How to Inspect Device Lock Policies and Financing Restrictions on Android Using ADB dumpsys devicelock

In modern mobile device management, carrier financing programs, and emerging market smartphone subsidy models, hardware vendors and financial institutions rely on specialized platform safeguards to manage device lock states. In Android 14 and newer versions, Google formalized this infrastructure through the Device Lock Framework, managed by the DeviceLockManagerService. Designed to govern subsidized, financed, or leased devices, the framework allows authorized financial applications and carrier device management backends to provisionally restrict device functionality—such as disabling outgoing calls, restricting third-party applications, or enforcing a complete system-wide lockout screen—if subscription or financing conditions are breached. For enterprise administrators, security researchers, and Android platform engineers, inspecting the internal state of these restrictions is critical. Using the Android Debug Bridge (ADB), engineers can audit device lock status, active restrictions, and provisioned controllers via dumpsys devicelock.

Architecture of the Android Device Lock Framework

The Android Device Lock Framework operates at the privileged system service layer to enforce security boundaries without requiring full device wipe or factory reset capabilities:

• DeviceLockManager: The public and privileged client API that allows authorized carrier and device partner applications to query lock state and deliver provisioned financing tokens.
• DeviceLockManagerService: The core OS background daemon that enforces lock policies, controls screen overlays, and coordinates with the Android package manager and window manager.
• Device Lock Controller: A specialized system application (often provisioned via Zero-Touch enrollment or factory ROM configuration) that communicates with backend financing servers and commands the OS to apply functional restrictions.

When a device is marked as locked by the service, Android restricts the user interface to an emergency dialer and an informational payment/support screen. Through dumpsys devicelock, engineers can verify whether lock controllers are bound, audit applied restrictions, and examine provisioning state.

Connecting via ADB and Verifying Privileges

To inspect device lock internals, connect your Android device to a computer via USB or wireless ADB. Ensure Developer Options and USB Debugging are active, and verify device communication:

adb devices

Confirm that your connected device is detected with the device state before running diagnostic shell commands.

Querying the Complete Device Lock Diagnostics Dump

To view the comprehensive operational status of the Device Lock framework across the operating system, execute the following command:

adb shell dumpsys devicelock

The resulting diagnostic dump outlines active provisioning status, controller package identities, and applied hardware restrictions:

DEVICE LOCK MANAGER SERVICE (dumpsys devicelock)
-------------------------------------------------------------------------------
Provisioning State: PROVISIONED
Device Lock Status: UNLOCKED
Controller Package: com.google.android.devicelockcontroller
Controller UID: 10185
Bound: true
Active Restrictions:
  Disallow Outgoing Calls: false
  Disallow USB Data Transfer: false
  Disallow App Installation: false
  Restricted Package Count: 0
Kiosk Mode Active: false
Last State Update: 2026-11-08 10:15:30

Auditing Device Lock Status and Operational State

To quickly check whether the device is currently in a locked, unlocked, or unprovisioned state, filter the diagnostic output:

adb shell dumpsys devicelock | grep -E "Device Lock Status|Provisioning State"

Interpreting the lock status:

• UNPROVISIONED: The device is standard retail consumer hardware with no active financing or carrier lease restrictions bound to the operating system.
• PROVISIONED: A device lock controller is bound and active, monitoring server heartbeats and policy updates.
• LOCKED: The device is under an active administrative lockout. The user interface is locked to restricted kiosk mode, preventing standard home screen navigation.

Inspecting Active Functional Restrictions

When an enterprise policy or financing condition triggers a partial or complete restriction, specific system capabilities are systematically disabled. You can inspect active restrictions by filtering the dump:

adb shell dumpsys devicelock | grep -A 8 "Active Restrictions"

Standard restrictions governed by the framework include:

• Disallow Outgoing Calls: Blocks non-emergency cellular voice calls while preserving access to emergency numbers (e.g., 911, 112, 999).
• Disallow USB Data Transfer: Disables MTP, PTP, and accessory data transfers while retaining charging capability.
• Disallow App Installation: Blocks sideloading via APK files or installation through application stores.
• Restricted Package Count: Details which specific third-party applications are actively suspended or hidden from the application drawer.

Verifying Controller Package Bindings and Health

If a subsidized device experiences synchronization failures with carrier servers or fails to unlock after an administrative command, verify that the system service is actively bound to its controller package:

adb shell dumpsys devicelock | grep -E "Controller Package|Bound"

If Bound: false is reported, the background controller process has encountered a crash or failed to start. You can inspect system logcat messages for binding errors:

adb shell logcat -d -s DeviceLock:V DeviceLockManagerService:V | tail -n 25

Auditing Kiosk Mode Overlays and Window Tokens

During active lock states, the framework collaborates with the Android WindowManager to render a persistent lock overlay window that intercepts all touch events. You can verify whether the device lock kiosk window holds top-level display priority:

adb shell dumpsys window | grep -E "mCurrentFocus|mFocusedApp" | grep -i "devicelock"

This confirms that the device lock controller’s lockout activity has successfully acquired input focus, preventing users from bypassing the restriction via hardware button combinations or multi-window gestures.