> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Wiping devices

> Remotely erase a managed Mac, Windows, or Linux device from the Primo cockpit. This is critical when a device is lost, stolen, or being reassigned. Understand the wipe options available per platform and when to use each.

## Platform compatibility

| macOS | Windows | Linux | iOS / iPadOS | Android |
| ----- | ------- | ----- | ------------ | ------- |
| ✅     | ✅       | ✅     | ✅            | ❌       |

## Wipe a device

1. Go to **Devices** and open the device details page.
2. Click **Actions > Wipe**.
3. Select the wipe mode (where applicable).
4. Confirm the action.

The device receives a **Wipe pending** status. Once acknowledged, it updates to **Wiped**.

<Tabs>
  <Tab title="macOS">
    On macOS, a remote wipe erases all user data and reinstalls macOS from recovery. The Mac returns to factory defaults.

    * If the device has Activation Lock enabled, disable it first or confirm a valid bypass code is escrowed — see [Activation Lock bypass](/mdm/guides/activation-lock-bypass).
    * For zero-touch deployment devices, the Mac automatically re-enrolls on first boot.
    * Otherwise, the employee must re-enroll manually.

    **Before wiping: release Activation Lock**

    If Activation Lock is still active when the wipe completes, the Mac reboots to the **Activate Mac** screen and asks for the previous user's Apple ID. On supervised devices the escrowed bypass code unlocks it, but on unsupervised (manually enrolled) devices the code can be a false positive — see [the three scenarios](/mdm/guides/activation-lock-bypass#the-three-scenarios).

    While the device is still accessible and unlocked:

    1. Open **System Settings** and select the user's Apple Account.
    2. **Sign out of iCloud** — this disables Find My Mac. The user's Apple ID password is required.
    3. Confirm **Find My Mac** is disabled and no Apple Account session remains.
    4. Back up any data you need — the wipe is irreversible.
    5. Launch the wipe.
    6. After the device reboots, confirm it reaches Setup Assistant without showing the Activate Mac screen.

    <Warning>
      On an unsupervised Mac, never wipe before signing the user out of iCloud. If Find My was enabled before MDM enrollment, no valid bypass code exists and the device will lock on the Activate Mac screen. Recovery then requires the former user or Apple Support — see [Recover a Mac stuck on the Activate Mac screen](/mdm/guides/activation-lock-bypass#recover-a-mac-stuck-on-the-activate-mac-screen).
    </Warning>
  </Tab>

  <Tab title="Windows">
    Primo offers two wipe modes for Windows: **Standard wipe** and **Hard wipe**. Each maps to a different Microsoft MDM command and has different behavior.

    |                               | **Standard wipe**                                                                                 | **Hard wipe**                                                                                                       |
    | ----------------------------- | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
    | **Microsoft command**         | [`doWipe`](https://learn.microsoft.com/en-us/windows/client-management/mdm/remotewipe-csp#dowipe) | [`doWipeProtected`](https://learn.microsoft.com/en-us/windows/client-management/mdm/remotewipe-csp#dowipeprotected) |
    | **What it does**              | Factory reset equivalent to **Reset this PC > Remove everything**                                 | Fully cleans the internal drive and keeps retrying until complete                                                   |
    | **Can be interrupted**        | Yes — power-cycling can stop the process                                                          | No — resumes automatically after any interruption                                                                   |
    | **If interrupted**            | Attempts roll-back; if roll-back fails, device may be unusable                                    | Retries on next boot until complete                                                                                 |
    | **Risk of unbootable device** | Low                                                                                               | Higher                                                                                                              |
    | **Best for**                  | Device reassignment, routine refresh                                                              | Lost or stolen devices, confirmed security incidents                                                                |

    **When to use each mode**

    | Scenario                                      | Recommended mode                                                          |
    | --------------------------------------------- | ------------------------------------------------------------------------- |
    | Device lost or stolen                         | **Hard wipe** — ensures data is erased even if the process is interrupted |
    | Employee offboarding with device reassignment | **Standard wipe** — sufficient when you have physical access              |
    | Device compromised by malware                 | **Hard wipe** — guarantees a full clean even if malware interferes        |
    | Routine device refresh                        | **Standard wipe** — lower risk, easier recovery if something goes wrong   |

    **Limitations**

    * **Windows Home is not supported** — remote wipe requires Windows Pro, Enterprise, or Education. See [platform support](/mdm/get-started/supported-platforms).
    * **Wipe is irreversible** — you cannot cancel it once initiated and acknowledged.
    * **BitLocker recovery key** — the previous key is no longer valid after a wipe. Ensure it is backed up beforehand.
  </Tab>

  <Tab title="Linux">
    On Linux, a remote wipe erases device data via a script the Fleet agent executes. Behavior depends on the distribution, disk layout, and encryption setup. You may need to reinstall the OS from scratch.
  </Tab>
</Tabs>

***

## Related articles

* [Locking devices](/mdm/guides/locking-devices)
* [Activation Lock bypass](/mdm/guides/activation-lock-bypass)
* [Set up Zero Touch for Mac](/mdm/zero-touch/zero-touch-macs)