Should you rekey commercial locks after an employee leaves?
Assess which access remains, recover credentials, and decide the scope of rekeying after an employee or contractor leaves a business.
Use the access record, not assumptions
Identify the doors covered by the issued key, including any master-key level. Check whether the person held building keys, cabinet keys, alarm credentials, access cards, or administrator accounts. A front-door rekey may leave several other access routes unchanged.
Coordinate timing with the business's offboarding process and the responsible manager. Keep the record factual: which credentials existed, which were recovered, and what actions were taken. A departure alone does not establish misconduct.
Mechanical and electronic access need different actions
A mechanical key generally cannot be remotely revoked. Rekeying or an appropriate core change can remove its access to affected cylinders. An electronic credential may be disabled in the system, but the change must reach the devices that enforce it.
| Credential | Action to confirm |
|---|---|
| Ordinary mechanical key | Identify all cylinders it operates and assess rekeying. |
| Master key | Review the full authorized scope with the system provider. |
| Individual card or app credential | Disable it and verify the update reached the relevant doors. |
| Shared code | Change it and redistribute only to current authorized users. |
| Administrator account | Remove privileges and transfer control appropriately. |
Check offline and backup access
Some electronic systems update immediately; others require a visit, a synchronization step, or another documented process. Schlage's electronic-lock guidance distinguishes standalone, offline, and connected arrangements.
Do not forget mechanical override keys, a landlord's system, or an emergency-access arrangement. Coordinate changes so current occupants and authorized responders retain the access they are meant to have.
Close the record after testing
Record the changed doors, credentials disabled, keys issued, and person who approved the work. Test a current authorized credential and confirm that the removed one is rejected through the provider's approved process. If the key inventory is incomplete, document that uncertainty and review the appropriate scope with a qualified provider. Repeated departures are also a reason to assess whether your current key-control process still suits the business.
Common questions
Is collecting the returned key enough?
It confirms that particular copy was returned. It does not establish that no duplicates exist. Decide based on the access scope, records, and the business's security policy.
Does deleting an app user remove their physical key?
No. Digital permissions and mechanical keys are separate access routes. Review both.
Manufacturer and standards sources
- Allegion: understanding key controlPlanning mechanical access and key-control responsibilities.
- Schlage: electronic access-control optionsStandalone, offline, and connected systems have different update and audit capabilities.
Need a verified technician for this job?
Compare listed companies and the evidence on their profiles. Contact the business directly to confirm support for your exact job, location, availability, and total price.