Can I have a password that only works for Exchange (not the domain)?

Question

I have recently migrated a client to Exchange 2010 from Postfix/Dovecot. Under the old setup a user with a BlackBerry would need to enter their username/password, which is then 'known' to a 3rd party (ie BlackBerry). I was always uncomfortable with this but at least if the password fell into the wrong hands, they would only have access to a single email account and no other resources.

Now, a user who has access to our RDS Gateway also has a BlackBerry, which requires her domain username and password to pass through the hands of a 3rd party. This makes me more uncomfortable than I was before.

What is the easiest way round this? Ideally I'd like users to have a second password that only works for IMAP.

Answer 1

The secure, "proper" way to do this is to deploy a BES, but thats a lot of money for a single employee.

And of course there's the non-technical fix - ban Blackberry and make her change to something that supports ActiveSync. Again, that may be a hard sell to the client.

So you'll probably have to resort to some ugly hack. There's one I used to use back in the Exchange 2003 days, before I managed to ban IMAP and POP; no guarantees it still works but the core trick it depends on is part of the IMAP protocol, so worth a try.

First, create a second domain account for her and give it full access permissions to her email but nothing else. Then have her configure her blackberry to use an IMAP login name of domain/username/mailboxname where "username" is the "fake" credentials and "mailbox name" is the "real" one.

e.g. if her current username is CONTOSO/sjsmith, and the new restricted account you made is CONTOSO/sjsbb, then she logs onto IMAP with username CONTOSO/sjsbb/sjsmith and the password from the sjsbb account.

Answer 2

Your RDS Gateway should only allow specific users/groups, not all domain users.
If you followed instructions similar to this (http://technet.microsoft.com/en-us/library/dd983949(v=ws.10) , you may have authorised the Domain Users group. You want to create a new group in AD for RDSusers, grant RDS access only to this group and only put users that require access in that group.

You can further lock down the email only user by creating an AD OU and specifying group policy restrictions.

For better control and functionality of the Blackberry, Blackberry Express Server is free and supported running directly on the Exchange 2010 server in small deployments. http://us.blackberry.com/business/software/besx.html