The first 5 things to do after a laptop goes missing

Someone calls from a client site to say their MacBook is not in the bag. Nobody knows yet whether it was left behind, taken, or is sitting in a lost-and-found drawer. The first hour matters more than the rest of the week, because the options available to you narrow as the battery drains and the device drops off the network.

Work the list in order. The fourth decision is much easier to make once the first three are done, and much harder to reverse afterwards.

1. Mark it lost or push the remote lock

Find My on a personal Mac and the remote lock command in Jamf, Mosyle, or SimpleMDM do the same core job. Both lock the Mac with a passcode you set and display a message and callback number on the screen, and neither commits you to wiping anything. Do this before you decide anything else, because it is free, reversible, and keeps location reporting alive so the Mac checks in when it next reaches a network. On a managed Mac the MDM lock is the stronger of the two, since it does not depend on anyone having been signed into iCloud.

2. Suspend the identity account, not just the device

A missing laptop with a live session on it is a working key to mail, files, and everything the browser has stayed signed into. Suspend the user’s account in Entra ID, Google Workspace, or Okta, and revoke active sessions and refresh tokens, which in most consoles is a separate action from disabling the account. Rotate any shared credentials that lived in the browser rather than in a password manager. This is the step people skip, because the hardware feels like the emergency.

3. Work out what was actually on it

A FileVault-encrypted Mac that was powered off when it went missing is a very different conversation than one that was asleep with a user logged in, because the encryption keys are only out of memory in the first case. Confirm from your MDM or inventory record whether FileVault was enabled and when the device last checked in. Then list what was stored locally rather than in cloud storage: client files on the Desktop, a local mail archive, a Downloads folder nobody has cleared since March. Write that list down while it is fresh, because every conversation after this one depends on it.

4. Decide on the remote wipe, knowing it is one way

Erasing the Mac remotely also ends your ability to locate it, and on an offline device the command simply queues until the Mac next connects. If the data is sensitive and recovery looks unlikely, wipe it. If there is a real chance of getting it back (a hotel, a client office, a filed report with the serial number on it), a locked device plus a suspended account may be the better trade for a day or two. Make the call deliberately and record who made it and when.

5. Report it and ask the privacy question

File a police report and record the serial number, which insurance, your MDM records, and any later conversation with Apple will all need. Then ask whether the incident triggers a notification obligation. Alberta’s PIPA sets out requirements around breaches involving personal information, and client contracts frequently carry their own notification clauses with their own timelines. We are not lawyers and this is not legal advice, but it is a question worth raising in the first hour rather than the third week.

If you only do one thing

Lock the device and suspend the account inside the same ten minutes. The hardware is replaceable, and the signed-in session is what turns a lost laptop into an incident.