How do I properly remove a user from Keystone when he/she leaves?

First, check to see if the user exists here:

General System Administration -> Security/Menus/Access Rights ->
User Maintenance [VALIDATION file] (KF0045).

Do a lookup or enter the User Id directly. If the user is found, update the status to Inactive. 

This not only prevents the user from being able to log in to Keystone Client, but it also inactivates that user's KeyNet record.

If the user needs to continue access to KeyNet for payroll information, click the "KeyNet" button.

(Note: if the user was not set up in the screen above, go to this screen directly: General System Administration -> KeyNet Parameters -> 
KeyNet User Maintenance (KC0054) screen.

• Change the Status to KeyNet.
• You will also want to remove any Roles that are no longer applicable.
  • Typically, you'll want to remove all Financials Roles, and keep only these KEMS Roles: ATTACH, DEMOGRAPHICS, CHECKHISTORY, and EMPTAXINFO.