We are a new company and we provision Macbooks for our new employees. We have proper MDM on our roadmap to be rolled out within 6 months, but in the meantime we need to make sure the company's computers are secure, mainly for when employees may terminate employment.
A colleague of mine had an employee who had his Apple ID associated with his work MacBook. He was fired, and upon his departure (so they think) he got on his iPhone, went to Find My iPhone, and remotely wiped the MacBook.
How can we avoid situations like this? I believe we need to set up all MacBooks with 2 accounts - one master Admin-level account, and an account for the employee which does NOT have admin privileges. Would this cover us? How do we ensure that they can't associate their Apple ID to the Mac, such that they can wipe it remotely like that?