DuckPolicy

An LSPosed / Xposed module that makes apps see no device-policy restrictions on your own device. It hooks DevicePolicyManager and UserManager restriction checks and returns the "no restriction" answer, per category, with a master toggle.

Fork and full rewrite of liyafe1997/FuckDevicePolicy. The original neutralises UserManager policies (e.g. work-profile / Intune device-wide restrictions); this v3 rewrite generalises that into a per-category UI across DevicePolicyManager and UserManager.

Features

• Master toggle + per-category switches, with All / None quick actions.
• Covers, per category: camera & screen-capture blocks, device-admin / owner / managed-profile checks, the full password/PIN policy set, keyguard feature limits, storage-encryption enforcement, managed app configuration, user restrictions (DISALLOW_*, incl. UserManager.hasUserRestriction), auto-lock timeout, kiosk / lock-task, permitted IME & accessibility allow-lists, assorted smaller restrictions, and Outlook's own MDM enrollment gate (requiresDeviceManagement / isPolicyApplied — skips the "your organization requires device management" screen; only installs when scoped into com.microsoft.office.outlook).
• Material You dynamic colours (Android 12+) and an adaptive icon.
• Small: R8 + resource shrinking, ~1.8 MB.

Install & scope

1. Install the APK from Releases and enable DuckPolicy in LSPosed.

2. Set the module scope:

   • System Framework (android) for the broadest, system-wide effect — this is the recommended default for work-profile / user-restriction cases.
   • or specific target app(s) whose policy view you want to change.

3. Reboot (or force-stop) the scoped processes to apply.

   

Important

Do not scope the MDM app itself (e.g. Microsoft Intune / Company Portal) or Microsoft Authenticator — hooking those can expose Xposed/root to detection (Authenticator in particular does heavy root/Play-Integrity attestation). Outlook is different and included in the default scope: it has no meaningful Xposed/root detection, only its own enrollment-gate check, which the outlook_enrollment category neutralises.

Because settings are shared cross-process via XSharedPreferences, the module should be enabled (and the device rebooted once) before you rely on the toggles — otherwise a freshly-installed, not-yet-hooked app can't read them.

To see which restrictions are actually applied on your device: adb shell dumpsys device_policy (look under userRestrictions:).

How it works (and its limits)

The hooks patch the client-side DevicePolicyManager / UserManager wrappers inside each scoped process, so they change what an app (or the framework) sees when it queries policy. They do not rewrite what system_server actually enforces underneath. Intended for your own device.

The Outlook enrollment gate is a separate, narrower thing: it patches Outlook's own private DevicePolicy class, not a framework or MAM-SDK type. It stops the initial "enroll this device" prompt, but does not touch Intune's MAM app-protection layer (screenshot block, copy/paste, save-to-personal, app PIN) — that's enforced independently by the embedded com.microsoft.intune.mam SDK and needs its own separate hook if you want to neutralise it too.

Build

./gradlew :app:assembleDebug      # debug
./gradlew :app:assembleRelease    # signed release (R8 + shrink)

Requires JDK 17. The Xposed API is pulled compileOnly from api.xposed.info.

Release signing

The project ships a signing key (app/duckpolicy.jks) that is intentionally not a secret — like an Android debug key. This lets CI and local builds produce a consistently-signed, installable APK with zero secret setup, and lets users update in place across versions. It is not a Play Store identity. Pushing a v* tag runs

.github/workflows/release.yml, which builds and publishes the signed APK.

Credits

• Original module and concept: liyafe1997/FuckDevicePolicy.
• See LICENSE.