com.samsung.android.knox.kpecore Copy

Labelled "KPECore", this is a Samsung system component belonging to Knox Platform for Enterprise (KPE), Samsung's enterprise security layer on Galaxy devices. Samsung describes KPE as bringing "hardware-based security, policy management, and compliance capabilities beyond the standard features commonplace in the mobile device market", requiring a valid Knox licence, and applied by administrators through the Knox Service Plugin in their UEM. It has no launcher icon and nothing a user opens. Samsung does not publicly document this package by name, so rather than guess at its internals the evidence is set out plainly. On this site's provenance data it is Samsung platform-signed and its permissions are almost entirely Knox ones, including KNOX_KPECORE_INTERNAL, KNOX_LICENSE_INTERNAL, KNOX_SECURITY, KNOX_DEVICE_CONFIGURATION, KNOX_CUSTOM_SETTING and KNOX_WIFI, alongside platform permissions such as WRITE_SECURE_SETTINGS, MANAGE_ROLE_HOLDERS, MANAGE_USERS, SET_TIME and INSTALL_SELF_UPDATES. That is the shape of a core on-device service for applying Knox policy and handling Knox licensing, and it can update itself, which fits a component Samsung services independently of firmware releases. For Android Enterprise, EMM and kiosk use, treat this as part of the Samsung management stack rather than something to trim. If your EMM applies Knox policy through the Knox Service Plugin, interfering with this package risks breaking that policy path, so it is rated caution. Samsung-specific configuration should be changed through the Knox Service Plugin and your EMM, not by disabling system packages. Version note: KPE is the Knox 3.x-era model. Samsung's container documentation records that from Knox 3.0 onward the Knox Platform for Enterprise extends the standard Android Enterprise work profile rather than requiring the older proprietary Knox Workspace container, and Samsung's admin documentation states that KPE depends on a valid Knox licence. Whether this particular package's role has changed across Knox or One UI releases is not something the available sources establish, so it is flagged here as an open question rather than asserted. This site records it on API 31 through API 37 devices, with versions ranging from 2.1.10.25 to 2.6.04.9.

• Knox Platform for Enterprise - Samsung Knox Documentation →
• Knox Service Plugin - Knox Platform for Enterprise, Samsung Knox Documentation →
• About containers - Knox SDK, Samsung Knox Documentation →
• Package provenance for com.samsung.android.knox.kpecore - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 27 permissions: 7 signature or system-level, 5 install-time and 15 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.