Wipe-Confirmation

[floh]

Hello everybody,

We need confirmation that a MacBook has been successfully wiped remotely and kindly ask for your advice on this matter. I found the Audit Logs of a MacBook, which has an entry like "Issued Wipe Computer Command." This is just a confirmation that a wipe command has been sent, but not confirmation that the machine has actually been wiped, am I correct?

Just in case this matters: We have a mix of preStage-enrolled and user invited-enrolled machines.

Best regards,
Floh

[joshuasee]

MDM commands, including DeviceWipe, are both sent and acknowledged*, which you can see in the logs. If it is acknowledged, the next thing the device does is start the wipe, meaning it will never offer any further reports under that enrollment, so you can never get a "Device is wiped" report, but you can be confident the acknowledgement means that.

* Under the DeviceName | History | Management History | Completed Commands

[enewton]

You could also use File flags and Smart Groups. Once your device is selected for wiping copy or create a file on the device and have a smart group that searches for that file, you could also use email notification to get notified when devices are moved into or out of group membership if you needed that kind of notification. 

[MelodyHammes]

Yes, you're correct. The entry "Issued Wipe Computer Command" in the Audit Logs confirms that the wipe command has been sent to the MacBook. However, it doesn't confirm the completion of the wipe process. To ensure the wipe's success, you might want to check for subsequent logs indicating the completion of the wipe or any error messages. Additionally, if it's a managed device, your mobile device management (MDM) platform might provide more detailed information on the status of the wipe.

[floh]

Hi everybody,

Thank you very much for the feedback. That's what I feared. Our data protection officer would like to see a protocol of the actual executed wipe process, which is why I opened a thread here.

I will discuss with him whether we could document it differently. All colleagues are working from home, far away from the office. That's why we use Jamf Pro, allowing me to remotely manage the MacBooks.

Best regards
Florian Erfurth