A tenant moves out of a multi-tenant office building or retail strip. They turn in their keys, or they say they do. Maybe there were extra copies. Maybe a former employee of theirs kept one. Maybe a contractor who did buildout work years ago still has one sitting in a drawer.
Six months later, nobody at the property can answer a simple question: who currently has a working key to that unit? That’s the exact situation a rekeying protocol is built to prevent.
The Problem: Turnover Outpaces Tracking
Multi-tenant buildings turn over constantly. Tenants leave, subtenants come and go, staff changes, and every one of those events is a moment where a key could end up in the wrong hands. Most buildings don’t rekey on a fixed schedule tied to these events, they rekey reactively, if at all, usually only after something has already gone wrong.
The risk compounds because keys don’t expire on their own. A standard key cut five years ago for a tenant who left in year two still opens that door today, unless someone physically changed the lock. Without a rekeying protocol tied to specific triggers, a property has no reliable way to say how many working keys exist for any given unit.
This is especially common in strip retail and small office buildings, where units change hands more often than large anchor tenancies. A retail space might turn over every two or three years. Each time, there’s an assumption that the outgoing tenant handed back every key, but nobody actually confirms it. Contractors who did buildout or renovation work for that tenant may have been given a key temporarily and never asked to return it. Delivery services, cleaning crews, and alarm technicians sometimes end up with keys too, especially in buildings where access has historically been handled informally.
None of this is unusual. It’s just what happens by default when there’s no protocol forcing a different outcome.
When to Rekey
A structured protocol rekeys on defined triggers, not on a “when we get around to it” basis:
- Every tenant departurerekey the unit before the next tenant moves in, full stop, regardless of how many keys were “returned”
- Lost or unaccounted-for keysif a key can’t be physically confirmed as returned or destroyed, rekey
- Security incidentsany break-in, unauthorized entry, or suspicious access gets the affected locks rekeyed immediately
- Staff changeswhen a property manager, maintenance employee, or anyone with master key access leaves
Treating tenant departure as an automatic rekey trigger, not a judgment call, is the single biggest change that closes the gap in most buildings.
Master Key System Implications
Most multi-tenant commercial buildings run a master key system: each tenant’s unit has its own key, and a master key (sometimes a sub-master for a floor or wing, plus a grand master for building staff) opens multiple units for maintenance and emergency access.
This structure means a single lost or uncontrolled master key is a much bigger problem than a lost individual tenant key. If a grand master is unaccounted for, every unit under that master is technically exposed, and the only real fix is rekeying the entire master system, not just one lock.
Because of this, master keys should be limited to as few people as possible, and a lost master should trigger an immediate, building-wide rekey conversation, not a “let’s keep an eye on it” response. When rekeying a multi-tenant building after a tenant departure, the individual unit gets a new key that still works under the existing master, so building staff retain access without having to touch every other unit.
Restricted Keyways as Prevention
The most effective long-term fix isn’t rekeying more often, it’s making unauthorized duplication impossible in the first place. Standard keyways can be copied at any hardware store. Restricted keyway systems from Medeco and Mul-T-Lock require a registered signature on file before a duplicate can be cut, and keys are stamped to indicate duplication is restricted. Pro Locksmith LLC is an authorized Mul-T-Lock dealer.
Putting a multi-tenant building on a restricted keyway doesn’t eliminate the need to rekey on turnover, but it drastically reduces the odds that a tenant walked away with an unauthorized copy nobody knows about. It turns “we hope they only had the keys we know about” into “we control who can make more.”
The Rekeying Process
Rekeying a commercial lock doesn’t require replacing the hardware. It means changing the internal pin combination so old keys stop working and new ones take over. For a multi-tenant building, the process looks like this:
- Pin new combinations into the affected locks, coordinated with the building’s master key system so building staff access isn’t disrupted
- Cut new keys for the incoming tenant or authorized staff
- Collect and destroy old keys wherever possible, this is also the point to update restricted keyway signature authorizations if applicable
- Update the key log to reflect the new combination, who received new keys, and the date
Skipping step 4 is common and it’s a mistake. A rekey that isn’t logged just resets the clock on the same tracking problem, the building still won’t know who has keys a few years from now.
Cost vs. Risk
Rekeying a lock costs a fraction of what a single unauthorized-entry incident costs a property in liability exposure, lost tenant trust, or insurance complications. Property managers sometimes push back on rekeying every unit at every turnover because it feels like an unnecessary recurring cost. It isn’t. It’s cheaper than the alternative: an incident where the building can’t demonstrate it controlled access to the unit in question.
The math is straightforward. Rekeying one commercial door lock is a single, predictable line item. An unauthorized-entry incident is not predictable, and the costs run well beyond the immediate loss, legal fees if the incident leads to a claim against the property, higher insurance premiums going forward, and the harder-to-quantify cost of a tenant who no longer trusts the building’s security and either leaves or tells other prospective tenants about it. Treating rekeying as a routine turnover expense, built into the cost of re-leasing a unit, keeps it in proportion. Treating it as an optional expense to skip when things are busy is how buildings end up exposed.
COI and Key Access Documentation
Any locksmith, contractor, or vendor performing rekeying work, or receiving keys as part of their work, on a commercial property should provide a certificate of insurance before that access happens. This isn’t paperwork for its own sake. If something goes wrong during or after the work, the COI is what protects the property.
Pro Locksmith LLC provides a certificate of insurance on request for every commercial job. We’re licensed and insured, our technicians are employees rather than subcontractors, and we quote flat-rate pricing before we start, no surprise charges after the fact.
Coordinating Rekeying with Lease Turnover
The most efficient time to rekey is during the gap between one tenant’s move-out and the next tenant’s move-in, when the unit is empty and there’s no conflict over access. Building this into the standard turnover checklist, alongside things like cleaning and inspection walk-throughs, means rekeying happens automatically rather than depending on someone remembering to schedule it separately.
Properties that manage several units across a building benefit from batching this work when possible, scheduling a locksmith visit that covers multiple vacant units in one trip rather than calling separately for each one. This is worth planning for at lease renewal time too: knowing which units are turning over in a given month lets a property manager schedule rekeying efficiently instead of reacting unit by unit.
Putting It Together
A workable rekeying protocol for a multi-tenant building has three parts: clear triggers for when to rekey, a restricted keyway to prevent unauthorized duplication between rekeys, and a key log that’s actually kept up to date. None of the three works well without the other two. A restricted keyway doesn’t help if you never rekey on turnover. A rekey schedule doesn’t help if the same standard keys can be duplicated at any hardware store the next day.
The building that gets this right isn’t necessarily spending more on security, it’s spending the same money on the right things, at the right time, consistently. That consistency is what actually closes the gap between “we think we know who has keys” and “we know who has keys.”
Pro Locksmith LLC handles commercial rekeying for multi-tenant buildings across Hollywood, Fort Lauderdale, Pembroke Pines, Davie, Pompano Beach, and Coral Springs. We set up restricted key systems, rekey on tenant turnover, and maintain the master key structure so building staff access isn’t disrupted during the process.
Sources: Medeco and Mul-T-Lock restricted key system product literature. Pro Locksmith LLC is an authorized Mul-T-Lock dealer.
Construction Keying During Tenant Buildouts
New tenants rarely move straight into a finished unit. There is usually a buildout period where contractors, electricians, flooring crews and inspectors all need to get in and out. Handing the tenant’s permanent keys to a general contractor at this stage undoes the whole point of rekeying at turnover, because those keys then spread across a crew of subcontractors before the tenant has even opened.
A better approach is construction keying. The unit is fitted with a temporary construction core or a set of construction keys for the buildout. When the work is finished, the construction key is retired, either by swapping to permanent cores or by using cylinders designed to reject the construction key once the permanent key is first used. The tenant then receives a clean set of keys that no contractor has ever held. On buildings with interchangeable cores this is especially simple, since the construction core comes out and the permanent core goes in.
Common Area Doors Deserve Their Own Plan
Individual units get most of the attention at turnover, but the doors shared by everyone are often in worse shape from a key control standpoint. Think about the doors a multi-tenant building has beyond its units:
- Main entrances and after-hours entries
- Rear corridors and loading or service doors
- Electrical, telephone and data rooms
- Roof access hatches and ladders
- Janitorial closets and storage rooms
- Restrooms in older buildings where they are keyed
- Dumpster enclosures and utility gates
Keys to these doors tend to be handed out freely over the years to tenants, vendors and maintenance staff, and they are rarely collected. A useful rule is that common area keys should belong to building staff only, with tenant access to shared entries handled by a tenant key that is set up to open that entry as well as the tenant’s own unit. That way, when a tenant leaves and their unit is rekeyed, their access to the shared doors ends at the same time.
Utility and Telecom Rooms
Electrical and telecom rooms are a particular headache in multi-tenant buildings. Tenants need their internet provider to reach equipment, the power company may need meter access, and contractors come and go. These rooms also hold equipment that affects every tenant in the building. Keying them above tenant level, and requiring vendors to be let in by building staff or through a controlled key box, keeps a single tenant’s contractor from wandering through the building’s infrastructure.
Fire Department Access
Many fire departments ask commercial buildings to keep a rapid entry key box mounted near the main entrance. Firefighters carry a key that opens these boxes, and the box holds keys to the building so crews can get in without forcing doors. When a building is rekeyed, the keys inside that box need to be updated too. A box full of old keys is easy to forget until the day it matters. Include the rapid entry box in every rekeying plan that touches a door whose key is stored there, and confirm with your local fire department what keys they want kept in it.
Tenants Who Change Their Own Locks
Some tenants install their own locks, either because they want control of their space or because a previous problem made them nervous. This can leave building staff unable to reach a unit during a water leak, fire alarm or emergency. Most commercial leases address this by requiring landlord approval for lock changes and a key for the landlord. Where a lease allows it, the cleaner solution is to rekey the tenant’s lock onto the building’s master system under a new change key, so the tenant gets exclusive day-to-day control while the building keeps emergency access through the master.
When a tenant has installed their own lock and then leaves, the lock itself may not fit the building’s system at all. It is worth deciding at move-out whether that hardware stays and gets rekeyed, or comes out and gets replaced with building-standard hardware.
Mailroom and Mailbox Locks
Many multi-tenant buildings have a bank of mailboxes. The master lock that the postal carrier uses to open the whole panel is controlled by the postal service. The individual tenant compartment locks are the building’s responsibility. When a tenant leaves, their mailbox lock should be rekeyed or replaced along with their unit door. It is a small lock that is easy to overlook, and an old mailbox key gives a former tenant a view of the new tenant’s mail.
Communicating With Tenants
A rekeying program works better when tenants understand it. Letting tenants know at lease signing that units are rekeyed at every turnover, that duplicate keys are ordered through management, and that lost keys should be reported promptly sets expectations early. It also reassures prospective tenants that the building takes access seriously, which is a reasonable selling point in a competitive leasing market.
When a building-wide change is coming, such as moving from standard keys to a restricted keyway, give tenants notice, schedule the change by floor or wing, and arrange a clear pickup process for new keys with signatures. Tenants who are caught off guard by a lock change tend to call in a hurry. Tenants who were told ahead of time usually just pick up their keys.
Electronic Access on Shared Entrances
For buildings with frequent turnover, putting shared entrances on electronic access control can cut down the mechanical rekeying load considerably. Tenants and their staff carry cards or fobs for the front door and after-hours entry, and a departing tenant’s credentials are simply turned off. Unit doors can stay mechanical, rekeyed at turnover as described above. This hybrid is common in office buildings and works well in retail centers where tenants share a rear corridor. The mechanical override cylinders on those electronic doors still belong in the master key plan and should be keyed at building staff level only.
Vacant Units Between Tenants
A vacant unit is still part of the building. It should be rekeyed promptly after move-out, not only when the next tenant signs, because empty units attract trespassing, dumping and theft of fixtures. Leasing agents who show vacant units need a way in, but handing them a master key for a single showing is a poor trade. A lock box holding the vacant unit’s key, with a code that changes periodically, gives agents what they need without widening master key distribution.
Auditing an Existing Building
For buildings that have never had a protocol, the first step is an audit. We walk the property, record every keyed door, identify what hardware and keyway each one uses, and note which doors are on the master system and which have drifted off it. Owners are often surprised to find several different keyways, old locks installed by departed tenants, and common area doors that open with a unit key. The audit becomes the roadmap for bringing the building under one plan, usually in phases that line up with lease turnover so the work is spread out and disruption is limited.
Pro Locksmith works with multi-tenant office buildings, retail centers and mixed-use properties across Broward County, north through Boca Raton and Delray Beach and on to West Palm Beach for commercial properties, and south through Aventura, North Miami, Coral Gables and Coconut Grove. To start an audit or set up a turnover protocol, call (954) 406-8266.