Credential Hygiene: Finding and Clearing Duplicates

Somewhere in every property office there is a list of door codes. It was accurate the week it was written. Since then the building has seen two managers, a renovation, a long queue of contractors and thirty staff changes, and the list has been updated roughly never. A list like that does not stay blank — it fills with duplicates.

Duplicates are the quiet majority of bad access: credentials that still work but no longer belong to anyone. What follows is a duplicate door access cleanup — how duplicates appear, why a lock’s documented capacity forces the question, and a hygiene pass that takes an afternoon and clears the entries nobody can explain.

How duplicates appear

Nobody creates duplicate access on purpose. It accumulates through small, reasonable decisions made by people who have since moved on, and it hides best in exactly the places a register never looks.

• The shared code that was meant to be temporary. One code for cleaners, one for contractors, one “just for now” — each convenient on the day it was created and impossible to attribute a year later.
• The spare credential. A second card or code issued “just in case” and never reconciled with the first. Both live, only one written down.
• Contractor access that outlived the contract. Issued for a fit-out and collected by nobody when the fit-out ended.
• Departures without removal. A credential left active because the door was never on the offboarding list — which is why staff offboarding and access revocation belongs in the same checklist as the laptop, the keys and the parking pass.
• Installation and test credentials. Left in place after commissioning, kept because nobody is quite sure what they do.
• Inherited registers. After a change of manager or management company, the incoming team keeps old credentials because it cannot prove which ones are still needed.

A duplicate is worse than a shared secret in one specific way: a shared code can be rotated when it leaks, while a duplicate nobody knows about cannot be managed at all — it simply waits.

The ceiling forces the question

The hardware side of hygiene comes down to one documented property: capacity. Locks hold a finite credential list, and the limits are stated per model. The DS-series deadbolts are documented with capacity for 100 fingerprints, 100 passwords and 100 cards. The DDL1 is documented with capacity for up to 297 users and 3 admin positions. The DDZ17 room-door model is documented with support for 300 users and temporary passwords.

Admin positions deserve their own line in this. When management access is documented at a small number of seats — 3, on the DDL1 — an administrator left in place after leaving the role is not a harmless spare. The seat cannot be given to the person now doing the job, and the second holder is exactly the sort of entry a register loses track of.

A ceiling changes the conversation. While there is empty space on a list, duplicates can hide in it indefinitely. When the list is full, adding a credential means choosing one to delete — and for many buildings the second or third year is when the space runs out. The ceiling is not a limitation to work around; it is the audit trigger most operators never schedule for themselves.

Documentation such as spec sheets is available on request, so a register can be sized against the documented capacity of the exact model installed. A site near that figure is not unlucky; it is due for a pass.

Temporary credentials should expire by design

Most duplicates started life as temporary credentials, and the reason is structural: expiry depends on someone remembering a date that was never written down. The person who issued the credential is often not the person on site when it should end.

Where a model’s documentation includes the capability, temporary access can be handled as a property of the design rather than a test of memory. The DDZ17 room-door model, for example, is documented with support for 300 users and temporary passwords — a documented capability to build a process on, not a promise that the process runs itself.

Properties that issue credentials at volume already live or die on this rule — hotel front desks most of all, where the daily rhythm is issue, use, clear. The mechanics of that flow are worth studying even outside hospitality: front desk credential handling is the discipline every other site borrows from.

The hygiene pass

One pass moves a building from unmanaged to defensible. Set aside half a day, bring the register and a pen, and work in this order.

When the pass is over, the register itself is the asset: every line mapped to a person, every temporary entry dated. If the property is about to change systems or change hands, that cleaned list is exactly what the transition needs — it is what moving access lists to a new platform is built from.

The point of the pass is not a perfect list. It is a list that can be corrected in five minutes next week, and the week after, so that the next cleanup is a formality instead of an excavation.