1# @ohos.enterprise.adminManager (Administrator Permission Management) 2 3The **adminManager** module provides administrator permission management capabilities for enterprise MDM applications, including enabling or disabling administrator permissions, subscribing to events, delegating applications, and granting permissions. 4 5> **NOTE** 6> 7> - The initial APIs of this module are supported since API version 12. Newly added APIs will be marked with a superscript to indicate their earliest API version. 8> 9> - The APIs of this module can be called only by a device administrator application. For details, see [MDM Kit Development](../../mdm/mdm-kit-guide.md). 10 11## Modules to Import 12 13```ts 14import { adminManager } from '@kit.MDMKit'; 15``` 16 17## adminManager.disableAdmin 18 19disableAdmin(admin: Want, userId?: number): Promise\<void> 20 21Disables a device administrator application for the specified user. This API uses a promise to return the result. 22 23**Required permissions**: ohos.permission.MANAGE_ENTERPRISE_DEVICE_ADMIN (available only for system applications) 24 25**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 26 27 28 29**Model restriction**: This API can be used only in the stage model. 30 31**Parameters** 32 33| Name| Type | Mandatory| Description | 34| ------ | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 35| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 36| userId | number | No | User ID, which must be greater than or equal to 0.<br> - If **userId** is passed in, this API applies to the specified user.<br> - If **userId** is not passed in, this API applies to the current user.| 37 38**Return value** 39 40| Type | Description | 41| -------------- | ------------------------------------------------------------ | 42| Promise\<void> | Promise that returns no value. If the operation fails, an error object will be thrown.| 43 44**Error codes** 45 46For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 47 48| ID| Error Message | 49| -------- | ------------------------------------------------------------ | 50| 9200005 | Failed to deactivate the administrator application of the device. | 51| 201 | Permission verification failed. The application does not have the permission required to call the API. | 52| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 53 54**Example** 55 56```ts 57import { Want } from '@kit.AbilityKit'; 58import { BusinessError } from '@kit.BasicServicesKit'; 59 60let wantTemp: Want = { 61 bundleName: 'com.example.myapplication', 62 abilityName: 'EntryAbility', 63}; 64 65adminManager.disableAdmin(wantTemp, 100).catch((err: BusinessError) => { 66 console.error(`Failed to disable admin. Code: ${err.code}, message: ${err.message}`); 67}); 68``` 69 70## adminManager.subscribeManagedEventSync 71 72subscribeManagedEventSync(admin: Want, managedEvents: Array\<ManagedEvent>): void 73 74Subscribes to system management events. 75 76**Required permissions**: ohos.permission.ENTERPRISE_SUBSCRIBE_MANAGED_EVENT 77 78**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 79 80 81 82**Model restriction**: This API can be used only in the stage model. 83 84**Parameters** 85 86| Name | Type | Mandatory| Description | 87| ------------- | ------------------------------------------------------- | ---- | ---------------------- | 88| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 89| managedEvents | Array\<[ManagedEvent](#managedevent)> | Yes | Array of events to subscribe to. | 90 91**Error codes** 92 93For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 94 95| ID| Error Message | 96| -------- | ------------------------------------------------------------ | 97| 9200001 | The application is not an administrator application of the device. | 98| 9200008 | The specified system event is invalid. | 99| 201 | Permission verification failed. The application does not have the permission required to call the API. | 100| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 101 102**Example** 103 104```ts 105import { Want } from '@kit.AbilityKit'; 106 107let wantTemp: Want = { 108 bundleName: 'com.example.myapplication', 109 abilityName: 'EntryAbility', 110}; 111let events: Array<adminManager.ManagedEvent> = [adminManager.ManagedEvent.MANAGED_EVENT_BUNDLE_ADDED, adminManager.ManagedEvent.MANAGED_EVENT_BUNDLE_REMOVED]; 112 113try { 114 adminManager.subscribeManagedEventSync(wantTemp, events); 115 console.info('Succeeded in subscribing managed event.'); 116} catch (err) { 117 console.error(`Failed to subscribe managed event. Code: ${err.code}, message: ${err.message}`); 118} 119``` 120 121## adminManager.unsubscribeManagedEventSync 122 123unsubscribeManagedEventSync(admin: Want, managedEvents: Array\<ManagedEvent>): void 124 125Unsubscribes from system management events. 126 127**Required permissions**: ohos.permission.ENTERPRISE_SUBSCRIBE_MANAGED_EVENT 128 129**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 130 131 132 133**Model restriction**: This API can be used only in the stage model. 134 135**Parameters** 136 137| Name | Type | Mandatory| Description | 138| ------------- | ------------------------------------------------------- | ---- | ---------------------- | 139| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 140| managedEvents | Array\<[ManagedEvent](#managedevent)> | Yes | Array of events to unsubscribe from. | 141 142**Error codes** 143 144For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 145 146| ID| Error Message | 147| -------- | ------------------------------------------------------------ | 148| 9200001 | The application is not an administrator application of the device. | 149| 9200008 | The specified system event is invalid. | 150| 201 | Permission verification failed. The application does not have the permission required to call the API. | 151| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 152 153**Example** 154 155```ts 156import { Want } from '@kit.AbilityKit'; 157 158let wantTemp: Want = { 159 bundleName: 'com.example.myapplication', 160 abilityName: 'EntryAbility', 161}; 162let events: Array<adminManager.ManagedEvent> = [adminManager.ManagedEvent.MANAGED_EVENT_BUNDLE_ADDED, adminManager.ManagedEvent.MANAGED_EVENT_BUNDLE_REMOVED]; 163 164try { 165 adminManager.unsubscribeManagedEventSync(wantTemp, events); 166 console.info('Succeeded in unsubscribing managed event.'); 167} catch (err) { 168 console.error(`Failed to unsubscribe managed event. Code: ${err.code}, message: ${err.message}`); 169} 170``` 171 172## adminManager.setDelegatedPolicies<sup>14+</sup> 173 174setDelegatedPolicies(admin: Want, bundleName: string, policies: Array<string>): void 175 176Delegates other applications to set device management policies. The applications must request the permissions required. 177 178**Required permission**: ohos.permission.ENTERPRISE_MANAGE_DELEGATED_POLICY 179 180**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 181 182 183 184**Model restriction**: This API can be used only in the stage model. 185 186**Parameters** 187 188| Name | Type | Mandatory| Description | 189| ------------- | ------------------------------------------------------- | ---- | ------------------ | 190| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 191| bundleName | string | Yes | Bundle name of the delegated application. The distribution type of the application can only be **enterprise_normal** or **enterprise_mdm**. For details about the **app-distribution-type** field, see [Profile](https://developer.huawei.com/consumer/en/doc/app/agc-help-add-releaseprofile-0000001914714796).| 192| policies | Array<string> | Yes | [Delegation Policy List](#delegation-policy-list)| 193 194**Error codes** 195 196For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 197 198| ID| Error Message | 199| -------- | ------------------------------------------------------------ | 200| 9200001 | The application is not an administrator application of the device. | 201| 9200002 | The administrator application does not have permission to manage the device. | 202| 9200009 | Failed to grant the permission to the application. | 203| 201 | Permission verification failed. The application does not have the permission required to call the API. | 204| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 205 206**Example** 207 208```ts 209import { Want } from '@kit.AbilityKit'; 210 211let admin: Want = { 212 bundleName: 'com.example.myapplication', 213 abilityName: 'EntryAbility', 214}; 215let policies: Array<string> = ["disabled_hdc"]; 216 217try { 218 adminManager.setDelegatedPolicies(admin, "com.example.enterprise.xxx", policies); 219 console.info('Succeeded in setting delegated policies.'); 220} catch (err) { 221 console.error(`Failed to set delegated policies. Code: ${err.code}, message: ${err.message}`); 222} 223``` 224 225## adminManager.getDelegatedPolicies<sup>14+</sup> 226 227getDelegatedPolicies(admin: Want, bundleName: string): Array<string> 228 229Queries the list of policies that can be accessed by the delegated application. 230 231**Required permission**: ohos.permission.ENTERPRISE_MANAGE_DELEGATED_POLICY 232 233**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 234 235 236 237**Model restriction**: This API can be used only in the stage model. 238 239**Parameters** 240 241| Name | Type | Mandatory| Description | 242| ---------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 243| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 244| bundleName | string | Yes | Bundle name of the delegated application. The distribution type of the application can only be **enterprise_normal** or **enterprise_mdm**. For details about the **app-distribution-type** field, see [Profile](https://developer.huawei.com/consumer/en/doc/app/agc-help-add-releaseprofile-0000001914714796).| 245 246 247**Return value** 248 249| Type | Description | 250| --------------------- | ------------------------- | 251| Array<string> | Delegation policy list.| 252 253**Error codes** 254 255For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 256 257| ID| Error Message | 258| -------- | ------------------------------------------------------------ | 259| 9200001 | The application is not an administrator application of the device. | 260| 9200002 | The administrator application does not have permission to manage the device. | 261| 201 | Permission verification failed. The application does not have the permission required to call the API. | 262| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 263 264**Example** 265 266```ts 267import { Want } from '@kit.AbilityKit'; 268 269let admin: Want = { 270 bundleName: 'com.example.myapplication', 271 abilityName: 'EntryAbility', 272}; 273 274try { 275 let policies: Array<string> = adminManager.getDelegatedPolicies(admin, "com.example.enterprise.xxx"); 276 console.info(`Succeeded in getting delegated policies.${JSON.stringify(policies)}`); 277} catch (err) { 278 console.error(`Failed to get delegated policies. Code: ${err.code}, message: ${err.message}`); 279} 280``` 281 282## adminManager.getDelegatedBundleNames<sup>14+</sup> 283 284getDelegatedBundleNames(admin: Want, policy: string): Array<string> 285 286Queries the delegated applications that can access a delegation policy and output the list of delegated applications. 287 288**Required permission**: ohos.permission.ENTERPRISE_MANAGE_DELEGATED_POLICY 289 290**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 291 292 293 294**Model restriction**: This API can be used only in the stage model. 295 296**Parameters** 297 298| Name | Type | Mandatory| Description | 299| ------------- | ------------------------------------------------------- | ---- | ------------------ | 300| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 301| policy | string | Yes | Delegation policy.| 302 303 304**Return value** 305 306| Type | Description | 307| --------------------- | ------------------------- | 308| Array<string> | List of delegated applications.| 309 310**Error codes** 311 312For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 313 314| ID| Error Message | 315| -------- | ------------------------------------------------------------ | 316| 9200001 | The application is not an administrator application of the device. | 317| 9200002 | The administrator application does not have permission to manage the device. | 318| 201 | Permission verification failed. The application does not have the permission required to call the API. | 319| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 320 321**Example** 322 323```ts 324import { Want } from '@kit.AbilityKit'; 325 326let admin: Want = { 327 bundleName: 'com.example.myapplication', 328 abilityName: 'EntryAbility', 329}; 330 331try { 332 let bundleNames: Array<string> = adminManager.getDelegatedBundleNames(admin, "disabled_hdc"); 333 console.info(`Succeeded in getting delegated bundles.${JSON.stringify(bundleNames)}`); 334} catch (err) { 335 console.error(`Failed to get delegated bundles. Code: ${err.code}, message: ${err.message}`); 336} 337``` 338 339## adminManager.startAdminProvision<sup>15+</sup> 340 341startAdminProvision(admin: Want, type: AdminType, context: common.Context, parameters: Record\<string, string>): void 342 343Enables the device administrator application to open a page for the BYOD administrator to perform activation. 344 345**Required permission**: ohos.permission.START_PROVISIONING_MESSAGE 346 347**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 348 349 350 351**Model restriction**: This API can be used only in the stage model. 352 353**Parameters** 354 355| Name | Type | Mandatory | Description | 356| ----- | ----------------------------------- | ---- | ------- | 357| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 358| type | [AdminType](#admintype15) | Yes | Type of the activated device administrator application. Only the **ADMIN_TYPE_BYOD** type is supported. | 359| context | [common.Context](../apis-ability-kit/js-apis-app-ability-common.md) | Yes| Context information of the administrator application.| 360| parameters | Record\<string, string> | Yes| Custom parameters. The key value must contain **activateId**.| 361 362**Error codes** 363 364For details about the error codes, see [Universal Error Codes](../errorcode-universal.md). 365 366| ID| Error Message | 367| ------- | ----------------------------------------------------- | 368| 201 | Permission verification failed. The application does not have the permission required to call the API. | 369| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 370 371**Example** 372 373<!--code_no_check--> 374```ts 375import { common, Want } from '@kit.AbilityKit'; 376 377let wantTemp: Want = { 378 bundleName: 'com.example.myapplication', 379 abilityName: 'EntryAbility', 380}; 381let recordParameters: Record<string, string> = { 382 "activateId": "activateId testValue", 383 "customizedInfo": "customizedInfo testValue" 384}; 385// Obtain the context from the component and ensure that the return value of this.getUIContext().getHostContext() is UIAbilityContext. 386const context = this.getUIContext().getHostContext() as common.UIAbilityContext; 387try { 388 console.info('context:' + JSON.stringify(context)); 389 adminManager.startAdminProvision(wantTemp, adminManager.AdminType.ADMIN_TYPE_BYOD, context, recordParameters); 390 console.info('startAdminProvision::success'); 391} catch (error) { 392 console.error('startAdminProvision::errorCode: ' + error.code + ' errorMessage: ' + error.message); 393} 394``` 395 396## ManagedEvent 397 398Enumerates the system management events that can be subscribed to. 399 400**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 401 402 403 404| Name | Value | Description | 405| -------------------------------------------- | ---- | -------------- | 406| MANAGED_EVENT_BUNDLE_ADDED | 0 | An application is installed.| 407| MANAGED_EVENT_BUNDLE_REMOVED | 1 | An application is uninstalled.| 408| MANAGED_EVENT_APP_START | 2 | An application is started.| 409| MANAGED_EVENT_APP_STOP | 3 | An application is stopped.| 410| MANAGED_EVENT_SYSTEM_UPDATE | 4 | The system is updated.| 411| MANAGED_EVENT_ACCOUNT_ADDED<sup>18+</sup> | 5 | An account is created.| 412| MANAGED_EVENT_ACCOUNT_SWITCHED<sup>18+</sup> | 6 | An account is switched.| 413| MANAGED_EVENT_ACCOUNT_REMOVED<sup>18+</sup> | 7 | An account is removed.| 414 415## AdminType<sup>15+</sup> 416 417Enumerates the types of device administrator applications. 418 419**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 420 421| Name | Value | Description | 422| ----------------- | ---- | ----- | 423| ADMIN_TYPE_BYOD | 0x02 | BYOD device administrator application.| 424 425## Appendix 426### Delegation Policy List 427| Policy Name| API | Description| 428| --- | --- | --- | 429|disallow_add_local_account| [accountManager.disallowOsAccountAddition](js-apis-enterprise-accountManager.md#accountmanagerdisallowosaccountaddition)<br>[accountManager.isOsAccountAdditionDisallowed](js-apis-enterprise-accountManager.md#accountmanagerisosaccountadditiondisallowed) | Prevents the device from creating a local user, without needing the **accountId** parameter.<br>Checks whether the device is prevented from creating a local user, without needing the **accountId** parameter.| 430|disallow_add_os_account_by_user| [accountManager.disallowOsAccountAddition](js-apis-enterprise-accountManager.md#accountmanagerdisallowosaccountaddition)<br>[accountManager.isOsAccountAdditionDisallowed](js-apis-enterprise-accountManager.md#accountmanagerisosaccountadditiondisallowed) | Prevents the specified user from adding accounts, with the **accountId** parameter passed.<br>Checks whether the specified user is prevented from adding accounts, with the **accountId** parameter passed.| 431|disallow_running_bundles|[applicationManager.addDisallowedRunningBundlesSync](js-apis-enterprise-applicationManager.md#applicationmanageradddisallowedrunningbundlessync)<br>[applicationManager.removeDisallowedRunningBundlesSync](js-apis-enterprise-applicationManager.md#applicationmanagerremovedisallowedrunningbundlessync)<br>[applicationManager.getDisallowedRunningBundlesSync](js-apis-enterprise-applicationManager.md#applicationmanagergetdisallowedrunningbundlessync)|Adds the applications that are not allowed to run by the current or specified user.<br>Removes applications that are not allowed to run.<br>Obtains applications that are not allowed to run by the current user or specified user.| 432|manage_auto_start_apps|[applicationManager.addAutoStartApps](js-apis-enterprise-applicationManager.md#applicationmanageraddautostartapps)<br>[applicationManager.removeAutoStartApps](js-apis-enterprise-applicationManager.md#applicationmanagerremoveautostartapps)<br>[applicationManager.getAutoStartApps](js-apis-enterprise-applicationManager.md#applicationmanagergetautostartapps)|Adds the auto-start applications. Currently, this capability supports only 2-in-1 devices.<br>Removes the auto-start applications. Currently, this capability supports only 2-in-1 devices.<br>Obtains the auto-start applications. Currently, this capability supports only 2-in-1 devices.| 433|allowed_bluetooth_devices|[bluetoothManager.addAllowedBluetoothDevices](js-apis-enterprise-bluetoothManager.md#bluetoothmanageraddallowedbluetoothdevices)<br>[bluetoothManager.removeAllowedBluetoothDevices](js-apis-enterprise-bluetoothManager.md#bluetoothmanagerremoveallowedbluetoothdevices)<br>[bluetoothManager.getAllowedBluetoothDevices](js-apis-enterprise-bluetoothManager.md#bluetoothmanagergetallowedbluetoothdevices)|Adds allowed Bluetooth devices.<br>Removes allowed Bluetooth devices.<br>Obtains allowed Bluetooth devices.| 434|set_browser_policies|[browser.setPolicySync](js-apis-enterprise-browser.md#browsersetpolicysync)<br>[browser.getPoliciesSync](js-apis-enterprise-browser.md#browsergetpoliciessync)|Sets the sub-policy for a specified browser.<br>Obtains the policy of a specified browser.| 435|allowed_install_bundles|[bundleManager.addAllowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanageraddallowedinstallbundlessync)<br>[bundleManager.removeAllowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagerremoveallowedinstallbundlessync)<br>[bundleManager.getAllowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagergetallowedinstallbundlessync)|Adds the applications that can be installed by the current or specified user.<br>Removes the applications that can be installed.<br>Obtains the applications that can be installed by the current or specified user.| 436|disallowed_install_bundles|[bundleManager.addDisallowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanageradddisallowedinstallbundlessync)<br>[bundleManager.removeDisallowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagerremoveallowedinstallbundlessync)<br>[bundleManager.getDisallowedInstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagergetdisallowedinstallbundlessync)|Adds the applications that cannot be installed by the current or specified user.<br>Removes the applications that cannot be installed.<br>Obtains the applications that cannot be installed by the current or specified user.| 437|disallowed_uninstall_bundles|[bundleManager.addDisallowedUninstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanageradddisalloweduninstallbundlessync)<br>[bundleManager.removeDisallowedUninstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagerremovedisalloweduninstallbundlessync)<br>[bundleManager.getDisallowedUninstallBundlesSync](js-apis-enterprise-bundleManager.md#bundlemanagergetdisalloweduninstallbundlessync)|Adds the applications that cannot be uninstalled by the current or specified user.<br>Removes the applications that cannot be uninstalled.<br>Obtains the applications that cannot be uninstalled by the current or specified user.| 438|get_device_info|[deviceInfo.getDeviceInfo](js-apis-enterprise-deviceInfo.md#deviceinfogetdeviceinfo)|Obtains device information.| 439|location_policy|[locationManager.setLocationPolicy](js-apis-enterprise-locationManager.md#locationmanagersetlocationpolicy)<br>[locationManager.getLocationPolicy](js-apis-enterprise-locationManager.md#locationmanagergetlocationpolicy)|Sets the location service policy.<br>Obtains the location service policy.| 440|disabled_network_interface|[networkManager.setNetworkInterfaceDisabledSync](js-apis-enterprise-networkManager.md#networkmanagersetnetworkinterfacedisabledsync)<br>[networkManager.isNetworkInterfaceDisabledSync](js-apis-enterprise-networkManager.md#networkmanagerisnetworkinterfacedisabledsync)|Disables a network interface.<br>Checks whether the network interface is disabled.| 441|global_proxy|[networkManager.setGlobalProxySync](js-apis-enterprise-networkManager.md#networkmanagersetglobalproxysync)<br>[networkManager.getGlobalProxySync](js-apis-enterprise-networkManager.md#networkmanagergetglobalproxysync)|Sets the global network proxy.<br>Obtains the global network proxy.| 442|disabled_bluetooth|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **bluetooth** as the parameter to disable or enable the Bluetooth capability.<br>Accepts **bluetooth** as the parameter to query whether the Bluetooth capability is disabled.| 443|disallow_modify_datetime|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **modifyDateTime** as the parameter to disable or enable the system time setting capability.<br>Accepts **modifyDateTime** as the parameter to query whether the system time modification capability is disabled.| 444|disabled_printer|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **printer** as the parameter to disable or enable the printing capability.<br>Accepts **printer** as the parameter to query whether the printing capability is disabled.| 445|disabled_hdc|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **hdc** as the parameter to disable or enable the HDC capability.<br>Accepts **hdc** as the parameter to query whether the HDC capability is disabled.| 446|disable_microphone|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **microphone** as the parameter to disable or enable the microphone capability.<br>Accepts **microphone** as the parameter to query whether the microphone is disabled.| 447|fingerprint_auth|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)<br>[restrictions.setDisallowedPolicyForAccount](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicyforaccount14)<br>[restrictions.getDisallowedPolicyForAccount](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicyforaccount14)|Accepts **fingerprint** as the parameter to disable or enable fingerprint authentication.<br>Accepts **fingerprint** as the parameter to query whether fingerprint authentication is disabled.<br>Accepts **fingerprint** as the parameter to disable or enable fingerprint authentication for a specified user.<br>Accepts **fingerprint** as the parameter to query whether fingerprint authentication is disabled for a specified user.| 448|disable_usb|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **usb** as the parameter to disable or enable the USB capability.<br>Accepts **usb** as the parameter to query whether the USB capability is disabled.| 449|disable_wifi|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **wifi** as the parameter to disable or enable the Wi-Fi capability.<br>Accepts **wifi** as the parameter to query whether the Wi-Fi capability is disabled.| 450|disallowed_tethering|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **tethering** as the parameter to disable or enable network sharing.<br>Accepts **tethering** as the parameter to query whether the network sharing capability is disabled.| 451|inactive_user_freeze|[restrictions.setDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionssetdisallowedpolicy)<br>[restrictions.getDisallowedPolicy](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedpolicy)|Accepts **inactiveUserFreeze** as the parameter to freeze or unfreeze inactive users.<br>Accepts **inactiveUserFreeze** as the parameter to query whether inactive users are frozen.| 452|snapshot_skip|[restrictions.addDisallowedListForAccount](js-apis-enterprise-restrictions.md#restrictionsadddisallowedlistforaccount14)<br>[restrictions.removeDisallowedListForAccount](js-apis-enterprise-restrictions.md#restrictionsremovedisallowedlistforaccount14)<br>[restrictions.getDisallowedListForAccount](js-apis-enterprise-restrictions.md#restrictionsgetdisallowedlistforaccount14)|Accepts **snapshotSkip** as the parameter to add applications with screen snapshot disabled.<br>Accepts **snapshotSkip** as the parameter to remove the applications with screen snapshot disabled.<br>Accepts **snapshotSkip** as the parameter to obtain the applications with screen snapshot disabled.| 453|password_policy|[securityManager.setPasswordPolicy](js-apis-enterprise-securityManager.md#securitymanagersetpasswordpolicy)<br>[securityManager.getPasswordPolicy](js-apis-enterprise-securityManager.md#securitymanagergetpasswordpolicy)|Sets the device password policy.<br>Obtains the device password policy.| 454|clipboard_policy|[securityManager.setAppClipboardPolicy](js-apis-enterprise-securityManager.md#securitymanagersetappclipboardpolicy)<br>[securityManager.getAppClipboardPolicy](js-apis-enterprise-securityManager.md#securitymanagergetappclipboardpolicy)|Sets the device clipboard policy.<br>Obtains the device clipboard policy.| 455|watermark_image_policy|[securityManager.setWatermarkImage](js-apis-enterprise-securityManager.md#securitymanagersetwatermarkimage14)<br>[securityManager.cancelWatermarkImage](js-apis-enterprise-securityManager.md#securitymanagercancelwatermarkimage14)|Sets the watermark policy. Currently, this feature is available only for 2-in-1 devices.<br>Cancels the watermark policy. Currently, this feature is available only for 2-in-1 devices.| 456|ntp_server|[systemManager.setNTPServer](js-apis-enterprise-systemManager.md#systemmanagersetntpserver)<br>[systemManager.getNTPServer](js-apis-enterprise-systemManager.md#systemmanagergetntpserver)|Sets the NTP server policy.<br>Obtains the NTP server information.| 457|set_update_policy|[systemManager.setOtaUpdatePolicy](js-apis-enterprise-systemManager.md#systemmanagersetotaupdatepolicy)<br>[systemManager.getOtaUpdatePolicy](js-apis-enterprise-systemManager.md#systemmanagergetotaupdatepolicy)|Sets the update policy.<br>Obtains the update policy.| 458|notify_upgrade_packages|[systemManager.notifyUpdatePackages](js-apis-enterprise-systemManager.md#systemmanagernotifyupdatepackages)<br>[systemManager.getUpdateResult](js-apis-enterprise-systemManager.md#systemmanagergetupdateresult)|Notifies the system of the update packages.<br>Obtains the system update result.| 459|allowed_usb_devices|[usbManager.addAllowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanageraddallowedusbdevices)<br>[usbManager.removeAllowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanagerremoveallowedusbdevices)<br>[usbManager.getAllowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanagergetallowedusbdevices)|Adds allowed USB devices.<br>Removes allowed USB devices.<br>Obtains allowed USB devices.| 460|usb_read_only|[usbManager.setUsbStorageDeviceAccessPolicy](js-apis-enterprise-usbManager.md#usbmanagersetusbstoragedeviceaccesspolicy)<br>[usbManager.getUsbStorageDeviceAccessPolicy](js-apis-enterprise-usbManager.md#usbmanagergetusbstoragedeviceaccesspolicy)|Sets the USB storage device access policy.<br>Obtains the USB storage device access policy.| 461|disallowed_usb_devices|[usbManager.addDisallowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanageradddisallowedusbdevices14)<br>[usbManager.removeDisallowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanagerremovedisallowedusbdevices14)<br>[usbManager.getDisallowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanagergetdisallowedusbdevices14)|Adds disallowed USB device types.<br>Removes disallowed USB device types.<br>Obtains disallowed USB device types.| 462