The last admin left: how to regain control of company accounts in a wind-down

Where should recovery start when no one has admin access?#

Recovery should start with the domain registrar and DNS, because most vendors verify a company's authority by asking it to prove control of its domain. If you can sign in to the registrar, you can add the verification records vendors request and point admin email back to an inbox you control.

If the registrar account itself is lost, recover it first. Registrars generally run their own account recovery based on the account holder's identity, the payment method on file and company documents. Old invoices and card statements usually reveal which registrar holds the domain.

Then work outward: the identity platform first, because it controls sign-in for many other tools, then systems of record such as the ERP, CRM and help desk, then everything else.

Per-system recovery paths#

Per-system recovery paths differ in who may export data and how a vendor confirms you are entitled to take over. The table summarizes the usual pattern; check each vendor's current help documentation, because recovery steps change and vary by plan.

Write each request into a recovery log with the date, the vendor ticket number, the documents sent and the result. The log helps the next person and shows a court, auditor or buyer that access was regained properly.

What proof of authority will vendors ask for?#

Vendors ask for proof of authority because a recovery request looks the same whether it comes from a legitimate officer or an attacker. Have the documents ready before contacting support, and expect follow-up questions if the company name on the account differs from the legal entity name.

Write the resolution so it names systems explicitly: authority to recover, administer, export and close company accounts, including email, chat, file storage and business applications. A vague resolution invites delays while support teams escalate the request.

• 1A board resolution or written consent naming the person authorized to act for the company in the wind-down.
• 2The officer's appointment letter, or the engagement letter of the wind-down officer or restructuring firm.
• 3For a receiver, assignee or trustee, the court order or assignment document giving control of company assets.
• 4Proof of domain control, such as a DNS record the vendor asks you to add.
• 5Billing details: the last invoice, the account number or the last digits of the card on file.
• 6Company documents such as the certificate of incorporation or a recent state filing.

What should you do right after regaining access?#

Right after regaining access, add a second named admin and stop anything that deletes data. A recovered account with a single admin simply repeats the problem that caused the lockout.

Timing rules can surprise you. Google says the Workspace Data Export tool must be started by a super admin account that is at least 30 days old, unless the organization's account is newer, so an admin created during recovery may not be able to run a full export immediately. Where your edition includes Google Vault, a Vault export can help in the meantime, but Google says searching and exporting require the Manage Matters, Manage Searches and Manage Exports privileges to be assigned first.

• 1Add at least two admins from the wind-down team, each with their own login and multi-factor authentication.
• 2Record, then remove or suspend, admin roles held by former staff and unknown accounts.
• 3Pause retention policies, auto-deletion and scheduled user removals.
• 4Note the plan, renewal date and any unpaid invoices that could trigger suspension.
• 5Start exports of systems of record and record the date range each export covers.

What if the former admin is reachable but not cooperative?#

A reachable but uncooperative former admin is a governance problem first and a technical problem second. Company accounts belong to the company, so a written request from the authorized officer citing the board resolution usually settles it; if not, counsel can send a formal demand.

Avoid workarounds that could look like unauthorized access, such as guessing passwords or using a former employee's personal device. Use the vendor's recovery process and document every step. Where the former admin was a contractor or managed service provider, check the services agreement for duties to return credentials and support a transition.

Illustrative example: an HVAC company after its IT contractor left#

Illustrative: a fictional HVAC and plumbing contractor is closing after the owner retires. Its outside IT contractor ended the engagement long ago, the office manager who held the ServiceTitan admin role has left, and nobody knows the Google Workspace super admin password.

The wind-down officer finds the domain registrar through an old card statement, recovers that account with company documents, and completes Google's domain-based recovery to regain the super admin role. With email back, password resets for ServiceTitan and QuickBooks Online reach the right inbox. Two admins are added everywhere, the Workspace export is scheduled once the new admin account qualifies, and the field service history of calls, estimates, jobs, invoices and warranty visits is exported in full.

Only then does the owner decide what to do with the records. The service history goes to a metadata-only fit check, and customer contact details are flagged for removal in any later preparation.

How SourceX helps after access is restored#

SourceX begins after access is restored, not during recovery. The fit check in the SourceX five-step transaction uses only metadata, such as which systems the company controls, how many years each holds and which record families exist, so no credentials or files are shared at that stage.

If a package proceeds, the Approval step records who authorized the release and under what authority, often the same board resolution or court order used to recover the accounts. That authority is carried into the SourceX Evidence Packet together with provenance, licensing rights, permitted use and the privacy record.