Tracking the status of stolen devices

Depending on the Absolute product licenses associated with your account, theft reports may not be available.

On the Reported Stolen page in Devices, you can monitor the status of newly submitted theft reports. You can also review past reports that are now closed.

The Absolute Investigations team updates the status of the report as the investigation progresses. Each time the report status changes, an email notification is sent to all email addresses specified in the theft report. There are five possible stages of an investigation, but not every investigation will pass through all stages (statuses):

Monitoring
Under Review
Under Investigation
Awaiting Customer
Closed

For more information about the possible statuses within each stage and what each status means, see status definitions.

While the Absolute Investigations team completes its investigation, you can view the device's Device Details, but you can't submit any device actions. Also note that a stolen device's location is not shown in the console, and no geolocation-related events are logged while the theft investigation is open.

Information included on the Reported Stolen page

Column	Details
Device name	The device name The name assigned to the device in the operating system. For Chromebooks, device name is not applicable and therefore shows as "Chrome" in the Secure Endpoint Console. and serial number The identification number assigned to the device by the device manufacturer. For Windows devices, this value may correspond to the serial number of the BIOS, the motherboard, or the chassis, depending on the manufacturer. of the device for which the report was submitted Click the device name to view the device's Device Details page.
Agent status The operating condition of a device's Secure Endpoint Agent. Possible values are Active (indicates that the device's agent has connected to the Absolute Monitoring Center), Inactive (indicates one of the following: the device was moved to another account; the device was unenrolled, but it is now set to be reactivated; or the device had Persistence enabled at the factory, but it has not yet called in to the Absolute Monitoring Center), and Disabled (indicates that the agent is either flagged for removal or removed from the unenrolled device). Inactive and Disabled devices do not consume a license.	The operating condition of the device's Secure Endpoint Agent. If a device's agent status changes, it may take up to a hour for the new status to be reflected on the Reported Stolen page.
Report ID	The identifier assigned to the theft report Click the identifier to view the report details or to upload the associated police report.
Report status	The status of the investigation Possible values are: Monitoring Under Review Under Investigation Awaiting Customer Closed To view more detailed information about each status, add the Reason column to the report. Status and Reason definitions
Reported date	The date and time when the theft report was submitted
Incident date	The date and time when the incident occurred
Recovered date	The date and time when the stolen device was recovered
Guarantee status	Indication of whether the device is eligible for a Service Guarantee payout Possible values are: Declined Eligible Not Available Paid
Investigator	The name and email address of the Investigations team member assigned to the investigation A value of Pending indicates that an investigator is not yet assigned to the investigation.
Police File Uploaded	The name of the police report file, if the police report has been uploaded

To find a device's theft report, you can search by device name. You can also add additional columns to the report, such as the Last connected and Closed Date columns. To refresh the page's data, click (Refresh the page) in the page footer.