Android device commands
Last updated September 25th, 2024
The available commands for a device vary based on its management mode. For fully managed with work profile devices, you can select either the whole device or just the work profile as the recipient of the command.
Device
| Device command | Description | Supported system |
|---|---|---|
| Lock device |
Locks the device. You can enter a reason for locking the device and a phone number to contact when the device is lost. The information you provide when sending a lock device command shows on the screen of the locked device. The following characters aren't supported in the lock screen message: \, ", [, and ]. |
Non-Samsung device — Android 6–8 Samsung device — Android 6 and higher Fully managed Fully managed with work profile Shared device Non-shared device |
| Unlock device |
Unlocks a locked device using the Unlock Code available on the Device Details page. You can share the unlock code with the device user, who can enter it on the screen and unlock the device. You can use the Clear Screen Lock device command to remove the password from a device that's locked due to the device user entering an incorrect password too many times or forgetting the password. |
Non-Samsung device — Android 6–8 Samsung device — Android 6 and higher Fully managed Fully managed with work profile Shared device Non-shared device |
| Lock screen | Locks the device screen. If the device's screen is password-locked, then the user needs to enter the password to access the device again. |
Android 6 and higher Fully managed Fully managed with work profile Shared device Non-shared device |
| Clear screen lock |
Clears the password and resets the lock on the device. For devices running Android 8 and higher, the device user must set a new lock before they can continue operating the device. For devices running Android 6–7.1.2, a temporary password is set on the device. After resetting the lock, you must deliver the temporary password to the device user, after which they can set a new personalized lock. For full details about this temporary password process, see How to reset the lock on a device. The device user can skip setting a new lock and continue using the temporary password indefinitely, which is a potential security risk. If possible, encourage them to set a new password. This command fails to take effect if the device meets all of these conditions:
The Clear Screen Lock device command is not supported for password policies set through the Knox Service Plugin. |
Android 6 and higher Fully managed Fully managed with work profile |
| Reset SD card |
Initializes the external SD card of the device. For devices with the External SD Card policy is set to Disallowed in the profile, you can't reset the SD card using the device command, because the policy takes a higher priority than the device command. |
Android 6 and higher Fully managed Fully managed with work profile |
| Play alarm sound | Sounds an alarm on the device until the device user takes action. On a non-kiosk device, the alarm is accompanied by a push notification from the Knox Manage agent. On a kiosk, it's accompanied by a popup. The alarm sounds regardless of the device's mute and vibration settings. |
Android 6 and higher> Fully managed Work profile |
| Push notification | Pushes and applies the latest profile and app information to the device. |
Android 6 and higher Fully managed Fully managed with work profile Work profile Shared device Mon-shared device |
| Turn off device |
Turns off the device. |
Non-Samsung device — Android 10 and higher Samsung device — Android 6 and higher Fully managed Fully managed with work profile Shared device Non-shared device |
| Reboot device | Reboots the device. |
Android 6 and higher Fully managed Fully managed with work profile Shared device Non-shared device |
| Factory reset |
Performs a factory reset on the device and changes the device status to Unenrolled. Initialize SD Card when factory reset — Select to initialize the SD card during the factory reset. Deactivate Factory Reset Protection — This option is only available when the profile is applied with the Factory Reset Protection policy or when you send the command to multiple devices. Click the check box to perform a factory reset without the Factory Reset Protection policy. |
Android 6 and higher Fully managed Fully managed with work profile Shared device Non-shared device |
App
| Device command | Description | Supported system |
|---|---|---|
| Run app |
Runs an app on the device. The app installation allowlist and blocklist policies take precedence over this command. If an app is explicitly allowed, then this command can't uninstall it. |
Android 6 and higher Fully managed Fully managed with work profile Work profile |
| Uninstall app |
Deletes an app from the device. The app installation allowlist and blocklist policies take precedence over this command. If an app is explicitly allowed, then this command can't uninstall it. |
Android 6 and higher Fully managed Fully managed with work profile Work profile Shared device Non-shared device |
| Sync installed app list | Synchronizes the device's app list. |
Android 6 and higher Fully managed Fully managed with work profile Work profile Shared device Non-shared device |
| Delete app data | Delete an app's data from the device. |
Android 6 and higher Fully managed Fully managed with work profile Work profile Shared device Non-shared device |
| Play Integrity (SafetyNet Attestation) | Initiates an integrity check of the device, which evaluates the integrity of the hardware and software on the device. The specifics of the evaluation depend on the device's Android version. The result of the evaluation can be found in the device details. |
Android 6 and higher Fully managed |
| Register Managed Google Play Account |
Assigns the Managed Google Play Account associated with your tenant to the device. Use this command if the Managed Google Play Account wasn't registered on the device during enrollment. |
Android 6 and higher> Fully managed |
Knox Manage
| Device command | Description | Supported system |
|---|---|---|
| Push profile |
Sends the profile to the device. On the Push profile dialog, click CONFIRM. |
Android 6 and higher Fully managed Fully managed with work profile Work profile |
| Update Knox Manage agent |
Updates the Knox Manage agent on the device for a new patch or version. The agent information registered in the Knox Manage server is sent to the device, which then selects the appropriate agent to request installation files from the server. |
Android 6 and higher Fully managed Fully managed with work profile Shared device Non-shared device |
| Lock Knox Manage agent |
Locks the Knox Manage agent. When the agent is locked, the device user must enter the agent's password that was configured during enrollment. If the user forgets the password, you can send the Delete Account command to sign the user out. Then, they can reset the password upon sign in. |
Android 6 and higher Fully managed Fully managed with work profile Work profile |
| Unlock Knox Manage agent | Unlocks the Knox Manage agent. |
Android 6 and higher> Fully managed Fully managed with work profile Work profile |
| Reset Push Token |
Creates and registers a new Firebase Cloud Messaging (FCM) token for the Knox Manage agent on the device. Use this command in scenarios where the device can't receive push notifications, which typically occurs when the token changed on the Knox Manage server and the device was unable to sync it. |
Android 6 and higher Fully managed Fully managed with work profile Shared device Non-shared device |
| Sync device information | Updates the inventory and app information on the device. |
Android 6 and higher Fully managed |
User and Profile
| Device command | Description | Supported system |
|---|---|---|
| Exit Kiosk mode | Exits Kiosk mode without unenrolling the device. You can find the status of the kiosk in device details. |
Android 6 and higher Fully managed with work profile Work profile |
| Update user information | Updates the device user information, such as the user activation status/username/user settings (Knox Browser website URL information, bookmark information) and license information.
If the user is signed out from the enrolled device, you can send this device command to enable the user to sign in to Knox Manage automatically. |
Android 6 and higher Fully managed Work profile |
Mobile network
| Device command | Description | Supported system |
|---|---|---|
| Reset Data Usage |
Resets data usage among the Android device's inventory information for:
|
Non-Samsung device — Android 10 and higher Samsung device — Android 6 and higher Fully managed Fully managed with work profile |
| Reset Number of Calls | Resets the number of calls and number of missed calls from the Android device's inventory information. |
Android 6 and higher Fully managed Fully managed with work profile Work profile on company-owned device |
| Lock SIM PIN |
Places a lock on the SIM card's PIN to prevent the use of the SIM card on another device. To lock a SIM PIN, enter the current SIM PIN and then enter a new PIN. If the locked SIM card is registered to another device, the device is locked and the user must enter the new PIN to unlock it. |
Samsung device — Android 6 and higher |
| Unlock SIM PIN |
Removes the lock placed on a SIM card's PIN. To unlock a SIM PIN, enter the current PIN that was applied through Knox Manage, and then enter the initial (default) SIM PIN. You can find the current PIN on the Device Details page > Network tab > SIM PIN Applied by Knox Manage. |
Samsung device — Android 6 and higher |
Certificate
| Device command | Description | Supported system |
|---|---|---|
| Delete a user Certificate | Deletes certificates installed by the administrator. You can select a certificate to delete. |
Android 6 and higher> Fully managed Fully managed with work profile |
| Delete admin-installed certificate | Deletes all the certificates installed by the administrator. |
Android 6 and higher> Fully managed Fully managed with work profile |
| Delete a CA certificate | Deletes certificates installed by Knox Manage. You can select a certificate to delete. |
Android 6 and higher> Fully managed Fully managed with work profile |
Diagnostics
| Device command | Description | Supported system |
|---|---|---|
| Collect Bug Report |
Collect the device's bug report, also known as dumpstate logs. You can view the bug report by selecting the device and clicking ACTIONS > View device log on the Devices page. |
Android 6 and higher Fully managed Fully managed with work profile Shared device Non-shared device |
| Collect audit log | Collects inventory and app information on the device. |
Android 6 and higher Fully managed Fully managed with work profile Work profile Shared device Non-shared device |
| Collect device log | Gathers the log data from the device. |
Android 6 and higher Fully managed Fully managed with work profile Work profile Shared device Non-shared device |
| Collect diagnosis information |
Gathers the device log to diagnose the cause of a device lock. Personally identifiable or sensitive information is masked. |
Android 6 and higher Fully managed Fully managed with work profile Work profile Shared device Non-shared device |
| Check for Compromised OS | Detects if the device OS is compromised. |
Android 6 and higher Shared device |
On this page
Is this page helpful?