Of course you can. The moment his account is deactivated, he should not be able to access any machine in the system. Unless of course, he installed proactively

Of course you can. The moment his account is deactivated, he should not be able to access any machine in the system. Unless of course, he installed proactively backdoors, which is a criminal offense, at least here in Germany. And with a proper setup, he should not get random remote access.