Shelter/Island/Insular work profile on rooted samsung phone

[gsmdb]

As we known when samsung phone is rooted then Knox is tripping so multi user with a work profile isn't possible with the error message... can't create work profile.

This is howto guide to bypass Knox security so Shelter works on it, after many tries and errors methode

My setup
- S20 magisk zygisk root android 13
- Magisk modules: lsposed, knoxpatch apk and enhancer (in lsposed), shamiko as blacklist mode, safetynet fix
- Shelter

Guide
- Root your samsung phone with zygisk magisk (25.2) and install those magisk modules. Reboot several times
- In Lsposed enable KnoxPatch module with suggested Recommended. Reboot
- In Magisk Settings change Multiuser Mode > Device Owner Managed (using in multi user profile)
- In Magisk Settings change Mount Namespace Mode > Inherit namespace. Reboot
- Install Shelter and create work profile following Setup Wizard
- Clone the needed apps to Work profile or install directly from Shelter Work Profile
- In Magisk configure DenyList with those apps in work profile

My rooted S20 works fine in Work Profile with my company apps Microsoft Authenticator, Company Portal, Outlook, Teams etc.

Hope it helps for you guys too.

Further process how to make company apps work on Work Profile created by Shelter/ Island needs follow steps

- Install Applist Detector to check root
- Install InitrcHider (zygisk version) in Magisk
- In Magisk configure DenyList with full denying for those company apps (ticks all processes)
- Uninstall Magisk from Settings/ Apps, not directly from Magisk! because if doing it from Magisk then you loose the root
- Check root again with AppList Detector
- Delete company apps data and cache from Settings/ Apps then setup those apps again as new

 

[hduraira]

As we known when samsung phone is rooted then Knox is tripping so multi user with a work profile isn't possible with the error message... can't create work profile.

This is howto guide to bypass Knox security so Shelter works on it, after many tries and errors methode

My setup
- S20 magisk zygisk root android 13
- Magisk modules: lsposed, knoxpatch apk and enhancer (in lsposed), shamiko as blacklist mode, safetynet fix
- Shelter

Guide
- Root your samsung phone with zygisk magisk (25.2) and install those magisk modules. Reboot several times
- In Lsposed enable KnoxPatch module with suggested Recommended. Reboot
- In Magisk Settings change Multiuser Mode > Device Owner Managed (using in multi user profile)
- In Magisk Settings change Mount Namespace Mode > Inherit namespace. Reboot
- Install Shelter and create work profile following Setup Wizard
- Clone the needed apps to Work profile or install directly from Shelter Work Profile
- In Magisk configure DenyList with those apps in work profile

My rooted S20 works fine in Work Profile with my company apps Microsoft Authenticator, Company Portal, Outlook, Teams etc.

Hope it helps for you guys too.

Does the above steps really working bro?
Please help me bro

Device Details:
Samsung S10
Custom ROM: One UI 5.1 android 13 by Ivan_meler
Issue: unable to use intune company portal and Island

Please guide me how to do it bro. The above instruction not working for me bro

 

[gsmdb]

Did it work for you to install Island?
The scoop is how to make Shelter/ Island/ Insular work with rooted Samsung.

Further process how to make company apps work on Work Profile created by Shelter/ Island needs follow steps

- Install Applist Detector to check root
- Install InitrcHider (zygisk version)
- In Magisk configure DenyList with full denying for those company apps (ticks all processes)
- Uninstall Magisk from Settings/ Apps, not directly from Magisk (important!) because if doing it from Magisk then you loose the root
- Check root again with AppList Detector
- Delete company apps data and cache from Settings/ Apps then setup those apps again as new

 

[hduraira]

Thanks for your reply bro
My first issue is that when i try to install shelter or island it starts, loads and restarts automatically bro
Rooted, installed above modules and followed the instruction bro.

 

[gsmdb]

Are you sure your Knox works? Samsung Health, Biometrics, Samsung Pass etc?
It looks like you've trouble with Knox.

You can try enable multi user (per default disabled in Samsung) either using Firefds Kit module in Lsposed or edit the build.prop with
#Multi user
fw.max_users=3
fw.show_multiuserui=1

 

[hduraira]

I have attached the screenshots bro. Please check. Yea even i think knox is not working it is tripped and i m using custom rom bro. If i use intune on main profile it says you need to enable encryption and in island profile it is not even registering profile. Samsung pass doesnt work bro...other samsung apps works properly when i use lsposed knox enhancer bro

 

[gsmdb]

My knox is tripped too because unlocking bootloader.

I'm using stock ROM with custom kernel rooted with magisk. The phone is still encrypted.

Your case is using a decrypted ROM. You can search in xda flashing custom ROM without decryption.

The official twrp doesn't decrypt the data partition, the biggest catch will be that you will not have the data partition in a twrp backup. But apart from that, twrp will still work for installs and updates and backups og the system and cache partitions.

Use smart switch doing backup in stead.

 

[hduraira]

My knox is tripped too because unlocking bootloader.

I'm using stock ROM with custom kernel rooted with magisk. The phone is still encrypted.

Your case is using a decrypted ROM. You can search in xda flashing custom ROM without decryption

Can u suggest any rom bro?
MY device is S10, and dont want to use pixel or different rom , want only one ui ported rom bro android 13

 

[hduraira]

My knox is tripped too because unlocking bootloader.

I'm using stock ROM with custom kernel rooted with magisk. The phone is still encrypted.

Your case is using a decrypted ROM. You can search in xda flashing custom ROM without decryption.

The official twrp doesn't decrypt the data partition, the biggest catch will be that you will not have the data partition in a twrp backup. But apart from that, twrp will still work for installs and updates and backups og the system and cache partitions.

Use smart switch doing backup in stead.

How to do it bro using smart switch

 

[gsmdb]

You can still use One UI5.1 ivan_meler custom ROM. Nothing wrong with it.
You must flash stock ROM first to get back encrypted. Set it up until your phone is working.
Flash twrp and get custom ROM on external SD card.
Follow your own process to flash custom ROM with twrp.
In twrp do wipe dalvik and cache as usual. DON'T format Data. Doing it will get your phone decrypted.
Install your custom ROM.

I did it as remembered back to the days with my old s10 with custom ROM android 10.

 

[hduraira]

You can still use One UI5.1 ivan_meler custom ROM. Nothing wrong with it.
You must flash stock ROM first to get back encrypted. Set it up until your phone is working.
Flash twrp and get custom ROM on external SD card.
Follow your own process to flash custom ROM with twrp.
In twrp do wipe dalvik and cache as usual. DON'T format Data. Doing it will get your phone decrypted.
Install your custom ROM.

I did it as remembered back to the days with my old s10 with custom ROM android 10.

In the official TWRP My SD card shows only 117MB instead of 128GB bro. So i will try adb sideload bro

 

[gsmdb]

Probably your SD card is formatted with ExFat which isn't visible in twrp.
Try FAT32 in stead.

 

[hduraira]

{the file is too large for destination} -b cant able to transfer file more than 4gb bro after formatting SD card to FAT32

 

[hduraira]

Bro in island work profile, intune looks like this only bro, I did click in check device settings multiple time bro nothing happens bro but in the main profile I can install and register my device in intune bro and use my company mails and teams bro

 

[gsmdb]

You do know how to use island? You can only use one intune app either in main or work profile. Clone or install directly in work profile and uninstall from the main profile.
Did you check the root from work profile with Applist detector? Install Applist Detector in work profile and run.
In my work profile my device settings is registered as unknown, but ok because it does pass all checks from company apps.