Technical · Course T7Lesson 2 of 4
The remote command surface
8 min read- Choose between quick actions and the Ops tab for a given job
- Execute the high-consequence commands safely and explain their guardrails
- Explain what happens to a command sent to an offline device
WeGuard splits remote control into two surfaces: quick actions on the device's Actions tab for the handful of things you do constantly, and the Ops tab for the full command catalog. Knowing which is which saves a lot of clicking.
One rule governs both: commands sent to offline devices are queued and execute the moment the device reconnects. "I sent it and nothing happened" is almost always a connectivity statement.
Quick actions
The Actions tab surfaces the everyday set — Reboot, Lock / Unlock, Clear Kiosk Password (Kiosk policies), and Power Off (Samsung and LG device-owner devices). Availability shifts with platform, policy type, and plan, which is the same platform → type → plan triage from Policy Mastery applied to buttons.
Admin Lock deserves its own paragraph. It replaces the device's screen with a custom message until an admin releases it — useful for compliance enforcement or reassigning a device. You can write the message, accept the default, or schedule the lock for a future date and time. Its one prerequisite trips people up: the device's policy must have location settings enabled, and the dialog will block you with a warning if not.
The Ops tab: six categories, thirty-one commands
| Category | Commands |
|---|---|
| Device Control | Restart Device, Power Off (Samsung), Wake Up Device, Force Policy Refresh, Restart WeGuard |
| Security & Kiosk | Lock, Unlock, Admin Lock, Admin Unlock, Wipe Device, Clear Kiosk Password |
| Application Management | App Install, App Uninstall, Clear App Data, Force Stop App (Samsung), Launch App, Uninstall WeGuard, APK Data Usage, Data Usage Report |
| Storage & Directory | Delete APK Directory, Delete Log Directory, Clear Wallpaper Directory, Delete Persona Wallpaper, Delete Admin Lock Wallpaper, Delete Bug Report |
| Account Management | Remove Account By Type, Remove All Accounts, Remove EMM Account |
| Location Services | Troubleshoot Location, Start Location Service, Stop Location Service |
Pick a category, click the command card, supply any input it needs (a package name for App Uninstall, for instance), and confirm. Samsung-only commands hide on non-Samsung hardware, and plan-gated commands hide entirely — so a "missing" command is usually a plan or hardware answer, not a bug.
Two commands are worth memorizing as first-line troubleshooting: Force Policy Refresh for a device running stale rules, and Wake Up Device for an Android device that seems unreachable.
The high-consequence set
Four operations change a device's life, and each has a guardrail worth explaining to customers before they need it:
- Wipe Device — full factory reset. You must type
WIPE <deviceId>exactly to confirm. Irreversible; raises a critical alert and an audit entry. (On BYOD/Work Profile devices the action is Wipe Profile — the work container only, personal data untouched. That distinction is a BYOD selling point.) - Mark as Lost — admin-locks the device with a message and moves it into the lost filter. On iOS it activates Apple Lost Mode, which additionally requires a footer note and phone number, and needs a supervised device. Mark as Active reverses it: flags cleared, device unlocked.
- Replace Device — the hardware-swap state, with a required note; excluded from active counts, reversible via Restore.
- Delete Device — removes management. Online Android devices get wiped as part of deletion; offline ones just lose the record. iOS offers a choice: Reset Device or Remove MDM Profile Only, with an option to preserve an eSIM data plan. There is no undo — re-enrollment is the only path back.
SIM Lock PIN management rounds out the security set: per-device PINs with edit and change history (statuses UPDATED, RECEIVED, SENT, ERROR, MISMATCH), plus CSV bulk upload for setting or updating PINs across the fleet. It only works where Enable SIM Lock is on in the relevant policies.
Everything above writes to the audit log — which is what makes remote control defensible in front of a customer's security team.