Preventing unauthorized factory resets on end-user devices: enforce FRP and disable ADB via Compliance Policy

Android

This article explains how to prevent unauthorized factory resets on your managed Android devices by enabling Factory Reset Protection (FRP) and disabling Android Debug Bridge (ADB) access through Esper Compliance Policies.

Before you begin

Unauthorized factory resets allow end users to remove devices from management and repurpose them for personal use. Two configuration gaps enable this behavior:

• ADB enabled: Users with physical access can connect via USB and issue factory reset commands or install reset tools.
• FRP not enabled: Without Factory Reset Protection, a factory reset immediately produces a usable device with no authentication requirement, allowing the device to escape MDM control.

This issue affects any Android device managed under Esper where Compliance Policies have not been hardened. It is not model- or firmware-specific—it is a configuration gap.

How to disable ADB and enable Factory Reset Protection

1. In the Esper Console, navigate to Compliance Policies in the left navigation panel.
2. Create a new Compliance Policy or edit the existing policy applied to your device group.
3. In the policy editor, locate the ADB setting and set it to Disabled. This prevents USB debugging access and removes the ability for users to issue ADB commands.
4. Locate the Factory Reset Protection (FRP) setting and enable it. When FRP is active, a factory reset locks the device and requires sign-in with the authorized Google account credentials before the device can be set up again.
5. Click Save.

How to apply and test the policy

1. Apply the updated Compliance Policy to a test device group first before rolling out to the full fleet:
   • Navigate to Devices & Groups → [Target Group] → Compliance Policy → Apply Policy.
   • Select the updated policy and confirm the application.
2. Verify the policy has been applied by checking the device's compliance status in the Esper Console under Devices & Groups → [Device Name] → Compliance.
3. Perform a test factory reset on the test device to confirm FRP blocks unauthorized setup.
4. After a factory reset on the test device, the device should prompt for the authorized Google account credentials before proceeding with setup. ADB commands over USB should return error: device unauthorized or have no response when attempted.
5. Once verified, apply the policy to your full device fleet using the same process.

Troubleshooting

FRP does not engage after factory reset:

• Confirm the Google account associated with FRP is correctly configured and active. FRP requires a Google account to have been set up on the device prior to the reset.
• If devices were provisioned without a Google account (common in AOSP or GMS-less builds), FRP will not function. In this case, contact Esper Support to assess alternative lockdown options for non-GMS devices.

ADB remains accessible after policy application:

• Confirm the policy has fully converged on the device by checking the last sync time in Devices & Groups → [Device Name] → Device Info.
• If ADB is still enabled despite the policy, contact Esper Support with details of your device and policy configuration.

Devices already factory reset and offline:

• These devices are no longer reachable via Esper. They must be physically recovered and re-provisioned.
• Refer to the Esper provisioning documentation for QR-code or Zero-Touch re-enrollment steps.
• If your fleet is large and multiple devices have been lost to unauthorized resets, contact Esper Support for assistance with bulk remediation.

Important notes

• FRP requires Google Mobile Services (GMS): FRP is a GMS feature and will not function on AOSP-only or GMS-less device builds. Verify that your target devices are GMS-certified before relying on FRP as a control.
• Refer to Creating a Compliance Policy for additional guidance on building and managing policies.

Still need help?

If you encounter issues applying these controls or need assistance with your fleet configuration, submit a support ticket and we'll help you secure your devices.