D5Critical3 devices
Devices belonging to accounts that have left
A managed laptop whose owner has left is either in a drawer, at a home address, or still in daily use by someone the directory does not know about. It still holds a compliance state and a certificate.
Evidence
| Device | Owner | Left | OS | Last check-in | Compliance | Encrypted |
|---|---|---|---|---|---|---|
| VG-LT-0417 | b.rennesund@vestholm.no | 30 Apr 2026 | Windows 11 | 14 Aug 2026 | Compliant | Yes |
| VG-LT-0388 | t.oksefjell@vestholm.se | 31 May 2026 | Windows 11 | 02 Aug 2026 | Compliant | Yes |
| VG-MB-0121 | m.haugsdal@vestholm.no | 14 Jun 2026 | macOS 15 | 09 Jul 2026 | Not evaluated | Unknown |
How this was derived
device.registeredOwner.employeeLeaveDateTime < 2026-08-20 AND device.managementState = 'managed'
- Devices read
- 968
- Owned by leavers
- 3
If closed
+3 points3 devices recovered or wiped3 certificates retired
Fix
Attach device return to the offboarding order, so the hardware is recovered or wiped on the same record as the account.
requires write access
Related findings