Receiving from a disconnected station

A certain user with his laptop left the company about a month ago, but a few days ago I received mail from my antivirus telling me that that PC had a virus. What could have happened, could DHCP have assigned someone else the gone users IP...

 

If the IP address is not mapped to a particular MAC address (this is not normal and would have had to be set up manaually), then yes the IP address will be assigned to another PC.

In general, a DHCP will give out a lease for a matter of days and will endeavour to give the same PC the same IP if it is still available. But if the IP isn't used for a week or so, and another network node needs an address, then DHCP will offer that IP.

This is why using computer names can be so useful when tracking systems that get their IP addresses from a DHCP server.

 

Thanks ReggieB we also thought of removing the users account just to make sure.

 

In a perfect world that's a good idea.

I tend to disable an account and move it to a dedicated ( "exemployees ") folder in Active Directory. You never know when you might need to reenable the SID. However, we do tend to run software that isn't very user aware and occasionally needs to be run under an old account. So perhaps that wouldn't be "norrmal" practice.

So for normal practice, I'd suggest you disable the account for a while before deleting it.