Lost Phone Locate Lock and Remote Wipe in ManageEngine MDM
The call every IT person dreads: a phone with company email, files and customer data is missing. The order in which you act decides whether the story ends with a recovered phone or a data incident.
🎥 Full video — security commands demonstrated on a managed device
A lost managed phone is exactly the moment MDM was bought for. In ManageEngine MDM Plus, every action lives on the device's page under Inventory → Devices as security commands: Locate, Alarm, Lock, Corporate Wipe and Complete Wipe. Used in the wrong order — wiping before locating, for example — you can destroy your own chance of recovery. This guide gives the correct sequence, and is honest about the single condition that governs everything: the phone must come online.
Inventory → Device → Security Commands
1. LocateFind it first
2. Alarm and LockSecure it now
3. Corporate Wipe (BYOD)Work data only
4. Complete Wipe (company phone)LAST RESORT
The command order matters: locate before you lock, lock before you wipe — a wiped phone can no longer report its position.
1
Step 1 — Locate Before Anything Else
Open the device in Inventory → Devices and run the Locate command (Geo-Tracking view shows it on a map)
Note the last known location and the time it was recorded — a location from 20 minutes ago is a lead; one from yesterday is history
Ask the employee the obvious questions first: last place used, whether it might be in a vehicle, bag or at a client site — most "lost" phones are found within the building
2
Step 2 — Alarm and Lock Immediately
Send the Alarm command — the phone rings loudly even if it is on silent, which settles the "it is in this room" question in seconds
Send Remote Lock so nobody can open apps, email or files while you decide the next step
If the phone is a BYOD device, message the employee's alternate number with what you have done — it is their property, and transparency keeps trust in the programme
3
Step 3 — Choose the Right Wipe
If recovery looks unlikely, protect the data. MDM Plus offers two very different wipes — choose by ownership:
Corporate wipe — removes the work profile, managed apps, company email and MDM itself. Personal photos, chats and apps survive. This is the correct wipe for an employee's personal (BYOD) phone and the maximum you should ever do to it
Complete wipe — factory-resets the whole device: everything goes, including personal data on it. Reserve this for company-owned phones that are confirmed lost or stolen
After a complete wipe on a Zero Touch/Knox-enrolled Android, the phone will demand enrollment again if it is ever switched on — it stays useless to a finder
Record what you sent and when, in the incident note — if company data was on the phone, your management may need that record.
4
The Honest Limit — the Phone Must Come Online
Every command above is a message waiting for delivery:
A phone that is switched off, out of coverage or has no data left receives nothing until it connects to the internet — locate, lock and wipe all queue on the server
A location can only be reported if location services were enabled on the device — one more reason to enforce that in the profile at enrollment time
If the phone never comes back online, the commands never land. This is true for every MDM product, whatever the marketing says
🔴 Set this up before you need it: enforce a strong passcode policy and location permission in the enrollment profile, and test the locate command on one device today. The middle of a loss incident is the worst time to discover a setting was never switched on.
🎥 Watch the Complete MDM Setup in the Video
Every step shown live in the ManageEngine MDM console — enrollment, profiles, apps and security commands, in full detail.
The wipe command can be issued, but it only executes when the phone next connects to the internet. If the phone is never switched on or never gets a network connection again, the wipe never runs. This is a platform limit shared by all MDM products.
Will a factory reset by a thief remove the management?
On a fully managed Android enrolled through Zero Touch or Knox, a reset triggers enrollment again during setup — the device returns to management and stays unusable without it. On a plain QR-enrolled device, a reset removes management, but the device also holds no company data after the reset, which is the point of the wipe.
Should I wipe an employee's personal phone if it is lost?
Only the corporate side. Use corporate wipe, which removes the work profile, company apps and email and leaves personal data untouched. A complete wipe of a personal device deletes the employee's own photos and data and is not appropriate — the BYOD agreement exists precisely to draw this line.
This guide is based on the ManageEngine MDM video by Technical Anshu • Stuck on a step? Ask in the video comments — that is where answers come fastest 🙏