboarding Should Be a Process, Not a Panic

Good offboarding starts before anyone resigns.

The organization should already have a repeatable process for technology access.

When someone leaves, IT and management should know which accounts to disable, which credentials to change, which devices to return, which files to preserve, which email or communications to transfer, and which responsibilities to reassign.

For a typical employee, that process may be relatively straightforward.

For someone with broad administrative access, the review should be considerably more thorough.

IT administrators can have access to systems most employees don't even know exist.

Their departure deserves a different level of attention.

What If Your IT Provider Is the Person Who Knows Everything?

The same risk can exist with an outsourced provider.

A small business may have worked with the same IT consultant for a decade.

They know everything.

The environment runs smoothly.

Nobody sees a reason to worry.

That's a good relationship—until the company realizes it doesn't have its own documentation, credentials, vendor records, or administrative ownership.

A strong IT provider shouldn't make itself impossible to replace.

In fact, one sign of a mature provider is that the environment is documented well enough that another qualified professional could understand it if necessary.

The objective of an IT relationship should be service, not dependency.

AI Doesn't Eliminate Institutional Knowledge Problems

Businesses are increasingly looking at AI as a way to preserve organizational knowledge.

There is real potential there.

AI-powered knowledge systems may help employees search documentation, summarize procedures, locate information, and access institutional knowledge more efficiently.

But AI cannot retrieve knowledge that was never captured.

If your entire network architecture exists inside one person's memory, there isn't anything for an AI assistant to search.

Good AI starts with good information.

That makes documentation even more valuable as organizations adopt new tools.

Don't Wait Until Someone Resigns

Here's the uncomfortable but useful exercise.

Pick the person in your organization who knows the most about your technology.

Now imagine they don't come to work tomorrow.

Not because anything bad happened.

They simply aren't available.

Could another qualified person determine:

• Who controls Microsoft 365?
• Where the domain is registered?
• How to access the firewall?
• Which backup platform you use?
• What systems are business-critical?
• Which vendors support them?
• Where administrative credentials are stored?
• What needs to happen during an outage?
• Which systems depend on each other?

If those questions make you uncomfortable, you've identified something worth fixing.

You don't need to replace the person.

You need to reduce the organization's dependency on them.

The Best IT People Should Be Able to Take a Vacation

There's another side to this conversation.

Reducing key-person dependency isn't just good for the business.

It's good for the employee.

An IT administrator shouldn't feel like they can never take vacation because nobody else can handle an emergency.

An employee shouldn't receive calls during family events because only they know a password.

A consultant shouldn't be expected to remember every configuration they've implemented over 12 years.

Documentation, shared processes, appropriate redundancy, and structured access make technology organizations healthier for everyone.

Being indispensable may sound flattering.

Operationally, it's usually a warning sign.

Final Thoughts

The person who knows everything about your technology may be one of the most valuable people supporting your business.

Keep them.

Appreciate them.

Listen to them.

But don't build your business around the assumption that they will always be available.

People change jobs. They retire. Companies change providers. Roles evolve.

The technology environment needs to continue operating through all of it.

The best time to discover what only one person knows isn't after their farewell lunch.

It's today.

Because eventually, someone will ask: “Does anyone know how this works?”

Your company should have an answer that doesn't begin with: “The person who knew just left.”