Playbook: lost or stolen laptop or phone

First steps

Get the device identifier, owner, time and place last seen, and whether it was powered on or asleep. Check in the device management console whether full-disk encryption was enabled and when the device last checked in. A powered-off, encrypted laptop with a strong pre-boot credential is a very different risk from an unlocked, unencrypted one.

Actions

Issue a remote lock and, depending on policy, a remote wipe through Intune, Jamf, Google endpoint management, or similar. Revoke the user’s sessions and refresh tokens, remove the device from trusted device lists, revoke device certificates used for VPN or Wi-Fi, and reset the user’s password. Retrieve the BitLocker or FileVault recovery key record to confirm escrow, but do not share it.

• Remote lock or wipe
• Revoke sessions, tokens, device certificates
• Reset password
• Confirm encryption status from management logs
• Report theft to police if applicable

Lab: verify encryption reporting

On a lab Windows VM and a lab macOS or Linux VM if available, check encryption status locally, then confirm what your device management console reports for the same device. The exercise shows whether you can trust the console during a real loss.

# Windows
manage-bde -status C:
Get-BitLockerVolume | Select MountPoint,VolumeStatus,ProtectionStatus,EncryptionPercentage
# macOS
fdesetup status
# Linux (LUKS)
lsblk -o NAME,TYPE,FSTYPE,MOUNTPOINT | grep -i crypt
sudo cryptsetup status /dev/mapper/<name>

Assess exposure

If the device was encrypted and locked, data exposure is unlikely, and many privacy regulations treat properly encrypted lost devices more leniently. If it was unencrypted or unlocked, identify which data was stored locally or synced, and involve legal for notification decisions. Record the outcome and any improvements, such as enforcing encryption compliance before granting access.