Protect · Playbooks · At work

A work laptop is lost or stolen

Last updated 2026-10-14 · Written with AI assistance, reviewed by a person

Laptops get left in taxis, stolen from cars, forgotten at airports. It happens to everyone eventually. With a few quick steps, a missing laptop is usually an inconvenience rather than a data breach. Report it right away, then protect the accounts while IT checks encryption, remote controls plus what was on it. Don't wait until tomorrow to see whether it turns up.

This covers any laptop with work information or access to work accounts, including a personal laptop used for work.

Who does what. The person who lost it reports it, then answers IT's questions. Whoever runs IT handles accounts plus remote actions. The owner decides about wiping, insurance, notifications. Only take actions you're authorized to take, and follow your vendor's current instructions where they differ from ours.

Do this now

For the person who lost it, or the owner:

1. Get somewhere safe. Don't confront anyone, or go to a location on a map to get it back. For a theft, call the local police, then give them any location information.
2. Call IT on a number you know, then give the owner a heads-up. Use another phone or device: don't wait until you can get into your work email.
3. Describe its last known state. Was it shut down, asleep, screen-locked or open? When, where did you last have it? Did a phone, security key, USB drive, written password or recovery key go with it?
4. Call the likely location's lost property or security desk (office, hotel, airport, car service), while the security steps carry on.
5. Let IT run the remote actions. Don't remove the laptop from management or an account, or trigger an erase yourself, without telling whoever's leading. Those can get in the way of recovery, or destroy information.

No IT support? From a trusted device, contact your email provider's business support, then secure your work accounts through their official websites. If Find My (Mac) or Find my device (Windows) was set up beforehand, use it to mark the laptop lost or lock it. These features can't be added after it's gone. [1] [2]

For whoever runs IT

Identify the exact device by serial number or asset tag, plus who it's assigned to. Before changing anything, record its encryption status, last check-in, management enrollment, linked accounts. Keep the management record.

Start protecting accounts straight away, then check which remote actions are available. A queued lock or wipe isn't proof the laptop received it.

How serious is it?

Every missing laptop needs a response. These facts set how urgent:

Encryption protects stored data under specific conditions. A policy that says "encryption required" isn't evidence this laptop was encrypted when it went missing. Check the device's own most recent status, plus how old that status is. BitLocker is designed to protect lost or stolen Windows devices, but how well depends on configuration plus device state. [3] [4]

Protect business accounts

Whoever runs IT, from a trusted device:

• Revoke the user's sessions plus relevant app tokens: email, cloud storage, VPN, password manager, key business apps.
• Block the missing device where you can. In Microsoft Entra ID, disable the device (don't delete it) to stop it using device-based sign-in. A central block may not sign out every app, or stop offline access. [5] [8]
• Reset passwords that were exposed or might be reachable. Revoke exposed keys or certificates. Start with admin accounts, email, finance, anything reachable from the laptop.
• Can't isolate the device's access, or seeing misuse? Temporarily block the user's account while you investigate. Arrange a safe way for them to keep working.
• Watch sign-ins, downloads, admin activity from now on. Investigate anything unexpected, but don't treat a location alone as proof of misuse.

Central session revocation can take time, and connected apps can keep their own sessions: check them separately. A cloud password change doesn't erase files on the laptop, or necessarily stop a cached offline sign-in. [5]

Phone, security key or recovery codes lost too? Revoke or disable those sign-in methods straight away. Don't leave a lost authenticator working while a replacement is arranged. If safe recovery isn't ready, block the account temporarily, then use the admin recovery process. Confirm the person's identity independently before setting up new methods. Never send recovery details to an account the missing laptop can still reach.

Seeing misuse? Run A work email account was hacked alongside this one. Getting the laptop back won't undo access someone already set up elsewhere.

Use the remote controls you actually have

Managed with Intune or another MDM

Open your device management console, select the verified device, then check which actions its platform plus enrollment support. Use lock or lost mode where that's available. Decide about wiping with the authorized owner, or under your incident policy.

In Microsoft Intune, available actions depend on platform, enrollment, permissions, connectivity. Check each action's status rather than assuming "submitted" means "done". Deleting a device record doesn't remove anything from the laptop. [6]

Wipe, retire, delete are different operations. Confirm exactly what each removes. For a full Intune wipe meant to remove sensitive data, don't choose the option that keeps user data. Wiping is destructive: it can remove personal files as well as work ones. [7]

Keep the management channel open, so the command can actually reach the laptop. Microsoft recommends finishing the wipe or retire before you delete a managed device's identity. [8]

Windows has no Intune remote lock. Intune's Remote lock action supports iOS, iPadOS, macOS plus Android Enterprise, not Windows. Don't promise a remote screen lock for a managed Windows laptop: use access restrictions, then a suitable wipe once authorized. On platforms that do support Remote lock, check its passcode requirements, then store any recovery PIN it generates securely. [10]

A Mac with Find My already on

Use the Find My app on another trusted Apple device, or iCloud Find Devices. Select the verified Mac, then use the lock option. Lock plus erase take effect when the Mac is online. A rough location isn't proof of who has it. [1]

Coordinate Find My with your management process. Don't remove the Mac from Find My as a cleanup step: that turns off Activation Lock. If you erase it, check Apple's current model-specific guidance first. [9]

Windows with a personal Microsoft account

Microsoft's Find my device needs to have been set up beforehand, with a personal Microsoft account. It doesn't work for work or school accounts. If it's available, use the official account device page to locate or lock the laptop. Don't assume every Windows laptop has it.

Nothing set up

Write down that remote lock or wipe isn't available. Carry on with the account steps, the police or lost property reports, plus the data assessment. Don't install an unknown "tracking" service, or give anyone credentials in exchange for a promised recovery.

Keep the device status separate from the account status. A cloud sign-out can't remove offline data. Remote lock may not help if the holder knows the password. A console accepting a command doesn't prove the erase finished. Ask your vendor what each reported status actually confirms.

Should you wipe it?

The owner, or incident lead, decides with IT, then records the decision. Don't wait for a full investigation if the exposure calls for urgent action, but confirm the device and your authority first. Consider:

• How likely is a quick, controlled recovery? (Say, it's confirmed at your own office's security desk.)
• Was sensitive information stored on it? Is encryption confirmed?
• Was it open, or were keys or passwords taken with it?
• Does the chosen command actually remove the data for this device plus enrollment type?
• Are the work files backed up? What would be lost for good?
• Is it personal hardware? What does your work-device agreement allow?
• Would wiping interfere with an investigation, or a legal duty to preserve data? Involve your adviser quickly if so.

A personal laptop: remove managed work data where supported. A full wipe needs clear authority or the owner's agreement. Not being able to wipe it never stops you cutting off business access.

Record the action, approver, reason, time sent, actual status. If the laptop is offline, the local data exposure is still open. Even a completed wipe can't recall files someone already copied.

What information was at risk?

The owner with IT.

Ask the employee about files saved or synced locally, email caches, browser downloads, exported customer lists, accounting data, source code, saved passwords. "Everything's in the cloud" doesn't mean there were no local copies.

Check the rest of the bag: external drives, paper records, other devices. Assess each one on its own. Laptop encryption doesn't protect an unencrypted USB stick sitting beside it.

If sensitive information might be exposed, bring in the owner plus your incident, insurance or legal support to assess notification duties. Many US state breach laws treat encrypted data differently, but usually only if the key wasn't exposed too. Check whether the disk recovery key was kept with the laptop, or in an account that may be compromised. A key in your records proves recovery material exists, not that encryption was switched on at the time. Keep confirmed facts separate from assumptions.

If it turns up

Don't reconnect it to company systems, or hand it straight back.

Tell IT first. Confirm the serial number, plus how it was recovered. Check for pending lock or wipe commands before it connects: a queued erase may run the moment it comes online, and you may not be able to cancel it on every platform.

IT should look for signs of tampering, then decide whether it needs examining or rebuilding. Keep it off normal networks until then. A laptop held the whole time by your own security desk needs less scrutiny than one handed in by a stranger.

Restore access deliberately. If the BitLocker recovery key could have been exposed, rotate it. [11] Record the return-to-service decision. Don't undo the account clean-up just because the laptop is back.

Get them working again, then close it

Give the employee an approved replacement: updated, with endpoint protection, verified encryption, management enrollment. Restore files from business backups or approved cloud storage. Confirm they can reach what they need, then ask them to report anything suspicious.

• The missing device is identified, with its status recorded.
• Sessions, device access, exposed sign-in methods are dealt with.
• Remote actions have confirmed results, or a named owner for anything unresolved.
• Local data exposure plus notification questions have been assessed.
• Police, property, provider, insurance references are kept where they apply.
• Any replacement or recovered device has a recorded return-to-service decision.
• Follow-up monitoring plus open work have an owner with a deadline.

Keep a restricted incident record. Never put recovery keys or passwords in routine updates. Keep device records plus recovery material as your policy says. Don't remove controls that may still protect or recover the device just to close the ticket.

Check again on account activity plus remote command status the next business day, then within a week. Watch longer if there's evidence of misuse.

Before the next one

• Check encryption across every laptop, with recovery keys stored separately from the laptops.
• Keep an accurate asset list: serial numbers, owners, enrollment.
• Test remote lock plus wipe on a spare device, so you know what really happens.
• Sensible screen-lock settings, with two-step sign-in on important accounts.
• One easy way to report a loss, with a clear message: report it immediately, no blame.
• Make sure backups cover the work that would otherwise disappear with a laptop.

Sources

Checked October 14, 2026. Remote features vary by hardware, operating system, enrollment, subscription, connectivity. This playbook follows NIST SP 800-61 Rev. 3 for incident response, with the product guidance below. It's checked against documentation, not yet tested against a live device management environment.

1. Apple: If your Mac is lost or stolen
2. Microsoft: Find and lock a lost Windows device
3. Microsoft: BitLocker overview
4. Microsoft: BitLocker countermeasures
5. Microsoft Entra: Revoke user access in an emergency
6. Microsoft Intune: Device actions
7. Microsoft Intune: Wipe devices
8. Microsoft Entra: Manage device identities
9. Apple: Erase a device in Find My
10. Microsoft Intune: Remote lock
11. Microsoft: BitLocker recovery overview

Related playbooks

• A work email account was hacked
• Someone is leaving the organization
• Our files are locked, or there's a ransom note