# Security Management Last Updated On: 21 Jul 2026 27 minutes read Mobile Device Manager Plus can be used to remotely secure data in mobile devices even in the event of the device being lost or missing. The following operations can be done using the security commands in MDM. To perform actions like sending commands (e.g., Remote Lock) or wiping a device, go to **Inventory**, select the device, open the **Actions** menu, choose the desired command (e.g., Remote Lock, Deprovision (Wipe), or Corporate/Complete Wipe), confirm the action, and monitor the status in the Inventory tab. ## Remote Lock You can remotely lock the managed mobile device. After a remote lock is performed, the user is prompted to enter the passcode of the mobile device only if you have [set a passcode](https://www.manageengine.com/products/desktop-central/help/mdm/mdm_android_passcode.html) for the device. This feature is supported for **Android, iOS, macOS**. In devices running **iOS 7 or later versions**, you can also specify a **message and a contact number** while locking the device. The device can be unlocked using the existing passcode. However, for macOS devices, you can only specify a message to be displayed while locking the device. The existing passcode will be rendered invalid, and the device can be unlocked only using the PIN set by the admin. **This feature is not supported on Windows devices.** Follow the steps mentioned below to specify a contact number and the message to be displayed on the lock screen of devices running iOS 7 or later: 1. On the web console, navigate to **Devices**. 2. Select the device to be locked. 3. Under **Actions**, click on **Remote Lock**. Enter the contact number and the message to be displayed on the locked screen of the mobile device. ![Device management actions menu in MDM showing options like Remote Lock and Wipe.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/lock-screen.webp) ## Scan now You can scan the enrolled mobile device to view details about the installed apps, blacklisted apps, restrictions imposed on the device, and other device details. Scanning can be performed only when the device is connected to the internet. **This feature is supported for Android, iOS, Windows, and ChromeOS.** If [Periodic communication mode](https://www.manageengine.com/products/desktop-central/help/mdm/customize_me_mdm_app.html#Configure_Mode_of_Communication) is chosen, the scanning operation has a 60-minute communication interval with the server. So, scanning takes place only the next time the device interacts with the server. ## Remote Alarm You can trigger an alarm on the mobile device if it is lost or stolen. It sounds an alarm even if the device is in silent mode. The alarm stops ringing only when the device is unlocked. This feature is applicable for **Android, iOS (Supervised), and Windows phones**, with iOS requiring [Lost Mode](https://www.manageengine.com/products/desktop-central/help/inventory/location_tracking.html) to be enabled for Remote Alarm to work. **Note:** After enabling Lost Mode on your device, the option to trigger a **Remote Alarm** will be available under the **Inventory Actions** of the device. ## Complete Wipe All the data in the device can be completely wiped using this command. The device becomes as good as new. You can also wipe all the data from the device's SD card for Knox devices. This feature is supported for **Android, iOS, macOS, ChromeOS, and Windows.** ## Corporate or Selective Wipe All the profiles and apps previously installed using MDM are wiped in **iOS, macOS, and Android devices**. In the case of Windows devices, only profiles are removed and not the apps. The personal data on the device is not affected. Also, the device is no longer managed by Endpoint Central. **Note:** In EC Inventory, MDM remote actions Corporate Wipe and Complete Wipe will be shown only for Modern Management Devices (macOS and Windows). In both standalone and integrated (EC MDM) MDM Inventory, the Deprovision action is shown instead of Wipe actions. ## Logout User This command lets the admin log out the current users on **Shared iPads**. With this option, the admin can log out users even when they are currently logged in or when iCloud data sync is in progress. ## Delete User This command lets the admin select the list of users on Shared iPads or Mac and then delete the session for all device users. With the force deletion option, the admin can delete users even when they are currently logged in or when iCloud data sync is in progress. This feature is applicable for **Shared iPads and Mac machines running macOS 10.13 and above.** **Note:** For Mac machines, the administrator user with a secure token cannot be deleted from the device. ## Clearing the passcode This command clears the passcode completely. However, the user is prompted to enter a new passcode if a passcode policy was previously associated with the device. Clearing the passcode also clears the biometric-based passcodes in all **iOS and Android devices (provisioned as Device Owner) except for Samsung devices running Android 5.0. This feature is not supported for Windows devices.** ## Reset Passcode You can reset the passcode on managed devices using this command. If the new passcode does not meet the complexity criteria set for the device, or if no passcode was set using device settings, the user is prompted to set a passcode as per the associated passcode policy. **This is applicable only for Android devices.** Admin can specify the new passcode and choose to send a notification email to the user. **Note:** - Passcodes set by users cannot be removed or reset from Samsung devices running Android 9.0 or above enrolled via invite. OS-specific details on Clear and Reset passcode commands are provided in the table below. - For devices running Android 14.0 and above, the minimum passcode length should be 6. ## Clear Screentime Passcode Admins can remotely clear the screen time passcode for troubleshooting purposes. This is applicable only for Supervised iOS devices. - In iOS 11.0 and earlier, this action removes screen time passcode restrictions and other constraints. - From iOS 12.0 and above: - If the Screen Time passcode and **Share Across Devices** setting is enabled, this command clears the Screen Time passcode and its restrictions. If the user is a child in the iCloud family, the command fails. - If Share Across Devices is disabled, the command clears only the Screen Time passcode and not the associated restrictions. You can enable/disable users from configuring screen time restrictions using MDM. ## Device Access Recovery Key If a managed device is locked due to incorrect passwords, you can either perform **Clear Passcode** or generate a **Device Access Recovery Key** to unlock the device. In case of no network connectivity, you can generate a Recovery Key and unlock the device. It is supported for Android devices enrolled as **Device Owner**. Once you have exhausted half the maximum number of failed attempts in the passcode policy, you will be redirected to the recovery key page. For example, a value of 6 specifies that the device will be locked after 3 failed login attempts and users can unlock the device using the recovery key. After 6 failed login attempts, the device data will be completely wiped. To know more about generating a Device Access Recovery Key, [click here](https://www.manageengine.com/mobile-device-management/how-to/device-access-recovery-key.html). ## Pause Kiosk The Pause command lets you pause Kiosk on devices previously provisioned with Kiosk. This is usually used when IT admins need to troubleshoot device issues. You can automatically resume Kiosk after a specified time using the **Resume Kiosk** command. You can also pause Kiosk using other methods as listed here: https://www.manageengine.com/products/desktop-central/help/mdm/android_kiosk.html **Supported only for Android devices.** ## Resume Kiosk If a Kiosk-provisioned device is paused, the Resume command restores the device to Kiosk mode. You can also resume Kiosk using other methods: https://www.manageengine.com/products/desktop-central/help/mdm/android_kiosk.html#Temporarily_Disabling_Kiosk **Supported only for Android devices.** MDM supports pausing and resuming Kiosk using different methods. For example, you can pause Kiosk using remote chat commands and resume it using security commands. ## Enable Lost Mode This command is used to mark devices as lost and initiate Lost Mode on the devices. Before enabling Lost Mode on certain devices, be aware of potential failures while disabling it. As outlined in Apple's protocol document: https://developer.apple.com/documentation/devicemanagement/disable_lost_mode#discussion Attempts to deactivate Lost Mode may fail for unspecified reasons, potentially leaving the device stuck in Lost Mode. **Note:** For devices without SIM cards (such as iPads), if the device is restarted while in Lost Mode, Wi-Fi connectivity is lost and the device is locked. To avoid this, clear the passcode after successfully enabling Lost Mode but before restarting the device. ## Lost Mode Behaviour The Lost Mode screen is displayed only when the device is in a locked state. If a user attempts to unlock the device while Lost Mode is active, it will be immediately locked again. If the device is not protected by a passcode, powering it on brings it to an unlocked state. MDM immediately locks the device, and the Lost Mode screen will not be displayed. To ensure proper Lost Mode functionality, the device must be secured with a passcode. If not already configured, the administrator must set one through the Lost Mode configuration. ## Restart Remote Restart is applicable only for: - Supervised iOS devices running iOS 10.3 or above - Samsung or non-Samsung devices running Android 7.0 or later, provisioned as Device Owner - macOS devices - Windows devices - Chrome OS devices provisioned in Kiosk Mode **Note:** - Remote Restart and Remote Shutdown can be scheduled. Watch this video to learn more: https://www.youtube.com/watch?v=k-gf9bsEE0Y - On Windows devices, the command is implemented 5 minutes after acknowledgment. - On Chrome devices, the command expires if the device does not contact the MDM server within 10 minutes. - On Apple devices (iOS and macOS), a password-protected device must be unlocked after restart to ensure Wi-Fi connectivity. - macOS devices provide an option to notify the user to restart. - For scheduling details, refer to: https://www.manageengine.com/mobile-device-management/help/asset_management/mdm-bulk-actions.html#Scheduling_Remote_Restart_and_Shutdown_for_Groups_and_Devices ## Wipe Users This command wipes out all users and user profiles from the device. **Applicable only for Chrome devices.** ## Take Screenshot You can execute the **Take Screenshot** command on Chrome devices provisioned in Kiosk mode. The command expires if the device does not contact the MDM server within 10 minutes. Screenshots are recorded under Device Files (Inventory > Devices > System Activity). To view them, sign in to the Google Admin Console. ## Set Volume This command sets the volume level on kiosk devices remotely. It expires if the device does not contact the MDM server within 10 minutes. **Applicable only for Chrome devices.** ## Recover User Account When a device is locked after exceeding the maximum number of failed attempts in the passcode configuration, the user is locked out. The account can be remotely unlocked by selecting **Recover User Account** and entering the user account details. Supported for **macOS 10.13 and above.** Only devices running Android 5.0 or above can be provisioned as [Profile Owner](https://www.manageengine.com/mobile-device-management/help/android_for_work/mdm_android_for_work_introduction.html#Profile_Owner) or [Device Owner](https://www.manageengine.com/mobile-device-management/help/android_for_work/mdm_android_for_work_introduction.html#Device_Owner). ## Android Clear and Reset Passcode Support Matrix | ANDROID OS VERSION | DESCRIPTION | SAMSUNG (Invite) | PROFILE OWNER (Invite) | CORE ANDROID (Invite) | DEVICE OWNER (Admin Enrollment) | |---|---|---|---|---|---| | **Clear Passcode** | | | | | | | Below Android 5.0 | Passcode applied to the work profile in a Profile Owner provisioned device and the device passcode in a Device Owner provisioned device cannot be cleared. | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![failed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/failured.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![failed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/failured.webp) | | Android 5.0 and 6.0 | Passcode applied to the work profile in a Profile Owner provisioned device cannot be cleared. | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![failed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/failured.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | | Android 7.0 | Passcode applied to a device provisioned as Device Owner and the work profile passcode in a Profile Owner provisioned device can be cleared. | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![failed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/failured.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | | Android 8.0 and above | Passcode can be cleared in Samsung devices provisioned as Device Owner and the work profile in Profile Owner provisioned devices. | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![failed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/failured.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | | **Reset Passcode** | | | | | | | Below Android 5.0 | Passcode applied to the work profile in a Profile Owner provisioned device and the device passcode in a Device Owner provisioned device cannot be reset. | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![failed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/failured.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![failed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/failured.webp) | | Android 5.0 and 6.0 | Passcode applied to the work profile in a Profile Owner provisioned device cannot be reset. | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![failed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/failured.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | | Android 7.0 | Passcode applied to a device provisioned as Device Owner and the work profile passcode in a Profile Owner provisioned device can be reset. | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![failed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/failured.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | | Android 8.0 and above | Passcode can be reset in Samsung devices provisioned as Device Owner and the work profile in Profile Owner provisioned devices. | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ![failed](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/failured.webp) | ![success](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/mobile-device-management/success.webp) | ## Knox Container Security Commands For Knox, security commands can be executed separately for the device and the container. - **Create Container:** Distributes Knox License and creates a Knox Container within a supported device. - **Remove Container:** Removes the Knox Container and revokes the Knox license. - **Lock Container:** Locks the Knox Container and restricts user access. - **Unlock Container:** Unlocks a previously locked container. - **Clear Passcode:** Clears the container passcode and prompts the user to set a new one based on complexity criteria. ## Procedure to Use Security Commands 1. On the web console, navigate to **Devices** under the **Inventory** tab. 2. Click the specific device under **Device Name**. 3. Click the **Action Button** on the right side and select the action to be performed. You will be prompted to enter your password for authentication. 4. The specified security command is executed and the status is reported under **Device Details**. ## Troubleshooting Tips **Issue:** This Mac is Locked. Try again in 24,284,826 minutes. **Cause:** The Mac was MDM-locked and left powered on. Its battery drained completely while in storage. After restart, the system clock reset to Epoch time (00:00:00 UTC, January 1, 1970). **Solution:** - Connect the device directly to the corporate network via Ethernet. - Allow 30 minutes of uninterrupted uptime while connected. - Perform a full restart and verify the device unlocks. ## FAQ **Why does the Clear Passcode / Reset Passcode inventory action fail on devices enrolled using ADB enrollment?** If a passcode was set on the device **before ADB enrollment**, the **Clear Passcode** and **Reset Passcode** actions will fail. In this case, wipe the device and enroll it again. If the passcode is configured **only after ADB enrollment**, these actions will work as expected.