Comment Fix it (Score 1) 1
Incident response: you're done as soon as you restore his access. The higher-ups made the call to keep him working for the next two weeks. It is not your place to countermand of interfere with that decision. If they wanted his access cancelled, they would have sent him home. Every minute he loses to your behavior is another bit of knowledge that doesn't get transferred to the next guy.
Long term: You have serious problems to address with your backups and business continuity planning. How do I know? Because if your backups were in order you wouldn't have asked. You'd know that you can readily undo any damage the guy might cause.