1# @ohos.enterprise.adminManager (Enterprise Device Management) 2 3The **adminManager** module provides enterprise device management capabilities so that devices have the custom capabilities required in enterprise settings. 4 5> **NOTE** 6> 7> The initial APIs of this module are supported since API version 12. Newly added APIs will be marked with a superscript to indicate their earliest API version. 8> 9> The APIs of this module are available only to [device administrator applications](../../mdm/mdm-kit-guide.md#introduction). 10 11## Modules to Import 12 13```ts 14import { adminManager } from '@kit.MDMKit'; 15``` 16 17## adminManager.disableAdmin 18 19disableAdmin(admin: Want, userId?: number): Promise\<void> 20 21Disables an administrator application for the user specified by the device. This API uses a promise to return the result. 22 23**Required permissions**: ohos.permission.MANAGE_ENTERPRISE_DEVICE_ADMIN 24 25**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 26 27 28 29**Model restriction**: This API can be used only in the stage model. 30 31**Parameters** 32 33| Name| Type | Mandatory| Description | 34| ------ | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 35| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 36| userId | number | No | User ID, which must be greater than or equal to 0.<br> - If **userId** is passed in, this API applies to the specified user.<br> - If **userId** is not passed in, this API applies to the current user.| 37 38**Return value** 39 40| Type | Description | 41| -------------- | ------------------------------------------------------------ | 42| Promise\<void> | Promise that returns no value. If the operation fails, an error object will be thrown.| 43 44**Error codes** 45 46For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 47 48| ID| Error Message | 49| -------- | ------------------------------------------------------------ | 50| 9200005 | Failed to deactivate the administrator application of the device. | 51| 201 | Permission verification failed. The application does not have the permission required to call the API. | 52| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 53 54**Example** 55 56```ts 57import { Want } from '@kit.AbilityKit'; 58import { BusinessError } from '@kit.BasicServicesKit'; 59let wantTemp: Want = { 60 bundleName: 'com.example.myapplication', 61 abilityName: 'EntryAbility', 62}; 63 64adminManager.disableAdmin(wantTemp, 100).catch((err: BusinessError) => { 65 console.error(`Failed to disable admin. Code: ${err.code}, message: ${err.message}`); 66}); 67``` 68 69## adminManager.subscribeManagedEventSync 70 71subscribeManagedEventSync(admin: Want, managedEvents: Array\<ManagedEvent>): void 72 73Subscribes to system management events. 74 75**Required permissions**: ohos.permission.ENTERPRISE_SUBSCRIBE_MANAGED_EVENT 76 77**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 78 79 80 81**Model restriction**: This API can be used only in the stage model. 82 83**Parameters** 84 85| Name | Type | Mandatory| Description | 86| ------------- | ------------------------------------------------------- | ---- | ---------------------- | 87| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 88| managedEvents | Array\<[ManagedEvent](#managedevent)> | Yes | Array of events to subscribe to. | 89 90**Error codes** 91 92For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 93 94| ID| Error Message | 95| -------- | ------------------------------------------------------------ | 96| 9200001 | The application is not an administrator application of the device. | 97| 9200008 | The specified system event is invalid. | 98| 201 | Permission verification failed. The application does not have the permission required to call the API. | 99| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 100 101**Example** 102 103```ts 104import { Want } from '@kit.AbilityKit'; 105let wantTemp: Want = { 106 bundleName: 'com.example.myapplication', 107 abilityName: 'EntryAbility', 108}; 109let events: Array<adminManager.ManagedEvent> = [adminManager.ManagedEvent.MANAGED_EVENT_BUNDLE_ADDED, adminManager.ManagedEvent.MANAGED_EVENT_BUNDLE_REMOVED]; 110 111try { 112 adminManager.subscribeManagedEventSync(wantTemp, events); 113 console.info('Succeeded in subscribing managed event.'); 114} catch (err) { 115 console.error(`Failed to subscribe managed event. Code: ${err.code}, message: ${err.message}`); 116} 117``` 118 119## adminManager.unsubscribeManagedEventSync 120 121unsubscribeManagedEventSync(admin: Want, managedEvents: Array\<ManagedEvent>): void 122 123Unsubscribes from system management events. 124 125**Required permissions**: ohos.permission.ENTERPRISE_SUBSCRIBE_MANAGED_EVENT 126 127**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 128 129 130 131**Model restriction**: This API can be used only in the stage model. 132 133**Parameters** 134 135| Name | Type | Mandatory| Description | 136| ------------- | ------------------------------------------------------- | ---- | ---------------------- | 137| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 138| managedEvents | Array\<[ManagedEvent](#managedevent)> | Yes | Array of events to unsubscribe from. | 139 140**Error codes** 141 142For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 143 144| ID| Error Message | 145| -------- | ------------------------------------------------------------ | 146| 9200001 | The application is not an administrator application of the device. | 147| 9200008 | The specified system event is invalid. | 148| 201 | Permission verification failed. The application does not have the permission required to call the API. | 149| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 150 151**Example** 152 153```ts 154import { Want } from '@kit.AbilityKit'; 155let wantTemp: Want = { 156 bundleName: 'com.example.myapplication', 157 abilityName: 'EntryAbility', 158}; 159let events: Array<adminManager.ManagedEvent> = [adminManager.ManagedEvent.MANAGED_EVENT_BUNDLE_ADDED, adminManager.ManagedEvent.MANAGED_EVENT_BUNDLE_REMOVED]; 160 161try { 162 adminManager.unsubscribeManagedEventSync(wantTemp, events); 163 console.info('Succeeded in unsubscribing managed event.'); 164} catch (err) { 165 console.error(`Failed to unsubscribe managed event. Code: ${err.code}, message: ${err.message}`); 166} 167``` 168 169## adminManager.setDelegatedPolicies<sup>14+</sup> 170 171setDelegatedPolicies(admin: Want, bundleName: string, policies: Array<string>): void 172 173Delegates other applications to set device management policies. 174 175**Required permission**: ohos.permission.ENTERPRISE_MANAGE_DELEGATED_POLICY 176 177**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 178 179 180 181**Model restriction**: This API can be used only in the stage model. 182 183**Parameters** 184 185| Name | Type | Mandatory| Description | 186| ------------- | ------------------------------------------------------- | ---- | ------------------ | 187| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 188| bundleName | string | Yes | Bundle name of the delegated application. Only **enterprise_mdm** and **enterprise_normal** applications are supported. For details about the application distribution types, see [Guide](https://gitee.com/nezha-father/docs/blob/master/en/application-dev/security/app-provision-structure.md).| 189| policies | Array<string> | Yes | [Delegation Policy List](#delegation-policy-list)| 190 191**Error codes** 192 193For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 194 195| ID| Error Message | 196| -------- | ------------------------------------------------------------ | 197| 9200001 | The application is not an administrator application of the device. | 198| 9200002 | The administrator application does not have permission to manage the device. | 199| 9200009 | Failed to grant the permission to the application. | 200| 201 | Permission verification failed. The application does not have the permission required to call the API. | 201| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 202 203**Example** 204 205```ts 206import { Want } from '@kit.AbilityKit'; 207let admin: Want = { 208 bundleName: 'com.example.myapplication', 209 abilityName: 'EntryAbility', 210}; 211let policies: Array<string> = ["disabled_hdc"]; 212 213try { 214 adminManager.setDelegatedPolicies(admin, "com.example.enterprise.xxx", policies); 215 console.info('Succeeded in setting delegated policies.'); 216} catch (err) { 217 console.error(`Failed to set delegated policies. Code: ${err.code}, message: ${err.message}`); 218} 219``` 220 221## adminManager.getDelegatedPolicies<sup>14+</sup> 222 223getDelegatedPolicies(admin: Want, bundleName: string): Array<string> 224 225Queries the list of policies that can be accessed by the delegated application. 226 227**Required permission**: ohos.permission.ENTERPRISE_MANAGE_DELEGATED_POLICY 228 229**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 230 231 232 233**Model restriction**: This API can be used only in the stage model. 234 235**Parameters** 236 237| Name | Type | Mandatory| Description | 238| ---------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 239| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 240| bundleName | string | Yes | Bundle name of the delegated application. Only **enterprise_mdm** and **enterprise_normal** applications are supported. For details about the application distribution types, see [Guide](https://gitee.com/nezha-father/docs/blob/master/en/application-dev/security/app-provision-structure.md).| 241 242 243**Return value** 244 245| Type | Description | 246| --------------------- | ------------------------- | 247| Array<string> | Delegation policy list.| 248 249**Error codes** 250 251For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 252 253| ID| Error Message | 254| -------- | ------------------------------------------------------------ | 255| 9200001 | The application is not an administrator application of the device. | 256| 9200002 | The administrator application does not have permission to manage the device. | 257| 201 | Permission verification failed. The application does not have the permission required to call the API. | 258| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 259 260**Example** 261 262```ts 263import { Want } from '@kit.AbilityKit'; 264let admin: Want = { 265 bundleName: 'com.example.myapplication', 266 abilityName: 'EntryAbility', 267}; 268 269try { 270 let policies: Array<string> = adminManager.getDelegatedPolicies(admin, "com.example.enterprise.xxx"); 271 console.info(`Succeeded in getting delegated policies.${JSON.stringify(policies)}`); 272} catch (err) { 273 console.error(`Failed to get delegated policies. Code: ${err.code}, message: ${err.message}`); 274} 275``` 276 277## adminManager.getDelegatedBundleNames<sup>14+</sup> 278 279getDelegatedBundleNames(admin: Want, policy: string): Array<string> 280 281Queries the delegated applications that can access a delegation policy and output the list of delegated applications. 282 283**Required permission**: ohos.permission.ENTERPRISE_MANAGE_DELEGATED_POLICY 284 285**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 286 287 288 289**Model restriction**: This API can be used only in the stage model. 290 291**Parameters** 292 293| Name | Type | Mandatory| Description | 294| ------------- | ------------------------------------------------------- | ---- | ------------------ | 295| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 296| policy | string | Yes | Delegation policy.| 297 298 299**Return value** 300 301| Type | Description | 302| --------------------- | ------------------------- | 303| Array<string> | List of delegated applications.| 304 305**Error codes** 306 307For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 308 309| ID| Error Message | 310| -------- | ------------------------------------------------------------ | 311| 9200001 | The application is not an administrator application of the device. | 312| 9200002 | The administrator application does not have permission to manage the device. | 313| 201 | Permission verification failed. The application does not have the permission required to call the API. | 314| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 315 316**Example** 317 318```ts 319import { Want } from '@kit.AbilityKit'; 320let admin: Want = { 321 bundleName: 'com.example.myapplication', 322 abilityName: 'EntryAbility', 323}; 324 325try { 326 let bundleNames: Array<string> = adminManager.getDelegatedBundleNames(admin, "disabled_hdc"); 327 console.info(`Succeeded in getting delegated bundles.${JSON.stringify(bundleNames)}`); 328} catch (err) { 329 console.error(`Failed to get delegated bundles. Code: ${err.code}, message: ${err.message}`); 330} 331``` 332 333## adminManager.startAdminProvision<sup>15+</sup> 334 335startAdminProvision(admin: Want, type: AdminType, context: common.Context, parameters: Record\<string, string>): void 336 337Enables the device administrator application to open a page for the BYOD administrator to perform activation. 338 339**Required permission**: ohos.permission.START_PROVISIONING_MESSAGE 340 341**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 342 343 344 345**Model restriction**: This API can be used only in the stage model. 346 347**Parameters** 348 349| Name | Type | Mandatory | Description | 350| ----- | ----------------------------------- | ---- | ------- | 351| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 352| type | [AdminType](#admintype15) | Yes | Type of the activated device administrator application. Only the ADMIN_TYPE_BYOD type is supported. | 353| context | [common.Context](../apis-ability-kit/js-apis-app-ability-common.md) | Yes| Context information of the administrator application.| 354| parameters | Record\<string, string> | Yes| Custom parameters. The key value must contain **activateId**.| 355 356**Error codes** 357 358For details about the error codes, see [Universal Error Codes](../errorcode-universal.md). 359 360| ID| Error Message | 361| ------- | ----------------------------------------------------- | 362| 201 | Permission verification failed. The application does not have the permission required to call the API. | 363| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 364 365**Example** 366 367```ts 368import { common, Want } from '@kit.AbilityKit'; 369import adminManager from '@ohos.enterprise.adminManager'; 370let wantTemp: Want = { 371 bundleName: 'com.example.myapplication', 372 abilityName: 'EntryAbility', 373}; 374let context = getContext(this) as common.UIAbilityContext; 375let recordParameters: Record<string, string> = { 376 "activateId": "activateId testValue", 377 "customizedInfo": "customizedInfo testValue" 378} 379try { 380 console.info('context:' + JSON.stringify(context)); 381 adminManager.startAdminProvision(wantTemp, adminManager.AdminType.ADMIN_TYPE_BYOD, context, recordParameters); 382 console.info('startAdminProvision::success'); 383} catch (error) { 384 console.info('startAdminProvision::errorCode: ' + error.code + ' errorMessage: ' + error.message); 385} 386``` 387 388## ManagedEvent 389 390Enumerates the system management events that can be subscribed to. 391 392**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 393 394 395 396| Name | Value | Description | 397| -------------------------------------------- | ---- | -------------- | 398| MANAGED_EVENT_BUNDLE_ADDED | 0 | An application is installed.| 399| MANAGED_EVENT_BUNDLE_REMOVED | 1 | An application is uninstalled.| 400| MANAGED_EVENT_APP_START | 2 | An application is started.| 401| MANAGED_EVENT_APP_STOP | 3 | An application is stopped.| 402| MANAGED_EVENT_SYSTEM_UPDATE | 4 | The system is updated.| 403| MANAGED_EVENT_ACCOUNT_ADDED<sup>18+</sup> | 5 | An account is created.| 404| MANAGED_EVENT_ACCOUNT_SWITCHED<sup>18+</sup> | 6 | An account is switched.| 405| MANAGED_EVENT_ACCOUNT_REMOVED<sup>18+</sup> | 7 | An account is removed.| 406 407## AdminType<sup>15+</sup> 408 409Enumerates the types of device administrator applications. 410 411**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 412 413| Name | Value | Description | 414| ----------------- | ---- | ----- | 415| ADMIN_TYPE_BYOD | 0x02 | BYOD device administrator application.| 416 417## Appendix 418### Delegation Policy List 419| Policy Name| API | Description| 420| --- | --- | --- | 421|disallow_add_local_account| [accountManager.disallowOsAccountAddition](js-apis-enterprise-accountManager.md#accountmanagerdisallowosaccountaddition)<br>[accountManager.isOsAccountAdditionDisallowed](js-apis-enterprise-accountManager.md#accountmanagerisosaccountadditiondisallowed) | Does not accept the **accountId** parameter, and disallows the device to create a local user.<br>Does not accept the **accountId** parameter, and checks whether to disallow the device to create a local user.| 422|disallow_add_os_account_by_user| [accountManager.disallowOsAccountAddition](js-apis-enterprise-accountManager.md#accountmanagerdisallowosaccountaddition)<br>[accountManager.isOsAccountAdditionDisallowed](js-apis-enterprise-accountManager.md#accountmanagerisosaccountadditiondisallowed) | Accepts the **accountId** parameter, and disallows the specified user to add accounts.<br>Accepts the **accountId** parameter, and checks whether to disallow the specified user to add accounts.| 423|disallow_running_bundles|[applicationManager.addDisallowedRunningBundlesSync](js-apis-enterprise-applicationManager.md#applicationmanageradddisallowedrunningbundlessync)<br>[applicationManager.removeDisallowedRunningBundlesSync](js-apis-enterprise-applicationManager.md#applicationmanagerremovedisallowedrunningbundlessync)<br>[applicationManager.getDisallowedRunningBundlesSync](js-apis-enterprise-applicationManager.md#applicationmanagergetdisallowedrunningbundlessync)|Adds applications to the application blocklist. These applications are disallowed to run by the current or specified user.<br>Removes applications from the application blocklist.<br>Obtains the application blocklist of the current user or a specified user.| 424|manage_auto_start_apps|[applicationManager.addAutoStartApps](js-apis-enterprise-applicationManager.md#applicationmanageraddautostartapps)<br>[applicationManager.removeAutoStartApps](js-apis-enterprise-applicationManager.md#applicationmanagerremoveautostartapps)<br>[applicationManager.getAutoStartApps](js-apis-enterprise-applicationManager.md#applicationmanagergetautostartapps)|Adds the list of auto-start applications upon system startup. Currently, this capability supports only 2-in-1 devices.<br>Removes an app from the auto-startup app list. Currently, this capability supports only 2-in-1 devices.<br>Queries the list of auto-start applications upon system startup. Currently, this capability supports only 2-in-1 devices.| 425|allowed_bluetooth_devices|[bluetoothManager.addAllowedBluetoothDevices](js-apis-enterprise-bluetoothManager.md#bluetoothmanageraddallowedbluetoothdevices)<br>[bluetoothManager.removeAllowedBluetoothDevices](js-apis-enterprise-bluetoothManager.md#bluetoothmanagerremoveallowedbluetoothdevices)<br>[bluetoothManager.getAllowedBluetoothDevices](js-apis-enterprise-bluetoothManager.md#bluetoothmanagergetallowedbluetoothdevices)|Adds allowed Bluetooth devices.<br>Removes allowed Bluetooth devices.<br>Queries allowed Bluetooth devices.| 426|set_browser_policies|[browser.setPolicySync](js-apis-enterprise-browser.md#browsersetpolicysync)<br>[browser.getPoliciesSync](js-apis-enterprise-browser.md#browsergetpoliciessync)|Sets a policy for a browser.<br>Obtains the policy of a specified browser.| 427|allowed_install_bundles|[bundleManager.addAllowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanageraddallowedinstallbundlessync)<br>[bundleManager.removeAllowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagerremoveallowedinstallbundlessync)<br>[bundleManager.getAllowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagergetallowedinstallbundlessync)|Adds the applications that can be installed by the current or specified user.<br>Removes the applications that can be installed.<br>Obtains the applications that can be installed by the current or specified user.| 428|disallowed_install_bundles|[bundleManager.addDisallowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanageradddisallowedinstallbundlessync)<br>[bundleManager.removeDisallowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagerremoveallowedinstallbundlessync)<br>[bundleManager.getDisallowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagergetdisallowedinstallbundlessync)|Adds the applications that cannot be installed by the current or specified user.<br>Removes the applications that cannot be installed.<br>Obtains the applications that cannot be installed by the current or specified user.| 429|disallowed_uninstall_bundles|[bundleManager.addDisallowedUninstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanageradddisalloweduninstallbundlessync)<br>[bundleManager.removeDisallowedUninstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagerremovedisalloweduninstallbundlessync)<br>[bundleManager.getDisallowedUninstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagergetdisalloweduninstallbundlessync)|Adds the applications that cannot be uninstalled by the current or specified user.<br>Removes the applications that cannot be uninstalled.<br>Obtains the applications that cannot be uninstalled by the current or specified user.| 430|get_device_info|[deviceInfo.getDeviceInfo](js-apis-enterprise-deviceInfo.md#deviceinfogetdeviceinfo)|Obtains device information.| 431|location_policy|[locationManager.setLocationPolicy](js-apis-enterprise-locationManager.md#locationmanagersetlocationpolicy)<br>[locationManager.getLocationPolicy](js-apis-enterprise-locationManager.md#locationmanagergetlocationpolicy)|Sets the location service policy.<br>Queries the location service policy.| 432|disabled_network_interface|[networkManager.setNetworkInterfaceDisabledSync](js-apis-enterprise-networkManager.md#networkmanagersetnetworkinterfacedisabledsync)<br>[networkManager.isNetworkInterfaceDisabledSync](js-apis-enterprise-networkManager.md#networkmanagerisnetworkinterfacedisabledsync)|Disables a network interface.<br>Queries whether a specified network interface is disabled.| 433|global_proxy|[networkManager.setGlobalProxySync](js-apis-enterprise-networkManager.md#networkmanagersetglobalproxysync)<br>[networkManager.getGlobalProxySync](js-apis-enterprise-networkManager.md#networkmanagergetglobalproxysync)|Sets the global network proxy.<br>Obtains the global network proxy.| 434|disabled_bluetooth|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|The feature parameter is used to enable or disable the Bluetooth capability.<br>Accepts **bluetooth** as the parameter to query whether the Bluetooth capability is disabled.| 435|disallow_modify_datetime|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **modifyDateTime** as the parameter to disable or enable the system time setting capability.<br>Accepts **modifyDateTime** as the parameter to query whether the system time modification capability is disabled.| 436|disabled_printer|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **printer** as the parameter to disable or enable the printing capability.<br>Accepts **printer** as the parameter to query whether the printing capability is disabled.| 437|disabled_hdc|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **hdc** as the parameter to enable or disable HDC.<br>Accepts **hdc** as the parameter to query whether the HDC capability is disabled.| 438|disable_microphone|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **microphone** as the parameter to enable or disable the microphone capability.<br>Accepts **microphone** as the parameter to query whether the microphone is disabled.| 439|fingerprint_auth|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)<br>[restrictions.setDisallowedPolicyForAccount](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicyforaccount14)<br>[restrictions.getDisallowedPolicyForAccount](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicyforaccount14)|Accepts **fingerprint** as the parameter to disable or enable fingerprint authentication.<br>Accepts **fingerprint** as the parameter to query whether fingerprint authentication is disabled.<br>Accepts **fingerprint** as the parameter to disable or enable fingerprint authentication for a specified user.<br>Accepts **fingerprint** as the parameter to query whether to disable fingerprint authentication for a specified user.| 440|disable_usb|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **usb** as the parameter to enable or disable the USB capability.<br>Accepts **usb** as the parameter to query whether the USB capability is disabled.| 441|disable_wifi|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **wifi** as the parameter to enable or disable the Wi-Fi capability.<br>Accepts **wifi** as the parameter to query whether the Wi-Fi capability is disabled.| 442|disallowed_tethering|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **tethering** as the parameter to enable or disable network sharing.<br>Accepts **tethering** as the parameter to query whether the network sharing capability is disabled.| 443|inactive_user_freeze|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **inactiveUserFreeze** as the parameter to enable or disable the inactive user running capability.<br>Accepts **inactiveUserFreeze** as the parameter to query whether to disable the inactive user running capability.| 444|snapshot_skip|[restrictions.addDisallowedListForAccount](js-apis-enterprise-restrictions.md#restrictionsadddisallowedlistforaccount14)<br>[restrictions.removeDisallowedListForAccount](js-apis-enterprise-restrictions.md#restrictionsremovedisallowedlistforaccount14)<br>[restrictions.getDisallowedListForAccount](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedlistforaccount14)|Accepts **snapshotSkip** as the parameter to add the applications that disable the screen snapshot function.<br>Accepts **snapshotSkip** as the parameter to remove the applications that disable the screen snapshot function.<br>Accepts **snapshotSkip** as the parameter to query the applications that disable the screen snapshot function.| 445|password_policy|[securityManager.setPasswordPolicy](js-apis-enterprise-securityManager.md#securitymanagersetpasswordpolicy)<br>[securityManager.getPasswordPolicy](js-apis-enterprise-securityManager.md#securitymanagergetpasswordpolicy)|Sets the device password policy.<br>Obtains the device password policy.| 446|clipboard_policy|[securityManager.setAppClipboardPolicy](js-apis-enterprise-securityManager.md#securitymanagersetappclipboardpolicy)<br>[securityManager.getAppClipboardPolicy](js-apis-enterprise-securityManager.md#securitymanagergetappclipboardpolicy)|Sets the device clipboard policy.<br>Obtains the device clipboard policy.| 447|watermark_image_policy|[securityManager.setWatermarkImage](js-apis-enterprise-securityManager.md#securitymanagersetwatermarkimage14)<br>[securityManager.cancelWatermarkImage](js-apis-enterprise-securityManager.md#securitymanagercancelwatermarkimage14)|Sets the watermark policy. Currently, this feature is available only for 2-in-1 devices.<br>Cancels the watermark policy. Currently, this feature is available only for 2-in-1 devices.| 448|ntp_server|[systemManager.setNTPServer](js-apis-enterprise-systemManager.md#systemmanagersetntpserver)<br>[systemManager.getNTPServer](js-apis-enterprise-systemManager.md#systemmanagergetntpserver)|Sets the NTP server policy.<br>Obtains the NTP server information.| 449|set_update_policy|[systemManager.setOtaUpdatePolicy](js-apis-enterprise-systemManager.md#systemmanagersetotaupdatepolicy)<br>[systemManager.getOtaUpdatePolicy](js-apis-enterprise-systemManager.md#systemmanagergetotaupdatepolicy)|Sets the update policy.<br>Queries the update policy.| 450|notify_upgrade_packages|[systemManager.notifyUpdatePackages](js-apis-enterprise-systemManager.md#systemmanagernotifyupdatepackages)<br>[systemManager.getUpdateResult](js-apis-enterprise-systemManager.md#systemmanagergetupdateresult)|Notifies the system of the update packages.<br>Obtains the system update result.| 451|allowed_usb_devices|[usbManager.addAllowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanageraddallowedusbdevices)<br>[usbManager.removeAllowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanagerremoveallowedusbdevices)<br>[usbManager.getAllowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanagergetallowedusbdevices)|Adds allowed USB devices.<br>Removes allowed USB devices.<br>Obtains allowed USB devices.| 452|usb_read_only|[usbManager.setUsbStorageDeviceAccessPolicy](js-apis-enterprise-usbManager.md#usbmanagersetusbstoragedeviceaccesspolicy)<br>[usbManager.getUsbStorageDeviceAccessPolicy](js-apis-enterprise-usbManager.md#usbmanagergetusbstoragedeviceaccesspolicy)|Sets the USB storage device access policy.<br>Obtains the USB storage device access policy.| 453|disallowed_usb_devices|[usbManager.addDisallowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanageradddisallowedusbdevices14)<br>[usbManager.removeDisallowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanagerremovedisallowedusbdevices14)<br>[usbManager.getDisallowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanagergetdisallowedusbdevices14)|Adds disallowed USB device types.<br>Removes disallowed USB device types.<br>Obtains disallowed USB device types.| 454