Contain, Don't Destroy

Stopping an attack from causing more damage is called containment. For an affected employee account, you can temporarily disable it while you investigate what happened. For example, if an attacker is using Ava's account, run:

seclab disable ava

You should see:

Disabled ava. They can no longer log in.

Now check whether any sessions remain open:

seclab sessions ava

You should see:

ava is not signed in anywhere.

Nobody is signed in as Ava anymore. Her account and group memberships still exist, so you can investigate and later restore her access. Deleting the account would remove those memberships too.

Only stop access for the affected account. Other employees should be able to keep working. In the next lesson, you will deal with accounts that the attacker created for themselves.