Skie for Enterprise · Problem

Tampering, factory resets and bypass attempts

What stops a student from resetting, uninstalling or working around the controls?

Most device controls fail the same way: an ordinary app can be uninstalled, a setting can be changed, or a reset wipes everything. Anyone who has run a school fleet has seen all three.

53 questions on this problem

How do I stop rented or issued devices being resold?Skie blocks factory reset from Settings and blocks safe mode and developer options. Android's Factory Reset Protection is on, so a wiped device asks for the Skie organisation's Google...
What does hardening mean in Skie device management?Hardening in Skie is a list of individual policy switches, each one an Android restriction the device owner enforces. An admin sets them for the whole organisation, then adjusts per school...
Which Skie hardening protections are on by default and which are optional?Open the policy for any group and each protection shows as a switch with its default state. Reset, safe mode, developer options and VPN blocks start on. Camera, Bluetooth, SMS, screenshots...
What does the Skie compliance score confirm about hardening?After every apply, the Skie app asks Android whether each protection is really in force and sends the answer back. The dashboard turns that into a compliance score per device and per group...
How does Skie re-apply a protection if a setting is changed?When a protection drifts, Skie puts it back from the cached, signed policy on the device, so it works without internet. If someone runs Reset all settings, the protections are re-applied...
How does Skie block factory reset on school tablets?The block on factory reset from Settings is a policy switch that is on by default, and an admin can set it for the whole organisation. On the tablet the Reset option is simply unavailable....
What is Factory Reset Protection in Skie and how is it tied to the admin account?Admins do not manage this by hand. Skie ties Factory Reset Protection to its own organisation Google account, and the protection is on for managed devices by default. If a tablet is wiped...
Can students use safe mode to get around Skie?The block safe mode switch is on by default in every policy. On a managed device the usual button routes into safe mode do nothing, so the tablet boots with Skie's rules in place. Admins...
Why does Skie block developer options on student devices?Developer options and adb are blocked by one policy switch, on by default and set from organisation down to group. A student who taps the build number to reveal the menu finds nothing...
Why does Skie block adb and USB debugging on managed tablets?Skie keeps USB debugging off on managed tablets with the developer options and adb switch, on by default. Your own team still provisions devices through the Skie Provision app or a laptop...
What does the lock accounts option do in Skie?Lock accounts is an optional switch, off by default. Turn it on for a group, for instance an exam batch or a fixed-purpose set of tablets, and nobody can add, remove or change accounts on...
Can a student uninstall the Skie app from a managed device?Skie runs as the Android device owner, and the block on uninstalling Skie is on by default. The remove option is not available to a student. Only an admin can release a device, using Remove...
Can students force stop, clear data or disable apps that Skie manages?Force stop, clear data and disable are blocked on managed apps by a default-on switch. A student who opens App info finds those buttons greyed out. That keeps classroom apps running with...
Can a student stop the Skie app from running in the background?The Skie app cannot be stopped by the user, and this is part of the default hardening. It also runs a background service with a watchdog worker and reports presence about every 4 minutes. A...
Can students add a new user on a managed tablet?Adding users is blocked by default through a policy switch. A student cannot create a second Android user, which would otherwise be a space without the managed rules. Admins set it once for...
Can students create a work profile on a managed tablet?Work profile creation is blocked by default in Skie's policy, so a student cannot set up a parallel profile outside the managed rules. The same family of switches also covers clone profiles...
Can students use clone apps or a second copy of an app on managed Android?Skie blocks clone profiles on Android 14 and newer with a default-on policy switch. A student cannot make a second copy of a blocked or limited app that escapes the app list. The install...
Can students hide apps in Android's private space on a managed device?Private space exists on Android 15 and newer, and Skie blocks private profiles there with a default-on switch. A student cannot create a hidden area to keep apps out of sight. On older...
Why does Skie block switching users on managed devices?Switching users is blocked in the default hardening policy. Even if another user existed on a tablet, a student could not move into it. Together with the block on adding users, it keeps...
Why does Skie block removing users on a managed device?Removing users is blocked by default through a separate policy switch. A student cannot delete the managed space on a tablet, which would otherwise be a way to wipe data and rules. It is...
Can students use airplane mode to avoid Skie on a school tablet?Airplane mode can be locked through a policy switch, so a student cannot cut the tablet off from the network at will. Rules are cached on the device and keep working offline, and a device...
Why does Skie lock mobile network settings on managed devices?Locking mobile network settings is a hardening switch, on by default. It stops a student editing access point names or toggling data options that could route around the filtered network...
Why does Skie lock date and time to automatic?Skie forces automatic time and time zone on, so a student cannot shift the clock to slip past a schedule window or a lock. Schedules such as school hours or night mode then run on the...
How does Skie block network reset on managed tablets?Network reset is blocked by a default-on policy switch. The option that clears Wi-Fi, mobile and Bluetooth settings is unavailable, so a student cannot wipe Wi-Fi profiles or network rules....
Can a student undo Skie with Reset all settings?Reset all settings does not remove Skie. If a student manages to run it, Skie re-applies the protections within seconds from the cached signed policy, and the event appears in compliance...
Why does Skie block third-party accessibility apps?Third-party accessibility apps can read the screen and tap on a user's behalf, which makes them a route around rules. Skie blocks them with a default-on switch, so a student cannot enable...
When should I lock Wi-Fi settings in Skie?Lock Wi-Fi settings is optional and off by default. Turn it on for groups that should only use campus networks, such as a hostel branch, with Wi-Fi profiles pushed from the dashboard and...
When should I block SD cards and external storage on managed tablets?Blocking SD cards and external storage is optional, off by default. Turn it on where files must not move onto or off the tablet through a card, such as exam devices. It is a single policy...
When should I disable USB data entirely on managed tablets?Disabling USB data entirely works on Android 14 and newer and is optional, off by default. Turn it on for devices that are charged only, such as tablets in a lab trolley. Remember a laptop...
Can Skie disable Bluetooth on managed devices?Disable Bluetooth is optional and off by default. Turn it on for groups where nearby sharing or wireless accessories are a distraction or a risk, such as exam rooms. It is a single policy...
How does Skie stop file transfer over USB on managed tablets?Disabling USB file transfer is on by default. Plug a managed tablet into a computer and the files do not appear, so work cannot be copied out or unwanted files in that way. If you want the...
Can Skie disable screenshots on student tablets?Disable screenshots is optional, off by default. Turn it on for groups sitting an exam or viewing restricted content, and screen capture is blocked on those tablets. Admins can set it for...
Can Skie turn off NFC on managed devices?Disable NFC is an optional switch, off by default. Use it where contactless tapping or beaming between devices is not wanted, such as exam tablets or fleet phones. Set it on the group...
Can Skie turn off Wi-Fi Direct on managed devices?Disable Wi-Fi Direct is optional and off by default. Use it to stop tablets sharing files directly with each other without going through the network, which is useful in exams and tighter...
What is the panic lock and when should I use it?Panic lock is the emergency control for situations that cannot wait. An authorised admin triggers it from the dashboard and managed devices lock, with offline devices following when they...
Can I run a compliance check whenever I want?A compliance run asks devices to read each protection back from Android and report a fresh score, so you see the real state and not the one from the last apply. Start one after a policy...
What is the trusted clock in Skie and why does it matter?Skie keeps its sync timing on a trusted clock, so a wrong device date cannot make last-seen times or Due calculations misleading. It also locks date and time to automatic, with auto time...
How does Skie recognise a device that has been reset, and does it use a second seat?Skie matches devices by IMEI or serial, so a reset device that returns is recognised and does not take a second seat. Factory Reset Protection is on and tied to the Skie admin account, so a...
Which settings can be locked at organisation level in Skie so lower levels cannot change them?An organisation admin can lock hardening switches and the web filter at the top, and lower levels cannot loosen them. Rules flow down and the most specific level applies last, but blocking...
Can we block screenshots on hostel devices?Disable screenshots and disable camera are optional policy switches, off until you set them, and applied to a whole group. After applying, the device reads the setting back from Android and...
Are chrome://flags and other internal Chrome pages blocked on managed devices?Skie blocks chrome://flags, net-internals, inspect, view-source and javascript: pages through the Chrome rules it enforces as device owner. The block is on by default across Chrome stable...
Can a clever student get around Skie on a school device?Skie closes many routes at once: factory reset, safe mode, developer options, unknown sources, uninstalling Skie and more, each its own policy switch. Skie is built to be tamper-proof; if...
What should we do if a student finds a way around a rule?Send Skie support the device, steps and date. In the dashboard, the breach centre and compliance score show which devices read back differently from policy, and you can run a compliance...
Can a student turn off the web filter on a Skie device?The Private DNS setting is blocked, so a student has no screen to change it. Chrome's own secure DNS is off, and VPN and DNS changer apps are never allowed. If a change were somehow made...
Can a student download and install an APK from a website?Unknown sources are blocked by default, both per app and globally, so an APK downloaded in Chrome will not install. Apps on managed devices come from Google Play, and the install guard...
Can a student sideload an app from a computer over USB?Developer options and adb are blocked by default, and USB file transfer is off by default. On Android 14 and newer, USB data can be disabled entirely as an optional switch, which suits exam...
Can a keyboard or accessibility app be used to override device controls?Third-party accessibility apps are blocked and default apps are locked, as separate policy switches that are on by default. Admins can set them from organisation down to group. Because the...
Can a student remove Skie from the device admin list?Skie runs as the Android device owner, uninstalling Skie is blocked, and the app cannot be stopped by the user. Only an admin can release a device with Remove Skie in the dashboard. That...
What happens if someone factory resets a managed device from the recovery menu?Resets from Settings are blocked, and Factory Reset Protection is tied to the Skie admin account for the recovery menu route. A wiped device cannot be set up again without the Skie...
What is a signed policy bundle and why does it matter?Every policy bundle Skie sends is cryptographically signed, and the device checks the signature before applying anything, rejecting any bundle that does not verify. Admins do not do...
What is the per-device key and what is it used for?Each device holds its own key and identity, tied to its IMEI, serial and enrolment ID, and it signs the reports it sends. This lets the dashboard trust that a status came from that device....
How do we know a rule was really applied on a device?After every apply, the Skie app asks Android for the actual state of each protection and reports a compliance score, so the dashboard reflects what is set rather than what was sent. Admins...
Could a device or app send a fake 'all good' report to the dashboard?Device reports are signed with the device's own key and the server checks the signature, so a message from another source is not taken as that device's status. The compliance score is built...

Students distracted by phones and apps in class · Hostel night-time phone use and curfew rules · Unsafe websites, other browsers and VPN workarounds · Managing hundreds of devices, classes and branches · Setting up and rolling out devices quickly · Lost, stolen, broken and reassigned devices