To deactivate a technician in a TechIdentityManager system do the following.
Have a manager from your MSP/IT company uses the ManagementConsole to deactivate the technician.
Logon to ManagementConsole
Select the “Techs” page
Click “Deactivate” for the new technician
Within 1 hour of deactivating the technician they will have all their accounts on each domain deactivated. The accounts will not be removed, so that logging and other active directory features will still work, but since the account is deactivated, they will have no access.
Also, in a more complicated setup, the combination of TechGroups, DomainGroups, and RightsGroups that the technician is assigned on the ManagementConsole controls which rights they have on which domains. In this kind of setup, a tech can be removed from a TechGroup to change the permissions on a set of domains, or changes to a DomainGroup can be used to change the group of domains technicians have access.