Remote Lock and Wipe for Lost Phones and Laptops

When a phone or laptop goes missing, the data and the signed-in accounts on it are usually worth more than the device, and the tools that can lock or erase it remotely only work if they were switched on before the loss. This guide explains, in plain English, how to lock, locate and erase a lost iPhone, iPad, Mac, Android phone or Windows PC using the free tools from Apple, Google and Microsoft, what each tool needs to be in place first, and when to erase rather than wait. The second half is for IT teams: the remote lock, wipe and selective wipe actions in a device management service such as Microsoft Intune, Activation Lock on company-owned Apple devices, and the controls that stop remote wipe itself being turned into a weapon. For the incident process around a loss (intake, breach assessment, police reports, records), use the Lost or Stolen Device Response Checklist; this page covers the lock and wipe tools in depth.

Key takeaways

Set it up before you need it. Find My on Apple devices, Find Hub on Android and Find my device on Windows all have to be turned on, and signed in, before the device is lost; afterwards it is too late.
Lock first, erase second. Locking (Lost Mode on Apple, Secure device on Android, Lock on Windows) keeps your options open and keeps the device findable; erasing cannot be undone and, on Android, removes the phone from Find Hub.
A lock is only as strong as the passcode. Microsoft notes that remote lock on a device with no passcode set may simply turn the screen off; encryption plus a strong passcode is what actually protects the data.
Offline devices act later. An erase sent to a device that is switched off or out of signal runs the next time it connects, so also change passwords and sign out sessions straight away.
Remote wipe is a privileged action. One compromised administrator can erase a whole fleet, as the Stryker attack in 2026 showed; require a second approver for wipes and limit who can send them.

What to switch on now, before anything is lost

Device	Feature to turn on	What it needs	Where you use it from
iPhone, iPad, Mac	Find My (turning it on also enables Activation Lock)	Signed in with an Apple Account; two-factor authentication is required to erase remotely	Find My app on another Apple device, or icloud.com/find
Android phone or tablet	Find Hub (previously Find My Device)	Power, Wi-Fi or mobile data, signed in to a Google Account, Find Hub on, visible on Google Play	Find Hub app, or google.com/android/find
Windows 10 or 11 PC	Find my device	Signed in with a Microsoft account, location turned on, the account must be an administrator on the PC	account.microsoft.com/devices
Company-managed device	Enrolment in your organisation's device management service	Enrolled by IT; a passcode policy enforced	Your IT service desk

Two more settings matter as much as the tracking feature. A screen lock with a six-digit or longer passcode, and full-disk encryption, which modern phones turn on with the passcode and laptops provide through FileVault or BitLocker (see the Disk Encryption Guide: BitLocker and FileVault). Write down, somewhere other than the device, how to sign in to your Apple, Google or Microsoft account without it: if your only second factor is on the lost phone, you can lock yourself out at the worst moment. See the Personal Account Recovery Planning Guide.

Your phone or laptop is missing: step by step

Locate it. Sign in from another device. Apple's Find My can show the last known location for up to seven days if the battery has died; Google's Find Hub shows the last known location if the current one is not available.
Lock it and add a contact message. On Apple devices, choose Lost Mode in Find My: it locks the device with your passcode, suspends Apple Pay cards and passes, and can show a phone number on the lock screen. On Android, use the secure option in Find Hub. On Windows, select Lock at account.microsoft.com/devices, then reset your Microsoft account password as Microsoft advises.
If it was stolen, do not go and get it. Give the location to the police instead.
Protect your accounts. Change the passwords for your email, Apple, Google or Microsoft account and banking apps, and sign out all other sessions. This matters even if the device is offline, because an erase or lock may not arrive for hours.
Call your mobile network. Ask them to block the SIM so the number cannot be used to receive your text message codes.
Decide whether to erase. Erase when you are confident you will not get it back, when the device held sensitive work data, or when it had a weak or no passcode. Apple calls erasing a last resort and warns that it cannot be undone.
Erase. On Apple, choose Erase This Device in Find My or at icloud.com/find. On Android, choose the erase option in Find Hub. Windows Find my device does not offer an erase option for personal PCs; a work PC can be wiped by IT.
Keep the device on your account. Apple states that Activation Lock stays on after a remote erase, so your Apple Account password is needed to reactivate the device, and Google states your Google Account password is needed to use an erased Android device again. Leave the device linked to your account so that protection stays in place against a thief.

What erase does on each platform

Platform	If the device is offline	After the erase	Stopping it
Apple (iPhone, iPad, Mac)	The erase starts the next time it is online	Activation Lock stays on, so your Apple Account password is needed to reactivate it; on iOS 15 or later it can still be found in Find My	Stop Erase Request in Find My, before it connects, using your Apple Account password
Android	Needs power and a connection to act	All data deleted, but Google warns SD cards may not be; the device disappears from Find Hub; your Google Account password is needed to use it again	Not reversible once run
Windows (personal)	Lock acts when online	No consumer remote erase; rely on BitLocker encryption and a strong sign-in	Not applicable

Remote lock and wipe for organisations

Device management services send the same platform commands, with more control over what is removed. Microsoft Intune is used below because its documentation is specific; other services such as Jamf, Google endpoint management or Workspace ONE send equivalent Apple and Android management commands.

Action (Intune name)	What it does	Use it when	Watch out for
Remote lock	Locks the device; the user needs the existing passcode or PIN. Does not wipe or unenrol	Device reported missing, first response	Only effective if a passcode is set. Generates a six-digit recovery PIN shown for up to 30 days; record it securely
Wipe (no options)	Factory reset that removes user data, settings and management policies (CSP node doWipe)	Corporate device lost or stolen and unlikely to return	On Windows, an interrupted wipe tries to roll back and may need a reinstall
Wipe, keep enrolment state and user account	Reset that keeps user files and the enrolment (doWipePersistUserData)	Troubleshooting, not a lost device	Leaves user data in place: never use it for theft
Wipe and continue even if the device loses power	Deletes all data, overwrites free space and keeps going through power loss (doWipeProtected)	Corporate Windows devices that need full data destruction	Microsoft warns it can leave some devices unbootable; have a recovery procedure
App selective wipe	Removes company data from apps protected by Intune app protection policies, leaving personal data	Personally owned phones (BYOD) not fully enrolled	Runs when the user next opens the app, which Microsoft says may take up to 30 minutes after the request
Managed Lost Mode (supervised iPhone and iPad)	Logs the user out, locks the device, shows a message; admins can request location even with Location Services off	Company iPhone lost but possibly recoverable	Only an administrator can turn it off

Platform details that catch teams out

macOS Recovery PIN: Intune requires a six-digit Recovery PIN to wipe Macs without a T2 chip, and the PIN is not visible after the wipe. Apple silicon and T2 Macs, or Macs with FileVault on, can be erased instantly because the media key is discarded.
Obliteration Behavior: sets the fallback on Macs if Erase All Content and Settings fails (Default, Do not obliterate, Obliterate with warning, Always obliterate).
Android Factory Reset Protection: Intune's admin wipe does not preserve reset protection data by default, so the Google account may be required after reset; plan how devices return to service.
Samsung fully managed devices: if the Factory Reset device restriction is set to Block, the wipe can fail and the device loses contact with Intune.
ChromeOS: deprovision the device first, or it re-enrols once it reaches Wi-Fi.
eSIM plans: preserved by default on iOS and Android Enterprise wipes; select the option to remove the data plan if the line should not remain usable.
Apple User Enrollment: Apple's platform documentation states remote wipe is not possible on devices enrolled through User Enrollment, the model used for personal devices. Use app-level controls there.
Volume limits: Intune allows up to 500 Wipe actions per tenant per day across the portal, bulk actions and the Graph API, which is a safeguard but also a ceiling to know before a mass incident.

Activation Lock on company Apple devices

Activation Lock is helpful on a stolen personal iPhone but painful on a returned company one if the leaver's Apple Account is still attached. On supervised devices, Apple's documentation states Activation Lock is disallowed by default; a device management service can allow it and escrow a bypass code, or enable it server-side with a unique 31-byte bypass code per device. Organisations using Apple Business can turn off Activation Lock on organisation-owned devices registered before the lock was enabled. Supervise company devices through automated enrolment so you hold the bypass code, not the user. See the Mobile Device Management Security Guide.

Deciding between lock, selective wipe and full wipe

Company-owned, encrypted, passcode set, possibly misplaced: remote lock or Managed Lost Mode, revoke sessions, and wait a defined period (for example 24 to 72 hours) before full wipe.
Company-owned, stolen, or held highly sensitive data: lock, revoke sessions and wipe as soon as theft is confirmed.
Personally owned (BYOD): app selective wipe of company data; never a full wipe of a personal phone unless the user has agreed in writing in your BYOD policy. See the BYOD Policy Template.
Small organisation without device management: rely on the consumer tools on each device, enforce a passcode and encryption by checklist, and keep a list of which accounts each device was signed in to.
Large fleet: pre-approve the decision matrix, put wipe behind a second approver, and rehearse the process.

Where identity fits

A wipe removes data on the device; it does not invalidate tokens that were already copied or are still valid elsewhere. Revoke the user's sessions and refresh tokens in your identity provider, remove the device's registration, and rotate any credentials the device held: VPN certificates, Wi-Fi certificates, SSH keys, developer tokens and cached passwords for shared or service accounts. A developer laptop is a store of non-human identity secrets as well as personal ones. See the Entra Primary Refresh Token Security Guide and the OAuth Token Introspection and Revocation Guide.

Securing remote wipe itself

The power to erase every device is one of the most destructive permissions in an organisation. In March 2026 an attacker who obtained administrator access at Stryker used Microsoft Intune's own remote wipe command to erase tens of thousands of devices, including employees' enrolled personal phones; no wiper malware was needed. See the Stryker Intune wiper attack 2026.

Multi Admin Approval: Intune access policies can require a second administrator to approve device wipe, retire and delete actions, as well as scripts, apps and role changes. Admins cannot approve their own requests, approved requests expire after three days, and Intune sends no notification, so agree a contact route with approvers. The policy also applies to app-only Microsoft Graph calls, which matters for automation identities.
Least privilege: give service desk staff remote lock (built-in Help Desk Operator includes it) but reserve wipe for a smaller group; use scope tags so no single role covers the whole fleet.
Just-in-time admin: no standing Intune Administrator or Global Administrator assignments. See the Microsoft Intune Guide.
Automation identities: review app registrations and service principals holding device management Graph permissions; each one can wipe without a human.

Detection and measurement

Audit logs: alert on any wipe, retire or delete action, on bulk device actions, on Multi Admin Approval policy changes and on new Intune or Global Administrator assignments.
Volume anomaly: more than a handful of wipes in an hour outside a planned refresh is an incident until proven otherwise.
Lost device tickets: correlate with sign-ins from the lost device after the report time.

Metric	Target
Devices with find and remote lock capability enabled (enrolled or tracking on)	100% of company devices
Devices with passcode and full-disk encryption verified by compliance policy	100%
Median time from loss report to lock and session revocation	Under 1 hour
Wipe actions protected by second-approver control	100%
Lost devices with confirmed wipe or recovery within the decision window	Tracked per quarter

Rolling it out

Inventory: list every device type and who owns it; mark which can be locked and wiped today.
Baseline policy: enforce passcode and encryption by compliance policy; enrol company Apple devices as supervised.
Pilot actions: test lock, wipe and selective wipe on spare devices of each platform, including an offline device and a Mac needing a Recovery PIN.
Protect the action: turn on Multi Admin Approval for device wipe, test that a request needs approval, and document the emergency route.
Publish the user steps: tell staff exactly who to call and that early reporting is never punished.
Rollback: an Apple erase request can be stopped before the device connects; Intune approvals can be rejected; there is no rollback once a wipe runs, which is why the approval step comes first.

Common failure patterns

Tracking never switched on: the device is lost and nothing was enabled; enforce it at setup.
Locking a device with no passcode: the lock does little; enforce a passcode before relying on remote lock.
Removing the device from the account too early: unlinking a stolen device you still own works against the account-based reactivation protection described above.
Wipe without session revocation: tokens copied before the wipe keep working; revoke them separately.
Unprotected wipe permission: one compromised administrator erasing the fleet, as at Stryker.
Losing the Recovery PIN: remote lock and Mac wipe PINs are only visible for a limited time; store them in the ticket.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev. 5	AC-19 Access Control for Mobile Devices; SC-28 Protection of Information at Rest; MP-6 Media Sanitization	Mobile device controls, encryption, wipe as sanitisation
NIST CSF 2.0	PR.DS-01 data at rest protected; PR.AA-05 access permissions managed with least privilege	Encryption and limiting who can wipe
CIS Controls v8.1	Safeguard 4.11 Enforce Remote Wipe Capability on Portable End-User Devices; 4.10 Enforce Automatic Device Lockout	Direct requirement for remote wipe and lockout

Practitioner checklist

Enforce Find My, Find Hub or enrolment on every company device at setup.
Enforce passcode and full-disk encryption through compliance policy.
Supervise company Apple devices and escrow Activation Lock bypass codes.
Publish a one-page "lost device" instruction for staff with a 24-hour contact.
Lock first, revoke sessions and credentials, then wipe per a pre-agreed decision window.
Use app selective wipe, not full wipe, on personal devices.
Require a second approver for wipe, retire and delete actions.
Alert on wipe volume, admin role changes and approval policy changes.
Record recovery PINs in the incident ticket.
Test lock and wipe on each platform at least once a year.

Remote lock and wipe for lost phones and laptops: Step by step for home and work