An MSP holds the keys to every client it supports. That makes password handling the part of documentation where mistakes cost the most, in both directions: too loose and you're a breach waiting to happen; too strict and techs start keeping their own copies.
Store passwords with what they unlock
The firewall password belongs on the firewall's record; the Microsoft 365 global admin belongs with the tenant. When credentials live next to the device or service, techs find them in seconds and don't need to guess which of five "Admin" entries is the right one.
Encrypt, and control who sees what
Passwords should be encrypted at rest, and visible only to the people who need them. Useful controls:
- Per-client access, so contractors or new hires see only the clients they work on
- Per-record restrictions for the most sensitive accounts, like domain admin and backup encryption keys
- Read-only users who can see documentation but not passwords
- Temporary access that ends on its own after a few hours
Log every view
An audit log of who viewed which password, and when, answers questions after an incident and deters casual browsing. It also helps when a client or auditor asks how their credentials are protected.
Keep MFA secrets with shared accounts
Shared admin accounts that need a one-time code are a constant headache. Storing the TOTP secret alongside the login, encrypted, lets any authorized tech generate the code without passing a phone around, and every code generated can be logged too.
Rotate on a schedule, and after people leave
Rotate shared admin passwords on a schedule, and always when a technician leaves. Track the date each password was last changed, and keep a list of passwords that are old, reused or weak. Local administrator passwords on client computers can be rotated automatically by a script and stored on each computer's record.
Offboarding a technician
When someone leaves, end their sessions, remove their access, and list every password they viewed in the past months so you can decide which to rotate first. Doing this from a single screen makes it a ten-minute job instead of a forgotten one.
Moving off spreadsheets and old vaults
Most password managers export to CSV. Import that file, map each password to its client, then link the important ones to the device or service they belong to. Delete the export file afterwards.
Where DokLocker fits
DokLocker stores passwords encrypted on the records they belong to, with per-client and per-record access, temporary access, logged views and one-time codes. It imports from Passportal, IT Glue, Hudu and any password manager's CSV, and works alongside Keeper, Bitwarden and 1Password if you'd rather keep your vault. See our security page for how it's built.