diff --git a/src/com/android/settings/DeviceAdminSettings.java b/src/com/android/settings/DeviceAdminSettings.java
index 9eb1ddb7134..532498396eb 100644
--- a/src/com/android/settings/DeviceAdminSettings.java
+++ b/src/com/android/settings/DeviceAdminSettings.java
@@ -108,10 +108,10 @@ public class DeviceAdminSettings extends ListFragment {
         filter.addAction(DevicePolicyManager.ACTION_DEVICE_POLICY_MANAGER_STATE_CHANGED);
         getActivity().registerReceiverAsUser(
                 mBroadcastReceiver, UserHandle.ALL, filter, null, null);
-        mDeviceOwnerPkg = mDPM.getDeviceOwner();
-        if (mDeviceOwnerPkg != null && !mDPM.isDeviceOwner(mDeviceOwnerPkg)) {
-            mDeviceOwnerPkg = null;
-        }
+
+        final ComponentName deviceOwnerComponent = mDPM.getDeviceOwnerComponentOnAnyUser();
+        mDeviceOwnerPkg =
+                deviceOwnerComponent != null ? deviceOwnerComponent.getPackageName() : null;
         mProfileOwnerComponents.clear();
         final List<UserHandle> profiles = mUm.getUserProfiles();
         final int profilesSize = profiles.size();
diff --git a/src/com/android/settings/MonitoringCertInfoActivity.java b/src/com/android/settings/MonitoringCertInfoActivity.java
index e2ac5d072b8..9dd83f54917 100644
--- a/src/com/android/settings/MonitoringCertInfoActivity.java
+++ b/src/com/android/settings/MonitoringCertInfoActivity.java
@@ -47,12 +47,13 @@ public class MonitoringCertInfoActivity extends Activity implements OnClickListe
         final AlertDialog.Builder builder = new AlertDialog.Builder(this);
         builder.setTitle(R.string.ssl_ca_cert_dialog_title);
         builder.setCancelable(true);
-        hasDeviceOwner = dpm.getDeviceOwner() != null;
+        // TODO See b/25772443
+        hasDeviceOwner = dpm.getDeviceOwnerComponentOnCallingUser() != null;
         int buttonLabel;
         if (hasDeviceOwner) {
             // Institutional case.  Show informational message.
             String message = this.getResources().getString(R.string.ssl_ca_cert_info_message,
-                    dpm.getDeviceOwnerName());
+                    dpm.getDeviceOwnerNameOnAnyUser());
             builder.setMessage(message);
             buttonLabel = R.string.done_button;
         } else {
diff --git a/src/com/android/settings/applications/InstalledAppDetails.java b/src/com/android/settings/applications/InstalledAppDetails.java
index 32d3d2ffb73..7d8a7f09b16 100755
--- a/src/com/android/settings/applications/InstalledAppDetails.java
+++ b/src/com/android/settings/applications/InstalledAppDetails.java
@@ -206,6 +206,9 @@ public class InstalledAppDetails extends AppInfoBase
             enabled = false;
         }
 
+        // We don't allow uninstalling DO/PO on *any* users, because if it's a system app,
+        // "uninstall" is actually "downgrade to the system version + disable", and "downgrade"
+        // will clear data on all users.
         if (isProfileOrDeviceOwner(mPackageInfo.packageName)) {
             enabled = false;
         }
@@ -250,7 +253,7 @@ public class InstalledAppDetails extends AppInfoBase
         List<UserInfo> userInfos = mUserManager.getUsers();
         DevicePolicyManager dpm = (DevicePolicyManager)
                 getContext().getSystemService(Context.DEVICE_POLICY_SERVICE);
-        if (packageName.equals(dpm.getDeviceOwner())) {
+        if (dpm.isDeviceOwnerAppOnAnyUser(packageName)) {
             return true;
         }
         for (UserInfo userInfo : userInfos) {
diff --git a/src/com/android/settings/users/UserSettings.java b/src/com/android/settings/users/UserSettings.java
index 6a9bb098f10..59ab9016f66 100644
--- a/src/com/android/settings/users/UserSettings.java
+++ b/src/com/android/settings/users/UserSettings.java
@@ -1030,7 +1030,7 @@ public class UserSettings extends SettingsPreferenceFragment
             DevicePolicyManager dpm = (DevicePolicyManager) context.getSystemService(
                     Context.DEVICE_POLICY_SERVICE);
             // No restricted profiles for tablets with a device owner, or phones.
-            if (dpm.getDeviceOwner() != null || Utils.isVoiceCapable(context)) {
+            if (dpm.isDeviceManaged() || Utils.isVoiceCapable(context)) {
                 caps.mCanAddRestrictedProfile = false;
             }
 
diff --git a/src/com/android/settings/wifi/WifiSettings.java b/src/com/android/settings/wifi/WifiSettings.java
index 00b311c2117..490529a9cd5 100644
--- a/src/com/android/settings/wifi/WifiSettings.java
+++ b/src/com/android/settings/wifi/WifiSettings.java
@@ -22,6 +22,7 @@ import android.app.AppGlobals;
 import android.app.Dialog;
 import android.app.admin.DevicePolicyManager;
 import android.content.BroadcastReceiver;
+import android.content.ComponentName;
 import android.content.ContentResolver;
 import android.content.Context;
 import android.content.Intent;
@@ -985,11 +986,12 @@ public class WifiSettings extends RestrictedSettingsFragment
 
         boolean isConfigEligibleForLockdown = false;
         if (dpm != null) {
-            final String deviceOwnerPackageName = dpm.getDeviceOwner();
-            if (deviceOwnerPackageName != null) {
+            final ComponentName deviceOwner = dpm.getDeviceOwnerComponentOnAnyUser();
+            if (deviceOwner != null) {
+                final int deviceOwnerUserId = dpm.getDeviceOwnerUserId();
                 try {
-                    final int deviceOwnerUid = pm.getPackageUid(deviceOwnerPackageName,
-                            UserHandle.USER_SYSTEM);
+                    final int deviceOwnerUid = pm.getPackageUid(deviceOwner.getPackageName(),
+                            deviceOwnerUserId);
                     isConfigEligibleForLockdown = deviceOwnerUid == config.creatorUid;
                 } catch (NameNotFoundException e) {
                     // don't care