The Helpdesk didn't know until after the RIF happened as some of them lost their jobs too. But every fired employee will get some return-labeled boxes shipped over to them, and are asked to pack up their equipment & send them back. Most companies who do these layoffs still count you as an employee for the duration of your severance, and your only real job requirement is to pack up your equipment and drive it to the UPS store.

Towards the end of their severance time, Infosec will run a remote wipe so if their endpoint ever connects to Wifi it'll get nuked. They tend to wait a bit to ensure there's not something on the laptop that needs to be recovered for the company – or the employee says they had some critical personal things on it. Either way the only way they get it back is by sending it back and letting the Helpdesk pull the data.

Worst case, an employee doesn't send stuff back and we write it off. It's really not a big deal. Mandatory FDE + device wipes when a laptop comes online means any data is protected, which is 100% of what we're concerned about. No one cares if an employee gets a "free" MacBook that's a few years old.