Report a lost business laptop promptly through your organization’s incident process. The first response should identify the correct device, assess its likely exposure, contain relevant access and preserve a record of what happened. Do not wait for proof of misuse before notifying the responsible IT or security contact.
A queued remote-wipe command is not proof that data has been erased. Nor does a password change establish that every application session has ended. Treat device actions, account actions and the information-exposure assessment as separate workstreams.
Give the response owner facts, not guesses
Record when and where the laptop was last seen, when the loss was noticed, its asset tag or serial number if available, and whether it was locked, shut down or in use. Note who used it and which business applications were accessible. Avoid putting passwords, recovery keys or sensitive file contents into an ordinary incident ticket.
| Question | Evidence to seek | If unknown |
|---|---|---|
| Is this the correct device? | Asset inventory, assigned user and a matching serial or device identifier. | Resolve identity before issuing destructive commands. |
| Was storage encrypted? | Current management evidence and the recorded protection state. | Do not mark encryption confirmed from a policy assignment alone. |
| Was management working? | Enrollment state, last successful check-in and action status. | Record the gap and plan for commands that may not arrive. |
| What information was available? | Known local files, synchronized folders, cached application data and accessible accounts. | Ask the user and system owners; do not assume “cloud-based” means no local copy. |
| What access needs containment? | Device, identity, VPN and relevant application session records. | Assign each service an owner to investigate. |
| Who makes response decisions? | Named incident lead and applicable business, privacy or legal contacts. | Escalate through the established organization process. |
Contain access without erasing the evidence trail
Have authorized administrators apply the organization’s device and account containment procedures. Record the action, target, time, operator and observed result. Check relevant application sessions rather than assuming a single identity action covers every service. Microsoft’s guidance explains that applications can maintain their own sessions, so revocation behavior needs to be understood for the services involved. Microsoft: revoking user access.
Keep the lost device’s management record and relevant logs while the incident owner decides what evidence and remote actions are still needed. Premature cleanup can make it harder to track the device or understand the response. If the laptop is recovered, follow IT’s inspection and return-to-service process before reconnecting it to normal work.
Understand what a remote wipe can establish
Microsoft Intune’s wipe behavior depends on platform and selected options; some options preserve information, while others are destructive. The authorized owner must select the action that fits the device, ownership and response requirements. Do not treat similarly named controls as interchangeable. Microsoft: device wipe behavior.
Microsoft also documents that an offline device cannot receive the action until it reconnects and checks in appropriately. A pending command therefore leaves a real uncertainty. Preserve the action status and follow up on completion rather than reporting “wiped” when the command was merely submitted. Microsoft: troubleshooting device actions.
Before a destructive action, the incident lead should resolve evidence-preservation needs and confirm authority over the device. This article does not determine breach-notification obligations; the responsible organizational contacts need the facts about information, access and safeguards to make that assessment.
Close with evidence and a prevention action
A useful closure record separates confirmed facts from unresolved exposure: encryption evidence, last check-in, containment results, wipe status, data assessment and any required follow-up. “No alert was seen” is not the same as evidence that no access occurred.
Use the incident to improve the asset inventory, encryption verification and reporting instructions. Our incident-response overview covers a different threat scenario but reinforces the need for coordinated response. For help reviewing device management and containment readiness, discuss the evidence gaps with TX Computing’s security services.
By mjunaid for TX Computing. Sources checked November 7, 2026. The cover is a generated conceptual illustration, not a customer installation.