Prosecutors cite a kill switch tied to his Active Directory status as the trigger for a companywide lockout.