On my network (234 devices), I'd find him in 30 minutes (as long as the
network cable was attached), even if he never went on the internet.

All devices on my network are static IP, and I have a DHCP scope of 5
addresses, as soon as one of those 5 ip's answer a ping, I get an alert.

I then query my switches for that IP and in 30 minutes I would be standing
over his shoulder (with walking papers)

When you boot a live CD, if there is a network cable attached, Linux WILL
REQUEST AN IP...

It's always best not to try to bypass the safeguards that are setup in a
workplace (could cost you your job)