com.samsung.android.kgclient Copy

Shown on the device simply as "Device Services", this is Samsung's on-device client for Knox Guard. Knox Guard is a cloud service from Samsung that protects devices, enterprise assets and payment plans against theft, loss and financial default: an administrator can remotely lock a device, push a lock screen message or payment reminder, restrict which SIMs may be used, block adb and developer mode, and lock devices that have not connected to a network for a set period. This client is the component on the handset that receives and enforces those instructions. In our sample it is signed by a Samsung OEM key that also signs the Android framework, a platform-level key. For Android Enterprise, EMM and kiosk work the important point is that Knox Guard sits underneath your EMM rather than beside it, and it can stop enrolment outright. By default, Knox Guard activated devices manufactured with Android 15 and higher cannot be enrolled into Android Enterprise at all: both fully managed (device owner) and work profile (profile owner) provisioning are blocked until an administrator unblocks Android Enterprise provisioning for those devices in the Knox Guard console. If a Samsung device refuses to provision for no obvious reason, checking whether it is Knox Guard activated is a worthwhile step. Knox Guard is a deterrent against theft and default, so this client is not something to disable: on an activated device, disabling it is exactly what the service exists to resist. Its behaviour on a device that was never activated is not described in Samsung's documentation, so do not assume it is inert there. Version note: the role here has changed more than once. Knox Guard only supports Samsung devices manufactured with Android 11 or higher, and like other Knox cloud services it is supported on the five most recent major Android versions. Samsung blocked new enrolments on devices running Knox Guard client 1.0 (Android P and Q builds) from April 2025, with existing enrolled devices supported for the remainder of their service periods. The default block on Android Enterprise provisioning described above applies to devices manufactured with Android 15 and higher, so behaviour on older hardware differs.

• Get started with Knox Guard - Samsung Knox Documentation →
• Block and unblock Android Enterprise provisioning - Knox Guard, Samsung Knox Documentation →
• Knox Guard frequently asked questions - Samsung Knox Documentation →
• Knox Guard Update: End of New Enrollment for KG Client 1.0 (P, Q OS) Devices - Samsung Knox →
• Package provenance for com.samsung.android.kgclient - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (493 packages, 7791 observations).
• Its largest observed manifest declares 53 permissions: 6 runtime (user-granted), 20 signature or system-level, 6 install-time and 21 vendor or uncatalogued.
• APK size ranges from 3.0 MB to 6.3 MB across the reporting device profiles, so the build differs substantially between them.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.