Company laptop lost or stolen? What to do right now

Can a company brick a stolen laptop?

Usually not the hardware itself. There are three levels (this article covers Windows laptops):

• Remote wipe. If the laptop was enrolled in a tool such as Intune, an administrator can erase it. The command waits until the laptop is on and online. Microsoft’s current list of Windows actions includes wipe and locate, but its remote lock covers phones and tablets, not Windows PCs.
• Company sign-in after a reset. If the laptop was registered to your company with Windows Autopilot, a reset or reinstall usually brings back your company’s sign-in screen once it’s online. That makes resale harder. It’s a speed bump, not a lock.
• A firmware lock. Bricking the laptop, so it won’t start even with a new drive, takes a firmware-level anti-theft service. Many business laptops, Lenovo ThinkPads among them, ship with a module for one built in, which does nothing unless the company activates it with a subscription before the theft.

What to tell your IT contact, and why

Tell them four details, because each decides a next step.

• Which laptop: lets them find it in the device list.
• When it was last seen: sets how far back to check sign-ins.
• Whether it was signed in: tells them how urgent the sign-out is.
• What was on it: decides whether to wipe now or check the files first.

The account steps, in order

Your IT contact, or you with them, works through these in order:

1. Reset the owner’s passwords, starting with their work email and their Microsoft or Google account.
2. Sign them out everywhere. Signing out matters because a stolen laptop can stay signed in even after a password changes. In Microsoft 365, an administrator can revoke their sessions in the Microsoft Entra admin center, though apps already signed in can keep access for up to an hour, and some for longer.
3. Review which devices and apps are approved for the account.

What none of these can do

• Be added afterward. Enrollment, encryption, and activation all happen before the laptop is gone.
• Reach a laptop that stays offline. A thief who never connects it never gets the wipe. Encryption is what protects the data then.
• Get the laptop back. Location is approximate and only works if location was turned on. Plan on replacing the laptop.

Why encryption matters more than the wipe

If the drive is encrypted with BitLocker or Device encryption and the laptop needs a sign-in, a thief can’t read your files, even by pulling the drive. They can still erase it and resell it. That’s why the data decides how bad this is: a laptop can be replaced, but customer records and passwords can’t be taken back. It only holds if the recovery key isn’t with the laptop, so keep every key in your company account. See how to encrypt a work laptop.

Wipe now, or wait to see if it turns up?

If its files are also in OneDrive or a backup, send the wipe; it costs nothing you can’t get back. It feels like a choice between the files and the risk, but that assumes the laptop holds the only copy. If some files existed only on that laptop, the wipe erases them too, so ask which loss is worse. An unencrypted laptop with customer records in a thief’s hands is usually the worse one.

Set up before the next one

Start with enrollment: every option above waits on setup done before the laptop goes missing.

• Check what you already have. Microsoft 365 Business Premium includes Intune, so you may already have remote wipe.
• Make enrollment automatic. Ask whoever sells you laptops to register them to your company with Windows Autopilot, so new laptops join management at first sign-in, without anyone remembering to.
• Check where the facts live. In the admin center, compare the device list with the laptops you actually have, and check that each shows as encrypted. Having the license isn’t having it running.
• Keep a short list. A spreadsheet is enough: serial number, who has it, enrolled, encrypted, and the date you checked.
• Make reporting easy. Tell your team who their IT contact is and to report a missing laptop right away, with no blame, so the account steps happen in the first hour.
• Decide on the firmware lock. With encryption and management in place, the data is protected, and the firmware lock mainly protects the hardware. Skip it unless losing the laptop itself is the bigger problem.