I have case where customer would like to disable AD Admin accounts when person is left.
There are currently lot of admin accounts created directly in AD, first we would need to map them to identity, but we don't want to update information / birth rights to them. We just would need to disable those accounts when person is left. Persons do also have another AD account which they use in daily life, but those admin accounts are used to sign shared servers etc.
What is the preferred way to handle this kind of scenario?