diff --git a/res/xml/privacy_settings.xml b/res/xml/privacy_settings.xml
index 6a6b548..8c66fe1 100644
--- a/res/xml/privacy_settings.xml
+++ b/res/xml/privacy_settings.xml
@@ -55,6 +55,7 @@
         android:key="network_reset"
         android:title="@string/reset_network_title"
         settings:keywords="@string/keywords_network_reset"
+        settings:userRestriction="no_network_reset"
         settings:useAdminDisabledSummary="true"
         android:fragment="com.android.settings.ResetNetwork" />
 
diff --git a/res/xml/user_details_settings.xml b/res/xml/user_details_settings.xml
index 9bcc194..44ec064 100644
--- a/res/xml/user_details_settings.xml
+++ b/res/xml/user_details_settings.xml
@@ -23,6 +23,7 @@
     <com.android.settingslib.RestrictedPreference
             android:key="remove_user"
             android:title="@string/user_remove_user"
+            settings:userRestriction="no_remove_user"
             settings:useAdminDisabledSummary="true" />
 
 </PreferenceScreen>
diff --git a/src/com/android/settings/DeviceInfoSettings.java b/src/com/android/settings/DeviceInfoSettings.java
index 94336e6..0f51011 100644
--- a/src/com/android/settings/DeviceInfoSettings.java
+++ b/src/com/android/settings/DeviceInfoSettings.java
@@ -81,7 +81,9 @@
     private UserManager mUm;
 
     private EnforcedAdmin mFunDisallowedAdmin;
+    private boolean mFunDisallowedBySystem;
     private EnforcedAdmin mDebuggingFeaturesDisallowedAdmin;
+    private boolean mDebuggingFeaturesDisallowedBySystem;
 
     @Override
     protected int getMetricsCategory() {
@@ -192,8 +194,12 @@
         mDevHitToast = null;
         mFunDisallowedAdmin = RestrictedLockUtils.checkIfRestrictionEnforced(
                 getActivity(), UserManager.DISALLOW_FUN, UserHandle.myUserId());
+        mFunDisallowedBySystem = RestrictedLockUtils.hasBaseUserRestriction(
+                getActivity(), UserManager.DISALLOW_FUN, UserHandle.myUserId());
         mDebuggingFeaturesDisallowedAdmin = RestrictedLockUtils.checkIfRestrictionEnforced(
                 getActivity(), UserManager.DISALLOW_DEBUGGING_FEATURES, UserHandle.myUserId());
+        mDebuggingFeaturesDisallowedBySystem = RestrictedLockUtils.hasBaseUserRestriction(
+                getActivity(), UserManager.DISALLOW_DEBUGGING_FEATURES, UserHandle.myUserId());
     }
 
     @Override
@@ -202,9 +208,11 @@
             System.arraycopy(mHits, 1, mHits, 0, mHits.length-1);
             mHits[mHits.length-1] = SystemClock.uptimeMillis();
             if (mHits[0] >= (SystemClock.uptimeMillis()-500)) {
-                if (mFunDisallowedAdmin != null) {
-                    RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getActivity(),
-                            mFunDisallowedAdmin);
+                if (mUm.hasUserRestriction(UserManager.DISALLOW_FUN)) {
+                    if (mFunDisallowedAdmin != null && !mFunDisallowedBySystem) {
+                        RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getActivity(),
+                                mFunDisallowedAdmin);
+                    }
                     Log.d(LOG_TAG, "Sorry, no fun for you!");
                     return false;
                 }
@@ -228,9 +236,12 @@
                 return true;
             }
 
-            if (mDebuggingFeaturesDisallowedAdmin != null) {
-                RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getActivity(),
-                        mDebuggingFeaturesDisallowedAdmin);
+            if (mUm.hasUserRestriction(UserManager.DISALLOW_DEBUGGING_FEATURES)) {
+                if (mDebuggingFeaturesDisallowedAdmin != null &&
+                        !mDebuggingFeaturesDisallowedBySystem) {
+                    RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getActivity(),
+                            mDebuggingFeaturesDisallowedAdmin);
+                }
                 return true;
             }
 
diff --git a/src/com/android/settings/PrivacySettings.java b/src/com/android/settings/PrivacySettings.java
index a0b074b..03e569b 100644
--- a/src/com/android/settings/PrivacySettings.java
+++ b/src/com/android/settings/PrivacySettings.java
@@ -38,6 +38,7 @@
 import com.android.settings.dashboard.SummaryLoader;
 import com.android.settings.search.BaseSearchIndexProvider;
 import com.android.settings.search.Indexable;
+import com.android.settingslib.RestrictedLockUtils;
 import com.android.settingslib.RestrictedPreference;
 
 import java.util.ArrayList;
@@ -186,12 +187,6 @@
             // Hide the item if data management intent is not supported by transport.
             getPreferenceScreen().removePreference(mManageData);
         }
-
-        RestrictedPreference networkResetPref = (RestrictedPreference) findPreference(
-                NETWORK_RESET);
-        if (networkResetPref != null) {
-            networkResetPref.checkRestrictionAndSetDisabled(UserManager.DISALLOW_NETWORK_RESET);
-        }
     }
 
     private void setConfigureSummary(String summary) {
@@ -315,5 +310,13 @@
             nonVisibleKeys.add(AUTO_RESTORE);
             nonVisibleKeys.add(CONFIGURE_ACCOUNT);
         }
+        if (RestrictedLockUtils.hasBaseUserRestriction(context,
+                UserManager.DISALLOW_FACTORY_RESET, UserHandle.myUserId())) {
+            nonVisibleKeys.add(FACTORY_RESET);
+        }
+        if (RestrictedLockUtils.hasBaseUserRestriction(context,
+                UserManager.DISALLOW_NETWORK_RESET, UserHandle.myUserId())) {
+            nonVisibleKeys.add(NETWORK_RESET);
+        }
     }
 }
diff --git a/src/com/android/settings/RestrictedSettingsFragment.java b/src/com/android/settings/RestrictedSettingsFragment.java
index 3642fa6..ee7b6e7 100644
--- a/src/com/android/settings/RestrictedSettingsFragment.java
+++ b/src/com/android/settings/RestrictedSettingsFragment.java
@@ -251,7 +251,7 @@
     @Override
     protected void onDataSetChanged() {
         highlightPreferenceIfNeeded();
-        if (mAdminSupportDetails != null && isUiRestricted()) {
+        if (mAdminSupportDetails != null && isUiRestrictedByOnlyAdmin()) {
             updateAdminSupportDetailsView();
             setEmptyView(mAdminSupportDetails);
         } else if (mEmptyTextView != null) {
@@ -266,4 +266,9 @@
     protected boolean isUiRestricted() {
         return isRestrictedAndNotProviderProtected() || !hasChallengeSucceeded();
     }
+
+    protected boolean isUiRestrictedByOnlyAdmin() {
+        return isUiRestricted() && !mUserManager.hasBaseUserRestriction(mRestrictionKey,
+                UserHandle.of(UserHandle.myUserId()));
+    }
 }
diff --git a/src/com/android/settings/SecuritySettings.java b/src/com/android/settings/SecuritySettings.java
index e89b0d2..b4cbab2 100644
--- a/src/com/android/settings/SecuritySettings.java
+++ b/src/com/android/settings/SecuritySettings.java
@@ -276,19 +276,30 @@
         final UserManager um = (UserManager) getActivity().getSystemService(Context.USER_SERVICE);
         mKeyStore = KeyStore.getInstance(); // needs to be initialized for onResume()
 
-        RestrictedPreference credentialStorageType = (RestrictedPreference) root.findPreference(
-                KEY_CREDENTIAL_STORAGE_TYPE);
-        credentialStorageType.checkRestrictionAndSetDisabled(
-                UserManager.DISALLOW_CONFIG_CREDENTIALS);
-        RestrictedPreference installCredentials = (RestrictedPreference) root.findPreference(
-                KEY_CREDENTIALS_INSTALL);
-        installCredentials.checkRestrictionAndSetDisabled(UserManager.DISALLOW_CONFIG_CREDENTIALS);
-        mResetCredentials.checkRestrictionAndSetDisabled(UserManager.DISALLOW_CONFIG_CREDENTIALS);
+        if (!RestrictedLockUtils.hasBaseUserRestriction(getActivity(),
+                UserManager.DISALLOW_CONFIG_CREDENTIALS, MY_USER_ID)) {
+            RestrictedPreference credentialStorageType = (RestrictedPreference) root.findPreference(
+                    KEY_CREDENTIAL_STORAGE_TYPE);
+            credentialStorageType.checkRestrictionAndSetDisabled(
+                    UserManager.DISALLOW_CONFIG_CREDENTIALS);
+            RestrictedPreference installCredentials = (RestrictedPreference) root.findPreference(
+                    KEY_CREDENTIALS_INSTALL);
+            installCredentials.checkRestrictionAndSetDisabled(
+                    UserManager.DISALLOW_CONFIG_CREDENTIALS);
+            mResetCredentials.checkRestrictionAndSetDisabled(
+                    UserManager.DISALLOW_CONFIG_CREDENTIALS);
 
-        final int storageSummaryRes =
-                mKeyStore.isHardwareBacked() ? R.string.credential_storage_type_hardware
-                        : R.string.credential_storage_type_software;
-        credentialStorageType.setSummary(storageSummaryRes);
+            final int storageSummaryRes =
+                    mKeyStore.isHardwareBacked() ? R.string.credential_storage_type_hardware
+                            : R.string.credential_storage_type_software;
+            credentialStorageType.setSummary(storageSummaryRes);
+        } else {
+            PreferenceGroup credentialsManager = (PreferenceGroup)
+                    root.findPreference(KEY_CREDENTIALS_MANAGER);
+            credentialsManager.removePreference(root.findPreference(KEY_RESET_CREDENTIALS));
+            credentialsManager.removePreference(root.findPreference(KEY_CREDENTIALS_INSTALL));
+            credentialsManager.removePreference(root.findPreference(KEY_CREDENTIAL_STORAGE_TYPE));
+        }
 
 
         // Application install
@@ -300,6 +311,12 @@
         // Side loading of apps.
         // Disable for restricted profiles. For others, check if policy disallows it.
         mToggleAppInstallation.setEnabled(!um.getUserInfo(MY_USER_ID).isRestricted());
+        if (RestrictedLockUtils.hasBaseUserRestriction(getActivity(),
+                UserManager.DISALLOW_INSTALL_UNKNOWN_SOURCES, MY_USER_ID)
+                || RestrictedLockUtils.hasBaseUserRestriction(getActivity(),
+                        UserManager.DISALLOW_INSTALL_APPS, MY_USER_ID)) {
+            mToggleAppInstallation.setEnabled(false);
+        }
         if (mToggleAppInstallation.isEnabled()) {
             mToggleAppInstallation.checkRestrictionAndSetDisabled(
                     UserManager.DISALLOW_INSTALL_UNKNOWN_SOURCES);
diff --git a/src/com/android/settings/WirelessSettings.java b/src/com/android/settings/WirelessSettings.java
index ce0766b..5b1d644 100644
--- a/src/com/android/settings/WirelessSettings.java
+++ b/src/com/android/settings/WirelessSettings.java
@@ -34,6 +34,7 @@
 import android.nfc.NfcManager;
 import android.os.Bundle;
 import android.os.SystemProperties;
+import android.os.UserHandle;
 import android.os.UserManager;
 import android.provider.SearchIndexableResource;
 import android.provider.Settings;
@@ -242,7 +243,8 @@
         //enable/disable wimax depending on the value in config.xml
         final boolean isWimaxEnabled = isAdmin && this.getResources().getBoolean(
                 com.android.internal.R.bool.config_wimaxEnabled);
-        if (!isWimaxEnabled) {
+        if (!isWimaxEnabled || RestrictedLockUtils.hasBaseUserRestriction(activity,
+                UserManager.DISALLOW_CONFIG_MOBILE_NETWORKS, UserHandle.myUserId())) {
             PreferenceScreen root = getPreferenceScreen();
             Preference ps = findPreference(KEY_WIMAX_SETTINGS);
             if (ps != null) root.removePreference(ps);
@@ -260,7 +262,8 @@
         }
         // Disable VPN.
         // TODO: http://b/23693383
-        if (!isAdmin) {
+        if (!isAdmin || RestrictedLockUtils.hasBaseUserRestriction(activity,
+                UserManager.DISALLOW_CONFIG_VPN, UserHandle.myUserId())) {
             removePreference(KEY_VPN_SETTINGS);
         }
 
@@ -285,7 +288,9 @@
 
         // Remove Mobile Network Settings and Manage Mobile Plan for secondary users,
         // if it's a wifi-only device.
-        if (!isAdmin || Utils.isWifiOnly(getActivity())) {
+        if (!isAdmin || Utils.isWifiOnly(getActivity()) ||
+                RestrictedLockUtils.hasBaseUserRestriction(activity,
+                        UserManager.DISALLOW_CONFIG_MOBILE_NETWORKS, UserHandle.myUserId())) {
             removePreference(KEY_MOBILE_NETWORK_SETTINGS);
             removePreference(KEY_MANAGE_MOBILE_PLAN);
         }
@@ -317,9 +322,11 @@
         final ConnectivityManager cm =
                 (ConnectivityManager) activity.getSystemService(Context.CONNECTIVITY_SERVICE);
 
-        final boolean adminDisallowedTetherConfig = mUm.hasUserRestriction(
-                UserManager.DISALLOW_CONFIG_TETHERING);
-        if (!cm.isTetheringSupported() && !adminDisallowedTetherConfig) {
+        final boolean adminDisallowedTetherConfig = RestrictedLockUtils.checkIfRestrictionEnforced(
+                activity, UserManager.DISALLOW_CONFIG_TETHERING, UserHandle.myUserId()) != null;
+        if ((!cm.isTetheringSupported() && !adminDisallowedTetherConfig) ||
+                RestrictedLockUtils.hasBaseUserRestriction(activity,
+                        UserManager.DISALLOW_CONFIG_TETHERING, UserHandle.myUserId())) {
             getPreferenceScreen().removePreference(findPreference(KEY_TETHER_SETTINGS));
         } else if (!adminDisallowedTetherConfig) {
             Preference p = findPreference(KEY_TETHER_SETTINGS);
diff --git a/src/com/android/settings/accounts/AccountSettings.java b/src/com/android/settings/accounts/AccountSettings.java
index 03163f1..3337209 100644
--- a/src/com/android/settings/accounts/AccountSettings.java
+++ b/src/com/android/settings/accounts/AccountSettings.java
@@ -62,6 +62,7 @@
 import com.android.settings.search.Indexable;
 import com.android.settings.search.SearchIndexableRaw;
 import com.android.settings.users.UserDialogs;
+import com.android.settingslib.RestrictedLockUtils;
 import com.android.settingslib.accounts.AuthenticatorHelper;
 
 import java.util.ArrayList;
@@ -325,9 +326,12 @@
         if (userInfo.isEnabled()) {
             profileData.authenticatorHelper = new AuthenticatorHelper(context,
                     userInfo.getUserHandle(), this);
-            profileData.addAccountPreference = newAddAccountPreference(context);
-            profileData.addAccountPreference.checkRestrictionAndSetDisabled(
-                    DISALLOW_MODIFY_ACCOUNTS, userInfo.id);
+            if (!RestrictedLockUtils.hasBaseUserRestriction(context,
+                    UserManager.DISALLOW_MODIFY_ACCOUNTS, userInfo.id)) {
+                profileData.addAccountPreference = newAddAccountPreference(context);
+                profileData.addAccountPreference.checkRestrictionAndSetDisabled(
+                        DISALLOW_MODIFY_ACCOUNTS, userInfo.id);
+            }
         }
         mProfiles.put(userInfo.id, profileData);
         Index.getInstance(getActivity()).updateFromClassNameResource(
@@ -715,13 +719,16 @@
             for (int i = 0; i < profilesCount; i++) {
                 UserInfo userInfo = profiles.get(i);
                 if (userInfo.isEnabled()) {
-                    SearchIndexableRaw data = new SearchIndexableRaw(context);
-                    data = new SearchIndexableRaw(context);
-                    data.title = res.getString(R.string.add_account_label);
-                    data.screenTitle = screenTitle;
-                    result.add(data);
-                    if (userInfo.isManagedProfile()) {
+                    if (!RestrictedLockUtils.hasBaseUserRestriction(context,
+                            DISALLOW_MODIFY_ACCOUNTS, userInfo.id)) {
+                        SearchIndexableRaw data = new SearchIndexableRaw(context);
                         data = new SearchIndexableRaw(context);
+                        data.title = res.getString(R.string.add_account_label);
+                        data.screenTitle = screenTitle;
+                        result.add(data);
+                    }
+                    if (userInfo.isManagedProfile()) {
+                        SearchIndexableRaw data = new SearchIndexableRaw(context);
                         data = new SearchIndexableRaw(context);
                         data.title = res.getString(R.string.remove_managed_profile_label);
                         data.screenTitle = screenTitle;
diff --git a/src/com/android/settings/accounts/AccountSyncSettings.java b/src/com/android/settings/accounts/AccountSyncSettings.java
index 33c29bd..493e1db 100644
--- a/src/com/android/settings/accounts/AccountSyncSettings.java
+++ b/src/com/android/settings/accounts/AccountSyncSettings.java
@@ -262,20 +262,23 @@
         MenuItem syncCancel = menu.add(0, MENU_SYNC_CANCEL_ID, 0,
                 getString(R.string.sync_menu_sync_cancel))
                 .setIcon(com.android.internal.R.drawable.ic_menu_close_clear_cancel);
-        MenuItem removeAccount = menu.add(0, MENU_REMOVE_ACCOUNT_ID, 0,
-                getString(R.string.remove_account_label))
-                .setIcon(R.drawable.ic_menu_delete);
-        removeAccount.setShowAsAction(MenuItem.SHOW_AS_ACTION_NEVER |
-                MenuItem.SHOW_AS_ACTION_WITH_TEXT);
-        EnforcedAdmin admin = RestrictedLockUtils.checkIfRestrictionEnforced(
-                getPrefContext(), UserManager.DISALLOW_MODIFY_ACCOUNTS,
-                mUserHandle.getIdentifier());
-        if (admin == null) {
-            admin = RestrictedLockUtils.checkIfAccountManagementDisabled(
-                    getPrefContext(), mAccount.type, mUserHandle.getIdentifier());
+        if (!RestrictedLockUtils.hasBaseUserRestriction(getPrefContext(),
+                UserManager.DISALLOW_MODIFY_ACCOUNTS, mUserHandle.getIdentifier())) {
+            MenuItem removeAccount = menu.add(0, MENU_REMOVE_ACCOUNT_ID, 0,
+                    getString(R.string.remove_account_label))
+                    .setIcon(R.drawable.ic_menu_delete);
+            removeAccount.setShowAsAction(MenuItem.SHOW_AS_ACTION_NEVER |
+                    MenuItem.SHOW_AS_ACTION_WITH_TEXT);
+            EnforcedAdmin admin = RestrictedLockUtils.checkIfRestrictionEnforced(
+                    getPrefContext(), UserManager.DISALLOW_MODIFY_ACCOUNTS,
+                    mUserHandle.getIdentifier());
+            if (admin == null) {
+                admin = RestrictedLockUtils.checkIfAccountManagementDisabled(
+                        getPrefContext(), mAccount.type, mUserHandle.getIdentifier());
+            }
+            RestrictedLockUtils.setMenuItemAsDisabledByAdmin(getPrefContext(),
+                    removeAccount, admin);
         }
-        RestrictedLockUtils.setMenuItemAsDisabledByAdmin(getPrefContext(),
-                removeAccount, admin);
         syncNow.setShowAsAction(MenuItem.SHOW_AS_ACTION_NEVER |
                 MenuItem.SHOW_AS_ACTION_WITH_TEXT);
         syncCancel.setShowAsAction(MenuItem.SHOW_AS_ACTION_NEVER |
diff --git a/src/com/android/settings/applications/AppInfoBase.java b/src/com/android/settings/applications/AppInfoBase.java
index b67eb2b..76729ab 100644
--- a/src/com/android/settings/applications/AppInfoBase.java
+++ b/src/com/android/settings/applications/AppInfoBase.java
@@ -56,6 +56,7 @@
     protected static final boolean localLOGV = false;
 
     protected EnforcedAdmin mAppsControlDisallowedAdmin;
+    protected boolean mAppsControlDisallowedBySystem;
 
     protected ApplicationsState mState;
     protected ApplicationsState.Session mSession;
@@ -97,6 +98,8 @@
         mSession.resume();
         mAppsControlDisallowedAdmin = RestrictedLockUtils.checkIfRestrictionEnforced(getActivity(),
                 UserManager.DISALLOW_APPS_CONTROL, mUserId);
+        mAppsControlDisallowedBySystem = RestrictedLockUtils.hasBaseUserRestriction(getActivity(),
+                UserManager.DISALLOW_APPS_CONTROL, mUserId);
 
         if (!refreshUi()) {
             setIntentAndFinish(true, true);
diff --git a/src/com/android/settings/applications/AppStorageSettings.java b/src/com/android/settings/applications/AppStorageSettings.java
index 34fc083..357ec1e 100644
--- a/src/com/android/settings/applications/AppStorageSettings.java
+++ b/src/com/android/settings/applications/AppStorageSettings.java
@@ -194,7 +194,7 @@
     @Override
     public void onClick(View v) {
         if (v == mClearCacheButton) {
-            if (mAppsControlDisallowedAdmin != null) {
+            if (mAppsControlDisallowedAdmin != null && !mAppsControlDisallowedBySystem) {
                 RestrictedLockUtils.sendShowAdminSupportDetailsIntent(
                         getActivity(), mAppsControlDisallowedAdmin);
                 return;
@@ -203,7 +203,7 @@
             }
             mPm.deleteApplicationCacheFiles(mPackageName, mClearCacheObserver);
         } else if (v == mClearDataButton) {
-            if (mAppsControlDisallowedAdmin != null) {
+            if (mAppsControlDisallowedAdmin != null && !mAppsControlDisallowedBySystem) {
                 RestrictedLockUtils.sendShowAdminSupportDetailsIntent(
                         getActivity(), mAppsControlDisallowedAdmin);
             } else if (mAppEntry.info.manageSpaceActivityName != null) {
@@ -219,7 +219,7 @@
         } else if (v == mChangeStorageButton && mDialogBuilder != null && !isMoveInProgress()) {
             mDialogBuilder.show();
         } else if (v == mClearUriButton) {
-            if (mAppsControlDisallowedAdmin != null) {
+            if (mAppsControlDisallowedAdmin != null && !mAppsControlDisallowedBySystem) {
                 RestrictedLockUtils.sendShowAdminSupportDetailsIntent(
                         getActivity(), mAppsControlDisallowedAdmin);
             } else {
@@ -323,6 +323,10 @@
                 mClearCacheButton.setOnClickListener(this);
             }
         }
+        if (mAppsControlDisallowedBySystem) {
+            mClearCacheButton.setEnabled(false);
+            mClearDataButton.setEnabled(false);
+        }
     }
 
     @Override
@@ -369,6 +373,10 @@
             }
             mClearDataButton.setOnClickListener(this);
         }
+
+        if (mAppsControlDisallowedBySystem) {
+            mClearDataButton.setEnabled(false);
+        }
     }
 
     private void initMoveDialog() {
@@ -488,6 +496,10 @@
             mUri.addPreference(pref);
         }
 
+        if (mAppsControlDisallowedBySystem) {
+            mClearUriButton.setEnabled(false);
+        }
+
         mClearUri.setOrder(order);
         mClearUriButton.setVisibility(View.VISIBLE);
 
diff --git a/src/com/android/settings/applications/InstalledAppDetails.java b/src/com/android/settings/applications/InstalledAppDetails.java
index 80335fc..7ba6c7f 100755
--- a/src/com/android/settings/applications/InstalledAppDetails.java
+++ b/src/com/android/settings/applications/InstalledAppDetails.java
@@ -250,6 +250,10 @@
             }
         }
 
+        if (mAppsControlDisallowedBySystem) {
+            enabled = false;
+        }
+
         mUninstallButton.setEnabled(enabled);
         if (enabled) {
             // Register listener
@@ -413,7 +417,7 @@
         menu.findItem(UNINSTALL_ALL_USERS_MENU).setVisible(showIt);
         mUpdatedSysApp = (mAppEntry.info.flags & ApplicationInfo.FLAG_UPDATED_SYSTEM_APP) != 0;
         MenuItem uninstallUpdatesItem = menu.findItem(UNINSTALL_UPDATES);
-        uninstallUpdatesItem.setVisible(mUpdatedSysApp);
+        uninstallUpdatesItem.setVisible(mUpdatedSysApp && !mAppsControlDisallowedBySystem);
         if (uninstallUpdatesItem.isVisible()) {
             RestrictedLockUtils.setMenuItemAsDisabledByAdmin(getActivity(),
                     uninstallUpdatesItem, mAppsControlDisallowedAdmin);
@@ -673,8 +677,12 @@
     }
 
     private void updateForceStopButton(boolean enabled) {
-        mForceStopButton.setEnabled(enabled);
-        mForceStopButton.setOnClickListener(InstalledAppDetails.this);
+        if (mAppsControlDisallowedBySystem) {
+            mForceStopButton.setEnabled(false);
+        } else {
+            mForceStopButton.setEnabled(enabled);
+            mForceStopButton.setOnClickListener(InstalledAppDetails.this);
+        }
     }
 
     private void checkForceStop() {
@@ -740,7 +748,9 @@
             }
             EnforcedAdmin admin = RestrictedLockUtils.checkIfUninstallBlocked(getActivity(),
                     packageName, mUserId);
-            if (admin != null) {
+            boolean uninstallBlockedBySystem = mAppsControlDisallowedBySystem ||
+                    RestrictedLockUtils.hasBaseUserRestriction(getActivity(), packageName, mUserId);
+            if (admin != null && !uninstallBlockedBySystem) {
                 RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getActivity(), admin);
             } else if ((mAppEntry.info.flags & ApplicationInfo.FLAG_SYSTEM) != 0) {
                 if (mAppEntry.info.enabled && !isDisabledUntilUsed()) {
@@ -760,7 +770,7 @@
                 uninstallPkg(packageName, false, false);
             }
         } else if (v == mForceStopButton) {
-            if (mAppsControlDisallowedAdmin != null) {
+            if (mAppsControlDisallowedAdmin != null && !mAppsControlDisallowedBySystem) {
                 RestrictedLockUtils.sendShowAdminSupportDetailsIntent(
                         getActivity(), mAppsControlDisallowedAdmin);
             } else {
diff --git a/src/com/android/settings/bluetooth/BluetoothSettings.java b/src/com/android/settings/bluetooth/BluetoothSettings.java
index 244b5ee..e639005 100644
--- a/src/com/android/settings/bluetooth/BluetoothSettings.java
+++ b/src/com/android/settings/bluetooth/BluetoothSettings.java
@@ -171,6 +171,9 @@
 
         if (isUiRestricted()) {
             setDeviceListGroup(getPreferenceScreen());
+            if (!isUiRestrictedByOnlyAdmin()) {
+                getEmptyTextView().setText(R.string.bluetooth_empty_list_user_restricted);
+            }
             removeAllDevices();
             return;
         }
@@ -294,6 +297,7 @@
                 mDevicePreferenceMap.clear();
 
                 if (isUiRestricted()) {
+                    messageId = R.string.bluetooth_empty_list_user_restricted;
                     break;
                 }
 
@@ -355,7 +359,7 @@
             case BluetoothAdapter.STATE_OFF:
                 setOffMessage();
                 if (isUiRestricted()) {
-                    messageId = 0;
+                    messageId = R.string.bluetooth_empty_list_user_restricted;
                 }
                 break;
 
diff --git a/src/com/android/settings/deviceinfo/StorageSettings.java b/src/com/android/settings/deviceinfo/StorageSettings.java
index 5e0aacc..277f59f 100644
--- a/src/com/android/settings/deviceinfo/StorageSettings.java
+++ b/src/com/android/settings/deviceinfo/StorageSettings.java
@@ -395,7 +395,10 @@
                     EnforcedAdmin admin = RestrictedLockUtils.checkIfRestrictionEnforced(
                             getActivity(), UserManager.DISALLOW_MOUNT_PHYSICAL_MEDIA,
                             UserHandle.myUserId());
-                    if (admin != null) {
+                    boolean hasBaseUserRestriction = RestrictedLockUtils.hasBaseUserRestriction(
+                            getActivity(), UserManager.DISALLOW_MOUNT_PHYSICAL_MEDIA,
+                            UserHandle.myUserId());
+                    if (admin != null && !hasBaseUserRestriction) {
                         RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getActivity(), admin);
                         return;
                     }
diff --git a/src/com/android/settings/deviceinfo/UsbBackend.java b/src/com/android/settings/deviceinfo/UsbBackend.java
index 53895fe..cd88709 100644
--- a/src/com/android/settings/deviceinfo/UsbBackend.java
+++ b/src/com/android/settings/deviceinfo/UsbBackend.java
@@ -22,6 +22,7 @@
 import android.hardware.usb.UsbManager;
 import android.hardware.usb.UsbPort;
 import android.hardware.usb.UsbPortStatus;
+import android.os.UserHandle;
 import android.os.UserManager;
 
 public class UsbBackend {
@@ -37,6 +38,7 @@
     public static final int MODE_DATA_MIDI   = 0x03 << 1;
 
     private final boolean mRestricted;
+    private final boolean mRestrictedBySystem;
     private final boolean mMidi;
 
     private UserManager mUserManager;
@@ -56,6 +58,8 @@
         mUsbManager = context.getSystemService(UsbManager.class);
 
         mRestricted = mUserManager.hasUserRestriction(UserManager.DISALLOW_USB_FILE_TRANSFER);
+        mRestrictedBySystem = mUserManager.hasBaseUserRestriction(
+                UserManager.DISALLOW_USB_FILE_TRANSFER, UserHandle.of(UserHandle.myUserId()));
         mMidi = context.getPackageManager().hasSystemFeature(PackageManager.FEATURE_MIDI);
 
         UsbPort[] ports = mUsbManager.getPorts();
@@ -134,7 +138,7 @@
                     ? UsbPort.POWER_ROLE_SOURCE : UsbPort.POWER_ROLE_SINK;
     }
 
-    public boolean isModeDisallowedByAdmin(int mode) {
+    public boolean isModeDisallowed(int mode) {
         if (mRestricted && (mode & MODE_DATA_MASK) != MODE_DATA_NONE
                 && (mode & MODE_DATA_MASK) != MODE_DATA_MIDI) {
             // No USB data modes are supported.
@@ -143,6 +147,15 @@
         return false;
     }
 
+    public boolean isModeDisallowedBySystem(int mode) {
+        if (mRestrictedBySystem && (mode & MODE_DATA_MASK) != MODE_DATA_NONE
+                && (mode & MODE_DATA_MASK) != MODE_DATA_MIDI) {
+            // No USB data modes are supported.
+            return true;
+        }
+        return false;
+    }
+
     public boolean isModeSupported(int mode) {
         if (!mMidi && (mode & MODE_DATA_MASK) == MODE_DATA_MIDI) {
             return false;
diff --git a/src/com/android/settings/deviceinfo/UsbModeChooserActivity.java b/src/com/android/settings/deviceinfo/UsbModeChooserActivity.java
index c2f9477..e1f8950 100644
--- a/src/com/android/settings/deviceinfo/UsbModeChooserActivity.java
+++ b/src/com/android/settings/deviceinfo/UsbModeChooserActivity.java
@@ -106,9 +106,10 @@
         mBackend = new UsbBackend(this);
         int current = mBackend.getCurrentMode();
         for (int i = 0; i < DEFAULT_MODES.length; i++) {
-            if (mBackend.isModeSupported(DEFAULT_MODES[i])) {
+            if (mBackend.isModeSupported(DEFAULT_MODES[i])
+                    && !mBackend.isModeDisallowedBySystem(DEFAULT_MODES[i])) {
                 inflateOption(DEFAULT_MODES[i], current == DEFAULT_MODES[i], container,
-                        mBackend.isModeDisallowedByAdmin(DEFAULT_MODES[i]));
+                        mBackend.isModeDisallowed(DEFAULT_MODES[i]));
             }
         }
     }
diff --git a/src/com/android/settings/location/LocationSettings.java b/src/com/android/settings/location/LocationSettings.java
index e891ebd..4996d04 100644
--- a/src/com/android/settings/location/LocationSettings.java
+++ b/src/com/android/settings/location/LocationSettings.java
@@ -266,8 +266,8 @@
         mManagedProfileSwitch.setOnPreferenceClickListener(null);
         final EnforcedAdmin admin = RestrictedLockUtils.checkIfRestrictionEnforced(getActivity(),
                 UserManager.DISALLOW_SHARE_LOCATION, mManagedProfile.getIdentifier());
-        if (mUm.hasUserRestriction(UserManager.DISALLOW_SHARE_LOCATION, mManagedProfile)
-                && admin != null) {
+        final boolean isRestrictedByBase = isManagedProfileRestrictedByBase();
+        if (!isRestrictedByBase && admin != null) {
             mManagedProfileSwitch.setDisabledByAdmin(admin);
             mManagedProfileSwitch.setChecked(false);
         } else {
@@ -278,9 +278,8 @@
             if (!enabled) {
                 mManagedProfileSwitch.setChecked(false);
             } else {
-                final boolean isRestricted = isManagedProfileRestrictedByBase();
-                mManagedProfileSwitch.setChecked(!isRestricted);
-                summaryResId = (isRestricted ?
+                mManagedProfileSwitch.setChecked(!isRestrictedByBase);
+                summaryResId = (isRestrictedByBase ?
                         R.string.switch_off_text : R.string.switch_on_text);
                 mManagedProfileSwitch.setOnPreferenceClickListener(
                         mManagedProfileSwitchClickListener);
@@ -382,9 +381,11 @@
         final boolean enabled = (mode != android.provider.Settings.Secure.LOCATION_MODE_OFF);
         EnforcedAdmin admin = RestrictedLockUtils.checkIfRestrictionEnforced(getActivity(),
                 UserManager.DISALLOW_SHARE_LOCATION, UserHandle.myUserId());
+        boolean hasBaseUserRestriction = RestrictedLockUtils.hasBaseUserRestriction(getActivity(),
+                UserManager.DISALLOW_SHARE_LOCATION, UserHandle.myUserId());
         // Disable the whole switch bar instead of the switch itself. If we disabled the switch
         // only, it would be re-enabled again if the switch bar is not disabled.
-        if (admin != null) {
+        if (!hasBaseUserRestriction && admin != null) {
             mSwitchBar.setDisabledByAdmin(admin);
         } else {
             mSwitchBar.setEnabled(!restricted);
diff --git a/src/com/android/settings/nfc/NfcEnabler.java b/src/com/android/settings/nfc/NfcEnabler.java
index b81d342..5bda1ad 100644
--- a/src/com/android/settings/nfc/NfcEnabler.java
+++ b/src/com/android/settings/nfc/NfcEnabler.java
@@ -21,12 +21,14 @@
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.nfc.NfcAdapter;
+import android.os.UserHandle;
 import android.os.UserManager;
 import android.support.v14.preference.SwitchPreference;
 import android.support.v7.preference.Preference;
 import android.support.v7.preference.PreferenceScreen;
 
 import com.android.settings.R;
+import com.android.settingslib.RestrictedLockUtils;
 import com.android.settingslib.RestrictedPreference;
 
 /**
@@ -40,6 +42,7 @@
     private final RestrictedPreference mAndroidBeam;
     private final NfcAdapter mNfcAdapter;
     private final IntentFilter mIntentFilter;
+    private boolean mBeamDisallowedBySystem;
 
     private final BroadcastReceiver mReceiver = new BroadcastReceiver() {
         @Override
@@ -58,6 +61,8 @@
         mSwitch = switchPreference;
         mAndroidBeam = androidBeam;
         mNfcAdapter = NfcAdapter.getDefaultAdapter(context);
+        mBeamDisallowedBySystem = RestrictedLockUtils.hasBaseUserRestriction(context,
+                UserManager.DISALLOW_OUTGOING_BEAM, UserHandle.myUserId());
 
         if (mNfcAdapter == null) {
             // NFC is not supported
@@ -66,6 +71,9 @@
             mIntentFilter = null;
             return;
         }
+        if (mBeamDisallowedBySystem) {
+            mAndroidBeam.setEnabled(false);
+        }
         mIntentFilter = new IntentFilter(NfcAdapter.ACTION_ADAPTER_STATE_CHANGED);
     }
 
@@ -112,7 +120,12 @@
         case NfcAdapter.STATE_ON:
             mSwitch.setChecked(true);
             mSwitch.setEnabled(true);
-            mAndroidBeam.checkRestrictionAndSetDisabled(UserManager.DISALLOW_OUTGOING_BEAM);
+            if (mBeamDisallowedBySystem) {
+                mAndroidBeam.setDisabledByAdmin(null);
+                mAndroidBeam.setEnabled(false);
+            } else {
+                mAndroidBeam.checkRestrictionAndSetDisabled(UserManager.DISALLOW_OUTGOING_BEAM);
+            }
             if (mNfcAdapter.isNdefPushEnabled() && mAndroidBeam.isEnabled()) {
                 mAndroidBeam.setSummary(R.string.android_beam_on_summary);
             } else {
diff --git a/src/com/android/settings/notification/ZenModeSettingsBase.java b/src/com/android/settings/notification/ZenModeSettingsBase.java
index f1b5edf..86d07be 100644
--- a/src/com/android/settings/notification/ZenModeSettingsBase.java
+++ b/src/com/android/settings/notification/ZenModeSettingsBase.java
@@ -69,8 +69,12 @@
         maybeRefreshRules(true, true /*fireChanged*/);
         mSettingsObserver.register();
         if (isUiRestricted()) {
-            getPreferenceScreen().removeAll();
-            return;
+            if (isUiRestrictedByOnlyAdmin()) {
+                getPreferenceScreen().removeAll();
+                return;
+            } else {
+                finish();
+            }
         }
     }
 
diff --git a/src/com/android/settings/users/UserDetailsSettings.java b/src/com/android/settings/users/UserDetailsSettings.java
index a7af930..2a71885 100644
--- a/src/com/android/settings/users/UserDetailsSettings.java
+++ b/src/com/android/settings/users/UserDetailsSettings.java
@@ -29,7 +29,7 @@
 import com.android.internal.logging.MetricsProto.MetricsEvent;
 import com.android.settings.R;
 import com.android.settings.SettingsPreferenceFragment;
-import com.android.settingslib.RestrictedPreference;
+import com.android.settingslib.RestrictedLockUtils;
 
 import java.util.List;
 
@@ -60,7 +60,7 @@
 
     private UserManager mUserManager;
     private SwitchPreference mPhonePref;
-    private RestrictedPreference mRemoveUserPref;
+    private Preference mRemoveUserPref;
 
     private UserInfo mUserInfo;
     private boolean mGuestUser;
@@ -80,7 +80,7 @@
 
         addPreferencesFromResource(R.xml.user_details_settings);
         mPhonePref = (SwitchPreference) findPreference(KEY_ENABLE_TELEPHONY);
-        mRemoveUserPref = (RestrictedPreference) findPreference(KEY_REMOVE_USER);
+        mRemoveUserPref = findPreference(KEY_REMOVE_USER);
 
         mGuestUser = getArguments().getBoolean(EXTRA_USER_GUEST, false);
 
@@ -103,16 +103,14 @@
             mPhonePref.setChecked(
                     !mDefaultGuestRestrictions.getBoolean(UserManager.DISALLOW_OUTGOING_CALLS));
         }
+        if (RestrictedLockUtils.hasBaseUserRestriction(context,
+                UserManager.DISALLOW_REMOVE_USER, UserHandle.myUserId())) {
+            removePreference(KEY_REMOVE_USER);
+        }
         mPhonePref.setOnPreferenceChangeListener(this);
     }
 
     @Override
-    public void onResume() {
-        super.onResume();
-        mRemoveUserPref.checkRestrictionAndSetDisabled(UserManager.DISALLOW_REMOVE_USER);
-    }
-
-    @Override
     public boolean onPreferenceClick(Preference preference) {
         if (preference == mRemoveUserPref) {
             if (!mUserManager.isAdminUser()) {
diff --git a/src/com/android/settings/wifi/WifiSettings.java b/src/com/android/settings/wifi/WifiSettings.java
index e391fc8..b7a0f81 100644
--- a/src/com/android/settings/wifi/WifiSettings.java
+++ b/src/com/android/settings/wifi/WifiSettings.java
@@ -633,6 +633,9 @@
         // Safeguard from some delayed event handling
         if (getActivity() == null) return;
         if (isUiRestricted()) {
+            if (!isUiRestrictedByOnlyAdmin()) {
+                addMessagePreference(R.string.wifi_empty_list_user_restricted);
+            }
             getPreferenceScreen().removeAll();
             return;
         }
@@ -732,6 +735,9 @@
 
     private void setOffMessage() {
         if (isUiRestricted()) {
+            if (!isUiRestrictedByOnlyAdmin()) {
+                addMessagePreference(R.string.wifi_empty_list_user_restricted);
+            }
             getPreferenceScreen().removeAll();
             return;
         }