There needs to be a logcal, methodical approach to terminating access. Begin with company access, both physical and logical and work from the outside in.

Physical:

-Revoke colocation access

-Building Access keys and swipe cards

-Suite access keys and swipe cards

-(In the case of an unhappy departure) a full audit of existing keys and swipe cards. Deactivating any cards that can't be accounted for and changing locks if you're really worried.

Logical (Assuming you've already disabled the AD account):

Servers:

-Local administrator passwords must be changed

-Checking for 3rd party remote access tools

-Check for additional local admins

-Check for rogue machines that could tunnel out to the internet for remote access

-VPN Access - If not authenticated through AD revoke access. If authenticated through AD check for local accounts (admin or users)

Active Directory:

-Change domain admin passwords (standard)

If the employee may have malicious intent;

     -Change service account passwords

     -Initiate password reset for whole org. (Depending on the size of your org)

Vendors;

-Call vendors and service providers and revoke account access.

-Audit accounts (Cell phones for example) to see if a new account has been added.