0

Exchange 2010 sp2.

I have a "C" level exec that wants to get his email on his android tablet. Easy enough. However, he doesn't want any Activesync policy applied to his device for remote wipe, etc. not even the default policy, and doesn't want to use OWA.

I thought I knew Exchange pretty well, but can't find a Powershell command or anything that will allow a device to connect without enforcing at least some kind of policy.

Is he out of luck using Activesync? I can set him up with POP3/IMAP, but would rather not.

EDIT: screenshot of the prompts (with the default policy that is "wide open":

enter image description here

UPDATE:

I should add that I did post a short blog about this if anyone is interested on how to do this with a single user. It isn't pretty and I chose not to go that route, but I did work with Microsoft on finding a "way"...again, not pretty and I'd suggest doing it in a test environment first to really understand what/why.

http://dittotech.wordpress.com/2012/12/03/disable-exchange-activesync-policy-for-a-single-user/

3 Answers 3

6

The strict answer to your question "can I apply no policy?" is no.

So next we have to look at what the user thinks the policy is. Does he not want to get the security pop-up when adding the account? The don't enable any of the options that cause that pop-up.

The individual settings within ActiveSync policies fall in to two categories: those that affect only the mail client, and those that affect the whole device. Only the ones that affect the whole device result in a security prompt.

To make your user happy, create another ActiveSync policy just for him and apply it. Provided that you don't configure anything that requires system-level security changes, such as password rules and remote wipe, then he won't get the security prompt when the account is set up on the tablet.


Update to make my answer closer to reality:

If the device supports remote wipe, there is no way to suppress the security prompt for remote wipe.

  • During the initial ActiveSync setup, Exchange asks the client "do you support remote wipe?"
    • If the device supports remote wipe, Exchange requires it.
    • If the device does not support remote wipe, then the "Allow non-provisionable devices" option is consulted.
      • If checked, the device is allowed.
      • If not checked, the device is denied a partnership. The phone will either return an error or just show an empty inbox.

There is no way to stop Exchange from asking if it supports remote wipe.


Update after you posted the pic:

You are not going to be able to get rid of that security prompt.

My Android phone will only display the security prompt for capabilities requested by the assigned policy. If the policy changes, I'll get a new prompt.

My boss's phone will display the security prompt with all of the security features it supports. When the policy changes, she does not get a new prompt.

So you are fighting two problems, neither of which you will be able to change:

  1. There is no way to stop Exchange from asking a device if it supports remote wipe.
  2. It appears that your device prompts for all of the security capabilities it supports, regardless of what the Exchange server asks for.
7
  • I'm not sure what settings you are referring to. The default policy has no password rule and there isn't a setting for remote wipe. technet.microsoft.com/en-us/library/bb123783.aspx Do you have an example policy that works without giving a security prompt on the device?
    – TheCleaner
    Nov 26, 2012 at 16:08
  • The strict answer to your question "can I apply no policy?" is no. So next we have to look at what the user thinks the policy is. Does he not want to get the security pop-up when adding the account? The don't enable any of the options that cause that pop-up. Off the top of my head, that's pin/password rules, remote wipe, and require storage encryption.
    – longneck
    Nov 26, 2012 at 16:11
  • All of those (except remote wipe which I can't find as an option) are unchecked even in the default policy but still prompts.
    – TheCleaner
    Nov 26, 2012 at 16:16
  • What is the prompt telling you? That should lead you to the option that is causing the prompt.
    – longneck
    Nov 26, 2012 at 16:19
  • Longneck, I edited my original post. See the prompt pic. I can't find any way, even with MS support to prevent it through any custom policy, etc.
    – TheCleaner
    Dec 5, 2012 at 14:25
3

The real answer if you're actually doing your job is, "sir/ma'am we need to enforce security policies so that we don't end up on the front page of The Post." If they can't handle that they should be fired, not you...

I'm not trying to be a fool, this is real. You can't be applying a policy to your enterprise for everyone but the most sensitive users. This is how breaches happen. If the C doesn't want to enter a password too often, I suppose you can adjust a different policy other than a standard 5 minute lock. But again, someone is targeting the C at Morton's while they're eating their steak. I constantly argue that our exec policies should be tighter, not looser. They often agree with me.

Stand up and do the right thing. At least trying will save your job the day C's boss comes to you and asks why the policy didn't apply to a certain subset that holds the most sensitive data.

1
  • 2
    Agreed, that's what I told our company's C-level employee when he wanted to be exempt from the pesky security policies that the "little people" have to follow. It took a long conversation to convince him that they policies are more important for him than for anyone else -- if he loses his device in a cab, he probably doesn't want whoever finds it posting all of his emails on the web. And sure enough, 6 months later, he called IT in a panic asking us to wipe his device after it was stolen from his car, Exchange confirmed a successful wipe.
    – Johnny
    Apr 8, 2013 at 20:54
0

It's possible, though I'd tend to lie and just tell the user it's not possible. Computers don't care about the acronym after your name (and neither do I).

For Exchange 2007, though, as I recall, the same is applicable to Exchange 2010 as well.

To use the Exchange Management Console to enable or disable Exchange ActiveSync for a mailbox user

  1. Start the Exchange Management Console.

  2. In the console tree, expand Recipient Configuration, and then click Mailbox.

  3. In the result pane, select the mailbox user for whom you want to enable or disable Exchange ActiveSync.

  4. In the action pane, under the mailbox user's name, click Properties.

  5. In Properties, on the Mailbox Features tab, click Exchange ActiveSync, and then click either Enable or Disable.

  6. Click OK.

To use the Exchange Management Shell to enable or disable Exchange ActiveSync for a mailbox user

  • Run the following command to enable Exchange ActiveSync for the user John:

Set-CASMailbox -Identity John -ActiveSyncEnabled $true

  • Run the following command to disable Exchange ActiveSync for the user John:

Set-CASMailbox -Identity John -ActiveSyncEnabled $false

1
  • Not looking to prevent Activesync, more along the lines of what longneck is suggesting.
    – TheCleaner
    Nov 26, 2012 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .