Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have users complaining about having to input a PIN to access their Android phone when they are linked to an Exchange Server account. I understand this is a security feature built into MS Exchange. Would you recommend disabling it? How do I disable it? If I disable this "PIN/Password feature" on MS Exchange, what security holes do I open? Who/what all would the change affect? Can I change it for specific users/devices?

In reality I'm probably going to tell them to "deal with it" but I'm just looking for opinions and answers to the above questions.

share|improve this question
up vote 2 down vote accepted

You can create any number of ActiveSync policies (with different settings) and apply those policies to different sets of users. My opinion is that if these devices are personal devices then you probably shouldn't force a password policy on them, but you need to determine the risk/response regarding company email on the devices if they're lost or stolen. If these are company devices then you should without a doubt enforce passwords and any other policy setting deemed appropriate.

share|improve this answer
Is it possible to tell android phones that they can also use a lock pattern or is it pin/password only? – Beliskner Feb 24 '11 at 13:40

The first question I would ask, is why was it put their in the first place? Enforcing a PIN is not enabled in the default Activesync policy, so someone has enabled it at some point, there must have been a reason.

In some Industrys (such as finance) this will be a requirement for access to email from personal devices. Users would just have to be told to either use a PIN, or disconnect their device from Exchange.

If you only want to change it for specific users, then you would want to create a second Activesync policy and assign on those users to this. Take a look at this article for more details on Activesync policies.

share|improve this answer
I think it is enabled by default. I've just looked at two SBS2008 installs and it's enabled, unless SBS2008 enables it while a standalone install doesn't? – joeqwerty Jan 24 '11 at 18:04
@joe A standalone Exchange 2007 install doesn't enable it. Maybe SBS does, I guess that would make sense for an SBS server. – Sam Jan 24 '11 at 18:14
Thanks for confirming. – joeqwerty Jan 24 '11 at 18:18
SBS 2008 must enable it by default. I am the Administrator and I did the actual Windows/Exchange install and config and I don't remember ever messing with this setting. – HK1 Jan 26 '11 at 4:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.