How do you revoke remote access?

You revoke remote access by deactivating the relevant accounts, keys, or sessions in the system granting access, such as a VPN server, a remote desktop tool, or an identity management platform. This applies to employees leaving the company, contractors whose contracts are expiring, or devices that have been lost or stolen. In the sections below, we cover the most common methods and steps. Do you have questions about your specific situation? Feel free to contact us With Sellox, we are happy to help you further.

What methods exist to grant remote access?

The most commonly used methods for granting remote access are VPN connections, remote desktop software (such as RDP or TeamViewer), cloud-based access platforms, and SSH keys for server management. Each method has its own mechanism for granting and revoking access, which determines the steps you need to take to effectively lock someone out.

It is important to know which methods are active within your organization, because access sometimes occurs via multiple channels simultaneously. For example, an employee may have both a VPN account and a remote desktop connection. Effective access control therefore starts with a complete overview of all active connections and the associated accounts.

How do you revoke remote access via a VPN?

You revoke remote access via a VPN by deactivating or deleting the user account in the VPN management console, revoking the associated certificates, and forcibly terminating any active sessions. As long as the account remains active on the VPN server, the user can reconnect, even if other access rights have already been revoked.

The exact steps depend on the VPN software you are using. With solutions such as OpenVPN, Cisco AnyConnect, or WireGuard, you manage users via an admin panel or configuration files. Remember to also deactivate any two-factor authentication tokens or hardware keys linked to the account. With cloud-based VPN services, revoking access is often handled through a central identity platform such as Azure Active Directory or Okta.

How do you remove remote desktop access from a device?

You remove remote desktop access by disabling the remote desktop function on the target device, removing the user account from the list of allowed users, and ending active sessions via the session management settings of the operating system or the software used. For third-party tools, such as TeamViewer or AnyDesk, you also remove the device from the administrator's account overview.

Disabling Remote Desktop Protocol (RDP) on Windows

Go to System Properties, click on the “Remote” tab, and disable the option for remote connections. Then, remove any users who had explicit access via the “Select Users” button. This ensures that no one can connect to the device via RDP anymore.

Revoke access to third-party remote desktop software

For tools such as TeamViewer or AnyDesk, log in to the management console of the corporate account. Remove the relevant device or user from the shared devices list there. Also change the password of the administrator account if the user had access to it, and check that no unattended access modes are active.

What should you do after revoking remote access?

After revoking remote access, verify that all active sessions have actually been terminated, document the actions performed with a timestamp, and scan the log files for suspicious activity that occurred before the revocation. These are the steps that determine whether the revocation is complete and verifiable.

• Check the audit logs of the VPN server, the operating system, and any remote desktop tools for recent connections.
• Verify that the account is also disabled in linked systems, such as email, cloud storage, and internal applications.
• Save a written confirmation of the date and time at which access was revoked.
• Inform the relevant colleagues or the security team about the changes made.

Also, do not forget to change passwords for shared accounts if the departing user had access to them. Shared credentials are a common security vulnerability that is overlooked when offboarding employees or contractors.

Why is revoking remote access a security risk if it happens too late?

If remote access is not immediately revoked after the termination of employment or collaboration, an active access channel to sensitive systems remains open. This increases the risk of data breaches, unauthorized modifications, and sabotage, because the former user can technically still log in as if nothing has changed.

In practice, many security incidents can be traced back to accounts that were not deactivated in a timely manner. A former employee holding a grudge, or an attacker using stolen credentials, can remain active undetected for weeks or months without a monitoring process. The longer the delay, the greater the potential damage. Good access management therefore requires that revoking access be part of a standardized offboarding process, not a manual oversight.

How do you prevent unauthorized remote access in the future?

Unauthorized remote access is prevented by a combination of strict identity verification, regular account reviews, and automated deactivation upon termination. A central identity management platform makes it possible to revoke access quickly and completely from a single point, instead of manually going through multiple systems.

Additional measures that further reduce the risk:

• Multi-factor authentication (MFA): Even if login credentials are stolen, an attacker cannot log in without the second factor.
• Minimal access rights (least privilege): Give users access only to the systems they really need for their work.
• Regular access reviews: Periodically check who has access to which systems and remove unnecessary rights.
• Automated offboarding: Link HR processes to access management so that accounts are automatically deactivated upon termination of employment.
• Monitoring and alerting: Set up notifications for unusual login attempts or connections outside business hours.

A proactive approach to access management is the most effective way to prevent former users or malicious actors from retaining access to systems they are no longer authorized to use. Would you like to know how Sellox can support your organization with this? Contact us and discuss the possibilities with one of our specialists.