Technical · Course T7Lesson 1 of 4
Device states and the fleet view
7 min read- Name each device state and what triggers it
- Distinguish Inactive from Lost, Replaced, and Deleted
- Diagnose a device that shows the wrong state
Before you touch a single remote command, you need to read the board. WeGuard gives every managed device a state, and misreading one is how support tickets get opened for devices that are working perfectly.
The states
| State | What it means |
|---|---|
| Enrolled | Enrollment completed; may not be fully provisioned yet |
| Unprovisioned | Enrolled, but provisioning never finished (UUID not saved) |
| Active | Provisioned and has contacted the server within the active threshold |
| Inactive | Provisioned but hasn't checked in within the threshold |
| Lost / Stolen | An admin marked it — it's a human decision, not a detection |
| Replaced | Decommissioned in a hardware swap; excluded from active counts |
| Deleted | Soft-deleted from the fleet |
The distinction that matters most in customer conversations: Inactive is about silence, not loss. A device in a warehouse over a long weekend goes Inactive and returns to Active on its next heartbeat — nothing is wrong. Lost and Stolen, by contrast, only ever appear because a person clicked a button.
How devices move
The normal path runs Enrolled → Unprovisioned → Active, with Active and Inactive flipping back and forth for the rest of the device's life as it contacts the server or doesn't. Provisioning is the step that promotes a device out of Unprovisioned; after that, the heartbeat governs everything.
The admin-driven states branch off the side: mark a device Lost and it gets admin-locked with a message; Mark as Active later clears the lost/stolen/replaced flags and unlocks it. Replaced is the one built for hardware swaps — it removes the unit from active counts and reports while keeping its history, and a Restore action reverses it. Delete is the terminal one, and it cannot be undone from the portal: re-enrollment is the only way back.
Reading the device list
The fleet view is where triage starts. Devices are searchable and filterable by device ID, admin tag, user tag, policy, and status — the four handles that answer most "find me the device that…" questions. Clicking a row opens the device detail page, which lands on the Actions tab: quick commands up top, device information below, and the deeper Ops tab one click away.
Two habits separate fast operators from slow ones. First, filter by status before
you filter by anything else — it immediately separates "the fleet is fine" from
"something systemic broke." Second, when a customer reports a device "not working,"
check lastContactTime and whether the device's applied policy version matches the
current one: a device that hasn't synced is running yesterday's rules, and that
single check resolves a surprising share of tickets before any command gets sent.