Skip to main content
This guide applies to Windows devices

​
About Device Erase

When you erase a Windows device, Iru Endpoint sends a remote wipe command over MDM. You choose one of three erase types. The type you select controls how Windows is reinstalled and how the device handles an interrupted wipe. None of the three erase types retain user data. All three remove all data and apps from the device, equivalent to a factory reset. Back up anything you need to keep before you erase. For Apple devices, see Erase an Apple Device. For Android devices, see Erase an Android Device.

​
Erase Windows Devices

1

Navigate to Device Record

Navigate to the Device Record in the Iru Web App.
2

Open Device Action Menu

Open the Device Action Menu (ellipsis).
3

Select Erase Device

Select Erase Device.
4

Choose Erase Type

In the confirmation dialog, choose an Erase type:
  • Local: Rebuilds Windows using the recovery image already stored on the device
  • Cloud: Downloads a fresh copy of the Windows installation files from Microsoft’s servers
  • Protected: Fully cleans the internal drive and continues retrying until the wipe completes. Recommended for lost or stolen devices
5

Confirm Erase

Type ERASE in the confirmation field and click Erase Device to send the command.
The erase command is queued and will execute the next time the device is connected to the internet.

​
Choose an Erase Type

​
Local

  • Fastest option, and does not require an internet connection to reinstall Windows.
  • Equivalent to Reset this PC > Remove everything in Windows Settings with Keep my files turned off.

​
Cloud

  • Returns the device to a current, unmodified Windows build.
  • Useful when the local recovery image is missing, outdated, or otherwise untrusted.

​
Protected

  • Performs the most thorough wipe available.
  • Designed by Microsoft for lost or stolen devices.
  • Unlike Local, Protected does not prioritize rolling back to a working state if interrupted. It prioritizes leaving the drive clean.
  • In some device configurations, a Protected erase can leave the device unable to boot. This is expected behavior. The goal is to ensure data is removed, not to preserve a bootable device.

​
Considerations

Default to Local for standard offboarding

Local is the fastest option and does not depend on network connectivity. Use it for routine device retirement or reimaging when you have the device on hand and do not need the latest Windows build.

Use Cloud when the recovery image may be unreliable

Use Cloud when you want a current, unmodified Windows build, or when you cannot trust the local recovery image. That includes a missing or outdated image, a history of failed resets, or a corrupted recovery partition.

Use Protected for lost or stolen devices

Use Protected when the device is lost, stolen, or otherwise outside your physical control. Queue it as soon as the device is reported lost or stolen so it runs the next time the device connects.
Local and Protected erases both carry a risk that an interrupted wipe leaves the device unable to boot, requiring a manual Windows reinstall to recover. This is how Windows handles interrupted resets, and it is not controlled by Iru Endpoint. Protected accepts this risk intentionally: it prioritizes completing the wipe over preserving a bootable device, which is appropriate when data protection is more important than recovering the hardware.
Erasing a device permanently deletes all data and cannot be undone. Back up anything you need to keep before you proceed.

Erase an Apple Device

Remotely erase a Mac, iPhone, iPad, Apple TV, or visionOS device

Erase an Android Device

Factory reset a managed Android device, including optional external storage and eSIM erase

Lock a Device

Remotely lock a managed device and optionally display a message on the lock screen

Deleting a Device Record and Uninstalling Iru Endpoint

Delete device records and uninstall Iru Endpoint when preparing devices for reassignment or removal