[czhu12]

the problem is that its so challenging to figure out what the person actually has access to. Have they ever done a export with sensitive information, that is now sitting on their local machine? Any important clients they still are in contact with over email that they may try to sabotage? Any other creative endeavors you haven't thought through?

The most fool proof way is just to nuke the computer in its entirety.

[UltraSane]

I once worked at a company where one Active Directory server was storing all passwords in plain text. Just think of the havoc someone could do with a dump of that.