Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My question is for the Exchange administrators.

I recently upgraded my Android phone from 2.3.3 to 2.3.7. During this, my settings got wiped and I had to reinstall everything. As I was setting up my Exchange account for my work email, contacts, and calendars, I got prompted with a screen that told me I had to give up certain rights to my phone, including letting exchange admins:

  1. Dictate my password policy on my phone
  2. Monitor my wrong-password attempts
  3. Lock my phone
  4. Remotely wipe my phone. Not just exchange data, but wipe my phone back to factory condition.

I understand why a company would implement these policies, however, I'm curious as to why this never showed up before (people setup Win7 phones, other androids, iphones without being prompted for this), IT says nothing has changed on their side.

My real questions for the exchange admins is:

  1. If the users never see this warning about giving up control, do exchange admins have the ability to perform these functions? In other words, is me seeing the warning on my phone and accepting the terms required to give the exchange admins the ability to do these things, including wiping my phone to factory condition? IOW, the users who link to exchange without that prompt, are exchange admins able to wipe their phone?
  2. Without those abilities, what options do exchange admins have for controlling the data? IOW, if they took away those policy requirements for connecting to exchange from the mobile phone, they would still be able to kill your exchange account and clear the exchange data from the phone, right?
share|improve this question

2 Answers 2

up vote 6 down vote accepted

I believe that this is a generic prompt that comes up on certain versions of Android. I've seen it when I've configured ActiveSync on my Android with the Cyanogen mod installed, even though I do not have some of the policy items configured.

That said, your Exchange Admin can initiate a remote wipe of your phone at any time. You can do this as well from the Outlook Web interface.

The ActiveSync policy settings are just used for determining what features a device must have in order to sync with the server. If the policy requiring remote wipe is turned on, then the system will require all devices to support remote wipe in order to be provisioned on the server. If the device does not support that feature, Exchange will not provision it.

The Exchange features that remote devices support are often determined by the OS developer or vendor. A listing of what Exchange features different vendors support can be found here.

share|improve this answer
    
Thanks for clearing it up for me, and the link to the exchange features for phones. The part that gave me cause for pause was that they can wipe my phone to factory condition, not just wipe the Exchange data (which I would be more understanding). Is there anything else that phone users aren't aware of that Exchange admins can do? I mean, what are we really giving up by allowing ourselves to be tied to work 24/7? –  Mike Mar 8 '12 at 19:53
    
You should really contact your local admins and ask them specifically what they are or aren't enforcing in your ActiveSync policy. You should also refer to your local security policy wherever you work, usually they are posted online or on paper. It should state the answers you are looking for. –  Tatas Mar 8 '12 at 20:27
    
I did, and I'm pretty good friends with the IT guy, but he didn't know the answers. I think I found out though that all the policies have always been there, but that the phones aren't warning the users... Many people here are surprised. And it is in our policy, one line, buried deep... I was just trying to get an understanding so I can see if there's a possible alternative solution, but I've seen enough now. Thanks for the reply. –  Mike Mar 8 '12 at 22:00

It's very possible that your Exchange Admins have recently added an ActiveSync Policy to your account. And that you only notice it now because you are re-setting up your phone. It's also possible as smassey said, that the newer version of Android has code in it to actually display this message. To answer your specific questions. Yes, Exchange admins still have these abilities, regardless of whether or not the phone notifies the user of any policies being applied. And yes, even if an ActiveSync policy is not applied, Admins as well as the user can remotely wipe the phone.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.