On this page0
Guide
If you think an account or a computer has been compromised
Shut the door first, then find out what happened: block the account, cut its sign-ins and tokens, lock the computer, and read what the account did.
Before you start
- You do not need to be sure. Steps 1 to 5 delete nobody’s data, and the account can be switched back on afterwards, so act on a suspicion and check later.
- A role that lets you manage users (steps 1 and 2) and one that lets you manage security settings (steps 3 to 5). Administrators have both.
- For the computer steps: the right to manage devices, and the computer must be enrolled in Zonitix.
- If it is your own account you are worried about and you can still sign in, ask another administrator to do steps 1 to 5 on your account, or start with Your profile and sign-in security.
Shut the account
Step 1: Disable the account
Go to AdministrationUsers and find the person. Click the pencil on their row, open “Access”, set “Account Status” to “DISABLED” and click “Update User”.
The person cannot sign in by any route, and a browser where they are already signed in stops working at its next click. Their groups, roles and records are untouched, so you can switch the account back to “ACTIVE” when you are satisfied. Tell the real owner of the account by phone or in person, not by a message the intruder could read.
Step 2: Expire the password
On the same row, click the key button. Its tooltip reads “Expire password: sign out everywhere and require a new password at next sign-in”. Confirm with “Expire password”. The person is signed out everywhere and must set a new password the next time they sign in.
The button is greyed out for someone who signs in through Okta, Entra or Google; its tooltip then reads “This account signs in through its directory — reset the password there”. Do that in the directory, and block the person there too.
Step 3: Reset their MFA
Click the red shield button on the row (its tooltip reads “Account security: reset MFA or revoke trusted devices”) and choose “Reset MFA”. This removes every second factor on the account: the authenticator app, all passkeys, the recovery codes and every trusted device. Do it when the phone is lost or stolen, or when you cannot rule out that the intruder added a passkey or an app of their own. Zonitix asks you to confirm it is you before it goes ahead.
The person sets up a second factor again, and gets new recovery codes, the next time they sign in.
Step 4: Or only revoke trusted devices
If the second factor itself is safe (the person still has their phone) but a laptop they had ticked “Trust this device for 30 days” on is out of their hands, use the same shield button and choose “Revoke trusted devices” instead. Their MFA is kept, and every browser asks for the second factor again.
Step 5: Revoke their API tokens
An API token is a long password that a script uses in place of a person. Go to SystemAPI Tokens and open “All tokens (admin)”, which lists every token in your organization with its owner. Each token has a label: “Active”, “Invalidated”, “Revoked” or “Expired”. Click “Revoke” on each “Active” token that belongs to the account and confirm with “Revoke token”. It stops working within a second.
Expiring the password in step 2 already stops, for good, every token the person made before that moment. Those tokens show “Invalidated” and have no “Revoke” button, because there is nothing left to revoke.
If step 2 was not possible because the account signs in through a directory, the tokens still show “Active”, and revoking is what counts. A token stops working while its owner’s account is blocked, but a copied one would work again the moment you switch the account back to ACTIVE.
Deal with the computer
Step 6: Lock it, or erase a Mac
Go to DevicesInventory, find the computer and click “Manage”. In the “Agent” group, click “Lock screen” and confirm. It locks a Linux computer, or a Windows one that someone is signed in to; on a Mac running current macOS the command reports failed, so use the Apple MDM lock below for a Mac. It is an ordinary screen lock: whoever knows the computer’s password can unlock it. The command is not instant: the computer picks it up the next time it checks in, so a laptop that is switched off locks when it is next online. Until then the row shows “Lock queued”.
A Mac enrolled in Apple MDM has two stronger buttons in the “Remote — MDM” group. “Lock” keeps the Mac locked until someone types its 6-digit PIN on the machine; “Show unlock PIN” gives you that PIN. “Erase” wipes the Mac for good: it asks why, makes you type ERASE, and cannot be undone. It is shown only to people allowed to take destructive device actions.
Find out what happened
Step 7: Read what the account did
Go to SystemSystem Logs. In the “User” filter, pick the person or type part of their email address, and set “Time Range” to cover the days you are worried about. The list shows every sign-in and every change made under that account, newest first. Click the download arrow (“Export current view to CSV”) to keep a copy. See who did what (the audit log) explains each column.
Look for sign-ins at odd hours, an address in the “SOURCE” column that you do not recognise, changes to roles or groups, new API tokens, and anything exported or downloaded.
Step 8: Block where it came from, if you can tell
If the log shows the sign-ins came from one address or one country you have no staff in, you can block it. See Block countries and IP addresses, and add your own office address to the trusted list first so you do not lock yourself out.
Step 9: Tell the right people
Tell whoever in your company is responsible for security, and the owner of the account. If the person also has accounts in other systems, those are separate: change those passwords in each system, or in the directory they sign in through.
If you need help reading what you found, see Contact Zonitix support. Zonitix support has no sign-in to your app unless you grant one. If you believe the fault is in Zonitix itself, write to security@zonitix.com instead.
What you should see
The account’s row in Users shows the status “DISABLED”. After step 2 a green message reads “Password expired for” followed by the name, and says they were signed out and must set a new password at next sign-in.
In “All tokens (admin)” none of the person’s tokens is still labelled “Active”, and the computer’s row in Inventory shows “Lock queued” until the lock is delivered.
Expiring the password, resetting MFA and revoking trusted devices are each written to the audit log, as their confirmation windows say, so what you did is on record next to what the account did.
If something goes wrong
- The pencil and the key button on the row are greyed out
- That row is the primary administrator. Nobody can disable that account or expire its password from the Users page. Steps 3 to 5 still work on it: the red shield button offers “Reset MFA” and “Revoke trusted devices”, and its API tokens can be revoked in “All tokens (admin)”. Do those first. For the password, see step 5 of When your main administrator leaves.
- There is no red shield button, or no All tokens (admin) tab
- Both need a role that lets you manage security settings. Ask an administrator to do steps 3 to 5.
- The computer is not in Inventory
- It was never enrolled, so Zonitix cannot lock it. Carry on with the account steps, which do not depend on the computer. See Enroll a device for next time.
- The person has left, or is not coming back
- Disabling is for a suspension. To remove a leaver’s access everywhere, see Offboard someone.
- You disabled the wrong person
- Set Account Status back to ACTIVE and save. Nothing was removed. If you also reset their MFA or expired their password, they set those up again at their next sign-in. After a password expiry the API tokens they had made before it stay stopped, so they create new ones under System, API Tokens.
Still stuck? See When something goes wrong, or Contact Zonitix support.