Lost Laptop Procedure: A Step-by-Step IT Guide
A lost or stolen laptop procedure starts with locking the account and forcing a sign-out everywhere, then triggering a remote lock or wipe through the device's MDM enrollment, both inside the first few minutes after the report comes in. Filing a police report for theft, notifying a manager, and updating the asset register all matter, but they come after the account and the data are secured, not before. The order is the whole point: a procedure that starts with paperwork instead of the remote lock leaves a window open for no reason.
- Lock the account and force a sign-out from every session within minutes of the report, before anything else.
- Trigger a remote lock or wipe through MDM if the device is enrolled; do not wait for a police report first.
- File a report, police for theft, an internal incident log for loss, and record the reference number against the asset.
- Tell security or compliance the same day if the device could hold regulated or customer data, not at the next audit.
- Close the loop by marking the asset lost or stolen in the register and removing its software licenses so seats are not paid twice.
What is a lost or stolen laptop procedure?
A lost or stolen laptop procedure is a written, ordered sequence of actions that runs the moment an employee reports a missing device, so the response does not depend on which IT person picks up the phone or how urgent it happens to feel that day. It covers three things in a fixed order: securing the account and the data, reporting the incident to the right people, and updating the asset record so the device stops being treated as active equipment.
Without a written order, the natural instinct is to ask questions first, when to file a report, was anything sensitive on it, whose fault was it, and lock the account last. That sequence is backwards: every extra minute the account stays open is a minute someone else could be reading email or opening a VPN session from the missing device.
What should IT do in the first hour after a laptop is reported lost or stolen?
The first hour has three phases, and each one has a deadline shorter than it feels like it should need:
| Timeframe | Action | Who does it |
|---|---|---|
| 0 to 5 minutes | Disable the account or force a password reset and revoke active sessions and tokens | IT support, on the call with the employee |
| 5 to 20 minutes | Trigger a remote lock, or a remote wipe if the device holds no active police recovery case | IT support, through MDM |
| 20 to 60 minutes | Notify the employee's manager and, if regulated or customer data may be involved, security or compliance | IT support or the on-call lead |
The account lockout and the remote lock happen in parallel with the employee, not after they hang up. Waiting for a full incident form before touching the account is the most common reason this window gets missed.
Does the response differ for a lost laptop versus a stolen one?
The first hour is identical either way: lock the account, trigger the remote action, notify the right people. What differs is what happens after. A stolen laptop needs a police report, both because some insurers require the report number before paying a claim and because it puts a legal record of the theft on file. A lost laptop usually stays an internal incident: an internal log entry with the date, the last known location and the employee's account, without a police filing unless it later turns out to hold data that triggers a breach notification requirement.
The distinction matters for one more reason: a laptop reported lost that turns up again should be re-enrolled and re-verified before it goes back into use, not just handed back. A device that was out of IT's control for any period, even briefly, should not return to service on trust alone.
How do you remotely lock or wipe the device?
The mechanism depends on what the device was enrolled in when it was issued, which is exactly why enrollment at intake matters more than any step taken after the device is already gone. A laptop enrolled in an MDM platform, whether that is Apple Business Manager with Find My, Microsoft Intune, or a Google endpoint management console, can usually be locked or wiped remotely the next time it connects to the internet, even if it is powered off at the moment the command is issued; the command queues and executes on the next check-in. Apple's own guidance on Activation Lock is a clear example of how a lock survives a factory reset attempt on a lost device, which is the property that actually matters here.
A device with no MDM enrollment and only local disk encryption, BitLocker or FileVault, cannot be remotely wiped; the encryption only prevents the data from being read, it does not reach a device that is already out of contact. That gap is the strongest argument for making MDM enrollment mandatory at issuance rather than optional, covered further down.
In InventorIA, a device synced from Microsoft Intune shows a "Managed by Intune" badge on its asset record, so whether a specific laptop is enrolled does not require a separate lookup in the MDM console.
Do you need to file a police report for a stolen laptop?
Yes, for theft, and the report number should be recorded on the asset's incident history, not just kept in an email thread. Two reasons make the filing worth the time even when recovery is unlikely: most business insurance policies that cover stolen equipment require a police report number before they will process a claim, and a filed report is the difference between an internal suspicion and a documented incident if the device resurfaces in a way that matters legally.
A lost laptop, with no evidence of theft, does not need a police report by default. Filing one anyway rarely changes the outcome, and treating every loss as a theft report inflates the paperwork without adding protection where the actual risk is the data, not the hardware.
Who else needs to know a laptop is lost or stolen?
Three people or teams beyond IT support have a real stake in the incident, and each has a different reason to be told:
- The employee's manager, so the loss is on record for the team and a loaner or replacement request does not come as a surprise.
- Security or compliance, the same day, if the device could plausibly hold regulated data, customer records, or credentials with standing access to production systems. Whether the incident becomes a reportable breach is their call to make, not IT's, but they cannot make it without being told promptly. The FTC's data breach response guide is a plain description of why the clock on notification starts at discovery, not at confirmation of harm.
- Finance or procurement, once a replacement device is requested, so the cost is tracked against the right budget line instead of appearing as an unexplained purchase later.
How do you close the loop in the asset register?
The incident is not closed when the account is locked, it is closed when the register matches reality. That means four updates on the same day, not at the next audit: mark the device's status as lost or stolen rather than deleting the record, so its history stays queryable; remove or reassign its software licenses, the same check covered in finding unused SaaS licenses, so a missing laptop does not keep a paid seat open indefinitely; record the incident date and reference number against the asset; and open a replacement request that follows the same lifecycle policy used for a planned refresh, so the new device is not an off-policy exception. A register that reflects this the same day is the difference between a five-minute lookup at the next audit and a re-survey of the whole fleet; see how that register looks in practice at a free InventorIA account.
How do you prevent the next one?
None of these remove the risk of a laptop going missing, but each one shortens the response window or lowers what is actually exposed when it happens:
- Full-disk encryption enabled and verified at issuance, not assumed because the operating system supports it
- MDM enrollment mandatory for every laptop before it leaves IT, no exceptions for executives or contractors
- A screen lock timeout under five minutes, so a laptop left unattended for a short window is not an open session
- An asset tag or engraved serial number, which meaningfully raises the odds of a lost device being returned rather than kept
- A standing rule against leaving a laptop visible in a parked car or checked in airline luggage, two common ways a laptop goes missing
Frequently asked questions
What is the first step when an employee reports a lost or stolen laptop?
Lock the account and revoke active sessions immediately, while still on the call with the employee. Everything else, the remote wipe, the report, the register update, follows in the same hour but the account comes first.
Do I need to file a police report for a stolen company laptop?
Yes. Most insurance policies covering stolen equipment require the report number before paying a claim, and it creates a documented record of the theft. A laptop that is simply lost, with no sign of theft, does not need one by default.
Can you remotely wipe a laptop that is turned off?
Yes, if it is enrolled in an MDM platform. The wipe command queues and runs automatically the next time the device connects to the internet, even after being off for a while. A device with no MDM enrollment cannot be reached this way.
How long should the whole lost or stolen laptop procedure take?
The account lock and remote wipe happen inside the first twenty minutes. Notification and the police report, where needed, happen within the same day. Closing the asset register update should also happen the same day, not at the next audit.
Track a device's status without losing its history
Keep every laptop's serial number, assigned owner and lifecycle history in one record, so you always know what was lost and who held it.
Try the live demo →