Testing with an Emulator

Testing with an Emulator

An Android emulator is the easiest way to test the Device Owner features, because a fresh AVD has no accounts — so set-device-owner works instantly, no factory reset needed.

Install the SDK without Android Studio

You only need a JDK, the command-line tools, the emulator, and a system image.

# 1. JDK 17 (any distro) and Android command-line tools on PATH
#    Lay out:  <sdk>/cmdline-tools/latest/bin/sdkmanager

# 2. Install packages — use a GOOGLE APIS image (NOT a Play image):
sdkmanager "platform-tools" "emulator" \
           "platforms;android-30" \
           "system-images;android-30;google_apis;x86_64"

Use google_apis, not google_apis_playstore. Play-Store images ship a Google account/GMS that blocks adb dpm set-device-owner. The google_apis image allows Device Owner over ADB.

A lighter API level (e.g. 30 / Android 11) boots faster on weak hardware and still supports every policy CORE MDM uses.

Create and boot an AVD

avdmanager create avd -n coremdm_test \
  -k "system-images;android-30;google_apis;x86_64" -d pixel_5

emulator -avd coremdm_test -no-snapshot -no-boot-anim -gpu swiftshader_indirect

On Windows, launch the emulator as a detached process (e.g. PowerShell Start-Process) so it doesn't die with the shell.

Wait for boot:

adb wait-for-device
adb shell getprop sys.boot_completed   # "1" when ready

Install CORE MDM and make it Device Owner

adb install -r app-release.apk
adb shell dpm set-device-owner com.core.mdm/.MdmDeviceAdmin
adb shell dpm list-owners               # verify

Open the app, sign in (email/password works with no Google account), and it enrolls — it now shows in the console as a Device Owner device.

Useful checks

# watch MDM logs
adb logcat -v time MdmCommandService:* DeviceRegistry:* AppPolicyManager:* *:S

# screenshot
adb exec-out screencap -p > shot.png

# is a policy applied? e.g. hidden app
adb shell dumpsys package <pkg> | grep -m1 hidden

# content filter VPN up?
adb shell settings get secure always_on_vpn_app        # -> com.core.mdm
adb shell dumpsys connectivity | grep -o tun0

Gotchas

• Device Owner apps can't be force-stopped ("Ignoring request to force stop protected package"). To restart the service, reboot the emulator (adb reboot) or open the app's activity.
• The installed-app inventory uploads on service start — if the console's Installed Apps tab is empty, reboot/relaunch and reopen the tab.
• Emulators block ICMP ping; test connectivity with the validated-network capability in dumpsys connectivity, not ping.
• First boot is slow on low-end CPUs (minutes). That's normal.

What this validates

Enrollment, the command queue + cancel, the Firestore rules, the installed-app inventory, app hide/suspend, enforced PIN, reboot, and the content-filter VPN auto-authorization — all without touching a real phone.