Samsung Knox used illegally

[Jason Hackney1]

Samsung Knox has been activated on my phone without my consent. It has been made device administrator and with Knox mdm is being used to remotely access and monitor my phone, and enforce policies restricting my access to settings and apps.

I am not associated with any enterprise, business or platform and I own my phone. I do not have access to Knox dashboard or Knox at all, even though it is active on my phone. It was renamed "android system" in my apps and I only found it after searching through its notifications and that it threads its way through many of my apps. It enables wifi and Bluetooth sometimes right in front of me and has a 2nd set of wifi settings I can't change.

Samsung was initially helpful, connecting me with knox support. It then disconnected and when I called back with my ticket number I was told there was not a separate knox support department....even though they had just connected me to them five minutes before.

I am not sure what I can do about this and need help. It was hard work just figuring out what was happening. Most of it is hidden from view, or I am bluntly locked out of it. It simply stayed put through several factory resets. Also almost all logs are disabled and bug reports and traces are missing information. It won't allow me to send feedback reports either.

This is being done illegally and against samsung policy, they seem to be aware and won't help at all. It is being done without my consent and is causing me harm.

Any advice is appreciated

Jason [Mod redacted personal info]
[Mod redacted email]

 

[mustang7757]

Welcome to AC!
Which Samsung device you have?
Knox is Samsung security and in every Samsung device. Knox MDM is the business enterprise , is this used as a work phone ? Go to device administrator do you see knox listed there?

 

[Jason Hackney1]

Yes knox is listed as administrator and cannot be deactivated by me. My phone is my personal device and I am not connected to any enterprise, business, or platform...I understand knox is installed on most samsung phones......but mine is active, enforcing policies and remotely monitoring and accessing my phone.
I have been unable to stop or disable any of it. Thank you for replying. As unlikely as it may seem this has been done by someone else without my consent.

 

[B. Diddy]

Welcome to Android Central! Can you give a few more examples of how you know Knox is monitoring or controlling your phone?

Was this phone brand new, or was it ever owned by anyone else?

 

[mustang7757]

Yes knox is listed as administrator and cannot be deactivated by me. My phone is my personal device and I am not connected to any enterprise, business, or platform...I understand knox is installed on most samsung phones......but mine is active, enforcing policies and remotely monitoring and accessing my phone.
I have been unable to stop or disable any of it. Thank you for replying. As unlikely as it may seem this has been done by someone else without my consent.

Which Samsung device?

 

[Jason Hackney1]

The phone was brand new, a Galaxy A125U. I noticed almost immediately while setting the phone up some things weren't right. I didn't have access to some settings, and others were greyed out or would switch back after I left a screen. Wifi and Bluetooth shut on and off by themselves, there is a second set of wifi settings I can only access through hidden settings app. I show connected to a network but cannot disconnect. My cam is recording at times when I open it.it would not allow certain downloads from playstore, mainly apps that provided system or network information my google account was accessed and security changed. I found knox mdm renamed "android system" in apps, it's notification categories are the same as knox, it tells me sometimes that app or info is "unavailable, check back later".....what os tells you check back in later.....it's been a lot of small things. At first I thought I'd been hacked, then figured out my phone was managed and policies were being enforced....Samsung remote support was able to "unhide" knox mobile enrollment as device administrator, can't be deactivated.
Sorry for the text wall....look I'm not a programmer, it took a lot to figure out what was going on, and now that I have....I still can't fix it or stop it. It's a little scary tbh

 

[B. Diddy]

Did you buy it directly from Samsung or a carrier, or did you get it from a 3rd party seller?

Does this also happen in Safe Mode? https://www.t-mobile.com/support/devices/android/samsung-galaxy-a12/safe-mode-samsung-galaxy-a12

 

[Chuck Finley69]

If possible, I'd return it for a refund.

 

[mustang7757]

The phone was brand new, a Galaxy A125U. I noticed almost immediately while setting the phone up some things weren't right. I didn't have access to some settings, and others were greyed out or would switch back after I left a screen. Wifi and Bluetooth shut on and off by themselves, there is a second set of wifi settings I can only access through hidden settings app. I show connected to a network but cannot disconnect. My cam is recording at times when I open it.it would not allow certain downloads from playstore, mainly apps that provided system or network information my google account was accessed and security changed. I found knox mdm renamed "android system" in apps, it's notification categories are the same as knox, it tells me sometimes that app or info is "unavailable, check back later".....what os tells you check back in later.....it's been a lot of small things. At first I thought I'd been hacked, then figured out my phone was managed and policies were being enforced....Samsung remote support was able to "unhide" knox mobile enrollment as device administrator, can't be deactivated.
Sorry for the text wall....look I'm not a programmer, it took a lot to figure out what was going on, and now that I have....I still can't fix it or stop it. It's a little scary tbh

Go to settings>accounts and back up>manage accounts you see it there ?

 

[Jason Hackney1]

I bought the phone through metro pcs. No it doesn't show up in accounts/backup. It does not show up anywhere it should except as device administrator and on the apps screen. I cannot deactivate it as admin, and I cannot open, disable, or force stop.
I have actually watched settings being changed and wifi and Bluetooth turn on and off. I've had devices added to my google account, I've removed all third party app access, two step verifications. My bluetooth activates in the background running Gatt service while turned off. I'm going to call Samsung Knox in a few moments and I'll spend the first half hour repeating steps and following disable instructions until I'm able to finally convince them somethings not right, and that I'm not just seeing normal processes.

 

[mustang7757]

I bought the phone through metro pcs. No it doesn't show up in accounts/backup. It does not show up anywhere it should except as device administrator and on the apps screen. I cannot deactivate it as admin, and I cannot open, disable, or force stop.
I have actually watched settings being changed and wifi and Bluetooth turn on and off. I've had devices added to my google account, I've removed all third party app access, two step verifications. My bluetooth activates in the background running Gatt service while turned off. I'm going to call Samsung Knox in a few moments and I'll spend the first half hour repeating steps and following disable instructions until I'm able to finally convince them somethings not right, and that I'm not just seeing normal processes.

There should be a app ?

 

[Jason Hackney1]

Knox enrollment service is the app and I cannot open, stop, or disable it. It can't be Uninstaller or deactivated as device administrator.

 

[B. Diddy]

At this point, it'd probably be best to bring it back to Metro and show them what you're seeing. Then ask them for an exchange.

 

[mustang7757]

I agree

 

[Jason Hackney1]

Thank you for taking the time to help. Samsung is sending me to a service tech to reflash my phone. I'm hoping when they do they can just uninstall knox altogether. Thank you guys, for the good advice.

 

[mustang7757]

Thank you for taking the time to help. Samsung is sending me to a service tech to reflash my phone. I'm hoping when they do they can just uninstall knox altogether. Thank you guys, for the good advice.

You can reflash yourself through odin but let's see what they say

 

[Ben xfg]

Thank you for taking the time to help. Samsung is sending me to a service tech to reflash my phone. I'm hoping when they do they can just uninstall knox altogether. Thank you guys, for the good advice.

Even if you return the device, you'll want to secure your accounts.
I'd remove all accounts from that phone then change all the passwords to be safe. Sounds like a well thought out hack, and I doubt it's Samsung doing it.

 

[cknobman]

If it was brand new, and if has not been a long time, I really question the unwillingness to take it back to T-Mobile.
Based on the described behavior its quite possible you were not the first one to use that phone making it not "new".

 

[Mattrim Fox]

Okay, so this is a tricky one, Samsung Knox enrollment may seem like a good culprit, and if used improperly it totally is. However, it's far easier and more likely they signed you up for a work profile, which is Android Enterprise, but will most likely be handled by your specific phone manufacturer, ie Samsung, LG, Google ect.

So what you need to do is backup all your needed settings, apps, photos, contacts. Everything you can into an online folder, save that to another, separate device. And then delete your entire account with that provider and make a new one. Then factory reset the phone from the boot menu.

It sucks, but the work profile can only be connected to an email, so by simply deleting the main account on the phone, you can remove the connection to the "company" that owns the device.

Then use the separate device to move over your phones old info to get a full restore without the backup folder that was connected to that account. Best workaround I found, hope it helps!

 

[Annie Ross]

Okay, so this is a tricky one, Samsung Knox enrollment may seem like a good culprit, and if used improperly it totally is. However, it's far easier and more likely they signed you up for a work profile, which is Android Enterprise, but will most likely be handled by your specific phone manufacturer, ie Samsung, LG, Google ect.

So what you need to do is backup all your needed settings, apps, photos, contacts. Everything you can into an online folder, save that to another, separate device. And then delete your entire account with that provider and make a new one. Then factory reset the phone from the boot menu.

It sucks, but the work profile can only be connected to an email, so by simply deleting the main account on the phone, you can remove the connection to the "company" that owns the device.

Then use the separate device to move over your phones old info to get a full restore without the backup folder that was connected to that account. Best workaround I found, hope it helps!

I have had this issue the same exact issues that he described back in 2021. It has caused me so much mental health issues. My family think I'm nuts because I think they did it. I've been called every name possible. Like this guy said I've sat and watched this stiff happen. You say to back up everything. What would I have to do buy another phone to back up this one ? Thanks in advance