A computer that stops reporting has told you something — you just have to work out what. A drawer laptop, a dead agent and a stolen machine all look identical in the console. Here is how to tell them apart, and what to write down.
Sooner or later every Endpoint Central admin finds one: a PC that has not reported in for weeks. The console cannot tell you why — it only knows silence. Working out what the silence means is a small investigation with real consequences, because the possible answers range from 'it is in a drawer' to 'it left the building and is not coming back'. This guide gives the honest order of checks, the point at which a missing PC becomes a security record rather than an IT nuisance, and how to report it so the paperwork protects the company.
Most silent PCs are mundane. Work the list in order: the machine is switched off or on leave with its user; it was replaced and the old one is in storage awaiting disposal; the agent stopped working — service stopped, agent corrupted, or the machine was re-imaged and never re-enrolled; or the PC was retired but never removed from the console, so a ghost keeps ageing in your reports. A filter on last-contact date, sorted oldest first, plus one question to each machine's user ('is it on your desk?') resolves the great majority in an afternoon. Fix dead agents by reinstalling the agent; fix ghosts by actually removing retired machines from the console.
Two findings turn housekeeping into a record. The user has left the company and the device was never returned — now it is an HR and asset-recovery matter, and the console's record (model, serial number, last user, last seen date and location network) is the evidence list. Or the user is present but cannot produce the machine. At that point, stop investigating quietly and write it up: a device with company data is unaccounted for. Note what the inventory says was on it — the software list and the fact that it held office files is what decides how serious the loss is, and whether your data-protection obligations require formal reporting in your jurisdiction.
Whether it ends with recovery or a write-off, record the same facts while they are fresh:
Five lines, written on the day, are worth more in any later dispute than a month of reconstruction.
Prevention is a rhythm, not a project. Monthly, pull the list of machines not seen in 30 days and work it while the trails are warm — every entry is explainable in a week and a mystery in six months. Pair it with the joiner-leaver process: no final settlement until the asset register shows the machine back or the loss recorded. And resist the tidy-admin instinct to simply delete silent machines from the console to make the numbers pretty — deleting destroys the history you need if the device ever matters again. Investigate first, document, then remove.
See every screen from this guide live in the video — hardware inventory, software inventory, the License Manager and the alerts, on a real Endpoint Central console.
▶️ Watch Full VideoOrdinary life: the user is away, the machine sits unused in storage, or the agent has failed while the PC works fine. A genuinely lost device is the rare answer — but the checks are ordered so the rare answer is caught, not assumed away.
Only after each one is explained and, where relevant, documented. Deleting first destroys the device's history — serial number, software, last-seen date — which is exactly what a loss report or insurance claim needs.
Computer name, manufacturer, model and serial number from hardware inventory, the assigned/last user, the installed-software list, and the agent's last contact date — the core of any lost-asset record.