When the Employee Leaves and the Laptop Does Not Come Back
Offboarding is not finished when the badge stops working. It is finished when the laptop's disk no longer holds your files.
Departures are ordinary. A laptop that stays in a former employee's apartment is a missing device with a known last user. Treat it that way. Disable the accounts the same day. Wipe the enrolled device the same day. Do not trade a week of "we're sure they'll mail it" for a week of live sessions.
Order of operations
- Suspend identity first: mail, SSO, VPN, admin roles, and any personal phone that was approved for work apps.
- Wipe or lock the assigned laptop and phone if they are enrolled. If they are not enrolled, say so in the ticket. Hope is not a status.
- Recover or remotely remove local admin rights and cached passwords. A wipe is the clean version of that step.
- Record the decision. If personal data was on the device, your privacy process still applies. A resignation does not pause it.
This is the same muscle as a theft in the first hour. The relationship is just less ambiguous. DriveStrike is how Spearstone's customers send the wipe and keep a locate history if the device checks in again. It will not retrieve a laptop from someone's house. It will keep that laptop from remaining a quiet copy of your files.
If offboarding runbooks currently end at "disable Active Directory," contact Spearstone or add DriveStrike before the next departure, not during it.
Keep reading
- The New Year Device Inventory Is a List You Can Wipe
- After Change Healthcare, ePHI Still Sits on Staff Devices
Questions worth answering directly
Should you wipe a laptop you still hope will be returned?
If it holds data you would not want in a stranger's hands, yes. A returned laptop can be reimaged. A laptop that kept your files for a month cannot be un-copied.
Is account disable enough?
It closes the next login. It does not remove files, tokens, and mail already stored on the disk. Wipe is the step that addresses the copy.