You open the office network list and find a device nobody recognizes. The name looks nothing like the phones, laptops or payment terminal you bought. Blocking it feels sensible, until you wonder whether the next customer's payment will stop working.
To identify an unknown device on your business network, check its current connection, compare its address with the actual equipment, and confirm who owns it. Then review what it is allowed to reach. An unfamiliar label alone does not prove an intrusion, and a familiar label does not prove a device belongs there.
We would start with those checks before changing security settings across the office. If you also have suspicious account activity, malware warnings or signs of an active incident, involve the person responsible for security immediately. Identification should support containment, not delay it.
Check whether the device is connected now
A network screen may show current devices alongside entries it remembers from earlier visits. Ask the administrator to check the status and last seen time. An old visitor's phone in a history list is a different problem from an unidentified device connected to the staff network today.
Record the name shown, the network it joined and whether it is wired or wireless. Where the equipment provides it, also record the connected port or access point, the device that provides wireless coverage. A nearby access point is a starting clue, not proof of which person owns the device.
Two addresses may appear. An IP address is the address used to reach a device on that network. A MAC address identifies a network connection at the local link level. Neither is a person's identity, and neither should be treated as a permanent asset tag. Keep the observation time with both.
- Is the entry currently connected, disconnected or simply retained in history?
- Is it on the guest network, staff network or a network reserved for equipment?
- Does its arrival match an approved installation, visitor or staff device replacement?
- Is there a related security alert, or is the concern only an unfamiliar name?
Keep this record private. A public screenshot can expose staff names, device addresses and details about the business network. Share only what the authorized support person needs through an approved channel.
A private wireless address can look like a new device
Some phones and computers use a private wireless address for each network. That reduces the ability to follow the same device across different places. Depending on the device, software and network settings, the address may stay fixed for that network or change over time.
That means the address printed on a box, or shown in a general hardware screen, may not match the one your office sees. Ask the owner to open the connection details for the exact office network and compare the address shown there. Do not assume that every unexpected entry is another physical device.
A laptop connected by WiFi and through a wired dock can also present different network connections. Match the connection being investigated, not merely the laptop model. Manufacturer guesses and automatically detected device types help narrow the search, but they are not proof of ownership.
Do not ask everyone to turn off privacy settings on personal phones just to tidy the device list. Identify the current connection first. Company devices may need a centrally managed policy, but that decision belongs with the administrator and the business's device rules.
Match the record to equipment without interrupting the shop
Compare the entry with your equipment list and ask who is responsible for it. Include less obvious devices: the receipt printer, meeting room display, delivery scanner or a contractor's approved equipment. Confirm the device itself, rather than accepting a name that happens to look familiar.
For an ordinary staff device, the administrator may arrange a brief disconnect and reconnect while watching the corresponding entry. Save work and agree on the interruption first. Recheck the address afterwards because the device's privacy behavior may affect the record.
Do not perform that experiment on payment equipment, door controls, cameras or production machinery without the responsible operator's approval. A wired port may serve a desk phone with a computer connected through it, or several devices behind another networking box. Disabling that port can interrupt more than the one row you selected.
Avoid opening an unknown device's web page, trying passwords or installing an unapproved scanner to find out what it is. Your administrator can investigate with authorized tools and records. The business owner's useful contribution is the equipment owner, location and reason it should be connected.
Identify the device, then decide what it should be allowed to reach. Giving it a friendly name only solves the first part.Blocking an address is not the same as resolving the problem
If the device is unauthorized, ask the administrator to choose a containment method that fits its connection and the incident. A supported wireless client block, a wired port restriction or a separate restricted network can have different effects. Availability and enforcement depend on the installed equipment and settings.
An address filter recognizes an address, not the person or physical device behind it. Addresses can change or be copied. Do not treat an allow list as a substitute for properly authenticated access, maintained devices and rules that limit what each network can reach.
Ask what the restriction actually prevents. Losing internet access is not proof that a device can no longer reach another office computer. Have the administrator test the intended local and internet restrictions, then confirm that approved business equipment still works.
If an unauthorized person obtained a shared wireless password, the administrator may need to replace that credential and reconnect approved equipment. That does not address a wired connection, an infected laptop or compromised business accounts. The response needs to follow the evidence rather than stop at a cleaner device list.
For a separate warning about detected malicious traffic, see our guide to checking whether a business firewall threat was blocked. A device inventory and a threat investigation answer different questions.
Make commercial network security easier to verify next time
Once ownership is confirmed, label the entry with a useful business description and keep the equipment record current. Record who approved it, its purpose and the access it needs. Avoid putting unnecessary personal information into labels visible to other administrators.
Separate visitor access from business equipment, then test the separation. A different WiFi name alone is not proof that guests cannot reach office devices. Our guest network isolation guide explains that distinction.
Decide who reviews new or unexplained devices and what happens when a staff member leaves or equipment is replaced. Supported alerts can help, but a notification needs a named recipient and an agreed response. Do not assume someone is watching simply because a setting exists.
For a Windsor or Essex County business, NeuroDesk's commercial network security and access review is the relevant starting point. Tell us which network showed the unfamiliar device, whether it is connected now and whether any work or security alerts are affected. Keep passwords and complete device lists out of a general enquiry form.
Ask for a review that distinguishes an incomplete inventory from unauthorized access, checks the permitted connections and names the person responsible for follow-up. That is a more useful scope than blocking every unfamiliar row and waiting to hear which desk stopped working.
Sources and technical scope
These official references explain private addresses, connected-device records and supported address restrictions. Exact menus, defaults and enforcement differ by device, software and configuration. The checks above are practical recommendations, not a claim that every business network provides the same controls.