10

As written in the MS documentation here: The remote device wipe feature also includes a confirmation function that writes a time stamp in the sync state data of the user's mailbox. This time stamp is displayed in Outlook Web App and in the user's mobile phone properties dialog box in the EAC. more detailed infos can be found here: The Clear-...


6

ActiveSync and IMAP are quite similar. Both ActiveSync and IMAP IDLE maintain a dormant TCP session for inbound push notifications. IMAP IDLE handles 'push' email as well FYI. Both are quite conservative with bandwidth usage. Bandwidth consumption in practice will be more determined by configuration parameters than protocol choice. Setting things like '...


5

The strict answer to your question "can I apply no policy?" is no. So next we have to look at what the user thinks the policy is. Does he not want to get the security pop-up when adding the account? The don't enable any of the options that cause that pop-up. The individual settings within ActiveSync policies fall in to two categories: those that affect ...


4

Your question is truncated (stopping with "but is"), but I suspect you were asking if there is some "easier" log file than the IIS logs. While it's possible that the "Security" event log could yield some information (depending on how your Audit Policy is configured) the logs for the IIS Web Site hosting the Exchange-ActiveSync folder really are your best bet....


4

Okay the first thing to is to try https://testconnectivity.microsoft.com/ If a server error 500 occurs it might be related to the fact that the user is in a protected group, and thus some inheritance gets removed every hour.. From http://technet.microsoft.com/en-us/library/dd439375%28EXCHG.80%29.aspx To check whether inheritance is disabled on the user: ...


4

Further research and trial-and-error troubleshooting has confirmed that, if as stated in my question the solution must not result in using a non-stock e-mail app on the Galaxy S5 phone, it's not possible to use the fingerprint scanner without disabling the password requirement on the Exchange Server. So the answer is, "it can't be done" (without using a ...


4

This is usually resolved by setting the inheritable permissions flag on the user in question. Under ADUC, go to View -> Advanced Features to expose the Security tab under the user's profile dialog. Return to the user's settings in ADUC and choose the Security tab. Click on Advanced ensure that "Include Inheritable Permissions From This Object’s Parent"...


4

Take a look at https://technet.microsoft.com/en-gb/library/hh529949(v=exchg.150).aspx There is an interesting line at the bottom of that page that implies the effective maximum limit is about 33% less then the limit you have configured. Given the default for active sync is 10mb and you are seeing problems around 7, that would make sense. Try increasing to ...


3

Apparently Mac Mail uses both Active Sync and EWS to connect to exchange; because of this it will not show up as a device on the management side. Disabling EWS prevents Mac Mail from connecting while still allowing Active Sync devices to connect.


3

Normally what we tell users is to put the device in "flight" or "airplane" mode, cutting off network access when they are ready to change password, once they change the password on Desktop/Laptop, then they can enter the new password in device and connect back to network. Of course we also send the expiry notification so that they are well prepared for the ...


3

If you disabled the "Require SSL" option for the Exchange virtual directory ("/Exchange") this means the virtual directories for Active Sync ("/Microsoft-Server-Active-Sync" on Windows Server 2003) and Outlook Mobile Access ("/OMA") can still be set to "Require SSL" and the data between the server and your iPhone will still be encrypted. This only concerns ...


3

The thing to remember is that everything in PowerShell is an object. When you use Format-Table, the output is a formatting object and that's what is getting passed in to export CSV. If you pipe the results of the Format-Table command to Get-Member, you'll see what I mean. Get-ActiveSyncDevice | Get-ActiveSyncDeviceStatistics | sort-object status, ...


3

I ran into this yesterday and figured others might want to see this in the future. Didn't see this particular issue listed on SF. This seems to be a known issue. See here: Senders receive a message copy after they click "Reply to All" in Exchange ActiveSync. They state a workaround as: To work around this problem, manually change any existing address ...


3

Should be on your DVD/ISO. EX 2010 location example: x:\Setup\ServerRoles\ClientAccess\sync\xsd\v2.0 Directory of x:\Setup\ServerRoles\ClientAccess\sync\xsd\v2.0 09/25/2009 01:14 PM <DIR> . 09/25/2009 01:14 PM <DIR> .. 07/21/2009 08:27 PM 1,043 foldercreate-request.xsd 07/21/2009 08:27 PM ...


3

Horde Although I don't know if your also using Plesk/Odin, which I am, I ran in the same problem. After some search it seems Horde Webmail has some built-in functionality for that and if that is not the case for you, you can install addons for that. For example, when you login in to Horde Webmail go to Agenda and edit the agenda you want to have on ...


3

I would also use IMAPSync here it would preserved all flags: unread will stay unread, read will stay read, deleted will stay deleted. If you wish to more commercial solution then you can check audriga. But as you are familiar with Dovecot it wouldn´t be an issue for you to setup an IMAPSync crone job.


3

Dovecot's integrated dsync (usually used to replicate between Dovecot servers) can be used to migrate from arbitrary IMAP servers including Exchange. Basically, you will run doveadm dsync backup -R <user> <exchange-server>: (the colon is important) for each user, but some preparation is required: you either have to know the user's passwords, or ...


2

Run this in Exchange Shell Search-AdminAuditLog -Cmdlets "Clear-ActiveSyncDevice" Search-AdminAuditLog : http://technet.microsoft.com/en-us/library/dd335052.aspx Clear-ActiveSyncDevices : http://technet.microsoft.com/en-us/library/aa998614.aspx


2

I found a plug-in for qpsmtpd called tnef2mime. It was originally designed to convert Microsoft's TNEF (winmail.dat) attachments to MIME, but it also converts UUEncoded messages. I couldn't find a canonical source for this plugin, but SME Server keeps the plugin in their distribution and the bug database implies that people are using it recently. So I added ...


2

Solved: Hopefully this will help folks out. Root cause was a malformed email that was taking a long time to open in Outlook client itself. On the IIS Manager, we noticed that ExchangeApplictionPool -> Properties ->Health (tab) had Enable rapid-file protection checked. Our failures were set to 5. Increasing this value solved the problem since less then 10 ...


2

There is no standard LDAP sync. The software being used certainly should be able to access any ldap attributed that has been defined, which includes the post-Windows 2000 name. You will need to work with your vendor to have them adjust their software too look at the correct attributes. There is nothing you need to do on the Window server side. It all ...


2

Implementation of the policy as presented by the server is completely up to the device. Android's interpretation of that policy seems to be that a pattern lock doesn't fit the policy's demand - your Exchange server really doesn't have any say in the matter. Aside from rooting phones, your only recourse is probably to file a feature request against Android.


2

There seems to be a slew of similar problems on the web. The first thing that pops out in my mind is permissions. Specifically, whether or not these users are domain admins of any kind, or members of other special groups. First thing to do would be to go to https://www.testexchangeconnectivity.com and see what crops up when you use one of the affected ...


2

Security inheritance is not set by selecting a specific permission. It's a global setting per user object. The step about "select exchange servers" is pointless, you're doing this for all ACL's. Every AD user should have security inheritance enabled. A ton of software that utilizes these security attributes (especially Exchange and Lync) rely on them. The ...


2

Cant be too sure about the answer but To my knowledge there is no way of websense automatically adding/removing users from directory groups as this is solely controlled in the directory itself. I'm not 100% with V7 yet but with V6.x.x if the user is not a member of a group the default policy automatically applies, therefore if you want to change the standard ...


2

The real answer if you're actually doing your job is, "sir/ma'am we need to enforce security policies so that we don't end up on the front page of The Post." If they can't handle that they should be fired, not you... I'm not trying to be a fool, this is real. You can't be applying a policy to your enterprise for everyone but the most sensitive users. This ...


2

There's no built-in functionality to do what you're describing other than logon hours. Since you've already checked that I'd say that you've got some kind of malfunction occurring. The IIS logs on the ActiveSync server should probably be your first stop. If you can get a good report from a user of an exact time / date of the problem you should be able to ...


2

The maximum number of ActiveSync devices allowed is controlled by the throttling policy. You can find out which throttling policy is assigned to a mailbox with Get-Mailbox and then change that policy with Set-ThrottlingPolicy.


2

Heh, that config looked familiar for a reason. Hey Jon! Hopefully I didn't leave too many messes for you to clean up. I think you're most of the way there. One little case sensitivity issue, the phones should be sending /Microsoft-Server-ActiveSync instead of /Microsoft-Server-Activesync, so that would miss the match. Also, not sure if the requests will ...


2

That name is for internal use only, and it's not supposed to be explicitly used anywhere, especially in URLs, which should be configured using the server's internal hostname and/or public-facing FQDN. I don't know what you're using that name for, but you should stop doing that, and configure your Exchange server in a proper way.


Only top voted, non community-wiki answers of a minimum length are eligible