Tag Info

Hot answers tagged

8

It wouldn't be recommended to alter the permissions in IIS. You can control Activesync on a user by user basis in the properties of the user account in ADUC. Select the Exchange Features tab and disable the User Intitiated Synchronization feature.


8

UPDATED (again) The short answer to your question is NO. Outlook/Exchange clients either are capable or aren't capable of Remote-wipe. The Exchange policy simply expects that they support that feature.. If the phone supports Remote-wipe and you've accepted the policy (by being a so-called "Provisional Device"), then Exchange may send a request to wipe ...


5

The strict answer to your question "can I apply no policy?" is no. So next we have to look at what the user thinks the policy is. Does he not want to get the security pop-up when adding the account? The don't enable any of the options that cause that pop-up. The individual settings within ActiveSync policies fall in to two categories: those that affect ...


4

ActiveSync and IMAP are quite similar. Both ActiveSync and IMAP IDLE maintain a dormant TCP session for inbound push notifications. IMAP IDLE handles 'push' email as well FYI. Both are quite conservative with bandwidth usage. Bandwidth consumption in practice will be more determined by configuration parameters than protocol choice. Setting things like ...


4

This is usually resolved by setting the inheritable permissions flag on the user in question. Under ADUC, go to View -> Advanced Features to expose the Security tab under the user's profile dialog. Return to the user's settings in ADUC and choose the Security tab. Click on Advanced ensure that "Include Inheritable Permissions From This Object’s ...


4

Your question is truncated (stopping with "but is"), but I suspect you were asking if there is some "easier" log file than the IIS logs. While it's possible that the "Security" event log could yield some information (depending on how your Audit Policy is configured) the logs for the IIS Web Site hosting the Exchange-ActiveSync folder really are your best ...


4

Okay the first thing to is to try http://testexchangeconnectivity,com. If a server error 500 occurs it might be related to the fact that the user is in a protected group, and thus some inheritance gets removed every hour.. From http://technet.microsoft.com/en-us/library/dd439375%28EXCHG.80%29.aspx To check whether inheritance is disabled on the user: ...


3

If you disabled the "Require SSL" option for the Exchange virtual directory ("/Exchange") this means the virtual directories for Active Sync ("/Microsoft-Server-Active-Sync" on Windows Server 2003) and Outlook Mobile Access ("/OMA") can still be set to "Require SSL" and the data between the server and your iPhone will still be encrypted. This only concerns ...


3

The thing to remember is that everything in PowerShell is an object. When you use Format-Table, the output is a formatting object and that's what is getting passed in to export CSV. If you pipe the results of the Format-Table command to Get-Member, you'll see what I mean. Get-ActiveSyncDevice | Get-ActiveSyncDeviceStatistics | sort-object status, ...


3

It sounds like backscatter (NDR spam) to me, rather than your server being an open relay. Exchange Server 2003 by default is not an open relay. You can check whether or not your Exchange server is an open relay by using any number of online tests. You can help prevent backscatter spam in a few ways: Disable NDR's on your Exchange server. Filter email sent ...


3

ActiveSync (which the iPhone uses) works over ports 80 and 443 (preferably 443). Yes you will need to forward HTTPS traffic to your Exchange server for this to work. I really recommend the Exchange ActiveSync test over at testexchangeconnectivity.com - it is one of the best tools you can use to help you set it up properly and diagnose any problems. ...


3

I actually figured this error out myself. I installed exchange 2010 on an existing 2007 organization the problem was, I needed to add the existing 2007 server to the group 'exchange trusted subsystems' and the administrative account (that is used to log onto the exchange 2007 serveR) to the exchange trusted subsystem as well. This solved all the issues ...


3

No, but you can ask exchange if a user is using activesync. You need to find if Microsoft-Server-ActiveSync exists on that mailbox. You need to look for the Glen Scales wrote a script to do just that. You can also parse the logs. I couldn't find it on his site so here's the code: servername = wscript.arguments(0) set shell = createobject("wscript.shell") ...


3

Microsoft has a "tool" (in the form of a web site and robotic ActiveSync client) that might help you out: https://www.testexchangeconnectivity.com/ This will help you, especially, since you don't have your own ActiveSync client to test with. I have yet to have an E2K3 installation of any age "just work" out of the box with ActiveSync. Typically I find ...


3

If Exchange is configured correctly, you should only need port 443 open on your firewall.


3

No an administrator can't access you text messages and call record. Supported Exchange/ActiveSync policies on iPhone are described in iPhone Enterprise Deployment Guide Enterprise can also use a profile distribution service, this allow enterprise to push policies to the iPhone remotely. These policies can almost force any settings of the iPhone. See the PDF ...


3

I ran into this yesterday and figured others might want to see this in the future. Didn't see this particular issue listed on SF. This seems to be a known issue. See here: Senders receive a message copy after they click "Reply to All" in Exchange ActiveSync. They state a workaround as: To work around this problem, manually change any existing ...


3

Cant be too sure about the answer but To my knowledge there is no way of websense automatically adding/removing users from directory groups as this is solely controlled in the directory itself. I'm not 100% with V7 yet but with V6.x.x if the user is not a member of a group the default policy automatically applies, therefore if you want to change the standard ...


3

Further research and trial-and-error troubleshooting has confirmed that, if as stated in my question the solution must not result in using a non-stock e-mail app on the Galaxy S5 phone, it's not possible to use the fingerprint scanner without disabling the password requirement on the Exchange Server. So the answer is, "it can't be done" (without using a ...


2

The real answer if you're actually doing your job is, "sir/ma'am we need to enforce security policies so that we don't end up on the front page of The Post." If they can't handle that they should be fired, not you... I'm not trying to be a fool, this is real. You can't be applying a policy to your enterprise for everyone but the most sensitive users. This ...


2

There seems to be a slew of similar problems on the web. The first thing that pops out in my mind is permissions. Specifically, whether or not these users are domain admins of any kind, or members of other special groups. First thing to do would be to go to https://www.testexchangeconnectivity.com and see what crops up when you use one of the affected ...


2

There's no built-in functionality to do what you're describing other than logon hours. Since you've already checked that I'd say that you've got some kind of malfunction occurring. The IIS logs on the ActiveSync server should probably be your first stop. If you can get a good report from a user of an exact time / date of the problem you should be able to ...


2

Security inheritance is not set by selecting a specific permission. It's a global setting per user object. The step about "select exchange servers" is pointless, you're doing this for all ACL's. Every AD user should have security inheritance enabled. A ton of software that utilizes these security attributes (especially Exchange and Lync) rely on them. The ...


2

The maximum number of ActiveSync devices allowed is controlled by the throttling policy. You can find out which throttling policy is assigned to a mailbox with Get-Mailbox and then change that policy with Set-ThrottlingPolicy.


2

That name is for internal use only, and it's not supposed to be explicitly used anywhere, especially in URLs, which should be configured using the server's internal hostname and/or public-facing FQDN. I don't know what you're using that name for, but you should stop doing that, and configure your Exchange server in a proper way.


2

You should be using a SAN certificate and adding the appropriate domains to it, such as mail.domain.com, autodiscover.domain.com, etc. https://www.digicert.com/subject-alternative-name.htm


2

The correct way to do it with a. Local is to use the external domain. You set the path to the external'one, you register the certificate (some cheap exist) and you doa split dns setup, so internally the external host will resolve to the internal'one. This is the only clean way.


2

Local copies of emails are NOT encrypted, however it does use ssl to send and receive from the exchange server. Also as PMGoldstein said it allows you to wipe devices remotely. Here is a link to the current issue on the android request board for this feature, it states that it is currently not available in Froyo 2.2. I have also personally tested if data on ...



Only top voted, non community-wiki answers of a minimum length are eligible