All about Samsung MDM in Chimera - ChimeraTool help

The locks you might have on your phone

We have five distinct locks here to talk about. These are as follows: 

• KnoxGuard
• KnoxConfigure
• Knox Mobile Enrollment/Bulk Enrollment
• Knox Firmware Management
• Knox Asset Intelligence

Chimera's solutions to unlock your phone

For the KnoxGuard lock, we have the EUB KnoxGuard Remove and EUB KnoxGuard Patch procedures.

You can use the EUB Mdm Remove procedure for all other MDM locks.

In essence, we can handle all of the locks in EUB mode.

EUB Mdm Remove

The EUB Mdm Remove procedure first checks if the KnoxGuard lock is present:

1. If so, it cancels the procedure and prompts you to run one of the above-mentioned KnoxGuard procedures. 
2. If KnoxGuard is not locked, however, it will proceed to check for the presence of the other MDM locks. If it succeeds in detecting one, it will patch the device to prevent re-locking to these MDM locks. The device is safe to wipe, update, or re-flash up to all Samsung security updates released so far.

EUB KnoxGuard Remove

The EUB KnoxGuard Remove procedure can switch the current KnoxGuard state* to either Prenormal, Checking, or Completed state. KnoxGuard has various states, each with a different behavior**. We recommend the Completed state for best results once the device passes the Setup Wizard.

EUB KnoxGuard Patch

The EUB KnoxGuard Patch procedure unlocks the bootloader, sets the state to Completed, and turns off the KnoxGuard service completely on the phone so that it can no longer be re-locked and KnoxGuard servers are no longer checked. It does all of this in one simple step. We recommend this procedure for all devices when the KnoxGuard state is Locked or Active.

This procedure is available for most EUB models, except a few North American models that do not allow bootloader unlocking. There is still a way to prevent re-locking for these devices where the KnoxGuard Patch procedure is not available, but it is not a 100% permanent solution. For this case, you should first complete the Setup Wizard on the device without connecting the device to the internet, then run the normal KnoxGuard Remove procedure and set the state to Completed. This prevents it from re-locking, even if connected to the internet until the user wipes it or performs an over-the-air update.

Chimera prompts the users with warnings at the end of the KnoxGuard Remove and KnoxGuard Patch procedures. Please heed these warnings for the best results.

Reference

* Checking KnoxGuard state

If you start your phone in Download Mode, it will display some info about your device. Amongst others, you can find out the current KnoxGuard state.

** KnoxGuard states

Prenormal:

This is the device's initial state. It has not been online and is waiting to connect to the internet to know which state it must switch to. The device remains in this state until the Setup Wizard has run and reverts to this state if you have to rerun it. This includes factory resets and firmware flashes that cause data to be wiped.

In this state, you can not modify the device's firmware in Download Mode, but you can wipe the device.

Checking:

The device is checking with KnoxGuard servers to see if it has been enrolled. A device can remain in this state for many days until it receives a command from the server to switch to another state. During this period, it will continue to connect to KnoxGuard servers any time it has internet connectivity.

In this state, you can modify the device's firmware in Download Mode or wipe it, but its state will be reverted to Prenormal in both cases.

Completed:

The device has completed the checking period with KnoxGuard servers. No enrollment has been detected on any of the device identifiers. The device will no longer check against KnoxGuard servers when it has internet connectivity. This state is the recommended state for the best results.

If the device performs an over-the-air update, it can revert to Checking state.

In this state, you can modify the device's firmware in Download Mode or wipe it, but its state will be reverted to Prenormal in both cases.

Locked:

According to the KnoxGuard servers, the device has been enrolled and locked. This state is the most restricted. Restrictions depend on the profile the device receives from KnoxGuard servers. It will check for profile updates whenever it has internet connectivity.

In this state, you can not modify the device's firmware in Download Mode, and depending on the profile, it may be prevented from wiping data.

We recommend patching the device to prevent re-locking.

Active:

According to the KnoxGuard servers, the device has been enrolled but not locked. The Active state is semi-restricted. It will check for profile updates whenever it has internet connectivity. The owner of the device enrollment profile controls the state of the device. They can set the state to Locked or Completed within the enrollment period. Modifying the device's firmware in Download Mode will leave the device in Active state. The user can wipe the device, and the device will remain in Active state. We recommend patching the device to prevent re-locking.