Overview
macOS |
Windows |
Linux |
iOS / iPadOS |
Android |
|---|---|---|---|---|
✅ |
✅ |
✅ |
✅ |
Company-owned only |
How to use
- Open Devices and select the device.
- Click Actions > Wipe.
- Choose the wipe mode, where the platform offers one.
- Confirm.
The device moves to Wipe pending, and to Wiped once it acknowledges the command.
What happens on a Mac
The Mac erases everything and reinstalls macOS from recovery. If the machine was set up for zero touch, it re-enrols by itself on first boot; otherwise someone has to enrol it again by hand.
The thing that goes wrong on Macs is Activation Lock. If the employee's Apple Account is still signed in when the wipe finishes, the Mac reboots to the Activate Mac screen and asks for their Apple ID — and at that point you need the former employee, or Apple Support.
So, while the Mac is still in front of you and unlocked:
- Open System Settings and select the user's Apple Account.
- Sign out of iCloud. This turns off Find My Mac and needs the user's own Apple ID password.
- Check that Find My Mac is off and no Apple Account remains signed in.
- Back up anything you need. The wipe is irreversible.
- Run the wipe.
- When the Mac reboots, confirm it reaches the setup assistant and not the Activate Mac screen.
What happens on Windows
Windows is the one platform with a choice to make, and the two options behave very differently.
Standard wipe |
Hard wipe |
|
|---|---|---|
Equivalent to |
Reset this PC > Remove everything |
A full clean of the internal drive |
If someone pulls the power |
The process stops and tries to roll back |
It resumes at the next boot and keeps going |
If the roll-back fails |
The machine may be unusable |
Not applicable — it retries until done |
Risk of an unbootable device |
Low |
Higher |
Use it for |
Reassignment, routine refresh |
Lost, stolen or compromised devices |
Pick by whether you have the device in your hands. If you do, a standard wipe is enough and easier to recover from. If you do not — a stolen laptop, or one you suspect is compromised — use a hard wipe, because it is the only one that finishes even if someone interferes with it.
Three limits to know:
- Windows Home is not supported. Remote wipe needs Pro, Enterprise or Education.
- There is no cancel. Once the device acknowledges the command, it is going.
- The BitLocker recovery key becomes useless. Make sure it is saved somewhere before you start, not after.
What happens on Linux, iPhone, iPad and Android
-
Linux. The agent runs a script that erases the data. Results depend on the distribution, the disk layout and how encryption was set up — expect to reinstall the operating system in some cases.
-
iPhone and iPad. The device is erased and returns to the setup screen.
- Android. The device is factory reset: data, apps and accounts all go, and it comes back to its out-of-the-box state, unenrolled and ready for the next person. This only works on company-owned devices. A personally-owned Android cannot be wiped — to get company data off one of those, disenrol it instead.
Tips and Best Practices
- Sign the user out of iCloud before wiping any Mac. It takes a minute while you have the device and turns into a support case once you do not.
- Save the BitLocker recovery key somewhere outside the device. After the wipe the old key is worthless, and if you needed it you needed it beforehand.
- Standard wipe when you hold the device, hard wipe when you do not. That single rule covers almost every case.
- Wipe at handover, not later. Reassigning a device without wiping it leaves the previous employee's data in someone else's hands.
- Check the device reaches the setup screen. A wipe that reports success and stops at an activation screen is not finished.
Troubleshooting and FAQ
Troubleshooting
- The Mac is stuck on the Activate Mac screen. The Apple Account was still signed in when the wipe ran. Recovery needs the former user's Apple ID, or Apple Support.
- The wipe option is missing on a Windows machine. It is running Windows Home, which does not support remote wipe.
- A Windows device will not boot after a wipe. A standard wipe was interrupted and its roll-back failed. This is the risk a hard wipe avoids, at the cost of a different one.
- An Android device cannot be wiped. It is personally owned. Disenrol it instead to remove company data.
- The device sits at "Wipe pending". It has not acknowledged the command yet. It is offline, and the wipe will run when it reconnects.
FAQ
-
Can a wipe be cancelled?
No. Once the device acknowledges it, it runs to completion.
-
Does the device stay managed after a wipe?
On zero-touch Macs, yes — they re-enrol on first boot. Everywhere else the device comes back unmanaged and has to be enrolled again.
-
What is the difference between wiping and disenrolling?
Disenrolling removes management and leaves the data. Wiping removes the data.
-
Which Windows mode should we use by default?
Standard, for anything routine. Keep hard wipe for devices you have lost control of.