ts device

Show, disable, enable, or delete a device: a computer that signs in as itself. Disable a computer that is lost or should stop reaching the server for now, and delete one that is retired.

Usage

ts devices [--csv] [--no-trunc]
ts device <id>
ts device disable <id> [--force]
ts device enable <id>
ts device delete <id> [--force]

Description

A device signs in with a key of its own rather than as a person: it is a computer a deployment enrolled, or one a person registered as their own. ts devices lists every device in name order, with its operating system, its owner, the deployment that manages it, when it was last seen, its status, and its ID. ts device <id> also shows the people who use it and the person whose token enrolled it, as Set up by:. Every singular form names a device by the ID ts devices prints; a name is not accepted.

The status is one of:

• Active — it holds a live key, and signs in.
• Disabled — an administrator disabled it. It signs in nowhere, whatever key it holds.
• No key — it holds no live key, so it signs in nowhere.

The same devices are in the Administration site under Identity → Devices, which also moves a deployment's device to another deployment and changes its owner.

Disabling, Enabling, and Deleting

disable asks first, then stops the device signing in within five minutes and ends its guests' visits. A disabled device keeps its deployment, its owner, and its key, and cannot enroll again until it is enabled. enable lets it sign in again with what it had, and does not ask.

delete asks first, then removes the device for good: its key stops working, its guests' visits end, and no one's secrets are shared with it any more. It leaves every list. A computer that enrolls or registers again afterwards is a new device, trusted again only by the people who approve it.

To keep a computer out, disable it rather than delete it: a deleted device can come back by enrolling or registering again, while a disabled one stays out until you enable it.

Disabling, enabling, and deleting are recorded in the operator audit log with the acting administrator, as DeviceDisabled, DeviceEnabled, and DeviceRemoved. Disabling a device that is already disabled, or enabling one already enabled, changes and records nothing.

Devices and Device Keys

ts device-key revokes a different kind of key: a person's sign-in key, which signs one person in on one computer. Revoking it cuts that computer off without touching the account. A computer that signs in that way is not a device and is not listed here; the Administration site lists those keys under Identity → Device Keys. A device's own key goes with the device, so disable or delete the device instead.

Options

Flag	Description	Default/Values	Notes
--force, -f	Skip the confirmation prompt.		disable and delete. Required when there is no terminal.
--csv	Tab-separated output, nothing truncated.		ts devices only.
--no-trunc	Do not truncate columns.		ts devices only.

Examples

# Which computers sign in as themselves, and which are disabled?
ts devices

# One device, with the people who use it and who set it up
ts device 3f2504e0-4f89-11d3-9a0c-0305e82c3301

# A laptop is lost: stop it signing in and end its guests' visits
ts device disable 3f2504e0-4f89-11d3-9a0c-0305e82c3301

# It turned up: let it sign in again
ts device enable 3f2504e0-4f89-11d3-9a0c-0305e82c3301

# Retire a kiosk for good, from a script
ts device delete 8a1c7e42-90bb-4d15-a3f7-6c2e0b9d4517 --force

# Who disabled a device, and when?
ts audit --event=DeviceDisabled

# Deleting a stolen laptop does not keep it out: it can enroll or register
# again as a new device. Disable it instead.
ts device delete 3f2504e0-4f89-11d3-9a0c-0305e82c3301 --force

Output

NAME        OS                     OWNER  DEPLOYMENT       LAST SEEN         STATUS    ID
FIN-LT-042  Windows 11 Enterprise  bob    Finance Laptops  2026-10-21 07:45  Active    3f2504e0-4f89-11d3-9a0c-0305e82c3301
LOBBY-07    Windows 11 Pro                Lobby Kiosks     2026-10-14 18:20  Disabled  8a1c7e42-90bb-4d15-a3f7-6c2e0b9d4517
MBP-ALICE   macOS 15.1             alice                   2026-10-21 08:02  Active    c41f0d8a-2b77-4c19-9e0a-1d3b6f2e5a90

Device:      FIN-LT-042
OS:          Windows 11 Enterprise
Owner:       bob
Used by:     bob, carol
Deployment:  Finance Laptops
Set up by:   alice
Last seen:   2026-10-21 07:45
Status:      Active
ID:          3f2504e0-4f89-11d3-9a0c-0305e82c3301

A field with nothing to show prints -.

Exit Codes

0 on success, including disabling a device already disabled and enabling one already enabled. -1 when the ID is missing or is not a device ID, and when you answer no at the prompt, or there is no terminal and --force was not passed. -3 when the server cannot be reached. -4 when no account is signed in. -5 when the account is not a Server Administrator. -6 when no device has that ID.

Related Commands

• ts device-key — Revoke a person's sign-in key, which is not a device.
• ts user — The people who own and use devices.
• ts audit — Who disabled, enabled, or deleted a device, and when.