General System Administration -> Security/Menus/Access Rights -> User Maintenance [VALIDATION file] (KF0045) -> Enter the User Id -> Update the status from Active to Inactive.
This not only prevents the user from being able to log in to Keystone Client, but it also inactivates that user's KeyNet record. If the former employee needs access to KeyNet for payroll information, click the "KeyNet" button. Then, on the KeyNet User Maintenance (KC0054) screen, change the Status to KeyNet.