Category filter
How to deploy OS updates on Android devices?
Hexnode UEM provides central management over Android system update lifecycles, supporting commercial off-the-shelf (COTS) devices managed via Android Enterprise as well as specialized OEM hardware. IT administrators can execute policy-based Over-the-Air (OTA) updates or remotely push signed custom firmware builds to specialized endpoints.
Update Deployment Approaches
Select the deployment approach matching your organization’s device fleet and enrollment architecture:
| Deployment Approach | Target Endpoints | Management Engine | User Impact |
|---|---|---|---|
| System Update Policies (Commercial Off-the-Shelf Devices) |
Commercial endpoints (Samsung, Google Pixel, Zebra, Motorola, etc.) enrolled in Android Enterprise. | Automated OTA policies (Schedule OS Updates Policy). | Zero manual intervention; updates install during scheduled maintenance windows or automatically. |
| Custom Firmware Deployment (Specialized OEM Hardware) |
Dedicated hardware running custom ROM builds with Hexnode System Agent embedded in /system/priv-app. |
Direct ZIP payload push via the Remote “Update OS” Action. | Silent background flashing or scheduled installation prompts. |
Prerequisites & Compatibility Matrix
| Requirement | Android Enterprise System Update Policies | Custom Firmware File Push |
|---|---|---|
| Operating System | Android 7.0+ | Android 5.0+ |
| Enrollment Mode | Android Enterprise (Device Owner / Work Managed) | Android Enterprise (Device Owner) |
| Firmware Type | Standard Commercial OEM Over-the-Air (OTA) Release | OEM-Signed ZIP Custom Package |
| Hexnode App Level | Standard Hexnode UEM app from Google Play | Privileged System Agent in /system/priv-app |
| Custom ROM Required | ⛔ No (Works on standard commercial devices) | ✅ Yes (Required for direct file flashing) |
Note: Commercial devices managed via Android Enterprise do not require custom ROM configurations or system-level directory placement. Prerequisites related to custom ROMs apply strictly to direct firmware ZIP file pushes.
Configuring System Update Policies in Android Enterprise
Automate update deployment across commercial Android endpoints managed in Android Enterprise using centralized policy controls.
Step-by-Step Configuration Workflow
- Log in to the Hexnode UEM console.
- Navigate to Policies > New Policy (or edit an existing policy).
- Go to Android > Security > OS Updates and click Configure.
- Select the appropriate System Update Setting:
- Update Automatically: Installs system updates as soon as published by the device vendor.
- Update During Inactive Hours: Restricts update execution to a daily maintenance window (e.g., 00:00 to 06:00).
- Postpone Updates: Pauses incoming system updates for up to 30 days to allow internal testing.
- Select Policy Targets to attach the configuration to target Devices, Device Groups, or Users, then click Save.
For detailed policy behavior, review the Schedule OS Updates Documentation.
Executing Custom Firmware File Pushes
Deploy specialized vendor-signed firmware packages (.zip) to dedicated hardware equipped with system-privilege agents.
Step-by-Step Remote Action Workflow
- Host the OEM-signed firmware package on a secure web server accessible by target devices.
- Calculate the MD5 Hash of the ZIP file to ensure data validation during delivery.
- In the Hexnode UEM portal, navigate to the Manage tab.
- Select the target Android devices or device groups.
- Click Actions > Updates > Update OS.
- Configure the update parameters:
- Update File URL: Provide the HTTPS direct download link for the hosted update ZIP.
- File Hash: Enter the MD5 hash checksum.
- Select the preferred installation mode:
- Automatically install the update: Triggers silent background installation.
- Prompt user to install the update: Delivers an update notification prompt to the device screen.
- Click Update to dispatch the command.
Troubleshooting & Diagnostics
| Symptom | Root Cause | Resolution |
|---|---|---|
| “Update OS” action greyed out or unavailable | Device is missing privileged System Agent placement required for direct pushes. | Verify that the device runs Android 5.0+ and has the Hexnode System Agent embedded in /system/priv-app. For commercial devices, use System Update Policies instead. |
| File verification failure or MD5 checksum error | Payload corruption or incorrect hash value input. | Re-calculate the MD5 checksum on the hosting server and verify the direct URL string. |
| Device fails to boot after update execution | Incompatible or unsigned firmware package uploaded. | Ensure the firmware package is OEM-signed and verified via ADB sideload prior to wide-scale deployment. |
Frequently Asked Questions
Are custom ROMs required to manage commercial Android OS updates in Hexnode?
No. Commercial off-the-shelf devices enrolled in Android Enterprise use native system update policies to control OTA releases automatically. Custom ROM configurations are required only when pushing custom firmware ZIP files via the remote “Update OS” action.
Does Hexnode store custom firmware update ZIP files?
No. IT administrators must host the update package on an accessible HTTPS file repository and supply the download URL and MD5 checksum in the console.
Can administrators defer OS updates on Android Enterprise endpoints?
Yes. Under Android Enterprise update policies, administrators can configure the Postpone Updates setting to defer incoming vendor system updates for up to 30 days.
