Samsung KG (Knox Guard) Lock

Note: the KG status (Knox Guard) only reflects the situation at the moment of the check.

On Samsung, an MDM lock is usually called KG Lock. This is Samsung’s own variant of Mobile Device Management (MDM). Other brands simply call it MDM, but the concept is the same.

Important: always perform both checks

There are two risks you can only rule out by doing both checks:

1. Pre-registered → only visible via our IMEI check (multiple sources simultaneously).
2. Zero-touch configuration / PRENORMAL → only visible via KG status in Download Mode.

That's why you should always do both checks:

1. ✅ Step 1: Perform IMEI check – to discover pre-registered devices.
2. ✅ Step 2: Check KG status in Download Mode – to make the status final and prevent zero-touch.

⚠️ Only doing step 1 → chance that a zero-touch lock will still follow.

⚠️ Only doing step 2 → chance that a pre-registered device will still be locked online later.

Extra attention: pre-registered devices

Some devices are already pre-registered with an organization (such as a company, school, or provider), without having an active MDM/KG lock yet.

This means the device appears free now, but as soon as it connects to the internet, the organization can still activate a lock – immediately or at a later time (for example, if there's still an outstanding obligation or a company takes action).

Our IMEI check is extra valuable here, because our API consults multiple sources simultaneously (including Microsoft Azure, Apple Business, Sickw, and other MDM servers).

Other checkers often only look at one source, which means you can miss risks. With us, you get a much more complete picture of whether a device is already registered somewhere.

What is a KG lock?

A device with a KG lock is linked to an organization. Once the device connects to the internet, it checks in with the Knox Guard (KG) server, which can manage, lock, or wipe the device.

What is KG status: PRENORMAL?

New Samsung devices that have never been started usually show KG status: PRENORMAL. In this state, a carrier can still remotely activate a lock via Knox Guard. Because the status is not final, the device may still be part of a zero-touch configuration.

How to check the status?

The status is only visible via "Download mode". Below are the steps to enter it:

Works on most models with a USB-C charging port.

1. Turn the device off completely.
2. Connect the charging cable to your PC.
3. Hold Volume + and Volume – at the same time.
4. Then plug the cable into the device immediately.
5. Keep holding Volume + and Volume – until the green screen appears.
6. Press Volume + once to view the status.
7. Done? Hold Power and Volume - for 10 seconds

How to make the status final?

1. Start the device and complete the setup wizard.
2. Let the automatically started updates run for a while.
3. Then power the device off again.
4. Check again in Download mode
• You will now see a new entry next to KG status

The status is final and can no longer be changed. Zero-touch configuration via a carrier is no longer possible.

After a factory reset, the status is temporarily ‘Prenormal’ until the device has been online again.

What does the status mean?

• LOCKED: the device is locked via Knox Guard and may not be fully usable unless the carrier or administrator unlocks it.
• PRENORMAL: not yet activated or online, so it can still be locked. (or temporarily due to a reset)
• CHECKING (0), CHECKING (00) or NORMAL:
  The device is activated and registered with Samsung. A carrier can no longer activate a lock.