diff --git a/core/java/com/android/internal/widget/LockPatternUtils.java b/core/java/com/android/internal/widget/LockPatternUtils.java
index 89cb5b4a4adba..4e8f19cd0f959 100644
--- a/core/java/com/android/internal/widget/LockPatternUtils.java
+++ b/core/java/com/android/internal/widget/LockPatternUtils.java
@@ -893,7 +893,7 @@ public class LockPatternUtils {
      */
     public boolean isSeparateProfileChallengeEnabled(int userHandle) {
         UserInfo info = getUserManager().getUserInfo(userHandle);
-        if (!info.isManagedProfile()) {
+        if (info == null || !info.isManagedProfile()) {
             return false;
         }
         return getBoolean(SEPARATE_PROFILE_CHALLENGE_KEY, false, userHandle);
@@ -904,7 +904,7 @@ public class LockPatternUtils {
      */
     public boolean isSeparateProfileChallengeAllowed(int userHandle) {
         UserInfo info = getUserManager().getUserInfo(userHandle);
-        if (!info.isManagedProfile()) {
+        if (info == null || !info.isManagedProfile()) {
             return false;
         }
         return getDevicePolicyManager().isSeparateProfileChallengeAllowed(userHandle);
diff --git a/services/core/java/com/android/server/trust/TrustManagerService.java b/services/core/java/com/android/server/trust/TrustManagerService.java
index 78e3f7f087795..42b872119e7a5 100644
--- a/services/core/java/com/android/server/trust/TrustManagerService.java
+++ b/services/core/java/com/android/server/trust/TrustManagerService.java
@@ -675,12 +675,12 @@ public class TrustManagerService extends SystemService {
         public boolean isDeviceSecure(int userId) throws RemoteException {
             userId = ActivityManager.handleIncomingUser(getCallingPid(), getCallingUid(), userId,
                     false /* allowAll */, true /* requireFull */, "isDeviceSecure", null);
-            if (!mLockPatternUtils.isSeparateProfileChallengeEnabled(userId)) {
-                userId = resolveProfileParent(userId);
-            }
 
             long token = Binder.clearCallingIdentity();
             try {
+                if (!mLockPatternUtils.isSeparateProfileChallengeEnabled(userId)) {
+                    userId = resolveProfileParent(userId);
+                }
                 return mLockPatternUtils.isSecure(userId);
             } finally {
                 Binder.restoreCallingIdentity(token);