Why is a user unable to inactivate a Vault Owner who is also a Domain Admin in Vault?
In case the account is the only Domain Admin account available for the vault, a new one should be set in order to inactivate the old one.
To solve this, users can assign a new Domain Admin using the current Domain Admin profile, then use the new Domain Admin to inactivate the old one. If it is not possible or there is no Domain Admin in the active Vault, log a Support ticket and assign it to the Product Operations Team. They handle Domain Admin privilege assignments.
Vault Help Documentation: