Disable Factory Reset while Encrypted

Hi Brian Lupfer 

Please suggest which Sophos Mobile control product you are using - Sophos Mobile Control On-prem or Sophos Central Mobile?

If the Factory reset option is correctly set up and disabled for users through Sophos MDM software, users should not be able to reset the device.

Hi Jasmin, 

We are managing many devices using the Sophos Mobile Device manager housed on-prem.  What I am trying to accomplish is a broad solution to ensure device security. 

Disabling Factory Reset only addresses part of the problem. The issue that comes with that is if a user changes the PIN/Password and I need to reload the device. If factory reset is disabled, the device is Encrypted, and the user forgets their PIN, is there a way to factory reset the device as an admin? 

Hi Brian Lupfer 

It is possible to reset the device remotely in Sophos Mobile Admin, FRP is turned off by default if you have Android Enterprise. I have checked this internally, as you are not using Android Enterprise, you can go ahead and wipe the device remotely as per this article. Please let us know if you have any further concerns. 

Hi Shweta, 

To confirm, is the Wipe command supposed to work if the device is at the screen "Your tablet is encrypted for security. To start up your device, enter your PIN."?  From my testing it does not, is there a setting that I need to configure to facilitate that? 

To clarify about the issue I'm looking to solve is:

• In the scenario, where a device returns to me and I do not know the PIN.
• Factory reset is disabled so I cannot reset it from the Android Recovery screen. 
• Looking for a solution to reset a device given the above Criteria. 

Hi Brian Lupfer 

Could you please suggest what is the Operating system of the tablets which you are using and how you have encrypted them?

With the help of any encryption management software which can work at the enterprise level?

The devices are all Galaxy Tab E8.0 with either Android 7.1.1 or Android 8.1.0. 

They are all encrypted with the built in Encryption on the devices but unfortunately, the devices are not Enterprise grade. 

Hi Brian Lupfer 

I have checked this with our Support team and it seems the wipe command only works if the operating system is booted and the SMC client is working. So if the factory reset is disabled, the device is encrypted, to factory reset as admin it might be possible via the device manufacturer or if you type the PIN wrong too often. Unfortunately, there are no settings or commands available to do via the Sophos mobile dashboard.

Thank you Shweta, 

This is not what I was hoping to hear but it is an answer to my questions.