Script Commands for Android Enterprise: Devices with Work Profiles

Enables or disables the administrator mode on a device in lockdown mode.

Prevents the device user from uninstalling an application that was installed using packages.

Where bundleID is the bundle id of the application whose uninstallation you want to prevent.

Example

To prevent the device user from uninstalling the Google Photos app:

afw_prevent_uninstall com.google.android.apps.photos enable

Grants specified permissions to specified applications. You cannot grant special permissions such as Draw Over or Usage Access, to third party applications.

Sets the default response for future runtime permission requests by the SOTI MobiControl device agent.

Where

• prompt prompts the device user for all permissions
• grant automatically grants all permissions that an application requires
• deny automatically denies all permissions that an application requires
• clear resets the policy to the agent define default state

Specifies a preferred keyboard for use.

Minimum device agent version: 15.1.5

Android OS: OS5 and above

Where <pkg_name> is the font package containing the keyboard.

Example

afw_set_preferred_keyboard com.fontskeyboard.fonts

Enables or disables the Android Enterprise work profile.

Retrieves the current agent mode (user or administrator) of a device with lockdown mode applied and displays it in the Logs section of the Device Information panel.

Allows the administrator to disable automatic Android Enterprise agent updates to latest versions from the Google Play Store, remotely on Android devices through MobiControl. Each execution of the script will append to the list of apps for which scripts have been sent.

<package-list> indicates that a comma separated list of application bundle ids in a single command can also be entered.

Minimum device agent version: 15.1.5

Android OS:

Samsung: API Level 11 and MDM v 5.0+ and above

Zebra: API Level 26 and MXMF v10.3 and above

OEMs supported: Samsung and Zebra

Example

app_upgrade disable com.businessapp,com.web.browsername

Allows the administrator to enable automatic Android Enterprise agent updates to latest versions from the Google Play Store, remotely on Android devices through MobiControl. Each execution of the script will append to the list of apps for which scripts have been sent.

<package-list> indicates that a comma separated list of application bundle ids in a single command can also be entered.

Minimum device agent version: 15.1.5

Android OS:

Samsung: API Level 11 and MDM v 5.0+ and above

Zebra: API Level 26 and MXMF v10.3 and above

OEMs supported: Samsung and Zebra

Example

app_upgrade enable com.businessapp,com.web.browsername

Deletes a certificate on the device.

Where

• IssuerName is the common name of the certificate issuer
• SerialNumber is the serial number of the certificate
• storage is the type of storage into which to import the certificate

Example

To delete a certificate issued by apache.org:

certdelete -issuer "*.apache.org" -sn 00A03DB42A7841AFF5

Prompts the device agent to attempt to connect to the deployment server.

Where -f forces the device agent to connect regardless of configuration or setup settings.

Example

To connect to the deployment server regardless of configuration or setup settings:

connect -f

Renames a device.

If the name contains spaces, use quotation marks

Example

To change the name of a device to Apricot Candy:

devrename "Apricot Candy"

Disconnects the device from the SOTI MobiControl deployment server.

Copies a file or directory from an ftp server to a device.

Where

• wget copies a file from an ftp server to a local storage or sd card on the device
• -o specifies to override existing files
• -r specifies to recursively read all files under each folder

Example

To copy a file from ftp to local storage on the device:

ftp wget -o -r ftp://user:123@server/folder /storage/emulated/0/Download

Downloads files using the HTTP protocol.

Identifies the current top activity on the device.

Installs an application on the device.

Where appInstallerPath is the full path to the application installer file on the device

Example

To install the Gmail app located on an sd card:

install /sdcard/Download/Gmail.apk

Turns the device screen off and locks device until device user enters the correct password.

Sends a customs message to the SOTI MobiControl deployment server from the device. This message appears in the Logs tab of the Device Information panel in the SOTI MobiControl console.

Where type is the type of the associated message and the options are:

• -e for Error
• -w for Warning
• -i for Information

Example

To send a notification to the SOTI MobiControl console at certain intervals during a software push:

log -i "Starting Software Push"

Lists all the activities of an application package.

Sends a request to the device prompting the device user to grant the specified permissions.

• SYSTEM_ALERT_WINDOW requests the Draw Over permission. Requires an Android Classic or Enterprise agent of 13.5.2 or later
• PACKAGE_USAGE_STATS requests the Usage Access permission. Requires an Android Classic or Enterprise agent of 13.6.1 or later
• BIND_NOTIFICATION_LISTENER_SERVICE requests the Notification Access permission. Requires an Android Classic or Enterprise agent of 13.6.1 or later.
• WRITE_SETTINGS requests the Modify System Settings permission. Requires an Android Classic or Enterprise agent of 13.7.0 or later

Where possible, the permissions are granted silently.

Enables the ability to silently allow any third-party application (this applies to the SOTI MobiControl agent as well) to display over other applications across all Android devices.

Minimum Agent: 15.1.5

Plugin Versions: 1.15.1.102 (recommended for silent granting)

Devices supported: Android Enterprise with plugins (DO, COPE) and Android Classic devices

Android OS: 6 and later

OEMs Supported: Samsung, Zebra, Google, Honeywell (This feature is not OEM specific)

request_appops_permission android.permission.SYSTEM_ALERT_WINDOW allow <Package_ID>

insideagent request_appops_permission android.permission.SYSTEM_ALERT_WINDOW allow <Package_ID>

Example:

request_appops_permission android.permission.SYSTEM_ALERT_WINDOW allow com.businessapp

insideagent request_appops_permission android.permission.SYSTEM_ALERT_WINDOW allow com.businessapp

Disables the ability to silently allow any third-party application (this applies to the SOTI MobiControl agent as well) to display over other applications across all Android devices.

Minimum Agent: 15.1.5

Plugin Versions: 1.15.1.102 (recommended for silent granting)

Devices supported: Android Enterprise with plugins (DO, COPE) and Android Classic devices

Android OS: 6 and later

OEMs Supported: Samsung, Zebra, Google, Honeywell (This feature is not OEM specific)

request_appops_permission android.permission.SYSTEM_ALERT_WINDOW disallow <Package_ID>

insideagent request_appops_permission android.permission.SYSTEM_ALERT_WINDOW disallow <Package_ID>

Examples:

request_appops_permission android.permission.SYSTEM_ALERT_WINDOW disallow com.businessapp

insideagent request_appops_permission android.permission.SYSTEM_ALERT_WINDOW disallow com.businessapp

Performs a soft or hard reset of the device.

Where

• /S is the default option and soft resets the device. Any desktop remote control sessions will also be terminated.
• /H is used to hard reset a device running on the Windows Pocket PC or Windows CE platforms. It clears any data stored in the volatile memory. On Windows Mobile 5.0 and later devices this is equivalent to a soft reset. The real-time clock may also reset depending on the device make and model.
• /W is used to wipe data stored on the device and reset the device to factory default settings.
  Note: The wipe command is only supported on the Windows Mobile 5 operating system with AKU2 or later and newer versions of Windows Mobile.
• /E is used to wipe data stored on the device and its external storage as well as reset the device to factory default settings.
• /P is used to bypass factory reset protection. It is only supported on Android Enterprise Work Managed devices.

On Android Plus devices it is possible to specify a /delay parameter (in seconds): reset /S /delay 10

If /delay parameter is not defined, the default value is 5 seconds

Example

To soft reset a device:

reset /S

To reset an Android Plus device to its factory settings in 30 seconds:

reset /E /delay 30

Resets the remote control detection attempt counter.

Clears proxy configuration settings for the specified SSID (which should exist on the device before sending the command).

Example

To reset a proxy configuration for SSID 105:

resetwifiproxy 105

Sends a debug report from the device agent to the SOTI ftp server.

Sets WiFi proxy settings using a provided PAC file. The access point ID should exist on the device before sending this command.

Example

To set up a WiFi proxy using a PAC file:

setwifipacurl 105 https://website.com/proxy.pac

Sets WiFi proxy settings using a provided host and port for the specified SSID. The access point ID should exist on the device before sending this command.

Example

To set up a WiFi proxy:

setwifiproxy 105 192.168.2.127 8080

Displays a message box on the device screen.

Where

• message is the message displayed in the message box. Use quotation marks (" ") if there are spaces in the message.
• [timer] is the number of seconds until the message box disappears automatically. If you omit a timer value or add the keyword NO_TIMER, the message box will persist until the device user dismisses it.
• [type] is type of of message box. Options are:
  • 1 displays an information window with an OK button
  • 2 displays a question window with Yes and No buttons
  • 3 displays a warning window with an OK button
  • 4 displays a question window with OK and Cancel buttons
  • 5 displays an error window with an OK button
• [default button] sets the default buttons for message box types 2 (YES | NO) or 4 (OK | CANCEL)
• NOTIFY_DEVICE notifies the device user of the message, depending on the notification settings applied to the device. That is, devices set to ring, will ring, set to vibrate, will vibrate, and muted devices will have no notification. Only supported on Android Plus devices with agents 14.0.0 or later.

The return values for the showmessagebox are stored in a global variable, ShowMessageBoxReturn This variable can be used in scripts as %ShowMessageBoxReturn% to execute actions based on user response. Possible return values are IDYES, IDNO, IDOK, IDCANCEL. The value for this global variable does not change if the type is not 2 or 4.

Example

To show a simple message:

showmessagebox "This is a test message"

To provide device information using a macro:

showmessagebox "Your device's IP address is %IP%"

To set a 3 second timer to your message:

showmessagebox "This is a test message with a 3 second timer" 3

To add YES and NO buttons to your message box with no timer

showmessagebox "This is a test message with Yes/No button and no timer" NO_TIMER 2

To provide followup actions to a user response to message box:

showmessagebox "Abort the operation?" NO_TIMER 2 YES
if %ShowMessageBoxReturn% == IDYES goto Exit

Initiates sleep mode on the device for a set period. Only use this command in scripts.

Where length is in seconds

Example

To set the device to sleep for 5 seconds:

sleep 5

Initiates sleep mode on the device for a set period. Only use this command in scripts.

Where length is in milliseconds

Example

To set the device to sleep for 3.5 seconds:

sleep 3500

Removes the specified program from the device.

Where

• program is the program ID for the program you want to uninstall
• force forces uninstallation of the program, even if it is a system application

Example

To remove the program Google Maps:

uninstall com.google.maps

Unlocks the device and dismisses the password lock screen.

Enables or disables WiFi mobile access point.

Where 0 disables WiFi and 1 enables WiFi

Example

To disable WiFi:

wifiapenable 0

Saves or deletes specified settings on a device.

See The writeprivateprofstring Command for more information.