Aspects of the disclosure relate to detecting and identifying devices at enterprise locations to protect enterprise-managed information and resources. In some embodiments, a computing platform may capture information identifying devices present at a first enterprise location during a malicious event. Then, the computing platform may generate alerts when one of the devices present at the first enterprise location during the malicious event is detected at a second enterprise location. In other embodiments, when such a device is detected at the second enterprise location, an enterprise center monitoring system may generate commands that cause an augmented reality device at the second enterprise location to present one or more augmented-reality user interfaces that include one or more augmented-reality elements identifying a user in possession of the detected device.