NOTE Depending on the Absolute product licenses associated with your account, the Freeze feature may not be available.
You can freeze devices by showing a full screen message that restricts users from using the device. The device remains frozen until you submit a Remove Freeze request in the Absolute console, or the device's unfreeze code is entered on the frozen device.
There are two types of Freeze requests:
- On-demand: the device is frozen on the next agent connection
- Scheduled: the device is frozen on or after a specified date
IMPORTANT A device is limited to one outstanding Freeze request of each type. Therefore, if you submit a Freeze request of a particular type, and the device already has an existing request of the same type, the new request replaces the existing request. For more information, see Updating an outstanding Freeze request.
You can submit a Freeze request from a device's Device Details page, or you can select devices in a device group, roll-up folder, or device report and submit a single Freeze request for all selected devices. For example, if you discover that one or more devices in the Match Score Summary report have exceptionally high Match Scores, you can freeze the at-risk devices while you investigate the EDD data that was detected. You can also submit a Freeze request using the Absolute Control mobile app.
NOTE To automatically freeze your devices if they're offline for a specified number of days, create either a Conditional Offline Freeze request or an Offline Freeze rule, depending on the configuration of the Freeze feature in your account.
The following conditions apply to a device that has been frozen by a Freeze request or an Offline Freeze rule:
A full screen Freeze message, configured by the user who requested the Freeze, shows on the device. For Windows and Mac devices, if the device user is logged in when the request is initiated, they are immediately logged out and the message shows instead of the Login page. If the device is powered off or in sleep mode, the Freeze is initiated immediately after the device restarts or awakes.
NOTE When a frozen Mac device that is encrypted by FileVault is restarted, the Freeze message is not shown until the device user logs in to the device and the file system is decrypted. Although the user is logged in, the device is inaccessible.
A device user can't dismiss, minimize, or bypass the full-screen message.
The device's peripheral displays are disabled.
Remote login to the device is disabled.
The device's file system is inaccessible via network file sharing (for example, AFP, NFS, or SMB).
Note that the Freeze feature is persistent. The frozen state persists even when the device is restarted, even if it's restarted in safe mode. If a user re-installs the operating system, the device freezes again when the agent self-heals.
On-demand Freeze requests are supported on Windows, Mac, and Android devices with an active Absolute agent that is regularly connecting to the Absolute Monitoring Center.
NOTE If you attempt to freeze a Chromebook that has been synced from your Google account but doesn't yet have the extension deployed, the Freeze is processed once the extension is deployed and connects with the Absolute Monitoring Center.
Scheduled Freeze requests are supported on Windows and Mac devices with an active Absolute agent that is regularly connecting to the Absolute Monitoring Center.
Freeze requests are not supported on the following devices:
- Devices with an open theft report
- Devices with an Agent Status The operating condition of an Absolute agent. Possible values are Active (indicates that the agent has connected to the Monitoring Center), Inactive (indicates that the agent has not yet connected to the Monitoring Center), and Disabled (indicates that the agent is either flagged for removal or removed from the device). set to Inactive or Disabled
NOTE If the product license assigned to a device's policy group does not include support for Freeze actions, the device is ineligible to be frozen.
To submit an on-demand or scheduled Freeze request:
- Log in to the Absolute console as a user with Perform permissions for Freeze Device.
- Do one of the following:To freeze a single deviceTo freeze multiple devices
- From the navigation bar, open a page that supports the Freeze action, such as the All Devices page in the Assets area.
- In the work area, use the search field or filters to find the devices you want to freeze.
In the results grid, select the check box next to each device. To select all devices, select the Select All check box in the result grid's header. You can select up to 9,999 devices. To remove all selections, clear the Select All check box or click Clear all.
- Depending on the page you're on, click either Freeze or Device Actions > Freeze.
- If any devices do not meet this feature's prerequisites, the Eligibility for Freeze dialog opens and the devices show as ineligible in the Eligibility column. Do one of the following:
- If one or more devices are eligible and you want to freeze those devices, click Proceed with Eligible Devices. The Add message page of the Freeze Device dialog shows.
- If no devices are eligible, click Close.
Alternatively, you can upload a file of device identifiers and submit a request.
- When a device is frozen, a full screen message shows on the device to inform the user that their device is frozen and it can't be used. Select a message by doing one of the following:Use an existing message from the Settings > Device Freeze Messages area
- Click Select Message and select a message from the list. The message text shows in the text box.
- Do one of the following:
- To use the message as is, go to the next step.
- To edit the original message, click Edit and edit the message name and text as appropriate. When you save the request, the edited message is saved for future use.
- To edit the message text without overwriting the original message, click Duplicate and edit the message name and text, as appropriate. When you save the request, the original message remains unchanged and the new message is added for future use.
- Click Next.
NOTE If your Absolute account was created after the release of Absolute 7.7 (April 2019), a system default message called Absolute Freeze Message shows in the list. You can use this message as is, or edit or duplicate it to suit your needs.Create a new message
- In the Message Name field, enter a name to assign to the message.
- In the text box, enter the message you want to show on the device. Use the tools in the message editor toolbar to format the text and insert images in your message.
To include device specific information, click Insert variable and select one of the following:
- Device Name
- Detected Phone Number
- Detected Serial Number
- Serial Number
- [Custom Field name], such as Department or Assigned Username
- If you want to save this message so that you can use it in subsequent Freeze requests, select the check box next to Save message for reuse.
- Click Next.
The variable is added to your message in the format [%<variable name>%], or [%CDF:<variable name>%] if it's a Custom Field. The formatted variable also shows when you preview the message.
When the Device Freeze request is deployed, and the message shows on a device, the variable is replaced by the actual value associated with that device.
- Your message shows on the Preview message dialog page as it will appear on the device. To edit the message, click Previous. Otherwise, click Next to show the Configure request dialog page.
- Click the field under Freeze device and specify when you want the device to be frozen:
- To freeze each device on its next connection to the Absolute Monitoring Center, which is typically within the next 15 minutes, select the option, On next connection. When you select this option, an on-demand Freeze request is created.
- To schedule each device to freeze on or after a future date:
- Select the option, On or after a date. A date field shows.
- Click the date field and use the Calendar picker to select today's date or any future date. Dates prior to today are not supported.
When you select this option, a Scheduled Freeze request is created.
NOTE Scheduled Freeze requests are not supported on Android or Chromebook devices. If you choose the On or after a date option when you have selected one or more Android or Chromebook devices to freeze, those devices are removed from the request on the Submit request page of the Freeze Device dialog.
- Click the field under Select an option and select a method for generating an unfreeze code. The unfreeze code is entered directly on each frozen device to unfreeze it and make the device operational again.
- Generate a random unfreeze code for each device
- Generate the same unfreeze code for all devices
- Create a numeric unfreeze code for all devices
NOTE This option is available for requests that include multiple devices only.
NOTE This option is available only if you are logged in as a user with Perform permissions for Remove Freeze.
- Define the format of the code by doing one of the following:
- If you selected Generate a random unfreeze code for each device or Generate the same unfreeze code for all devices, click the Select code length field and specify the character length of the numeric code. You can select any value between 4 and 8 (default) digits. If the Device Freeze request includes Android devices, select 4 digits.
- If you selected Create a numeric unfreeze code for all devices, enter a 4 to 8 digit numeric code in the text field.
- To receive an email notification when the status of the Device Freeze request changes:
- Select the check box next to Send status updates. By default, status update emails are sent to the email address associated with your user account. To send emails to a different address, edit the default email address that shows in the text field.
- To also send status updates to another user, click Add another and enter the user's email address. You can add up to 10 email addresses.
- To remove an email address, click the icon next to the field.
- Click Next to show the Submit request page. The list of devices you selected in step 2 shows. Any devices that can't be frozen due to their current status are grayed out and removed from the request. To remove other devices from the request, clear each check box.
- The request is automatically assigned the name, Device Freeze - <date>. To change it, enter a new name in the field.
- Click Freeze Device or Freeze [x] Devices, depending on how many devices are in the request.
The Freeze request is created and deployed to each device. The request's status is set to Freeze Requested and a Device freeze requested event is logged to Event History.
If you selected On next connection in step 5, the device is frozen on the next agent connection to the Absolute Monitoring Center. For Windows and Mac devices, a connection typically occurs within the next 15 minutes; for Android and Chromebook devices, connections following a security action request are almost immediate.
If you selected On or after a date in step 5, the device is frozen on the specified date. If the device is online at that time, the status of the Freeze request is set to Frozen after the device's next agent connection. If the device is offline or powered off, the status is set to Scheduled Timer Expired until after the device comes back online and an agent connection occurs. The Freeze status is then updated to Frozen.
You can track the status of your request in Event History.
NOTE For Windows and Mac devices, if a user is logged in when the device freezes, the user is immediately logged out of their session and the Freeze message shows.
You can now take immediate action to secure a device, even when you're away from your desk.
If your user role is assigned Perform permissions for Freeze, you can use the Absolute Control® mobile app to freeze a device directly from your mobile device. With just a few taps, you can search for a device, review the device's key device details including its encryption status, and then submit an on-demand Freeze request. You can also use the app to submit Remove Freeze requests.
You can also track the status of your request in Event History.
NOTE In the current release, you can use the app to submit an on-demand Freeze request for a single device. To submit a request for multiple devices, or to submit a scheduled Freeze, use the Absolute console.
The app is supported on Apple and Android mobile devices running one of the following OS versions:
- iOS 11 and higher
- Android 8 and higher
To download the app, visit the Apple App Store or the Google Play Store from your mobile device.