We have a SharePoint 2007 site that is viewable by "All Authenticated Users". As part of company policy, when an employee is terminated or leaves, we modify their active directory account to remain active for 30 days, with the "deny logon" option selected in order for them to have an opportunity to download their pay stub from another separate web application. This essentially gives them access to web applications, but denies their ability to logon to the network from a computer.
The problem is, this also gives them access to our SharePoint site. We wish to keep this policy, but remove access to SharePoint.
I have looked for "exclusion" permission levels in SharePoint 2007, but they don't exist as far as I can tell. Ideally, it would be nice to place these users in a group that completely denies their access to sharepoint, even though "All Authenticated Users" allows view access.
Is there a way to deny these users to sharepoint?