Commercial rekey in NYC after an employee leaves

Friday, 4 PM, a Midtown office suite: the employee let go at noon still has keys to the suite and the storage room, and could walk back in after hours. Nobody knows whether a copy was ever cut.

The short version: a commercial rekey in NYC re-pins or swaps the cylinders that person's keys opened, so the old keys stop working, and new keys go only to the people who still need them. Start with the suite entrance, check with your managing agent before anyone touches a cylinder the building also keys, and if the person held a master key, plan to re-pin every cylinder under it. Budget it as a cost of the departure: New York's wage rules do not let you take it out of a final paycheck.

What a commercial rekey in NYC changes, and what it does not

Rekeying changes the pin stacks inside a cylinder so it answers to a new key. The lock body, the lever and the door stay. The old keys, and any copies cut from them, stop turning the plug. Which hardware can be rekeyed, and what to say when you ask, is on our page on lock rekeying in NYC.

On most office doors the cylinder is a separate part. A mortise lock's cylinder screws into the lock body, so a technician can re-pin it or fit a new cylinder without touching the rest of the lock. Some offices use interchangeable cores, the figure-eight-shaped cores that come out with a special control key; there, the change can be a core swap. If the departed employee ever held that control key, treat it like a master key: every core it can remove is exposed.

A rekey does nothing to electronic credentials. A lobby fob, a keypad code, an alarm code or a smart lock account has to be switched off in the system that issued it. Do those first; they are the quickest doors to close.

A rekey also never changes how the door opens from inside, and it should stay that way. The NYC Building Code's general rule for egress doors is that they be "readily openable from the egress side without the use of a key or special knowledge or effort" (§ 1010.1.9 of the 2022 code's egress chapter), so a lock that needs a key to leave is not the fix, however rattled the office feels.

Which cylinders to rekey first

When you rekey commercial door locks after a departure, work from what the person could open, not from what they were supposed to open. The key log, if you keep one, is the starting list. Without one, assume every key the person ever signed out or borrowed is still out there. If the suite is on a restricted keyway, the dealer's record of cut keys replaces that guess, and the new keys come only through whoever holds the key card.

Collect and compare. Ask for every key and fob at the exit meeting and check them against the log by key number.
Switch off the electronics. Ask the building to deactivate the lobby credential, tell the lobby desk or building security that the person is no longer authorized, and delete the person's keypad codes, alarm code and smart lock access.
List the cylinders. Suite entrance, storage room, server or supply closet, private offices and any keyed cabinets. Count cylinders, not doors: a lever lock and a deadbolt on one door are two.
Set the order. The suite entrance first, because it faces the corridor. Then the rooms that hold cash, records or equipment.
Clear it with the building before anyone touches a cylinder the building also keys.
Cut keys to a new list. New keys go only to the people on the updated log, numbered and signed for.

If a cylinder is worn, sticky or a different make from the rest, rekeying may not be the right call for that door. Our guide to repairing or replacing commercial door locks covers when the cylinder, not the lock, is the part to change.

When the employee held a master key

If your suite is master keyed, each person's key opens their own doors and one master opens all of them, and the size of the job depends on which level of key left. The design itself is in how a master key system works; this post stays with the departure. Three cases:

A change key. The technician re-pins the doors that key opened to a new change key that still works with the existing master. Anyone else who carried that same key, often everyone who uses the suite entrance, gets a new one. The master keeps working.
A master key. Every cylinder under that master has to be re-pinned to a new master, and depending on how the system was laid out, staff keys may change too. It is close to redoing the system, which is the best argument for keeping masters with as few people as possible.
The building's key. In a managed NYC building, your suite door may also open to the building's master so its staff can get in during an emergency. A commercial master key that belongs to the building is the building's to change, not yours.

Who signs off in a managed building

In a Midtown tower or a loft building with a managing agent, the cylinder in your suite door may not be entirely yours. Check the lease, then ask the managing agent four questions before booking the work:

Is the suite cylinder on the building's master, and does the building require its own keyway or its own locksmith?
Does the building need a copy of the new key?
Which documents does it want from a vendor, such as a certificate of insurance, and how far ahead?
Are there set hours or a freight elevator window for contractor work?

Our checklist of vendor documents to verify covers what to collect and who should review it. The person doing the rekey needs a license of their own: DCWP says "You must have a Locksmith license to repair, service, install, inspect, and open and close locks by mechanical means" (DCWP locksmith license checklist), and its license search works without an account. Once the building has answered, our commercial locksmith service in NYC lists what to describe for office work.

What New York wage law says about unreturned keys

The tempting fix is to deduct the rekey, or a charge per missing key, from the last check. New York Labor Law § 193 starts from the other direction: "No employer shall make any deduction from the wages of an employee, except deductions which:" and then lists them. The Labor Department's regulation, 12 NYCRR Part 195, names deductions that are not allowed, including "Repayment of employer losses, including for spoilage and breakage, cash shortages, and fines or penalties incurred by the employer through the conduct of the employee" and "Fines or penalties for tardiness, excessive leave, misconduct, quitting without notice" (§ 195-4.5). The Department's Illegal Deductions page lists "Losses to the business" among them.

Two workarounds fail as well. A signed authorization does not cover it: the regulation limits employee-authorized deductions "to the ones that are specifically listed in the statute, and to 'similar payments for the benefit of the employee'" (§ 195-4.1), and a rekey protects the business, not the employee. Requiring cash at the exit meeting does not work either: no employer may "require an employee to make any payment by separate transaction" unless the charge is permitted as a deduction or a current collective bargaining agreement allows it (§ 195-2.1).

The last check cannot wait for the keys, either. The Labor Department says employees whose employment has ended "are entitled to be paid no later than the pay day on which their next pay would have been due had they still been employed" (frequency of pay FAQ). So budget the rekey as a cost of the departure, put the effort into collecting keys at the exit meeting, and take anything beyond that to an employment lawyer. This section is general information, not legal advice.

A key log and key agreement for the next departure

The cheapest commercial rekey is the one you can scope from a single sheet of paper, because you know exactly which keys left. Two documents do that.

The key log. One line per key: the number stamped on it (never the address or suite), the doors it opens, who holds it, the date out, the date back and a signature each way. Keep masters and control keys on their own page, with as few names as possible.

The key agreement. An employee key agreement form does not need a lawyer's template to be useful. It needs:

The key numbers and doors issued, with the date.
A promise not to copy or lend keys, and to report a lost key the same day.
A line that keys and fobs stay company property and come back on the last day, to a named person.
The employee's signature, and yours.

Leave out any clause that charges the employee through payroll.

FAQ

How much does it cost to rekey a commercial lock in NYC?

It depends on how many cylinders change, whether they sit on a master system or a restricted keyway, and how many keys you need. In the LockAtlas app the price is a service fee that varies by time of day and day of the week, a flat labor price for the job, parts if needed and 8.875% sales tax, and you see the full breakdown before you book.

Can I deduct unreturned keys from an employee's paycheck in New York?

No, not from wages. New York's wage regulation lists "Repayment of employer losses" among prohibited deductions, and a signed authorization does not change that. For a dispute over company property, talk to an employment lawyer.

Do I need the landlord's permission to rekey office locks in NYC?

Check your lease, then ask the managing agent, especially if the suite door is on the building's master key. The building may want its own cylinder, its own locksmith or a copy of the new key.

Where LockAtlas fits

For a commercial rekey in NYC through the LockAtlas app, you describe the job, such as the number of cylinders, the doors and whether a master system is involved, and add a photo. The price is built from a service fee that varies by time of day and day of the week, a flat labor price for the job, parts if needed and 8.875% New York sales tax, and the full breakdown is shown before you book. A photo cannot show everything, so if the technician finds a cylinder that cannot be re-pinned, the change comes to you in the app to approve or decline. Locksmith licenses in NYC are individual, so you can check the assigned technician's name and license number with DCWP before work begins (individual licensing ends May 31, 2027, when DCWP moves to a Locksmith Business license). When your list of cylinders is ready, get the LockAtlas app.