Freezing offline devices

NOTE  If Absolute has upgraded the Freeze feature on your account, the Conditional Offline Freeze feature has been replaced by Offline Freeze rules. If the Conditional Freeze option is not available, you'll need to go to > Rules to create an Offline Freeze rule.

You can create a Conditional Freeze request that will freeze devices if they go offline and do not contact the Absolute Monitoring Center The server responsible for maintaining two-way communication with a device's Persistence agent, to initiate self-healing if the Absolute agent is removed or tampered with, and with its Absolute agent, to send device data and receive instructions. for a specified number of days. Use this feature if you want to ensure that your devices are protected even when they are powered off or a network connection is not available.

After you create a request, it is sent to the selected devices on the next agent connection. The number of days timer then begins to count down on each device. With each successful agent connection the timer is reset to zero (0). If a device does not call the Monitoring Center before the timer elapses, the device freezes and an email notification is sent to the user who created the request. The device remains frozen until you submit a Remove Freeze request in the Absolute console, or the user enters the device's Unfreeze code on the device.

IMPORTANT  A device is limited to one outstanding Freeze request of each type (On-demand, Scheduled, Conditional - Offline). Therefore, if you submit a Conditional Freeze request, and one already exists for the device, the new request replaces the existing request. For more information, see Updating an outstanding Freeze request.

The Freeze feature is persistent. The frozen state persists when the device is restarted, even when it is restarted in safe mode. If a user re-installs the operating system, the device freezes again when the agent self-heals.

You can submit a Conditional Freeze request from the All Devices page in the Assets > Devices area or a device's Device Details page. You can also select devices in a device group, roll-up folder, or device report and submit a single Freeze request for all selected devices.

The following conditions apply to a device that has been frozen by a Freeze request or an Offline Freeze rule:

  • A full screen Freeze message, configured by the user who requested the Freeze, shows on the device. For Windows and Mac devices, if the device user is logged in when the request is initiated, they are immediately logged out and the message shows instead of the Login page. If the device is powered off or in sleep mode, the Freeze is initiated immediately after the device restarts or awakes.

    NOTE  When a frozen Mac device that is encrypted by FileVault is restarted, the Freeze message is not shown until the device user logs in to the device and the file system is decrypted. Although the user is logged in, the device is inaccessible.

  • A device user can't dismiss, minimize, or bypass the full-screen message.

  • The device's peripheral displays are disabled.

  • Remote login to the device is disabled.

  • The device's file system is inaccessible via network file sharing (for example, AFP, NFS, or SMB).

Note that the Freeze feature is persistent. The frozen state persists even when the device is restarted, even if it's restarted in safe mode. If a user re-installs the operating system, the device freezes again when the agent self-heals.

Conditional Freeze requests are supported on Windows and Mac devices with an active Absolute agent.

Conditional Freeze requests are not supported on the following devices:

NOTE  If the Absolute product licenses assigned to a device's policy group does not include support for Freeze actions, the device is ineligible to be frozen.

To submit a request:

  1. Log in to the Absolute console as a user with Perform permissions for Freeze Device.

  2. Do one of the following:

    On the Device Details page for the device, click > Conditional Freeze.

    NOTE  Depending on the version of Device Freeze applied to your account, the Conditional Freeze option may not be available. If so, create an Offline Freeze rule.

    If the device does not meet this feature's prerequisites, the eligibility dialog opens and the device shows as ineligible in the Eligibility column. Click Close.

    1. From the navigation bar, open a page that supports the Conditional Freeze action. For example, click to open the All Devices page in the Assets > Devices area.
    2. Optionally, add filters to refine the device list.
    3. Search for the devices that you want to freeze.

    4. In the results grid, select the check box next to each device. To select all devices, select the Select All check box in the result grid's header. You can select up to 9,999 devices. To remove all selections, clear the Select All check box or click Clear all.

    5. Depending on the page you're on click either or Device Actions, and then click Conditional Freeze.

      6. NOTE  Depending on the version of Device Freeze applied to your account, the Conditional Freeze option may not be available. If so, create an Offline Freeze rule.

    6. If any devices do not meet this feature's prerequisites, they are ineligible for this request and the eligibility dialog shows. Each device's status shows in the Eligibility column. Do one of the following:
      • If one or more devices are eligible and you want to set a conditional freeze for those devices, click Proceed with Eligible Devices. The Add message page of the Freeze Device dialog shows.
      • If no devices are eligible, click Close.

    Alternatively, you can upload a file of device identifiers and submit a request.

  3. Frozen devices show a full screen message to inform the user that their device is frozen and it can't be used. Configure a message for your Conditional Freeze request by doing one of the following:

    1. Click Select Message and select a message from the list. The message text shows in the text box.

      NOTE  If your Absolute account was created after the release of Absolute 7.7 (April 2019), a system default message called Absolute Freeze Message shows in the list. You can use this message as is, or edit or duplicate it to suit your needs.

    2. Do one of the following:
      • To use the message as is, go to the next step.
      • To edit the original message, click Edit and edit the message name and text as appropriate. When you save the request, the edited message is saved for future use.
      • To edit the message text without overwriting the original message, click Duplicate and edit the message name and text, as appropriate. When you save the request, the original message remains unchanged and the new message is added for future use.
    3. Click Next.
    1. In the Message Name field, enter a name to assign to the message.
    2. In the text box, enter the message you want to show on the device. Use the tools in the message editor toolbar to format the text and insert images in your message.
    3. To include device specific information, such as the device's IMEI or Serial Number, or a Custom Field, such as Department or Assigned Username, click Insert variable and select one of the following:
      • Detected Phone Number
      • Detected Serial Number
      • IMEI
      • IMSI
      • Serial Number
      • [Custom Field name]

      4. The variable is added to your message in the format [%<variable name>%], or [%CDF:<variable name>%] if it's a Custom Field. The formatted variable also shows when you preview the message.

      When the Device Freeze request is deployed, and the message shows on a device, the variable is replaced by the actual value associated with that device.

    4. If you want to save this message so that you can use it in subsequent Freeze requests, select the check box next to Save message for reuse.
    5. Click Next.
  4. Your message shows on the Preview message dialog page as it will appear on the device. To edit the message, click Previous. Otherwise, click Next to show the Configure request dialog page.
  5. Under Freeze conditions, do the following:
    1. Select the option, Freeze if devices are offline for <x> days.
    2. In the text field, specify the length of the Conditional Freeze timer in days. The default value is 30 days, but any value up to and including 2000 days is supported. If a device does not connect to the Absolute Monitoring Center before the timer elapses, the device is frozen.
  6. Click the field under Select an option and select a method for generating an unfreeze code. The unfreeze code is entered directly on the frozen device to unfreeze it and make the device operational again.
    • Generate a random unfreeze code for each device
    • Generate the same unfreeze code for all devices

      NOTE  This option is available for requests that include multiple devices only.

    • Create a numeric unfreeze code for all devices

      NOTE  This option is available only if you are logged in as a user with Perform permissions for Remove Freeze.

  7. Define the format of the code by doing one of the following:
    • If you selected Generate a random unfreeze code for each device or Generate the same unfreeze code for all devices, click the Select code length field and specify the character length of the numeric code. You can select any value between 4 and 8 (default) digits.
    • If you selected Create a numeric unfreeze code for all devices, enter a 4 to 8 digit numeric code in the text field.
  8. To receive an email notification when the status of the Device Freeze request changes:
    1. Select the check box next to Send status updates. By default, status update emails are sent to the email address associated with your user account. To send emails to a different address, edit the default email address that shows in the text field.
    2. To also send status updates to another user, click Add another and enter the user's email address. You can add up to 10 email addresses.
    3. To remove an email address, click the icon next to the field.
  9. Click Next to show the Submit request page. The list of devices included in this request shows. To remove any devices from the request, clear each check box.
  10. The request is automatically assigned the name, Device Freeze - <date>. To change it, enter a new name in the field.
  11. Click Conditionally Freeze Device or Conditionally Freeze [x] Devices, depending on how many devices are in the request.

The Conditional - Offline freeze request is created and deployed to each device on the next agent connection. You can track the status of your request on the History > Events page.