Android kiosk mode on Zebra, Honeywell, Datalogic and Newland devices

Kiosk mode keeps a rugged Android device on one app, or a short list of apps, so users can't change settings or open anything else. This guide covers the Zebra TC22, TC27, TC53e, TC58e, TC501, TC701, MC3400, MC3300x, MC9400, ET40, ET401, VC8300 and the Android tablets ET60 and ET65, the Honeywell EDA52, the Datalogic Memor K20 and K25 and the Newland MT93.

Which option to choose

If you already use an MDM, use its kiosk feature, so the device runs only one launcher. The maker's launcher suits small fleets without an MDM. Zebra and Newland describe EHS and Ndevor as free.

Decide what the kiosk must allow

A kiosk that blocks too much stops work. List these first:

• Apps: your main app plus every app it opens, such as a browser, camera or PDF viewer.
• Wi-Fi: whether users may choose a network, or only IT.
• Battery: lock task mode, Datalogic Launcher and Managed Home Screen hide the battery status by default.
• Scanner: the kiosk app needs its scan settings, for example a DataWedge profile on Zebra devices.
• Power menu: lock task mode keeps the power-button menu unless the MDM switches it off, which can stop users powering down.
• Updates: plan them from the MDM or the maker's tool, because users can't reach them.

Set up kiosk mode in your MDM

Android's built-in kiosk mechanism is lock task mode: only apps the MDM allows can run, and Home, Recent apps, notifications and the lock screen are off unless enabled. It needs a fully managed or dedicated device, so enroll the devices with Android Enterprise first.

• Microsoft Intune: Managed Home Screen runs multi-app kiosks on dedicated and fully managed devices (Android 8.0 or later); an Exit lock task mode password (4–6 digits) lets IT leave the kiosk temporarily. See Intune for rugged devices.
• Workspace ONE: a Launcher profile with the Single App option locks the device to one app; an administrative passcode lets you exit it. See Workspace ONE for rugged devices.
• SOTI MobiControl: add a Lockdown configuration plus an Authentication configuration with the Device Administrator Password, which can dismiss lockdown. See SOTI MobiControl for rugged devices.

Console menus change between versions.

Zebra: set up Enterprise Home Screen

EHS replaces the home screen with User Mode, which shows only the apps you allow, and a password-protected Admin Mode. Get it from Google Play or the Zebra support portal, which lists supported devices; check your model there, including the ET60 and ET65.

1. Install EHS, press Home, select Enterprise Home Screen and tap Always once setup is done. Wait 10 seconds, then restart; a first install needs a restart.
2. In User Mode, open the menu and choose Tools › Admin Login. Set an admin password straight away in the admin Tools menu, not in the XML file.
3. Long-press an app icon to show or hide it in User Mode. Log out of Admin Mode from the Tools menu.
4. For a single-app kiosk, add the app to the kiosk section of enterprisehomescreen.xml in /enterprise/usr/ and set kiosk_mode_enabled to 1. Home and Back then return to the app.
5. Copy the finished file to the other devices with StageNow or the managed configurations of your MDM.

EHS alone is not a complete lockdown, Zebra notes: Quick Settings still reach Wi-Fi, Bluetooth and airplane mode unless restricted with UI Manager in StageNow.

Honeywell: set up Honeywell Launcher

Honeywell Launcher limits users to company-approved apps and locks the device settings. If it is not on your device, Honeywell offers a trial; after it, a licence is needed.

1. Open the Launcher's admin settings as described in Honeywell's Launcher user guide (among the EDA52 documents) and change the default admin password at the first login, as Honeywell advises.
2. Choose the approved apps, and whether users work in one app that starts at power-up or switch between several.
3. Lock down the device settings, and allow only trusted Wi-Fi and Bluetooth connections if needed.
4. Copy it to other devices as the guide describes (see staging tools).

Datalogic: set up Datalogic Launcher

On the Memor K20 and K25, Launcher is in the Datalogic Tools folder and acts as the home screen once started.

1. Open Launcher Settings with the last icon in the app list, or tap an empty area of the home screen 5 times quickly.
2. Enter the administrator password. Change the default under Administrator Password.
3. Add the apps users need, and background helper apps under Allowed Packages.
4. Turn on System Info to show time and battery. Notifications, Overview Button and Power Button Menu are off by default.
5. Turn on Launch on startup. Copy the settings with Export to File, Scan2Deploy Studio or your MDM.

Newland: lock the MT93 with Ndevor

In Ndevor, a Desktop profile locks devices to a set of apps and blocks system apps and settings; a Configuration profile switches the status bar pull-down, Home key and navigation bar. Change the default exit password in the Desktop profile. Newland's Android app guide also describes an Admin Tool app; check on your MT93 whether it is available.

Test the exit before rollout

Lock one test device, check scanning, Wi-Fi and a restart, then practise leaving the kiosk:

• MDM: remove the kiosk policy or use the exit password above.
• EHS: Tools › Admin Login, then in Admin Mode open Settings › Home and choose the Android launcher.
• Honeywell Launcher: log in to admin mode and leave Launcher as Honeywell's user guide describes.
• Datalogic Launcher: use the exit option in Launcher Settings.
• Ndevor: send the Return to native Android Desktop command.

A factory reset is the last resort: see the Zebra reset guide or your model's setup guide.

Common problems

• A button in the app does nothing: it opens a blocked helper app. With Datalogic Launcher, Logcat shows "Attempted Lock Task Mode violation" with the package name; add it to Allowed Packages. In an MDM, add it to the kiosk allow list.
• Scanner doesn't work in the kiosk app: the app has no scan profile. Check DataWedge, EDA52 scan settings or MT93 scanner settings.
• EHS admin locked out: after 10 failed logins (default) EHS disables Admin Mode login. Push a new configuration file, or turn on Lockout Recovery beforehand to retry after a wait.
• Restrictions remain after removing EHS: lift them with a new file before uninstalling.
• Device unusable after an Android 13 upgrade: remove older EHS versions before upgrading, then install EHS 6.0 or later.