SkieWhy does Skie block adb and USB debugging on managed tablets?
Android Debug Bridge, or adb, lets a computer send commands to a tablet over USB, which could change settings or install apps outside Skie's rules. Skie blocks USB debugging on managed devices through Android's debugging restriction. It is on by default. The only adb use is during provisioning, when the admin does it deliberately.
Adb is a powerful tool. With a cable and a laptop, a person with debugging switched on can inspect a device, push files and run shell commands. On a student tablet, that is exactly what you do not want in the wrong hands.
Skie applies Android's debugging features restriction as the device owner, so the USB debugging toggle cannot be switched on. A cable connection to a computer does not open an adb session. This is separate from the block on USB file transfer, which controls whether the tablet can be used as a storage device, and from the optional USB data switch described in its own entry.
A fair question is how Skie itself gets onto a tablet if adb is blocked. Provisioning is a one-time step done by the admin on a device that is not yet managed. For laptop provisioning, the admin pastes a command from the dashboard and runs it over adb before Skie takes over as device owner. Once the device is managed, the block applies.
The block is default on and is shown in the hardening list. The compliance read-back confirms it on each device.
Practical tip: do your provisioning in a controlled room with the right cables and a named person responsible for it. After enrolment, put devices into circulation only when the dashboard shows them fully compliant.