2

I have users complaining about having to input a PIN to access their Android phone when they are linked to an Exchange Server account. I understand this is a security feature built into MS Exchange. Would you recommend disabling it? How do I disable it? If I disable this "PIN/Password feature" on MS Exchange, what security holes do I open? Who/what all would the change affect? Can I change it for specific users/devices?

In reality I'm probably going to tell them to "deal with it" but I'm just looking for opinions and answers to the above questions.

2 Answers 2

3

You can create any number of ActiveSync policies (with different settings) and apply those policies to different sets of users. My opinion is that if these devices are personal devices then you probably shouldn't force a password policy on them, but you need to determine the risk/response regarding company email on the devices if they're lost or stolen. If these are company devices then you should without a doubt enforce passwords and any other policy setting deemed appropriate.

1
  • Is it possible to tell android phones that they can also use a lock pattern or is it pin/password only?
    – Beliskner
    Feb 24, 2011 at 13:40
1

The first question I would ask, is why was it put their in the first place? Enforcing a PIN is not enabled in the default Activesync policy, so someone has enabled it at some point, there must have been a reason.

In some Industrys (such as finance) this will be a requirement for access to email from personal devices. Users would just have to be told to either use a PIN, or disconnect their device from Exchange.

If you only want to change it for specific users, then you would want to create a second Activesync policy and assign on those users to this. Take a look at this article for more details on Activesync policies.

3
  • 1
    I think it is enabled by default. I've just looked at two SBS2008 installs and it's enabled, unless SBS2008 enables it while a standalone install doesn't?
    – joeqwerty
    Jan 24, 2011 at 18:04
  • @joe A standalone Exchange 2007 install doesn't enable it. Maybe SBS does, I guess that would make sense for an SBS server.
    – Sam Cogan
    Jan 24, 2011 at 18:14
  • SBS 2008 must enable it by default. I am the Administrator and I did the actual Windows/Exchange install and config and I don't remember ever messing with this setting.
    – HK1
    Jan 26, 2011 at 4:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .