What do I need to do to prevent them from getting back on?

Hello, this is Emily.

This is very unfortunate. Did you get a pop up or some sort that prompted you to call this company? That's usually how such scam started, and they would tell you a non-existing issue, so that you get worried and allow them to "fix" it.

Since you've let them into your company for hours, honestly, I cannot give you the full scope of what can happen - they could have already taken as many account information as possible that's on your computer records.

First thing first, I suggest you disconnect your computer from the internet just in case they can still remote into your computer. Then backup all of your personal files that are important. Then you want to do a complete factory reset. To reset your computer, hold down Shift key while you choose Windows restart option, then go to Troubleshoot > Reset this PC. Choose the option that deletes everything. The goal here is to get rid of anything they planted in your company.

Then, you need to update your Microsoft account password https://account.live.com > Security. Also make sure you review "Manage how you sign in" in the Security section to see if all contact methods are still correct and up to date, and are yours. Make sure you have two-step verification enabled.

And other accounts you frequent on your computer, your non-Microsoft email address(es), your bank account(s), etc, try to reset passwords for those and if two-factor options are available for those, I recommend you make sure they are all turned on, so that if they have your password, they still need to get access to the verification code sent to your phone to get in.

Speaking of two-steps, I recommend you set up your phone number as alternative way to receive the verification code. I wouldn't reocmmend using an alternative email address to receive the code, just in case they have access to your other email address to receive the code. I hope this makes sense.

All in all, you want to stay vigilant for the next few weeks at least especially on account(s) login activities (not just your Microsoft account, but others too). If you see something unusual, you want to report and take action right away.

I don't know what country you are in. You can report them too. For example, if you are in the USA, you can report to FTC https://www.ftc.gov/business-guidance/small-bus... You might be able to also file a report with law enforcement too.