03 · Client & Device Control
One APK is both the Agent — connecting to the server and enforcing configuration — and the corporate launcher that presents only the business entries you allow.
From remote actions and device restrictions to launcher control, it covers continuous Android management for real deployments.
03 · Client & Device Control
All three paths support later device replacement; a swapped device automatically inherits its configuration and policies.
A device that already runs the client enters the server address and device ID, or scans an enrollment code.
A new device enters Android Enterprise QR provisioning at first boot and becomes Device Owner by scanning a code.
Generate a QR code per configuration; new devices of the same kind scan once and adopt the target profile.
03 · Client & Device Control
The console issues the command, the on-device agent executes it and reports the result — a closed loop from “action issued” to “result confirmed”.
| Action | Capability | Typical use |
|---|---|---|
| Remote lock | Locks the screen immediately, optionally with a custom lock message; only someone holding an admin account can unlock on site | Lost device, verification pending, off-shift suspension |
| Forced restart | Restarts the device to recover the system kernel; used for maintenance and permission handover | Shift handover, scheduled inspection |
| Remote reboot | Sends a reboot command to selected devices; the device executes it on receipt | Batch reboot, applying updates |
| Factory reset | Wipes device data and restores factory state remotely; account binding and local data are removed together | Device recovery, resale, privacy disposal |
| Configuration refresh | Skips the scheduled sync and makes target devices apply the latest configuration immediately | Urgent policy change, rollback verification |
03 · Client & Device Control
Eight groups of system-level policies, published through configuration, constrain device behaviour over time.
| Domain | What can be controlled | Effect |
|---|---|---|
| Data channels | USB file transfer, physical media mounting (external storage) | Cuts off data movement over cable and removable media |
| Screen security | Block screenshots and screen recording | Business screens cannot be captured and reused |
| System entry points | Safe mode / safe boot, system entry paths | Prevents actions that bypass management authorisation |
| Display and interaction | Volume, keep-screen-on, screen timeout | Fixes display parameters for business devices |
| Wireless radios | Wi-Fi, Bluetooth, GPS, mobile data toggles | Constrains connectivity and data consumption |
| Network boundary | Global proxy settings | Routes all traffic through the corporate egress |
| System and updates | System update behaviour and conditions, app update control | Ensures changes only happen in approved windows |
| Region and form | Time zone, keyboard orientation | Keeps cross-region devices in a consistent business form |
03 · Client & Device Control
From app distribution to launcher control, you decide what is installed, what it may do and what it looks like.
| Capability | Behaviour | Effect |
|---|---|---|
| App delivery | Install, upgrade and remove apps automatically per configuration; APK and XAPK supported; results per device | Only the target app versions live on the device |
| Package-level locking | Control or remove specific apps by package name | Apps cannot be replaced or silently disabled |
| Corporate launcher | OneNexus Launcher replaces the system launcher: names, icons, order, wallpaper and shortcuts are all configurable | The interface is the business — no leakage to the system launcher |
| Kiosk mode | Single-app or multi-app kiosk locks the device to the specified business apps; restrictions can be tightened further | The device becomes a dedicated tool that cannot leave the business UI |
| Primary app | Designates the default app that starts at boot | Boots straight into the business flow, no manual choice |
03 · Client & Device Control
The same management intent lands with different strength depending on the permission level available.
Advanced capabilities take effect once a device has completed provisioning and holds Device Owner; the OneNexus enrollment QR code binds the device and establishes that identity in a single scan.
Three enrollment paths cover every site condition; eight restriction groups and launcher control keep devices inside the business scope.
Business enquiries: bd@ihuatek.com