Since GateIn 3.7 administrator can temporarily revoke access of a particular user account and mark it as disabled.
User marked as "disabled" cannot authenticate into portal. Attempt to reset the credentials of a disabled user will fail.
Additionally such users won't be listed in many places in the UI - like in user select forms related to security. Those will still appear in the organization management portlet. Administrator can filter and list enabled and disabled users only.
Introducing this feature required storing additional information about user - "enabled" attribute. When migrating from previous GateIn versions this attribute won't be set. Dedicated script is provided that help to migrate the legacy data. Please refer to instructions here
This feature can also be turned off by using "filterDisabledUsersInQueries" configuration switch. It is available in idm-configuration.xml file that can be located in the following path: gatein.ear/portal.war/WEB-INF/conf/organization/idm-configuration.xml