What to do if…
an unfamiliar administrator, management profile, or certificate appears on your device

What to do now

1. Pause sensitive activity. Do not use the device for banking, purchases, passwords, private messages, or identity documents until the unfamiliar item has been checked.

2. Record exactly what appears. Take screenshots or photograph the screen with another device. Capture the administrator, profile, certificate, issuer, organization, permissions, status, and any dates or ownership messages shown.

3. If settings are changing, apps are appearing, websites are redirecting, or warnings keep returning, disconnect Wi-Fi and cellular data after recording the screen. Keep the connection available if you need the device to contact emergency help.

4. Check whether there is a legitimate explanation. Consider recent work or school enrollment, a work account, a VPN, security software, parental controls, carrier setup, or a used device. Verify through contact details you already trust, not details supplied by the unfamiliar prompt.

5. Inspect the relevant settings without approving or deleting anything:

   • On iPhone or iPad, open Settings, General, then VPN & Device Management. Manually trusted root certificates may appear under Settings, General, About, then Certificate Trust Settings.
   • On Mac, open System Settings, General, then Device Management. Use Keychain Access to inspect certificates.
   • On Android, search Settings for work profile, device admin apps, VPN, or certificates. Menu names vary by manufacturer. On many devices, certificates are under Security and privacy, More security settings, then Encryption and credentials.
   • On Windows, open Settings, Accounts, then Access work or school. Certificates can be viewed with the Windows certificate-management tools.

6. If the device belongs to an employer or school, contact its administrator through a known phone number, website, or email address. Ask whether the named profile, certificate, account, or management service is authorized.

7. If this is your personal device and no trusted organization or service recognizes the item, contact the device manufacturer through its official support site or use a reputable local technician. Ask them to identify the item before removing a standalone certificate.

8. Remove an item only after confirming that it is unauthorized and considering what removal will erase:

   • Removing an Apple configuration profile deletes the settings and information associated with that profile.
   • Removing an Android work profile from a personally owned device deletes the apps and local data inside that work profile.
   • Disconnecting a Windows work or school account removes its sign-in information and associated data from the device but does not delete the account itself.
   • Some organization-controlled profiles cannot be removed by the device user.

9. If you entered important passwords after the item appeared and the device also behaved unexpectedly, use a separate trusted device to secure your primary email and other important accounts. Use new unique passwords, turn on multifactor authentication, and review recent activity and signed-in devices through each provider’s official security page.

10. If you find unauthorized transactions or identity misuse, contact the affected bank or service through a trusted channel and use IdentityTheft.gov to create a recovery plan.