How to remotely lock and locate a lost or stolen company laptop

Summary

This guide helps you troubleshoot and resolve: How to remotely lock and locate a lost or stolen company laptop. Follow the steps below to fix the issue.

Common Causes

If a company laptop has been lost or stolen, acting quickly is essential to protect sensitive business data. Most modern operating systems include built-in tools that allow you to remotely lock, locate, or wipe a device. This guide walks you through the available options for Windows and macOS laptops enrolled in Microsoft Intune, as well as consumer-grade tools like Find My Device and Find My Mac.

If you suspect the device has been stolen, also report the incident to local police and notify your manager or IT contact at 220 as soon as possible.

Before You Begin

To use any of the remote actions described below, the laptop must meet these prerequisites:

• The device was powered on and connected to the internet at least once after being lost.
• The device is signed in with a work or personal Microsoft account (Windows) or Apple ID (macOS).
• Location services were enabled before the device went missing.
• For managed company devices, the laptop must be enrolled in Microsoft Intune through 220's endpoint management.

Option 1: Remotely Lock a Windows Laptop via Microsoft Intune

This is the recommended method for company-issued Windows laptops managed by 220.

1. Open a web browser and navigate to intune.microsoft.com, then sign in with your administrator credentials.
2. In the left-hand menu, select Devices, then click All devices.
3. Locate the missing laptop using the search bar or filter by device name, user, or serial number.
4. Click on the device name to open its overview pane.
5. From the top toolbar, click Lock.
6. If prompted, set a new sign-in PIN or passcode that the user must enter to unlock the device.
7. Click OK to confirm.

The device will be locked the next time it connects to the internet. The user will need to enter their sign-in credentials to regain access.

Locating the Device in Intune

Intune does not provide real-time GPS location tracking for managed devices. To view the last known location of a Windows laptop, use Find My Device (see Option 2) if the device is signed in with a Microsoft account, or check the device's Last check-in date and time in the Intune device overview pane for an indication of when the device was last online.

Option 2: Remotely Lock a Windows Laptop Using Find My Device

If the laptop is not enrolled in Intune but is signed in with a Microsoft account, you can use Find My Device.

1. Go to account.microsoft.com/devices and sign in with the Microsoft account on the missing laptop.
2. Select the Find My Device tab.
3. Choose the missing laptop from the list of registered devices.
4. Click Find to view its approximate location on a map.
5. Click Lock to remotely secure the device with a new password.
6. Follow the prompts to set a new password and add a recovery message and contact phone number if desired.

Option 3: Remotely Lock or Wipe a macOS Laptop Using Find My

For company MacBooks, use Apple's Find My service.

1. Visit icloud.com/find from any browser, or open the Find My app on another Apple device.
2. Sign in with the Apple ID associated with the missing MacBook.
3. Click All Devices, then select the missing MacBook from the list.
4. To lock the device, click Mark as Lost. You will be prompted to create a passcode if one isn't already set, and you can display a custom message with contact details.
5. To erase the device, click Erase Mac. This will permanently delete all data, but Activation Lock will remain in place, preventing reactivation without the Apple ID.

Option 4: Remotely Wipe a Windows Laptop via Intune

If the laptop cannot be recovered and contains sensitive business data, a full wipe may be necessary.

1. In the Intune portal, navigate to Devices > All devices.
2. Select the missing laptop.
3. From the top toolbar, click Wipe.
4. Choose Retire to remove company-managed data and apps while leaving personal data intact, or Wipe to perform a full factory reset that removes all data, apps, and settings.
5. Click Yes to confirm.

The wipe command will be queued and executed the next time the device connects to the internet.

After the Device Is Secured

Once you have locked or wiped the device, take the following steps to protect your organisation:

• Reset the password for the user's Windows login and any associated Microsoft 365 or company accounts.
• Revoke any active sessions or sign-in tokens for the affected user.
• Notify relevant stakeholders, including management and any clients whose data may have been on the device.
• If the device was stolen, file a police report and provide the serial number, last known location, and any other identifying details.
• Document the incident for your records and review your organisation's security policies.

Still Having Issues?