Lock and wipe a device on offboard in Jamf
Automatically lock and wipe a departing employee’s Mac in Jamf from a Slack request with Stepwork. Send both commands and confirm their status.
- Use case
- Employee offboardingIT
- Best for
- IT Administrator, IT Manager
- Applications used
Jamf
Slack
- Business outcome
- Risk reduction
The problem
The laptop left with them. So did the data.
Offboarding closes the accounts, but the Mac often stays in a backpack or a home office. IT chases the person for a return, then wipes the laptop by hand whenever it turns up, which can be weeks later.
Until then, company files sit on a device nobody controls. When security asks whether a departed employee’s laptop was wiped, the answer is a guess.
The outcome
Every departing Mac gets the same lock and wipe
Stepwork sends the remote lock and wipe commands to the departing employee’s Mac in Jamf and checks their status. The run records who asked, which device was targeted, and whether each command completed, as part of employee offboarding.
- The request names the person and the device serial number.
- A serial number assigned to someone else stops the run.
- The Slack reply shows each command’s status.
The process
From Slack request to a wiped Mac
A teammate posts the departing employee and their Mac in Slack. Stepwork sends the lock and wipe in Jamf, in the same order every time.
- Step 1
Request it in Slack
A teammate posts the departing employee’s work email and the Mac’s serial number in the offboarding channel. That message starts the flow, and Stepwork records who asked and when.
- Step 2
Find the device
Stepwork signs in to Jamf and opens the computer record for that serial number. If there is no match, or the record is assigned to someone else, the run stops before any command is sent.
- Step 3
Send the lock and wipe
Stepwork sends the remote lock and wipe commands from the device record, the same commands an admin sends by hand.
- Step 4
Confirm and reply in Slack
Stepwork checks each command’s status in Jamf, then posts the result back in Slack. A Mac that is offline shows the commands as pending until it next checks in.
Why Stepwork
Every wipe leaves a record
A deterministic agent runs the lock-and-wipe path you recorded in Jamf. It checks that the device belongs to the person in the request before it sends anything, so a typo in a serial number does not wipe the wrong Mac.
Similar use cases
Similar use cases
Suspend a user in JumpCloudSuspends a departing user in the JumpCloud console, cutting SSO, LDAP, and device access.
Deactivate user account in OktaSigns into the Okta admin console, locates the user by email, deactivates the account, and confirms the status change ended all SSO sessions.
Suspend user account in Google WorkspaceSigns into the Google Admin console, locates the user, and suspends the account, blocking sign-in while preserving data.
FAQ