How to Inspect User Profiles and Account Restrictions on Android Using ADB dumpsys user

Android Multi-User Architecture and Process Isolation

Modern Android platforms utilise a sophisticated multi-user architecture derived from Unix UID separation. Rather than treating an entire device as a single monolithic user environment, Android partitions processes, applications, and cryptographic storage keys into distinct user profiles managed by UserManagerService. Each profile operates under a unique user identifier (such as User 0 for the primary device owner, User 10 for a corporate work profile, or User 11 for Private Space on Android 15+).

User boundaries enforce rigorous sandboxing. Applications installed within a work profile or private profile cannot read SQLite databases, access internal files, or execute inter-process communication (IPC) routines within another profile unless explicit cross-profile sharing intents are configured by device policy. Furthermore, mobile device management (MDM) suites enforce corporate compliance by applying granular user restrictions—such as blocking USB data transfer, prohibiting app sideloading, or restricting camera access.

For mobile security auditors, enterprise administrators, and Android developers, the Android Debug Bridge (ADB) provides deep visibility into active user profiles, user states, and applied restrictions through dumpsys user and pm list users.

Verifying Connected Devices and Multi-User Capabilities

To inspect multi-user states, connect your target Android smartphone or tablet via USB or Wireless ADB, and ensure debugging permissions are granted:

# Verify connected device state
adb devices -l

# Check multi-user system property support
adb shell getprop fw.max_users

Query the high-level list of registered user profiles configured on the device using package manager:

# List all configured users, IDs, and operational states
adb shell pm list users

A typical multi-user enterprise device produces structured output detailing active user handles:

Users:
    UserInfo{0:Owner:13} running
    UserInfo{10:Work profile:30} running

In this output, 0 represents the primary personal user, while 10 designates the managed enterprise profile running concurrently.

Auditing User Profiles and Account States via dumpsys user

The dumpsys user command queries UserManagerService directly, dumping comprehensive telemetry including user creation timestamps, serial numbers, user types, and cryptographic storage unlock states:

# Dump complete UserManager diagnostic state
adb shell dumpsys user

To examine the operational profile of a specific user handle, filter the output or locate the corresponding UserInfo block:

# Extract user configuration blocks
adb shell dumpsys user | grep -A 20 "UserInfo{0:"

Key properties within the user profile record indicate system status:

• User Type: Identifies profile classification, such as android.os.usertype.full.SYSTEM (primary owner), android.os.usertype.profile.MANAGED (enterprise work profile), or android.os.usertype.profile.PRIVATE (isolated private space).
• Flags: Bitmask representing user capabilities (e.g. ADMIN, PRIMARY, INITIALIZED).
• State: Reflects lifecycle and Credential Encrypted (CE) storage readiness: RUNNING_UNLOCKED (user has authenticated, encryption keys loaded into RAM), RUNNING_LOCKED (Direct Boot mode), or STOPPED.
• Serial Number: Unique persistent integer incremented on each user creation, ensuring recycled user IDs do not inherit lingering app storage.

Inspecting Applied User Restrictions and Security Policies

Enterprise MDM policies and parental controls enforce restrictions through the User Manager API. dumpsys user outputs all active restriction flags, distinguishing between system-enforced restrictions and policy-driven constraints.

To view the full restriction matrix for User 0 and secondary profiles:

# Inspect applied user restrictions
adb shell dumpsys user | grep -A 30 "User restrictions:"

Common security restrictions frequently observed in enterprise or kiosk environments include:

• no_usb_file_transfer (DISALLOW_USB_FILE_TRANSFER): Disables Media Transfer Protocol (MTP) and USB mass storage, preventing data exfiltration to unauthorized workstations.
• no_install_unknown_sources (DISALLOW_INSTALL_UNKNOWN_SOURCES): Prohibits sideloading APK packages outside the managed Google Play Store.
• no_outgoing_calls (DISALLOW_OUTGOING_CALLS): Blocks PSTN cellular voice calls.
• no_config_wifi (DISALLOW_CONFIG_WIFI): Prevents end users from altering Wi-Fi network configurations or disconnecting from corporate SSIDs.
• no_factory_reset (DISALLOW_FACTORY_RESET): Prevents unauthorized wiping of enterprise-enrolled hardware.

Reviewing this section allows auditors to verify that MDM profiles correctly restrict capabilities without requiring manual inspection of device UI menus.

Testing and Simulating Multi-User Lifecycle Events via ADB

Developers testing cross-profile applications or background sync services can simulate user lifecycle transitions directly via ADB shell commands:

To start a secondary user profile in the background without switching the active display:

# Start user profile 10 in the background
adb shell am start-user 10

To switch the active display focus to a secondary user account:

# Switch foreground session to user 10
adb shell am switch-user 10

To stop a secondary profile and unload its runtime services from memory:

# Gracefully stop secondary user profile
adb shell am stop-user -w 10

Provisioning and Removing Test Users

On devices supporting guest mode or secondary profiles (such as Android emulator builds or development devices), you can provision and tear down ephemeral users to validate clean installation workflows:

# Create a new secondary standard user
adb shell pm create-user "TestUser"

# Remove the test user and purge associated sandboxed storage
adb shell pm remove-user <USER_ID>

Auditing dumpsys user ensures security compliance, verifies profile sandboxing integrity, and validates that multi-user isolation behaves correctly across enterprise and multi-profile Android deployments.