What to write before you disable an account

Most tool output is not a disable

A path diagram shows relationships in collected directory data. A template finding shows settings. One sign-in row shows one authentication result for one account, application, and address. None of those, alone, says the account should be turned off. Disabling is a separate decision with its own note.

Disabling the wrong account stops a person or a service from working. The note exists so someone can see why it was done and put it back.

The note before the button

Write the account name, the tool and the record or picture you are citing, one sentence on what that source shows, and one sentence on what it does not show. Write who you asked, if you reached the owner, and the name of the person who approved the disable. Write the UTC time and how to undo it: who can re-enable the account, and where that is done.

If the account is a service account or a shared mailbox, say so. A disable that breaks a lab service is still a disable, and the note should name the dependency you checked.

Snippet

account:
source: tool, record id or collection time
shows:
does not show:
owner contacted:
approver:
utc time:
dependencies checked:
undo:

When the note is allowed to end in a disable

You can disable when the source shows something about this account that a named approver accepts as enough, and the note is filled in first. A sign-in the owner does not recognize, after you have actually reached them, can be that source. A diagram of possible rights is not. A template setting is not an account to disable.

If you cannot fill “shows” without guessing, you do not disable. You file the exposure or the configuration ticket instead.

Worked case: nine accounts, then one

A graph shows nine lab users with a path toward a privileged group. A request says to disable all nine. The note refuses: the picture shows relationships at collection time, not sign-ins, and no approver has tied any one account to an action. The nine stay enabled. The ticket records the edges.

Separately, one success for riley@hackblue-lab.org at 2026-11-03T16:40:22Z comes from an IP the owner, reached by phone, does not recognize. The approver is the lab lead. Dependencies: the account is a person, not a service. The note is filled in, and only then is the account disabled, with the lab lead named as the person who can turn it back on. The other eight are untouched.

Diagram

Fill the note, then decide

Source
Name the tool and the record.
Cite
```
sign-in time, or collection time
```
Limits
Write what that source does not show.
Limits
```
a path is not a sign-in
```
People
Owner contacted, approver named.
Approval
```
lab lead, by name
```
Undo
Who can re-enable, and that you checked dependencies.
Rollback
```
person account, not a service
```

Check yourself

1. A path diagram includes an account. What is the right next write-up?

2. Which pair has to be on the note before a disable?

3. The owner does not recognize a sign-in, and the lab lead approves. What may you disable?