New client takeover

The client has signed with you. Their previous provider still has the admin access.

We bring the client across for you. We find the ways into their systems, collect and test the access, put your tools in, change the credentials and close off the previous provider’s access, in an order planned around the client’s working day. You end up with a documented environment and a frank account of what you’ve taken on.

Request a quote for this project

Who holds the keys, stage by stage

The order matters. Choose a stage to see what happens and why.

  • Them the previous provider
  • Both shared, mid-handover
  • You your team
Who can get into each part of the client’s environment at each stage of the takeover
Day one Access collected Your tools in Credentials changed Access closed
Microsoft 365 admin accounts Them Both Both You You
Their partner access to the tenantNeeds no password, so a password change doesn’t touch it Them Them Them Them Removed
Domain and server admin Them Both Both You You
Service accountsPasswords sitting in scheduled tasks, services and app settings Them Both Both You You
Firewall admin and VPN accountsTheir VPN logins outlast the admin password change Them Both Both Both You
Remote support and RMM agentsAn installed agent keeps working after a password change Them Them Both Both You
Endpoint security Them Them You You You
Backup Them Them Both Both You

  1. Day one: look before touching anything

    Every working password, agent and admin relationship still belongs to the previous provider. Nothing changes yet. First we find out what’s there: users, devices, servers, network, Microsoft 365 and the line-of-business applications the client runs on.

  2. Access collected, and tested as it arrives

    We ask the previous provider for access in writing, with the client’s authorisation, and try each credential as it comes in. A handover spreadsheet can’t be taken at face value: accounts turn out disabled, MFA prompts go to a former engineer’s phone, a password was changed and never written down.

  3. Your tools go in beside theirs

    Your RMM and backup run alongside the previous provider’s, and theirs stay until yours are reporting. Endpoint security is the exception: two products on one machine tend to fight, so it’s swapped in one move per device.

  4. Credentials changed, in the right order

    Admin passwords change first. Each service account changes once we’ve found every place its password is used, so the change doesn’t stop a backup job or a line-of-business app. Note what’s still theirs at this point: a password change doesn’t remove an installed agent, a VPN login or a partner relationship.

  5. Their access closed, one item at a time

    Their partner access, remote support and RMM agents, VPN logins and backup access come out, each once yours is confirmed working in its place. Then we go back over admin roles, accounts and installed software looking for anything of theirs left behind.

The ways in a handover list leaves out

An outgoing provider hands over the passwords they think of. A lot of access isn’t a password at all, and that is what discovery goes looking for.

A second global admin
Created years ago for an engineer who has since left. Still active, and sometimes excluded from the MFA policy that covers everyone else.
Partner admin access
A delegated admin relationship gives the previous provider’s staff admin rights in the tenant without an account in it. It never shows in the user list.
The forgotten remote tool
Besides their RMM agent there’s often a standalone remote support tool, installed years ago and still running on some of the machines.
One local admin password everywhere
The same local administrator password on every PC, known to whoever built them.
A path to the firewall
Besides admin accounts and VPN users, there is sometimes a rule letting the previous provider’s office straight through to the firewall’s management interface.
Passwords tucked into config
Service account passwords stored in scheduled tasks, Windows services, scan-to-email settings and line-of-business application configuration.
Apps with standing consent
Third-party apps granted access to mailboxes or files.Listed, with who granted them, so you can decide what stays.
Things held in their name
The domain registration, DNS hosting, licences bought under their agreement, vendor support portals.Recorded with who holds each one, and raised in the findings report.

The judgement calls in a takeover

When do you cut the previous provider off?

Too early and you lose access you haven’t yet replaced. Too late and someone the client no longer pays still has admin rights to their systems.

We tie each removal to a check. Their remote agent comes out once your RMM is reporting from that machine; their backup access goes once your backup has completed successfully; their partner access goes once your own admin access is tested and nothing still depends on theirs.

Which passwords can change today, and which need a plan?

An admin password can change as soon as working access is confirmed. A service account can’t, until we know everything that uses it. Change it blind and something stops working that night, usually the thing nobody listed.

Where the previous provider administered the domain, we’ll also raise the krbtgt account with you. It signs the domain’s Kerberos tickets, and resetting it twice, with time for replication in between, means tickets issued under the old key stop working. Whether and when is agreed with you.

Run the old and new tools side by side, or swap?

RMM and backup can overlap for a while, and should: it means the old ones stay in place until yours are reporting. Two endpoint security products on the same machine usually can’t. They compete for the same files and processes and can slow a machine or block each other.

So security is swapped device by device, and each device is checked in your console before we move on.

What if the previous provider is slow to hand over?

A specific written request, sent with the client’s authorisation and naming each system, is harder to leave sitting in an inbox than a phone call. It’s also a clear record of what was asked for and when.

If something still doesn’t arrive, you hear about it early, and we work through the routes the client has as owner of their own systems. Anything that can’t be recovered is set out in the findings report.

What does the client notice?

As little as the work allows, and nothing unannounced. The client deals with you, or with us as your named partner. Anything that touches staff, such as a password they’ll need to re-enter on a phone, is planned with you so you can tell them before it happens.

What you’re left holding

  • The environment, documented in your platform

    Users, devices, servers, network, Microsoft 365 and line-of-business applications, written up in your documentation platform in the structure you already use, so your team supports this client like every other.

  • Credentials changed and recorded

    Administrator and service credentials changed, recorded with the documentation, and the previous provider’s access removed.

  • Your standard tools in place

    Your RMM, security and backup deployed and reporting to you.

  • A findings report

    The risks and issues discovery turned up, written for you to act on and to take to the client.

What a findings report tends to cover

Every environment is different, but findings usually fall into three piles.

Exposure
Admin accounts without MFA, shared logins, accounts for people who left long ago, firewall rules nobody can explain, backups nobody has restored from.
Age
Operating systems out of support, hardware out of warranty, firmware well behind.
Ownership
A domain, licences or vendor accounts held in the previous provider’s name, and systems nobody at the client can say they own.

It’s yours to use. Often it’s the basis of your first proper conversation with the new client about what needs fixing.

Got a client coming across?

We deliver the takeover remotely as a white-label project, under your brand or as your named partner. You keep the client and the ongoing service. We quote and invoice you a fixed price for the agreed scope.

Request a quote for this project More security and compliance projects