Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have recently migrated a client to Exchange 2010 from Postfix/Dovecot. Under the old setup a user with a BlackBerry would need to enter their username/password, which is then 'known' to a 3rd party (ie BlackBerry). I was always uncomfortable with this but at least if the password fell into the wrong hands, they would only have access to a single email account and no other resources.

Now, a user who has access to our RDS Gateway also has a BlackBerry, which requires her domain username and password to pass through the hands of a 3rd party. This makes me more uncomfortable than I was before.

What is the easiest way round this? Ideally I'd like users to have a second password that only works for IMAP.

share|improve this question

migrated from Sep 8 '12 at 12:28

This question came from our site for information security professionals.

This is a followup to this question. – Jack Douglas Sep 7 '12 at 8:22
up vote 3 down vote accepted

The secure, "proper" way to do this is to deploy a BES, but thats a lot of money for a single employee.

And of course there's the non-technical fix - ban Blackberry and make her change to something that supports ActiveSync. Again, that may be a hard sell to the client.

So you'll probably have to resort to some ugly hack. There's one I used to use back in the Exchange 2003 days, before I managed to ban IMAP and POP; no guarantees it still works but the core trick it depends on is part of the IMAP protocol, so worth a try.

First, create a second domain account for her and give it full access permissions to her email but nothing else. Then have her configure her blackberry to use an IMAP login name of domain/username/mailboxname where "username" is the "fake" credentials and "mailbox name" is the "real" one.

e.g. if her current username is CONTOSO/sjsmith, and the new restricted account you made is CONTOSO/sjsbb, then she logs onto IMAP with username CONTOSO/sjsbb/sjsmith and the password from the sjsbb account.

share|improve this answer
Don't know why I didn't think of BES - would the Express version not suffice? – Jack Douglas Sep 7 '12 at 10:36
I'm embarrassed to say that since I have a full BES on my network I'd not heard of BES Express! It's definitely the way to go though. – Graham Hill Sep 8 '12 at 10:21
BES Express has worked out just fine. You mentioned ActiveSync, did you mean you can set up a (non BB or perhaps a BB10) phone with ActiveSync using a password that is not the users domain password? – Jack Douglas May 6 '13 at 8:22
Yes, events have moved on and BB10 supports Activesync. You can give a restricted account permission to access an Exchange mailbox, although you might not need to, since ActiveSync doesn't authenticate or communicate via a third party but directly from the phone to your Exchange server. – Graham Hill May 7 '13 at 14:59
That is very useful information about the restricted accounts, thanks. Do you know what version of Exchange is needed, eg 2010+ perhaps? If you have time to update your answer that'd be superb! – Jack Douglas May 7 '13 at 15:11

Your RDS Gateway should only allow specific users/groups, not all domain users.
If you followed instructions similar to this ( , you may have authorised the Domain Users group. You want to create a new group in AD for RDSusers, grant RDS access only to this group and only put users that require access in that group.

You can further lock down the email only user by creating an AD OU and specifying group policy restrictions.

For better control and functionality of the Blackberry, Blackberry Express Server is free and supported running directly on the Exchange 2010 server in small deployments.

share|improve this answer
Yes I have an RDSUsers group - currently only one user is in it, though there will be a handful more. Thanks for confirming BES Express will work for me, that is the way I'm going to go. – Jack Douglas Sep 8 '12 at 5:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.