Habits from the machine you work on · habit 33 of 40

A device somebody else administers

A managed device is a good device. It is patched, encrypted, replaced when it breaks, and repaired by somebody whose job that is. The management is not a flaw in it.

The habit

You treat a device that works well as your own, because it was handed to you working and nobody said otherwise.

Why it is automatic

The device arrived ready. Somebody had imaged it, joined it, installed what was needed and set the wallpaper. All that was asked in return was a password on the first morning and a few clicks through screens headed with words like enrolment and compliance.

After that, good management is invisible on purpose. The measure of a well run fleet is that nobody notices it is managed. Updates land at night and certificates renew silently. The result is a machine that simply works, which also means there is no daily reminder of who else holds a key.

The reminders that do exist have faded into the furniture. A small icon in the corner. A line on the login screen. An entry in a settings pane nobody opens. These are honest disclosures that have sat there so long they stopped registering, the way a fire exit sign stops registering.

What it actually does here

What management software can do is broad by design, because narrow tools cannot support a fleet. Depending on platform and configuration that typically includes installing and removing applications, applying configuration profiles, setting browser policy, adding certificates the device will trust, collecting an inventory of installed software, and locating or wiping the machine.

Those capabilities come as a set. There is no version where the remote wipe works and the inventory does not. Enrolling a device in order to get remote repair necessarily grants the machinery that performs it, and that machinery does not distinguish a Tuesday afternoon from a Sunday night.

Policies vary enormously between organisations, and the reader almost certainly does not know their own. Two people with identical laptop models at different employers can be in quite different positions, and neither has read the schedule attached to the handbook. Not knowing is the normal condition here, not a personal failing.

Underneath it all is a plain fact of ownership. The person who owns the machine is not the person typing on it. The device is an asset with an entry in a register, returned when the job ends, then wiped and reissued. The account on it is a permission rather than a possession.

Enrolment is a moment nobody remembers

Almost everyone with a managed device consented to it, and almost nobody can describe what they consented to. It happened on the first day, between the building tour and the payroll form, on a screen with a Continue button and no realistic alternative. Refusing meant not having a computer.

That is worth naming clearly, because the usual framing is that people were careless. They were not. The gap is not between careful and careless readers. It is between a disclosure that was technically made and one that was actually received.

Not knowing your own policy is the normal condition

The honest position for most readers is uncertainty. You do not know whether your browser reports its history, whether your endpoint agent captures anything on a trigger, or whether the certificate on your machine is used for inspection or only for internal sites. These are answerable questions and the answers differ.

What that argues for is not paranoia. It argues for keeping this activity off any device whose configuration you cannot describe, which is a far easier test than working out what a given agent does. The same reasoning appears from the hardware side on the machine you also work on.

What to do instead

You cannot audit a fleet management platform from the user seat, and you do not need to. You need to know whether a device is managed, and to act on the answer.

1. Look at the management panes once, calmly, while nothing is happening. Most systems list configuration profiles and installed certificates in settings.
2. Treat the answer as binary. If anyone other than you administers the device, it is not the device for this, whatever the specific policy turns out to say.
3. Do not try to remove management or unenrol. It is visible when it happens, it breaks the machine you rely on for work, and it is somebody else's property.
4. Remember a borrowed family machine counts too. The test is who can administer it, not who employs whom.
5. Use an unmanaged device even if it is older and slower, and see nothing here is a mistake for why that is a change of habit rather than a correction.

How to notice you did it anyway

Whether a device is managed is not hidden. It is written down in several places that take a minute to check.

• The browser settings or management page, which states plainly whether an organisation controls it.
• The profiles or device management pane in system settings, which lists what was applied and by whom.
• The icon in the tray belonging to the management or endpoint agent, and what it says when opened.
• Applications that appeared without being installed by you, which is management doing its job.
• The text on the login screen, which on many fleets carries the notice people stopped reading years ago.

What readers ask about this habit