During an incident, you need to acquire forensic artifacts from a compromised Windows workstation using Microsoft Defender for Endpoint. The device is currently powered off but is expected to reconnect intermittently over the next few hours. You want the full investigation package (autoruns, scheduled tasks, network connections, prefetch files, and more) collected automatically the next time the device comes online, without keeping a live response console session open. Which action should you take from the device page?