The Desk Remembers: Auditing Residue Between Shifts in a Shared Zero-Trust Estate

Zero-trust architecture is usually drawn around a clean sequence: one identity, one device, one session, one decision. The drawing is useful, but it is not how many UK estates actually operate. Agency staff arrive for a rota, a ward handover or a warehouse shift and use whatever workstation is free. The session ends when the person leaves, not when the machine is returned to a known-good state. Between those two moments, the desk accumulates trust residue.

That residue is not a minor housekeeping issue. It is a control failure waiting for the next person to sit down. An audit programme that treats shared workstations as an exception will miss the point. The better question is whether the estate can prove, before the next user authenticates, that the previous user's access has been removed, expired or rendered unusable.

Why hot-desking breaks the clean model

Shared workstations are common in the NHS, local government, logistics, retail distribution and agency-heavy professional services. They are also common in environments where zero-trust teams have limited control over the endpoint: a temporary office, a partner site, a clinic room or a shift handover bay. The identity may be strong. The device posture may be checked. The session, however, may not be clean.

A user can log out of the visible desktop and still leave a browser session alive, a mapped drive mounted, a print queue configured, a VPN profile saved, a local admin tool installed or an offline token cached. Some of these artefacts are benign in isolation. Together they form a path that bypasses the intended access decision. The next person does not need to compromise an identity if the workstation still remembers the last one.

Audit teams should therefore treat the shared workstation as a distinct trust boundary. It is not enough to ask whether the device is managed. The relevant question is whether the device can demonstrate a clean handover.

Catalogue the residue before judging it

The first audit step is not a policy review. It is a residue inventory. On a representative sample of shared devices, capture what persists after a normal shift ends. Avoid relying on user reports. Inspect the device state directly and record the evidence in a form that can be re-tested.

The inventory should include: cached browser profiles and saved passwords; active or remembered VPN profiles; mapped network drives and their authentication state; installed print queues and any stored credentials; local administrative tools and scheduled tasks; offline tokens and cached cloud credentials; clipboard history where enabled; recent document lists; and any shared service accounts configured on the device. The list will vary by estate, but the principle is consistent: if it survives a reboot or a user change, it belongs in the audit scope.

Classify each item by persistence and by access. A cached intranet page is not the same as a saved VPN profile with an offline token. A print queue that authenticates as a shared account is not the same as a browser session that expires in fifteen minutes. The classification should drive the remediation priority, not the other way round.

Make the handover an evidence event

The practical weakness in many estates is that the handover is informal. A user signs out, a colleague signs in, and the device is assumed to be neutral. An auditable process needs an explicit evidence event between those steps. That event does not have to be elaborate. It does have to be repeatable and testable.

A useful routine is to define a handover checklist for shared devices and to sample its evidence monthly. The checklist should confirm that the previous session has ended, that cached credentials have been cleared, that mapped drives and print queues have been removed or re-scoped, that VPN profiles are not reusable without fresh authentication, and that local administrative tools are absent or controlled. The evidence can be a configuration export, a screenshot with a device identifier and timestamp, or a query against the endpoint management platform. The important point is that the evidence is tied to the device and the handover, not to a user's assurance that they logged out.

Shift-aware access reviews should follow the same logic. If a rota changes at 06:00, the review cannot wait until the next quarterly access recertification. High-turnover roles need a shorter review cycle, and the review should include the workstation state as well as the identity entitlement. An agency worker who has left the estate may still have a mapped drive on a shared device. The identity record may be closed while the device residue remains open.

Prefer ephemeral profiles, but verify the edges

Ephemeral profiles are the right direction for many shared estates. A non-persistent desktop, a clean browser profile per session and a device configuration that resets at logoff reduce the residue surface. But ephemeral design is not self-proving. Audit teams should verify where persistence still occurs: local caches, printer drivers, VPN clients, offline token stores and any application that writes credentials outside the profile.

The verification should include a deliberate test. Complete a normal shift, log out, reboot, and inspect the device before the next login. Then repeat with an abnormal exit: a closed lid, a lost network connection, a forced shutdown. The abnormal path is often where residue survives. If the estate cannot demonstrate a clean state after both paths, the ephemeral claim is incomplete.

Reprovisioning needs a record, not a ritual

Reprovisioning is often treated as a back-office task. For audit purposes it should be a recorded control. Each shared device should have a last reprovisioned date, a method, a result and an owner. If a device is reimaged only when it fails, the audit cannot distinguish between a clean handover and a lucky one. A simple register, linked to the asset management system, is sufficient if it is maintained.

The register should also capture exceptions. A device that cannot be reimaged because of a clinical application, a legacy driver or a site-specific constraint is not automatically a failure. It is an exception that needs compensating controls and a review date. The audit should test whether those compensating controls actually work, not whether the exception has been documented.

A UK-specific discipline

UK estates often combine tight budgets, mixed supplier arrangements and regulated data. Agency staff may work across multiple sites. NHS rotas and logistics shifts create rapid handovers. Local government shared service desks may be used by contractors with different entitlements. These are not reasons to abandon zero trust. They are reasons to make the handover explicit.

For technology leaders, the message is straightforward. A zero-trust estate that cannot account for the shared workstation is trusting the desk to forget. The desk does not forget. It caches, maps, prints, stores and reconnects. The audit routine should assume that residue exists and require evidence that it has been removed before the next person sits down. That is not a bureaucratic extra step. It is the difference between a clean session and an inherited one.