Part 5 of 6 · Biometric Identity Programme Series — next: Biometric Terminal RFP: The Specs That Matter
Managing a Fleet of Identity Terminals
Quick answer: A terminal is only trustworthy while its software is. Zero-touch enrolment puts a device into your management console on first boot, a managed configuration locks it to the enrolment application, per-device certificates expire and have to be renewed, and a lost unit has to be wiped remotely. Plan all four before the first unit ships: a fleet without a renewal process fails months later, when certificates expire and nobody is on site to fix it.
Programmes budget for the devices and discover the fleet. The fleet is where the operational cost actually sits, and most of it is decided in the first week.
Provisioning: what happens on first boot
Zero-touch enrolment is the standard answer for Android: the device is assigned to your organisation before it ships, and on first network connection it enrols into the management console, applies the policy and installs the applications without an operator touching setup screens. For a fleet of several hundred units across districts, this is the difference between a configuration task and a logistics project.
The alternative, manual enrolment by QR code or NFC bump, works for small fleets and for replacement units sent to the field. Decide which applies to replacements in particular, because that is the case that gets forgotten.
Locking the device to its job
A managed configuration should pin the terminal to the enrolment application in kiosk mode, disable the settings a curious operator can reach, and control which applications may be installed. Managed Google Play and private application distribution are the usual channels. The goal is that a unit in a district office behaves identically to the reference unit you tested.
Version pinning matters as much as the lock itself. Record the application version and the firmware version that passed acceptance, and require that any change goes through the same test. An unannounced application update on a running enrolment drive is a support incident waiting to happen.
Certificates expire, on a date nobody watches
Per-device certificates are what let a unit authenticate to the network and to backend services. Enrolment and renewal are handled by SCEP-style issuance, which means the renewal depends on a service being reachable and on someone monitoring its health. The failure mode is well known and entirely avoidable: certificates expire, terminals stop authenticating, and the cause is invisible at the counter.
Put the expiry dates in the operations calendar, monitor the renewal service, and test a renewal end to end during acceptance.
Loss, theft and the end of life of a unit
Remote wipe has to work on a unit that is switched on and connected, and it has to cover the queue of unsent records, not only the application data. Combine it with the device-side rule from the data protection article: if the terminal holds records for minutes rather than months, a lost unit is a hardware loss rather than a data incident.
Spare units, a repair path and a stated lead time belong in the same plan. An enrolment drive that stops because one district is waiting on a replacement has failed for reasons that have nothing to do with biometrics.
What Xinhong ships
We supply units configured for zero-touch enrolment against your management console, with the application and firmware versions recorded and frozen. We state the spare-part lead time before the order rather than after it, and we will run a wipe and a re-enrolment during acceptance so the process is proven before it is needed.
Frequently asked questions
How many spare units should we hold?
Size it from the pilot, not from a rule of thumb: take the observed failure and damage rate over the pilot period and add the repair turnaround. A common starting point is a few per cent of the fleet held centrally, plus a small buffer in each region, adjusted once real data exists.
Can we use consumer tablets with an MDM agent instead?
For a supervised enrolment drive, the device is specified for its capture hardware, its sealing and its supply life, not for manageability alone. Manageability is a requirement on top of those, not a substitute. Consumer devices also change model year far more often than a programme can re-test.
What happens when a certificate expires in a remote district?
The unit stops authenticating and the operator sees an error that means nothing to them. Prevention is a monitored renewal service and expiry dates in the operations calendar. Recovery is a documented field procedure, tested once during acceptance, that does not require the device to come back to a workshop.
Should operators be able to install applications?
No. A managed configuration should restrict installation to what the policy allows. An operator installing a messaging application on an enrolment terminal is a data-protection problem and a support problem at the same time.
Does zero-touch enrolment work with our existing MDM?
It depends on whether your console supports Android Enterprise zero-touch and on the device being registered to your organisation before shipment. Confirm both before the order; registering devices after delivery is possible but adds a step at exactly the wrong moment.
Tell Us Your Programme
Capture, document reading, matching or fleet: tell us the flow and the population, and we will say which of these specifications apply and which do not.