Why when I disable a user they still get access to the system.

I have Cognos reporting AD for security. AD Disabled users can still run scheduled reports and they must have permissions from AD.

I got info from ad admin that they must be disabled for 90 days or deleted.

What am I missing?

When we disabled an ad user