Office was broken into... super sleuth discovery session...
Last month, our overseas office was broken into and 8 of our iMacs were stolen. I tried to find out any information I could from the Meraki but found little.
The security company we use does give compensation when they didn't make it to the building within 3 minutes. However, they said they did get to the building in less than three minutes.
It's not the easiest thing to understand. I'm guessing they received the notification that the alarm had sounded at 04:51:59 when their vehicle speed was 9km/hour. And then arrived at the office at 4.54:13 when their vehicle speed was 0km/hr.
When I checked the Meraki I can see that two of the iMacs (first two rows below) were 'client association expired' at 03:54 and 03:53 and never seen again. That was an hour before the breakin however. Does anyone know what that 'client assocation expired' could mean? Would it only be the case if the computers were taken off the network (turned off/disconnected) and not just a usual situation where they have gone to sleep?
802.11 disassociation: Client association expired - Client was disassociated due to inactivity. ... This problem is typically associated with wireless interference, but can be caused by any issue that would cause a client to suddenly stop being heard by an AP.