I am interested in some additional information concerning a previous
Roberta Bragg response
. Can you give me any best practices and/or Sarbox related documentation concerning changing user IDs for users who have a legal name change (i.e., married, divorced, etc.). The company I work for currently does not change account names when a user has a legal name change and I was wondering if there would be any documented "best practices" items that would indicate whether or not it is a good idea to change a user's login ID when they have a name change.
I agree with Roberta's answer and can't think of a good reason why you would want to change an ID from a security perspective. I have worked in environments that gave the employee the option to change user IDs upon a marriage, divorce, etc., but it was not mandated by the employer; it was at the employee's discretion. I don't know of any regulatory resource that would address your question. Perhaps the old adage, "if it ain't broke, don't fix it" should apply here, as it's very likely this user has committed usernames and passwords to various accounts to memory. It could increase help desk calls (and therefore costs) to summarily change user IDs for such circumstances.
Ron E. writes:
Regarding your response on changing user IDs when people remarry, divorce, etc., apparently you don't worry about the headaches caused for help desks if you don't change the user ID. Our installation assigns user IDs based on names and if they change, we change the user IDs. Troubleshooting for us and our help desk would become a nightmare if the user ID no longer coincided with the person's legal name.
Seems like it would be a nightmare to switch the user IDs of an already established user. Think of the help desk calls when something you've been typing in daily for years changes!