Offline inactivity lock or wipe policies across Android, Windows, macOS and iOSSolved

Hi @sybylla,

Hexnode handles this differently depending on the platform, mainly because each OS exposes different local management capabilities.

Android

Hexnode supports activity-based local automation for Android. You can configure an automation rule with an Inactivity trigger and choose actions such as Lock Device, Enable Lost Mode, or Wipe Device. This can help when you need an action to trigger based on inactivity without waiting for a live console command.

Path:

1. Log in to the Hexnode UEM console.
2. Navigate to the Automate tab and click New Automation.
3. Select the target platform.
4. Under Create New Automation, select Quick.
5. Under Triggers and Schedules, select Event > Inactivity, then choose either On Device Inactive or Device inactive for specific period.
6. Under Choose Actions, select the desired action: Lock Device, Enable Lost Mode, or Wipe Device.
7. Proceed to Targets / Assignments to assign the rule to the required devices or device groups, then save the automation.

Windows

Hexnode does not provide a native offline inactivity automation rule for Windows. A possible approach is to deploy a custom PowerShell script that locally monitors idle time or network disconnect duration and then triggers a lock or wipe action locally. For wipe scenarios, this may involve Windows management components such as the MDM_RemoteWipe WMI class. This should be tested carefully before production use.

macOS

macOS does not support a native MDM-based offline trigger for automatic lock or wipe. Remote lock and wipe commands require the device to receive the command through Apple’s MDM/APNs flow, so the Mac must come online. Although scripts can be deployed to macOS, silent local wipe workflows are restricted by modern macOS security requirements.

However, app restrictions such as macOS blocklists are stored locally after deployment. Once the blocklist policy has reached the Mac, the selected apps remain blocked even if the device later goes offline.

iOS

iOS does not allow background scripts or arbitrary local automation because of Apple’s sandboxing and MDM framework restrictions. Remote wipe, Lost Mode, and lock commands require network connectivity.

For iOS theft-prevention hardening, use pre-deployed controls such as supervised enrollment, Kiosk Mode, restrictions to prevent access to settings where applicable, disabling manual erase from settings, and Activation Lock through Apple Business where supported.

Regards,
Sienna Carter
Hexnode UEM

What about non-compliance rules? If I mark a device as non-compliant after it has no internet for two days, will the lock or wipe action happen while it is still offline?

For iOS, if someone steals a supervised device, knows the passcode, and puts it in Airplane Mode, does that mean remote wipe or Lost Mode won’t help until the device reconnects?

Hi @sybylla,

Non-compliance actions are different from local inactivity automation.

If the device is offline, server-driven actions such as Lock Device or Wipe Device cannot be delivered immediately. The command will remain in a Pending state in the Hexnode console. Once the device reconnects to Wi-Fi or cellular data, Hexnode pushes the queued command and the action is executed.

So, for Android:

• Inactivity automation can be used for local inactivity-based actions.
• Non-compliance actions that require server communication are queued while the device is offline and run after reconnection.

For iOS, if an iOS device is offline or in Airplane Mode, new remote commands such as Remote Wipe, Lost Mode, or Lock Device cannot reach it until the device reconnects.

The practical approach is layered protection before the device is lost:

• Kiosk Mode: If the iPhone or iPad is already locked into Single App or Multi-App Kiosk Mode, the user cannot freely access Settings, Control Center, or non-allowed apps depending on the kiosk configuration.
• Pre-deployed restrictions: Restrictions already installed on the device continue to apply offline.
• Disable manual erase from settings: On supervised devices, restrict access to Erase All Content and Settings where applicable.
• Activation Lock / Apple Business supervision: If the device is supervised and enrolled through Apple Business, Activation Lock and supervision help prevent reuse or re-enrollment after an attempted reset.
• Pending commands: If you send a wipe or Lost Mode command while the device is offline, it remains pending and executes when the device reconnects.

These do not create a true offline wipe trigger on iOS, but they reduce what an unauthorized user can do while the device is disconnected.

Regards,
Sienna Carter
Hexnode UEM