In the Android operating system, the “Device Admin” API provides applications with highly elevated, system-level privileges. Apps granted Device Admin status can enforce password policies, remotely wipe the device, lock the screen, and encrypt storage. While this framework is essential for legitimate Mobile Device Management (MDM) solutions (like Google Workspace or Microsoft Intune), granting these privileges to arbitrary or untrusted applications represents a catastrophic security vulnerability. Malicious apps frequently request Device Admin rights to prevent users from uninstalling them and to execute devastating ransomware attacks that lock the device or wipe its contents entirely.
This guide explains how to audit and completely disable ‘Device Admin Apps’ system-wide on an Android device, ensuring that no unauthorized applications hold dangerous, system-altering privileges.
Revoke Device Admin Privileges
Device Admin rights are isolated in a highly specific security menu within the Android settings framework. You must manually audit this list and revoke the privileges of any application that you do not explicitly trust or recognize as your organization’s MDM agent.
- Unlock your Android device and open the main Settings app.
- Scroll down and tap on Security & privacy.
- Scroll to the bottom and tap on More security settings. (On some manufacturer skins like Samsung One UI, this may be located under “Security and privacy” > “Other security settings”).
- Locate and tap on Device admin apps.
- You will see a list of all applications that currently possess or are requesting these elevated privileges. Active Device Admins will have a toggled-on switch or a checkmark next to them.
- To disable an app, tap on its name or toggle the switch to the Off position.
- A high-priority system warning will appear detailing the privileges you are about to revoke. Tap Deactivate this device admin app (or simply Deactivate) to finalize the revocation.
Verify the Configuration Lockdown
By deactivating a Device Admin app, the Android kernel immediately strips the application of its elevated capabilities, demoting it to a standard user-space application subject to normal uninstallation procedures.
To verify the lockdown is active, ensure that the list under “Device admin apps” only contains verified, indispensable tools (such as “Find My Device” if explicitly required, or your company’s official MDM profile). If you suspect an app was malicious, you can now navigate to Settings > Apps and cleanly uninstall it, as it no longer possesses the system-level lockdown preventing its removal. The device is now significantly hardened against privilege escalation and ransomware attacks.