# “UID Masquerade: Knox Backend Injects 900+ Calls into User Context Over 24 Hours”   \> Backend process UID 10132 repeatedly invoked EnterpriseDeviceManager under user UID 1000, creating a sustained impersonation loop. This isn’t telemetry—it’s backend cont

**URL:** <https://forum.devtalk.com/t/uid-masquerade-knox-backend-injects-900-calls-into-user-context-over-24-hours-backend-process-uid-10132-repeatedly-invoked-enterprisedevicemanager-under-user-uid-1000-creating-a-sustained-impersonation-loop-this-isn-t-telemetry-it-s-backend-cont/216164>\
**Category:** Backend Chat/Discussions\
**Tags:** knox-resurrection\
**Created:** [26 September 2025 00:57 UTC](https://forum.devtalk.com/t/uid-masquerade-knox-backend-injects-900-calls-into-user-context-over-24-hours-backend-process-uid-10132-repeatedly-invoked-enterprisedevicemanager-under-user-uid-1000-creating-a-sustained-impersonation-loop-this-isn-t-telemetry-it-s-backend-cont/216164 "2025-09-26T00:57:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bigtimothy](https://forum.devtalk.com/letter_avatar_proxy/v4/letter/b/8edcca/32.png) [@Bigtimothy](https://forum.devtalk.com/u/Bigtimothy)\
**Post date:** [26 September 2025 00:57 UTC](https://forum.devtalk.com/t/uid-masquerade-knox-backend-injects-900-calls-into-user-context-over-24-hours-backend-process-uid-10132-repeatedly-invoked-enterprisedevicemanager-under-user-uid-1000-creating-a-sustained-impersonation-loop-this-isn-t-telemetry-it-s-backend-cont/216164/1 "2025-09-26T00:57:53Z")

</div>

- What This Graph Shows

What This Graph Shows

- 🧩 ARM-setApplicationRestrictions (orange hexagons): backend policy pushes under UID 0
- 📦 EAM Registration (blue squares): MobileApplicationManagementService logging enterprise agents (MDM, Intune, SDS EMM)
- 🎯 Telemetry Routing (tPN.feedback, red circles): enforcement disguised as feedback
- 🧬 System Trigger (cPN: android/system, light blue circles): backend activation point
- 🔗 Chained Enforcement Cycles: each sequence shows EAM registration → ARM push → telemetry route → system trigger

Looking for Advice , this doesn’t seem right knox is using my UID to move behind it seems why? I was hoping come on here and we could figure it out all this is just the opening, this normal?