Freezing devices

The following conditions apply to a frozen device:

• A full screen Freeze message, configured by the user who requested the Freeze, shows on the device. For Windows and Mac devices, if the device user is logged in when the request is launched, they are immediately logged out and the message shows instead of the Login page. If the device is powered off or in sleep mode, the Freeze is launched immediately after the device restarts or awakes.

  When a frozen Mac device that is encrypted by FileVault is restarted, the Freeze message is not shown until the device user logs in to the device and the file system is decrypted. Although the user is logged in, the device is inaccessible.

• A device user can't dismiss, minimize, or bypass the full-screen message.

• If the device is connected to a network when it's frozen, it remains connected.

• The device's peripheral displays are disabled.
• Remote login to the device is disabled.
• The device's file system is inaccessible via network file sharing (for example, AFP, NFS, or SMB).

Note that the Freeze feature is persistent. The frozen state persists even when the device is restarted, even if it's restarted in safe mode. If a user re-installs the operating system, the device freezes again when the agent self-heals If the Secure Endpoint Agent on a Windows device is damaged, tampered with, or removed, the Absolute Persistence module embedded in the device's firmware makes a self healing call to the Absolute Monitoring Center, which restores the agent..

If you want to use the same Freeze message in multiple requests, you can create it as an editable message template in the Settings > Messages area. Alternatively, you can create a new message while you're submitting a request, and then save it as a template for future use.

To help you get started, the Messages area includes the following Absolute templates:

• End of School Year
• Laptop return
• Out of compliance

Learn more

Freeze requests are not supported on the following devices:

• Devices with an open theft report
• Devices with an Agent status The operating condition of a device's Secure Endpoint Agent. Possible values are Active (indicates that the device's agent has connected to the Absolute Monitoring Center), Inactive (indicates one of the following: the device was moved to another account; the device was unenrolled, but it is now set to be reactivated; or the device had Persistence enabled at the factory, but it has not yet called in to the Absolute Monitoring Center), and Disabled (indicates that the agent is either flagged for removal or removed from the unenrolled device). Inactive and Disabled devices do not consume a license. set to Inactive or Disabled

To submit a Freeze request, your user role needs to be granted the Perform permission for Freeze Device.

To specify a numeric unfreeze code A 4 to 8 digit passcode that a user can enter on a frozen device to unfreeze it. in your Freeze request, your user role needs to be granted the Perform permission for both Freeze Device and Remove Freeze.

Depending on the configuration of your account, the Freeze at Firmware option may not be available.

To add an additional layer of protection, you can select the Freeze at Firmware option, which creates an on-demand Freeze request that freezes supported Windows devices in two steps:

• Step 1 - OS Freeze: the device is frozen by the standard on-demand Freeze.
• Step 2 - Firmware Freeze: after Step 1 is complete, the Freeze component forces the device to reboot and then freezes the device at UEFI runtime, which occurs before the operating system reboots. Once the device is frozen, the operating system can't be booted, and the device can't connect to a network.

To unfreeze a device that is frozen by a Firmware Freeze, you must enter the device's unfreeze code A 4 to 8 digit passcode that a user can enter on a frozen device to unfreeze it. locally. Remove Freeze requests are not supported.

Firmware Freeze is not supported in scheduled Freeze requests.

Benefits and use cases

Firmware Freeze adds an additional layer of protection to a frozen device by making it virtually impossible for a bad actor to circumvent a Freeze message. If an individual attempts to re-image a frozen device using an operating system that is not supported by the Secure Endpoint Agent, the device remains frozen and unusable. Similarly, for devices with virtualization, any attempts to boot into an alternate virtual machine won't be successful.

Also note that devices that are frozen at the firmware level can't establish a network connection, so remote access is unavailable and all communication with the device ceases. If a device is infected with malware, submitting a Firmware Freeze can help to stop its spread to other devices on your network. Also see What is the effect of a Firmware Freeze?

A Firmware Freeze is the best way to "brick" a device and render it unusable. It provides a fool-proof method to ensure that end-of-life devices are not repurposed without your consent.

System requirements

Firmware Freeze is supported when the following requirements are met:

• The device is running a supported version of the Windows operating system.

• The version of the Absolute Persistence module Absolute Persistence® technology is embedded in the BIOS of most Windows devices during the manufacturing process. The Persistence module is activated during theSecure Endpoint Agent’s first connection to the Absolute Monitoring Center. This software checks the status of the agent and initiates self-healing to restore the agent if it's missing, damaged, or tampered with. embedded in the firmware of a device supports Firmware Freeze.

  Eligible makes and models

• The device manufacturer has enabled the Firmware Freeze feature in the Persistence module.

Note that after the request is sent to a device, the device must pass an eligibility check before a Firmware Freeze can be processed. If the eligibility check fails, but the on-demand eligibility requirements are met, the device is frozen at the OS level only. An action status of OS Freeze succeeded, Unsupported - Firmware Freeze failed shows in Action Requests.

What is the effect of a Firmware Freeze?

The effect of the Freeze depends on whether the Windows device is successfully frozen during both steps, or only one:

Result	Freeze status	Status details in Action Requests	Event in Event History	Effect on device
Both the OS Freeze and the Firmware Freeze are successful	Frozen at OS and Firmware	OS Freeze succeeded, Firmware Freeze succeeded	Two events are logged: Device frozen Firmware freeze succeeded	The following conditions apply: A full screen Freeze message, configured by the user who requested the Freeze, shows on the device immediately after it's powered on and before the operating system loads. A device user can't dismiss, minimize, or bypass the full-screen message. The device's peripheral displays are disabled. The device can't establish a network connection. As a result: Remote login to the device is disabled. The device's file system is inaccessible via network file sharing (for example, AFP, NFS, or SMB). The Secure Endpoint Agent is unable to contact the Absolute Monitoring Center to confirm its status or receive instructions. The device can't be unfrozen by submitting a Remove Freeze request in the console. To unfreeze the frozen device, you must enter the device's unfreeze code A 4 to 8 digit passcode that a user can enter on a frozen device to unfreeze it. locally.
Firmware Freeze is successful, OS Freeze failed	Frozen at Firmware	OS Freeze failed, Firmware Freeze succeeded
OS Freeze is successful, Firmware Freeze failed because the device does not meet the system requirements	Frozen at OS	OS Freeze succeeded, Unsupported - Firmware Freeze failed	Two events are logged: Device frozen Firmware freeze failed	The device is frozen by a standard on-demand Freeze. The Standard Freeze conditions apply.
OS Freeze is successful, Firmware Freeze failed for other reason		OS Freeze succeeded, Internal error - Firmware Freeze failed

If the Freeze request fails at both the OS and firmware levels, the request's action status in Action Requests is set to Failed.

About removing a Firmware Freeze

To unfreeze a device that is frozen by a Firmware Freeze, you will need physical access to the device to enter the device's unfreeze code A 4 to 8 digit passcode that a user can enter on a frozen device to unfreeze it. locally. You only need to enter the unfreeze code once to remove both the OS Freeze and the Firmware Freeze. Learn more

Note that because the frozen device can't connect to the Internet, you can't unfreeze the device by submitting a Remove Freeze request. As a result, the Remove Freeze device action is not available in Device Details when the device's Freeze status is set to one of the following:

• Frozen at OS and Firmware
• Frozen at Firmware

To submit an on-demand Freeze request:

1. Log in to the Secure Endpoint Console and do one of the following:

   To freeze a single device

   On the Device Details page for the device, click Freeze.

   To freeze multiple devices

   1. From the navigation bar, open a page that supports the Freeze action. For example, open the All Devices page in the Devices area or open the Makes and Models report.
   2. In the work area, use the search field or filters to find the devices you want to freeze.

   3. In the results grid, select each device you want to include in the request. To select all devices, select the Select All checkbox in the result grid header. To select consecutive devices, select the first device and then hold down the Shift key and select the last device. You can select up to 350,000 devices. To remove all selections, click Clear all.

   4. Click Freeze.

   Alternatively, you can upload a file of device identifiers and submit a request.

2. [Optional] At the top of the dialog, click Freeze - <date> and enter a request name that will help you identify and track this request in Action Requests.
3. [Optional] Click Add description (optional) and enter a description for the request.
4. Under Freeze the device, leave As soon as possible selected.

5. [Optional] To also freeze the device at the firmware level, select the Freeze at Firmware checkbox. Learn more

   Note that this option is supported on select Windows devices only. If your request includes Mac or Chromebook devices, a standard on-demand Freeze is submitted on the unsupported devices.

   To unfreeze a device that is frozen at the firmware level, the device's unfreeze code must be entered locally. Remove Freeze requests are not supported.
   

6. Add a Freeze message to your request.

   Note that if you selected the Freeze at Firmware checkbox in step 5, the message needs to meet the following requirements:

   • The message contains no more than one image or logo.
   • Important information is not contained in an image. Due to message size limitations at the firmware level, images may be stripped out of the message before the message is displayed in the firmware.

   Also note that you may want to avoid including URLs in your message since a firmware frozen device is not able to connect to the Internet.

   You can add a message in one of the following ways:

   Use a message template

   1. Under Message, click Select message and select a message from the list. The list contains all Freeze message templates stored in the Settings > Messages area. To select an Absolute template, scroll to the bottom of the list.

      To create a new message, select the Blank message template, or follow the steps in Create a new message.

   2. [Optional] Click the message name and edit it. If you don't edit the message name, the message name defaults to the name of the Freeze Message template you selected.

   3. Do one of the following:

      • To use the message as is, go to the next step.

      • To edit the message, do the following:

        1. To add an image, drag the new image to the dialog, or click browse and select it. The image file must be in .png or .jpeg format and be no larger than 4 MB. Note that images are centered above the message text, by default. To remove an existing image, click Remove.

        2. Edit the message text, as required. You can use the tools in the message editor toolbar to format the message.

           When your message is saved, the system validates the message content and automatically removes any HTML tags or attributes that may expose Absolute servers or agents to injection attacks, such as cross site scripting (XSS). As a result, the formatting applied to your message text may be altered, in some rare cases.

   Create a new message

   1. [Optional] Under the Select message field, click Untitled message and edit the message name. If you don't edit the message name, the message name defaults to Untitled message.
   2. In the text box, enter the message you want to show on the device.

   3. Use the tools in the message editor toolbar to format the message.

      When your message is saved, the system validates the message content and automatically removes any HTML tags or attributes that may expose Absolute servers or agents to injection attacks, such as cross site scripting (XSS). As a result, the formatting applied to your message text may be altered, in some rare cases.

      Adding device specific information to a message

      You can add device specific information to the message using a Custom Device Field variable. When the message is generated, the variable is replaced with the value assigned to the device.

      Example

      You want the device user's department—Accounting—to show in the message. You add the Department Custom Device Field to the message. When the message is generated, "Accounting" shows in place of the variable.

      To add Custom Device Fields:

      1. In the text box, click where you want to insert the Custom Device Field.

      2. Click Insert variable and select a field from the list.

         You can include device identifiers in the message by selecting Device Name and Serial Number from the list.

      3. Leave the field's drop-down set to Label.
      4. Repeat the above steps for each Custom Device Field you want to add.

7. To save your new message so it's available for future use, select the Add the message to library checkbox and update the name of your new message template, if desired.

   You'll be able to view and edit your template in the Settings > Messages area.

8. In the Unfreeze Code section, click Edit and do the following:

   1. Choose how to generate an unfreeze code A 4 to 8 digit passcode that a user can enter on a frozen device to unfreeze it. by selecting one of the following options:

      • Generate a random code

      • Create a numeric code for all devices

        The numeric code option is available only if you are logged in as a user with the Perform permission for Remove Freeze.

   2. Define the format of the code by doing one of the following:

      • If you selected Generate a random code:

        1. Click the first field and select the character length of the numeric code. You can select any value between 4 and 8 digits. The default value is 8 digits.

        2. If this request is for multiple devices, click the second field and select one of the following options:

           • For each device: randomly generates a unique code for each device
           • For all devices: randomly generates one code that applies to all devices

        After you submit the Freeze request, you can go to the Device Freeze Status report to view a device's generated unfreeze code.

      • If you selected Create a numeric code for all devices, enter a 4 to 8 digit numeric code in the text field.

9. To send an email notification when the status of the Freeze request changes, select the checkbox next to Send status updates and do the following:

   1. The Events field shows the status change events that will trigger an email notification. By default, the following events are selected:

      On request	On device
      Request is created Request is complete	Device is frozen Device freeze is failed Device freeze is removed

      Note the following about these events:

      • On request events will trigger one email for the request.
      • On device events will trigger an email for each device in the request.
      • The Device freeze is failed event will trigger an email when a device is ineligible to be frozen, or when the Freeze request fails to be processed on the device.

      To remove an event, click its icon. To remove all selected events, click the Events field and click Clear. To select all events again, click Select All.

   2. Under Send email, click the field and begin entering each email address and then select it from the list. To remove an address, click its icon.
   3. You can create up to 5 email notification rules, each containing one or more events and a unique collection of email recipients. This feature is helpful if you want a particular event to trigger an email notification to some individuals, but not to others. To do so, click Add and repeat the previous two steps, up to 4 times. To remove an added section, click .
10. Click Preview and then click Freeze x devices.

The Freeze request is submitted, its action status is set to Pending in Action Requests, and a Device freeze requested event is logged to Event History.

The request is deployed to each device on its next successful connection to the Absolute Monitoring Center, which is typically within a few minutes for Absolute Resilience accounts, or within 15 minutes for Absolute Control accounts, assuming the devices are online. For online Chromebook devices, connections following a security action request are almost immediate. If the request requires dual approval, the request remains in the Pending Approval section in Action Requests. The action isn't sent to the device until the request is approved.

You can track the status of your request in Action Requests. You can also cancel the request for devices with a status of Pending.

To view a summary of all outstanding Freeze requests, including each device's unfreeze code, view the Device Freeze Status report.

For Windows and Mac devices, if a user is logged in when the device freezes, the user is immediately logged out of their session and the Freeze message shows. In some cases, a frozen Chromebook device may show a blank screen instead of the Freeze message. After the user restarts the device, the Freeze message shows.

The Freeze at Firmware option is not available in scheduled Freeze requests.

To submit a Freeze request that takes effect on a future date:

1. Complete steps 1 to 3 in Submitting an on-demand Freeze from the console.

2. Under Freeze the device:

   1. Select On or after a certain date.
   2. Click the first field and select the date to freeze the device. Today's date is supported.
   3. Click the second field and select a time (local device time A date and time expressed in a device's local time zone, as opposed to server time. In the console, local device time applies to usage data collected from devices, and the scheduling of some device action requests.). Times are available in 30 minute increments.

   If you schedule a Freeze for a time that has already occurred in the device's time zone, the device is frozen after its next connection.

3. Complete steps 6 to 9 in Submitting an on-demand Freeze from the console.

The Freeze request is submitted, its action status is set to Pending in Action Requests, and a Device freeze requested event is logged to Event History.

The request is deployed to each device on its next successful connection to the Absolute Monitoring Center, which is typically within a few minutes for Absolute Resilience accounts, or within 15 minutes for Absolute Control accounts, assuming the devices are online. For online Chromebook devices, connections following a security action request are almost immediate. If the request requires dual approval, the request remains in the Pending Approval section in Action Requests. The action isn't sent to the device until the request is approved.

The device will be frozen at the specified date and time. Note that:

• If the device is online at that time, the status of the Freeze request is updated to Frozen after the device's next agent connection to the Absolute Monitoring Center.
• If the device is offline or powered off at that time, the status is set to Frozen - Timer Expired if 24 hours elapse without an agent connection. As soon as the device comes back online and an agent connection occurs, the Freeze status is updated to Frozen.

You can track the status of your request in Action Requests. You can also cancel the request for devices with a status of Pending.

To view a summary of all outstanding Freeze requests, including each device's unfreeze code, view the Device Freeze Status report.

For Windows and Mac devices, if a user is logged in when the device freezes, the user is immediately logged out of their session and the Freeze message shows. In some cases, a frozen Chromebook device may show a blank screen instead of the Freeze message. After the user restarts the device, the Freeze message shows.