IBM MaaS360

IBM MaaS360

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Remove Device Control - KNOX enrolled Device Owner

  • 1.  Remove Device Control - KNOX enrolled Device Owner

    Posted Fri December 08, 2023 09:43 AM

    Morning,

    I was wondering what the best way is to remove MDM control from a Samsung device that is enrolled via KNOX with Device Owner enrolment.

    If I choose the "Remove Control" option for the device, would the device require a factory reset? Or would it just remove the MaaS360 control, leaving the device open for the end user to carry on using?

    I just want to know the best practices for de-coupling customer devices to allow them to be used outside of the MDM control.

    Thanks,

    David 



    ------------------------------
    David Greetham
    ------------------------------


  • 2.  RE: Remove Device Control - KNOX enrolled Device Owner

    Posted Mon December 11, 2023 04:46 AM

    Hi David

    Basically the Device Owner profile - as you will remember - is built from a freshly wiped device, and built into the operating system. As such, whether you send a Remove Control, or a Wipe, the end result will be the same - the device will be completely wiped. 

    If you are using KNOX Mobile Enrollment, then you will even find that after wiping the device it will reboot and re-enroll itself automatically. As such, if you want a clean device, removed from DO mode, you need to: 

    • Remove the serial number from KME portal (your device reseller will be able to do this)
    • Send a wipe command
    • Once rebooted the device will be free to use outside of enrollment. 

    The distinction between Wipe and Remove Control becomes more relevant in Profile Owner mode, which is an application-level configuration. In this case you can remove PO control and not have to wipe the device: this is not the case for DO. 

    Best 



    ------------------------------
    Eamonn O'Mahony
    Technical Client Success Manager
    IBM Security
    Dublin, Ireland
    ------------------------------

    Original Message