I have a device supported by Android for Work (Samsung Note 4, Android 6.0.1) but the security policy will not install saying "there is a custom OS installed". Device security status is "Official", but the KNOX counter is on 0x1. From what I can see, the bootloader and firmware are all official, standard region and non-rooted. Is there any way I can create a security profile that will still work with a 0x1 KNOX counter? What is the relation of KNOX with Android for Work?
No, you can't.
Knox creates a secure and encrypted container for your work profile. Once created it separates the information stored in your working profile and encrypts it.
The working profile is not accessible from outside its container, unless you enter a given key
The Knox flag is set because
- You or someone else rooted the device previously or
- Something went wrong while OTA