System Administrator interview questionsScripting — the offboarding script round

Purpose

Tells the candidate reading comes first, so a candidate who prepared to write code from a blank page spends the opening minutes on the evidence.

Purpose

Reads troubleshooting from evidence where the log itself is wrong. The separator is whether the candidate trusts the evidence over the log line the script wrote about itself.

Signals to score

• Finds the surname wildcard and explains how `*Okafor*` matched `cokafor-reid` as well as `mokafor`
• Concludes that Chidi was disabled, stripped of every group and had his password reset, and that nobody knows what he had
• Reads the run log's "sessions revoked" as written unconditionally, and shows from the code that it proves nothing
• Connects the expired client secret and the empty catch blocks to the revocation never happening
• Explains the successful 17:31 sign-in from the unrevoked session and the cloud account still enabled until the 17:40 sync
• Treats the failed sign-ins at 18:02 and on Saturday as the sync taking effect, and does not read them as Mira attempting something without more evidence
• Identifies the AP export as a business process running under a person's account, which disabling her broke
• Leaves the 90-day retention in `OU=Leavers` alone and says why deleting the account would have been worse
• Separates harm already done from harm still in progress, and deals with the second first

Follow-up questions

• The log says sessions were revoked. How do you know whether they were?
• Who is Chidi, and why was he in this script's loop?
• What happened at 17:31, and why did it stop by 18:02?
• Why did the finance export fail on Monday, and whose fault is the design?
• Would it have been better if the script deleted leavers instead?

Purpose

Sets the deliverable as a change to an existing script rather than a clean exercise, which is how offboarding scripts are really maintained, and leaves the choice of what to keep to the candidate.

Purpose

Reads scripting and automation at the standard a script needs when it changes accounts in bulk. The separator is whether failures become stops and whether a mistake can be undone.

Signals to score

• Takes an identifier that is unique by construction — employee ID, account name or UPN from the HR request — instead of a surname
• Matches exactly and stops unless exactly one account is found, printing what it did find
• Adds a dry run that lists every change without making it, through `-WhatIf` support or an explicit switch
• Writes the account's groups, OU and state to a file before changing anything, so a mistake can be put back exactly
• Makes directory failures stop the script with `-ErrorAction Stop` and removes the empty catch blocks
• Checks the result of the session revocation and records a failure as a failure, with the account named for follow-up
• Writes a log line per step saying what was attempted and what happened, not one summary written regardless
• Replaces the shared fixed password with a random one, or drops the reset and says why the disable is enough
• Moves the cloud credential out of the script and makes its expiry something that alerts before it happens
• Makes a second run on the same account harmless

Follow-up questions

• Friday's input was a surname. What does your version take, and where does it come from?
• Your lookup finds two accounts. What happens?
• The token request fails. Walk me through what your script does next.
• Someone runs it on the wrong person. How do you put them back as they were?
• Why is `Leaver-2026!` a problem even though the account is disabled?

Purpose

Reads identity and access across the whole estate rather than the directory alone. The separator is whether the candidate thinks in terms of every way a person can still act as themselves — accounts, shared secrets, devices, processes — and makes the list come from a record.

Signals to score

• Finds the payroll portal administrator account and has it disabled at the provider today, through the other administrator
• Checks that the portal's account recovery cannot be used from her personal email or phone
• Rotates the shared supplier portal password she knew, and moves it out of a spreadsheet into a managed store with named users
• Moves the AP export to a service identity with an owner, and looks for other tasks and services running as people
• Removes company mail and files from her personal phone through device management
• Uses the mail and file audit logs to see what the unrevoked session touched after 17:14, and records the answer either way
• Makes HR's record of the leaving date the trigger for offboarding, rather than a ticket someone has to remember
• Keeps the application inventory with an owner per application, moves applications to single sign-on where they support it, and reviews access to the rest on a schedule
• Applies the same thinking to movers, using Chidi's lost access to argue for groups that come from the role

Follow-up questions

• The payroll portal has its own sign-in. What did disabling her directory account do to it?
• The accounts payable team shares one supplier portal password. What happens to it today?
• Who should the AP export run as?
• How would you find out whether the session at 17:31 read anything?
• Where does next month's leaver list come from?

Purpose

Scores nothing and goes in the notes. A candidate who has closed accounts for real tends to ask where the leaver list comes from and which applications sit outside single sign-on.

Purpose

Ends on a real, current weakness rather than a pitch; it is what the candidate this round is for wants to know, and it only works if it is still true, so check it first.