SkieWhy does Skie block removing users on a managed device?
Skie blocks removing users with Android's remove-user restriction, and it is on by default. It stops anyone deleting a user space, including the managed one, as a way of disturbing the setup. The Remove user options are not shown, and the device keeps the user that Skie manages.
Removing a user is the destructive counterpart of adding one. In Android Settings under Users, someone with enough access can delete a user and its data. On a tablet that is meant to stay organised under a policy, that is a risk you can close.
Skie sets DISALLOW_REMOVE_USER as the device owner. The delete options in the Users screen are removed. This also protects the work done in the managed space, since a mistaken or deliberate delete would lose app data and settings that were prepared for the student.
The protection is on by default, and it is one of the four user-related switches in the hardening section: add users, switch users, remove users and the profile types. The state is read back from Android after each apply and included in the compliance score, so you can confirm it on any tablet.
What does an admin do if a user does need to be removed? Use the dashboard. If the problem is a stuck device, the replace device flow keeps the student, group and history while moving to a new tablet, and Remove Skie takes the device out of management cleanly.
We see this switch as a tidy complement to the others. It does not stand alone as a barrier. It closes a gap that would be awkward to explain if someone found it. Practical tip: if a device was bought second-hand and has an extra user on it, set it up fresh as part of provisioning. A one-time reset is needed anyway to make a device managed.