Reporting devices stolen

You can submit a theft report for devices that meet the following system requirements:

• Operating system: The device is running a supported version of one of the following operating systems:

  • Windows
  • macOS
  • Chrome OS (installed on Chromebooks only)
• Agent: For Windows and Mac devices, the device must have an Agent status The operating condition of a device's Secure Endpoint Agent. Possible values are Active (indicates that the device's agent has connected to the Absolute Monitoring Center), Inactive (indicates one of the following: the device was moved to another account; the device was unenrolled, but it is now set to be reactivated; or the device had Persistence enabled at the factory, but it has not yet called in to the Absolute Monitoring Center), and Disabled (indicates that the agent is either flagged for removal or removed from the unenrolled device). Inactive and Disabled devices do not consume a license. of Active, meaning that the agent is installed and regularly checking in to the Absolute Monitoring Center.
• Chromebook extension: For Chromebooks, the device must be synced with the Secure Endpoint Console and have an Agent status of Active and a Chromebook > Extension status of Pending or Installed.

Before you can submit a theft report, the following prerequisites must be met:

• The device does not currently have an open theft investigation.
• The device is not frozen. If the device is frozen, you must unfreeze it before continuing.
• The device is not in a policy group that is assigned an Offline Freeze rule. If it is, you must move the device to a policy group without an assigned rule.

Depending on the Absolute product licenses associated with your account, theft reports may not be available.

Submit a theft report to the Absolute Investigations team if all of the following conditions apply:

• The device is missing as a result of a criminal act
• You are prepared to proceed with a criminal investigation, including prosecution of the perpetrator

• You have filed a police report with law enforcement and have obtained a copy of the report

  If the police report is not available at the time you submit the theft report, and the device is eligible for the Service Guarantee, you must upload a copy of the report within 30 days of the theft report date.

If any of these conditions are not met, do not submit a theft report. However, you can track the device in the Secure Endpoint Console by reporting it missing.

If you want to remotely remove files from a stolen device, submit a File Delete or Wipe request before submitting a theft report. You can't submit either request on a device with an open theft report.

To create a theft report for a stolen device:

1. Ensure that the missing device meets the prerequisites for a stolen device.
2. Log in to the Secure Endpoint Console as a user with Manage permissions for Investigation. All default user roles are granted these permissions.
3. On the device's Device Details page, click Device Actions > Report Missing or Stolen.
4. On the Report Missing or Stolen Devices dialog, click Create Theft Report. The Investigate Stolen Device page opens.

   If the device has a pending Wipe or File Delete request, a warning message shows under the device. You can view the request's details by clicking the provided link. Note that the pending request will not prevent you from submitting a theft report.

5. Under Police Report, complete the following fields:
   • Police Agency: police agency with which you filed the police report
   • District/Division/Precinct Number: additional information about the policy agency
   • Investigating Officer: officer's name and badge number, if available
   • Agency Phone Number: phone number and extension of the police agency
   • Police File Number: record or identifying number referenced in the police report

6. If you have a copy of the police report, under Police Report Attachment click Upload and navigate to the location of the police report. Complete the steps to upload the file. The police file must be:

   • One of the following file formats are supported: PDF, TIF/TIFF, JPG/JPEG, GIF, and PNG
   • Under 10 MB

7. Under Incident Details, enter the following information from the police report:

   The greater the accuracy and detail of the information you provide, the greater the likelihood that the Absolute Investigations team is able to help recover the device. Required fields are indicated with an asterisk (*).

   1. In the Victim’s Name field, enter the full name of the user associated with the device when the incident occurred.

   2. Under When did the incident occur?:

      1. Click the first field and use the calendar picker to select the date of the incident.
      2. Click the second field and use the hour and minute selectors to enter the applicable time.
      3. Click the third field and select the applicable time zone.
   3. Under Where did the incident occur?, enter the location of the incident. At a minimum, City, State/Province, and Country are required.
   4. In the Details of the Incident field, enter the details (maximum 1000 characters) about the last known location of the device and the circumstances of the incident.

8. In the Investigation Report Contact list area:

   1. Complete all fields that are not prepopulated with your contact information.

   2. An Administrator may have created a default list of individuals to be notified when the Absolute Investigations team updates the status of a theft report. If your user role is granted View permissions for Investigation Contact, you can click Investigation Report Contacts to view this contact list in a new browser tab. When you're done reviewing the list, close the tab.

      To add more contacts for this theft report, begin typing an email address in the Additional Contacts field and then select it from the list. Press Enter after each address. Note that you can add email addresses for non-users. To remove an address, click its icon.

9. Under Consent to Install Software, read each paragraph carefully and then indicate your acknowledgment by selecting the two checkboxes.
10. Click Request Investigation.

The Reported Stolen page shows with the new report at the top of the grid with a status of Monitoring. You will receive an email notification each time the report changes status.

The device is now flagged as Reported Stolen and a Theft report created event is logged to Event History. If the device was reported missing, a Device reported found event is also logged.

While the Absolute Investigations team completes its investigation, you can view the device's Device Details, but you can't submit any device actions. Also note that a stolen device's location is not shown in the console, and no geolocation-related events are logged while the theft investigation is open.