API_LEVEL 不合规细节……有什么要担心的吗？答案

【问题标题】：API_LEVEL non compliance details ... anything to worry about?API_LEVEL 不合规细节……有什么要担心的吗？
【发布时间】：2019-12-02 11:23:10
【问题描述】：

我们最近采用了 Android Management API，在英国各地拥有大约 250 台自助服务终端设备。

我可以看到一堆与设备 API 级别相关的警告。即policyCompliant: true，但也有一些nonComplianceDetails。

我想知道这是否值得担心？设备会在一定时间后自行恢复出厂设置吗？

受影响的设备

{
  "name": "enterprises/XXXXXXXX/devices/XXXXXXXX",
  "managementMode": "DEVICE_OWNER",
  "state": "ACTIVE",
  "appliedState": "ACTIVE",
  "policyCompliant": true,
  "nonComplianceDetails": [
    {
      "settingName": "systemErrorDialogsDisabled",
      "nonComplianceReason": "API_LEVEL"
    },
    {
      "settingName": "lockTaskFeatures",
      "nonComplianceReason": "API_LEVEL"
    }
  ],
  "enrollmentTime": "2019-01-25T17:09:08.693Z",
  "lastStatusReportTime": "2019-12-02T11:15:14.869Z",
  "lastPolicySyncTime": "2019-12-02T11:15:10.501Z",
  "appliedPolicyVersion": "4",
  "apiLevel": 24,
  "enrollmentTokenData": "20",
  "disabledReason": {},
  "hardwareInfo": {
    "brand": "XXXX",
    "hardware": "XXXXXX",
    "deviceBasebandVersion": "XXXXXXXX",
    "manufacturer": "XXXX",
    "serialNumber": "XXXXXXXX",
    "model": "XXXXXX"
  },
  "policyName": "enterprises/XXXXXXXX/policies/policy_v41",
  "appliedPolicyName": "enterprises/XXXXXXXX/policies/policy_v41",
  "networkInfo": {
    "imei": "XXXXXXXX",
    "wifiMacAddress": "38:1c:4a:XX:c2:XX",
    "networkOperatorName": "vodafone UK"
  },
  "memoryInfo": {
    "totalRam": "1008689152",
    "totalInternalStorage": "1560133632"
  },
  "userName": "enterprises/XXXXXXXX/users/XXXXXXXX",
  "enrollmentTokenName": "enterprises/XXXXXXXX/enrollmentTokens/XXXXXXXX",
  "securityPosture": {
    "devicePosture": "POTENTIALLY_COMPROMISED",
    "postureDetails": [
      {
        "securityRisk": "COMPROMISED_OS",
        "advice": [
          {
            "defaultMessage": "The user should restore their device to a clean factory ROM."
          }
        ]
      }
    ]
  }
}

相应政策

{
  "name": "enterprises/XXXXXXXX/policies/policy_v41",
  "applications": [
    {
      "packageName": "com.example.examplekiosk",
      "installType": "FORCE_INSTALLED",
      "lockTaskAllowed": true,
      "defaultPermissionPolicy": "GRANT",
      "minimumVersionCode": 41
    }
  ],
  "screenCaptureDisabled": true,
  "cameraDisabled": true,
  "defaultPermissionPolicy": "GRANT",
  "persistentPreferredActivities": [
    {
      "receiverActivity": "com.example.examplekiosk/.activities.splash.SplashActivity",
      "actions": [
        "android.intent.action.MAIN"
      ],
      "categories": [
        "android.intent.category.HOME",
        "android.intent.category.DEFAULT"
      ]
    }
  ],
  "systemUpdate": {
    "type": "AUTOMATIC"
  },
  "addUserDisabled": true,
  "factoryResetDisabled": true,
  "mountPhysicalMediaDisabled": true,
  "modifyAccountsDisabled": true,
  "safeBootDisabled": true,
  "uninstallAppsDisabled": true,
  "statusBarDisabled": true,
  "keyguardDisabled": true,
  "statusReportingSettings": {
    "networkInfoEnabled": true
  },
  "wifiConfigsLockdownEnabled": true,
  "cellBroadcastsConfigDisabled": true,
  "credentialsConfigDisabled": true,
  "tetheringConfigDisabled": true,
  "vpnConfigDisabled": true,
  "createWindowsDisabled": true,
  "networkResetDisabled": true,
  "outgoingBeamDisabled": true,
  "outgoingCallsDisabled": true,
  "removeUserDisabled": true,
  "smsDisabled": true,
  "unmuteMicrophoneDisabled": true,
  "usbFileTransferDisabled": true,
  "ensureVerifyAppsEnabled": true,
  "stayOnPluggedModes": [
    "AC"
  ],
  "setUserIconDisabled": true,
  "setWallpaperDisabled": true,
  "dataRoamingDisabled": true,
  "locationMode": "HIGH_ACCURACY",
  "funDisabled": true,
  "autoTimeRequired": true,
  "appAutoUpdatePolicy": "ALWAYS",
  "encryptionPolicy": "ENABLED_WITHOUT_PASSWORD",
  "playStoreMode": "WHITELIST",
  "policyEnforcementRules": [
    {
      "settingName": "passwordPolicies",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "encryptionPolicy",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "keyguardDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "permittedInputMethods",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "permittedAccessibilityServices",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "applications",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "maximumTimeToLock",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "screenCaptureDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "cameraDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "keyguardDisabledFeatures",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "defaultPermissionPolicy",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "persistentPreferredActivities",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "openNetworkConfiguration",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "systemUpdate",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "accountTypesWithManagementDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "addUserDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "adjustVolumeDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "factoryResetDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "installAppsDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "mountPhysicalMediaDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "modifyAccountsDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "safeBootDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "uninstallAppsDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "statusBarDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "keyguardDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "minimumApiLevel",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "statusReportingSettings",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "bluetoothContactSharingDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "shortSupportMessage",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "longSupportMessage",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "passwordRequirements",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "wifiConfigsLockdownEnabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "bluetoothConfigDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "cellBroadcastsConfigDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "credentialsConfigDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "mobileNetworksConfigDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "tetheringConfigDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "vpnConfigDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "wifiConfigDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "createWindowsDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "networkResetDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "outgoingBeamDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "outgoingCallsDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "removeUserDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "shareLocationDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "smsDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "unmuteMicrophoneDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "usbFileTransferDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "ensureVerifyAppsEnabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "permittedInputMethods",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "stayOnPluggedModes",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "recommendedGlobalProxy",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "setUserIconDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "setWallpaperDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "choosePrivateKeyRules",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "alwaysOnVpnPackage",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "frpAdminEmails",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "deviceOwnerLockScreenInfo",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "dataRoamingDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "locationMode",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "networkEscapeHatchEnabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "bluetoothDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "blockApplicationsEnabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "installUnknownSourcesAllowed",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "debuggingFeaturesAllowed",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "funDisabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "autoTimeRequired",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "permittedAccessibilityServices",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "appAutoUpdatePolicy",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "kioskCustomLauncherEnabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "skipFirstUseHintsEnabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "privateKeySelectionEnabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "encryptionPolicy",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "usbMassStorageEnabled",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "permissionGrants",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "playStoreMode",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "setupActions",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "passwordPolicies",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    },
    {
      "settingName": "policyEnforcementRules",
      "blockAction": {
        "blockAfterDays": 299
      },
      "wipeAction": {
        "wipeAfterDays": 300
      }
    }
  ]
}

【问题讨论】：

标签： android-management-api

【解决方案1】：

在这种情况下可以忽略 API_LEVEL 错误。

还有一些建议： 1. 尝试为您的设备启用所有状态报告策略，以获得远程设备的扩展视图。

对于“policyEnforcementRules” - 您实际上可以尝试删除所有值。
这个可能是为了覆盖整体默认值，这个不支持。 { "settingName": "policyEnforcementRules", “块动作”：{ “blockAfterDays”：299 }, “擦拭动作”：{ “wipeAfterDays”：300 } }

【讨论】：

感谢您的回复。我们不希望设备在任何情况下都恢复出厂设置。由于无法在策略级别声明这一点，因此下一个最好的方法是采用所有顶级设置并尽可能松懈policyEnforcementRules。但是，是的，你是对的，这是非常愚蠢的递归规则。这不是故意的，只是复制+粘贴的呼救声。
已通过电子邮件与我联系以提供更多信息。回复您的每一个建议： 1. 设备都是一样的……我们从这里发货，所以大多数可用的报告并不是很有趣，因为设备是信息亭，因此应该处于相同的状态。我添加了有趣的 softwareInfo，因为它报告了 DPC 的版本。 2. 我有点害怕删除这个 TBH，因为它放宽了规则。我希望有一个设置说“在任何情况下都不要擦除此设备”。 3. 这是对政策的愚蠢补充。我已经删除了这个?

【解决方案2】：

将我的政策更新为 Google 推荐的新的自助服务终端设备管理方式，即：

  "applications": [
    {
      "packageName": "com.example.examplekiosk",
      "installType": "KIOSK",
      "defaultPermissionPolicy": "GRANT",
      "minimumVersionCode": 41
    }
  ],

似乎已在首批获得更新政策的少数设备上解决了该问题。所以手指交叉这个完全解决了这个问题。

我希望当推荐的做某事的方法发生变化时，有一个迁移指南或其他东西可以提供帮助。

【讨论】：