> ## Documentation Index
> Fetch the complete documentation index at: https://iru-kbee-63-enhance-rts-documentation.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Erase a Windows Device

> Remotely wipe a managed Windows device from Iru Endpoint. Choose Local, Cloud, or Protected erase to remove all data and apps.

<Callout icon="microsoft" color="#B84A7A" iconType="regular">This guide applies to Windows devices</Callout>

### About Device Erase

When you erase a Windows device, Iru Endpoint sends a remote wipe command over MDM. You choose one of three erase types. The type you select controls how Windows is reinstalled and how the device handles an interrupted wipe.

None of the three erase types retain user data. All three remove all data and apps from the device, equivalent to a factory reset. Back up anything you need to keep before you erase.

For Apple devices, see [Erase an Apple Device](/en/endpoint/devices/device-actions/erase-a-device). For Android devices, see [Erase an Android Device](/en/endpoint/devices/device-actions/erase-an-android-device).

### Erase Windows Devices

<Steps>
  <Step title="Navigate to Device Record">
    Navigate to the **Device Record** in the Iru Web App.
  </Step>

  <Step title="Open Device Action Menu">
    Open the **Device Action Menu** (ellipsis).
  </Step>

  <Step title="Select Erase Device">
    Select **Erase Device**.
  </Step>

  <Step title="Choose Erase Type">
    In the confirmation dialog, choose an **Erase type**:

    * **Local**: Rebuilds Windows using the recovery image already stored on the device
    * **Cloud**: Downloads a fresh copy of the Windows installation files from Microsoft's servers
    * **Protected**: Fully cleans the internal drive and continues retrying until the wipe completes. Recommended for lost or stolen devices
  </Step>

  <Step title="Confirm Erase">
    Type `ERASE` in the confirmation field and click **Erase Device** to send the command.
  </Step>
</Steps>

<Note>
  The erase command is queued and will execute the next time the device is connected to the internet.
</Note>

### Choose an Erase Type

| Erase type | How Windows is reinstalled                                                        | If the wipe is interrupted                                                                                                                        |
| ---------- | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| Local      | Uses the recovery image already stored on the device                              | Windows attempts to roll back to its pre-wipe state. If rollback fails, the device can become unusable and may require a manual Windows reinstall |
| Cloud      | Downloads a fresh copy of the Windows installation files from Microsoft's servers | The device must remain connected to the internet for the duration of the wipe                                                                     |
| Protected  | Fully cleans the internal drive                                                   | Continues retrying until the wipe completes, even if the device is power cycled. Can leave the device unable to boot                              |

#### Local

* Fastest option, and does not require an internet connection to reinstall Windows.
* Equivalent to **Reset this PC > Remove everything** in Windows Settings with **Keep my files** turned off.

#### Cloud

* Returns the device to a current, unmodified Windows build.
* Useful when the local recovery image is missing, outdated, or otherwise untrusted.

#### Protected

* Performs the most thorough wipe available.
* Designed by Microsoft for lost or stolen devices.
* Unlike Local, Protected does not prioritize rolling back to a working state if interrupted. It prioritizes leaving the drive clean.
* In some device configurations, a Protected erase can leave the device unable to boot. This is expected behavior. The goal is to ensure data is removed, not to preserve a bootable device.

### Considerations

<CardGroup cols={2}>
  <Card title="Default to Local for standard offboarding" icon="laptop">
    Local is the fastest option and does not depend on network connectivity. Use it for routine device retirement or reimaging when you have the device on hand and do not need the latest Windows build.
  </Card>

  <Card title="Use Cloud when the recovery image may be unreliable" icon="cloud">
    Use Cloud when you want a current, unmodified Windows build, or when you cannot trust the local recovery image. That includes a missing or outdated image, a history of failed resets, or a corrupted recovery partition.
  </Card>

  <Card title="Use Protected for lost or stolen devices" icon="shield">
    Use Protected when the device is lost, stolen, or otherwise outside your physical control. Queue it as soon as the device is reported lost or stolen so it runs the next time the device connects.
  </Card>
</CardGroup>

Local and Protected erases both carry a risk that an interrupted wipe leaves the device unable to boot, requiring a manual Windows reinstall to recover. This is how Windows handles interrupted resets, and it is not controlled by Iru Endpoint. Protected accepts this risk intentionally: it prioritizes completing the wipe over preserving a bootable device, which is appropriate when data protection is more important than recovering the hardware.

<Warning>
  Erasing a device permanently deletes all data and cannot be undone. Back up anything you need to keep before you proceed.
</Warning>

### Related Articles

<CardGroup cols={2}>
  <Card title="Erase an Apple Device" icon="apple" iconType="brands" href="/en/endpoint/devices/device-actions/erase-a-device">
    Remotely erase a Mac, iPhone, iPad, Apple TV, or visionOS device
  </Card>

  <Card title="Erase an Android Device" icon="android" iconType="brands" href="/en/endpoint/devices/device-actions/erase-an-android-device">
    Factory reset a managed Android device, including optional external storage and eSIM erase
  </Card>

  <Card title="Lock a Device" icon="lock" href="/en/endpoint/devices/device-actions/lock-a-device">
    Remotely lock a managed device and optionally display a message on the lock screen
  </Card>

  <Card title="Deleting a Device Record and Uninstalling Iru Endpoint" icon="trash" href="/en/endpoint/devices/device-record-management/deleting-a-device-record-and-uninstalling-iru-endpoint">
    Delete device records and uninstall Iru Endpoint when preparing devices for reassignment or removal
  </Card>
</CardGroup>