Also watch out for firewall and /etc/hosts.* entries that may allow the employee direct external access from a fixed IP address (DSL/cable) or using VPN/IPSEC tunnels.

Reset all root passwords, but also passwords belonging to accounts that may be escalated to root (like the wheel accounts on *BSD).