Here is what we do to inactivate a user.
1) Remove the user from all group and role memberships. Since we manage
context role memberships by group, we just have to removal all group
memberships.
2) Change their e-mail from their now inactive e-mail to an administrative
e-mail address. We used to make the inactive account e-mails null, but we
have found that many workflow robots and other notification processes fail
abnormally when an e-mail account is null, so it is better to have
something than nothing.
3) We append the text " (Inactive)" to the user's full name. For example,
if my active account id is "D12345," my full name is "Anderson, A", and my
e-mail is "aanderson@server.com", then when I leave the company, the
administrators change my account information to id = "D12345," full name =
"Anderson, A (Inactive)", and my e-mail is "windchill_admin@server.com".
Al