Can an admin get access to passwords not shared to anyone for a user who left the company?

[rbranger]

We are about to rollout passbolt for the whole company. Two questions came up where we need clarification:

1. If a user left the company (or is not available anymore due to illness or death), and has registered an important password but did not share it, is there a way that an admin can get access / recover this password?

2. Same question but the other way round: If an employee wants to store their personal passwords (e.g. for their home banking account in passbolt), is there any way for an admin to somehow get access to this password even if the password is not shared? E.g. by deleting the account and assigning ownership of such a password to the admin itself?

Thanks for you help and kind regards, Raphael

[remy]

Hello,

1. Not at the moment.
2. No.

See. similar topics:

As an admin, retain an escrow copy of users' private keys

Q1. What is the problem that you are trying to solve? In our experience with passbolt in a small company environment, the number one administrative pain point is when a user loses their private key. Typically this is because the machine where they generated it has crashed or needed reinstallation, and they didn’t keep a separate copy of the private key. We would like to help our users (and admins) by relieving them of the responsibility of keeping a secure copy of their private key. The way …

As a company owner, I can retrieve any secret stored in the company passbolt instance

Q1. What is the problem that you are trying to solve? If an employee leaves the company, and has stored company secrets in passbolt without sharing them, then currently those secrets are lost forever. Being able to retrieve those secrets may be critical for business continuity. A related common problem is when a user loses access to their own private key (e.g. reinstalls their PC without having taken a backup of the private key), and has unshared secrets in passbolt. There are other possible…

[kenrhodes_mth]

I have a question that is similar, thought not exactly the same.
If a user leaves the company, is there an easy way for the administrator(s) to find all of the passwords that have been shared with/by that user? I’ve seen reference in some topics to writing “custom reports in SQL” and I don’t have a clue how to access the passbolt database to do something like this, and I can’t find any reference for it in the documentation.

Is this something that can be done?

[remy]

@kenrhodes_mth we don’t have this report handy in SQL yet, but it will be part of the upcoming “Admin report” feature .

[emoxam]

Any news for the feature? I feel the lack of it too

[remy]

Hi @emoxam,

The account recovery feature was released in beta with v3.6 of Passbolt Pro Edition. It allows to recover user accounts when they leave if they have shared their key with the organization recovery key and if you have access to the email address mailbox.

Cheers,

[emoxam]

With no pro any chance to get it?

[garrett]

Hi @emoxam Another user previously inquired here about how a feature in Pro might become a feature in CE, which is what I am assuming you are asking How are features determined to go Pro vs CE

As Account Recovery has just rolled out in Pro, it’s currently a Pro-only feature.