Skip to main content
Guys! I dont know why is this important point missing from your application regarding security of Mobile Android devices. I have signed up for Trial version from your website and tried testing it on our devices to see if security policy is really in favour of my company.

Issue Details: Android version 5 and above. Android -> Settings -> Users -> Add User Or Profile.

Once we change the user account from Owner to a guest account / or simply add another user, then, your application stops controling the device. Anybody who knows how to change this setting can deactivate your application easliy in few seconds. Do you have any alternative settings to do here which i might have missed?!?!?!
Let me see what I can find out.
Here's what I've been able to find out.  The multiple profiles setup on Android does the app installation this way by design, so if they do create another account and switch to it that will circumvent the app.  If the device is lost though, as long as you have a password or passcode enabled, then that won't allow someone to access the device or turn off Webroot.  Apparently there are restricted profile types that don't allow creating a new account, but they're designed mostly for parental controls so I'm not sure if they'd work for your purposes:

http://www.howtogeek.com/205301/how-to-use-android-5-lollipops-restricted-user-profiles-for-basic-parental-controls/

Basically I'd recommend just letting your users know not to create multiple user accounts - do they actually have a need for this?  Also are these BYOD devices or company owned?

 

I'm not sure if other MDM software has a different approach to ours, but I'd be interested if you do find out how they handle it.