Prevent device administrators from being installed My company has some Android devices that are available for our customers to use. Customers have nearly full access to the devices, and unfortunately a customer recently installed Android Device Manager, added their Play account, registered the device to themselves, and then disabled the phone.

I was able to recover the devices by factory resetting and logging in with one of our existing play accounts, but I'd like to prevent this from happening in future.

Is there a way to prevent device administrators from being added to an Android device? I know I can create an administrator app and set it as Device Owner to ensure it's always an admin, but I don't think this will prevent this scenario from occurring again.
Physical control is total control.

If they have full physical access, if they try hard enough (and that customer obviously didn't do that by accident) they'll always be able to mess with the phone.

You can, however, make this much harder. As @Dan Brown suggested, you can lock the settings away with a password. Something else that comes to my mind is creating a new user on the phone (that is possible if you have at least Android Lollipop or a custom ROM based on it), again locking the main account which has administrator access away behind a password and then giving the phone to the customer with only access to the restricted user. Again, if they try hard enough they will still be able to break this if they have the device and enough time and knowledge. But a seperate account should be one of the easiest built-in ways to make this harder. You can also try some apps which offer parental controls - these apps need admin access but in turn can lock many rights away. But they often cost money and/or don't always work right.

I'll do a bit more research on this and edit the answer in case I find a better solution