mobile device management (part 2) management & administration exchange 2010 articles __...

8/12/2019 Mobile Device Management (Part 2) __ Management & Administration __ Exchange 2010 Articles __ Articles & Tutorials __ MSExchange.pdf

1/21

(http://ww w.m sexchange.org)

Tweet 0 4 7

Home Articles & Tutorials E xchange 2010 Articles Management & Administration

by Nuno Mota [Publishe d on 17 Jan. 2012 / Last Updated on 17 Jan. 2012 ]

In this article we will explore the new Mobile Device Management capabilities of Exchange 2010 and the possibility of creating allow, block and quarantine lists to control which mobiledevices are allowed to connect to Exchange.

If you would like to read the first part in this article series please go to Mobile Device Management (Part 1) (http://www.msexchange.org/articles_tutorials/exchange-server-2010/management-administration/mobile-device-management-part1.html).

In the first part of this article we explored the bas ics of the new Mobile Device Management capabilities of Exchange 2010. We saw all the poss ible access states and how Exchangedetermines the state each device should be as signed.

This second and fi nal part w ill be hands -on as we will s ee how to configure and manage all aspects of Mobile Device Management.

(http://www.packtpub.com/microsoft-exchange-2013-hig h-availability/book)

Mobile Device Ma nagement (Part 2)

0Me gusta

I ntroduction

Controlling Access States

Home Articles & Tut orials KBase Tips Products Reviews Free Tools Blogs Tech To pics Forums W hite Papers Contact Us
http://www.packtpub.com/microsoft-exchange-2013-high-availability/bookhttp://www.packtpub.com/microsoft-exchange-2013-high-availability/bookhttp://www.packtpub.com/microsoft-exchange-2013-high-availability/bookhttp://www.packtpub.com/microsoft-exchange-2013-high-availability/bookhttp://www.packtpub.com/microsoft-exchange-2013-high-availability/bookhttp://www.packtpub.com/microsoft-exchange-2013-high-availability/bookhttp://www.packtpub.com/microsoft-exchange-2013-high-availability/bookhttp://www.packtpub.com/microsoft-exchange-2013-high-availability/bookhttps://twitter.com/intent/tweet?original_referer=http%3A%2F%2Fwww.msexchange.org%2Farticles-tutorials%2Fexchange-server-2010%2Fmanagement-administration%2Fmobile-device-management-part2.html&text=Mobile%20Device%20Management%20(Part%202)%20%3A%3A%20Management%20%26%20Administration%20%3A%3A%20Exchange%202010%20Articles%20%3A%3A%20Articles%20%26%20Tutorials%20%3A%3A%20MSExchange.org%3A&tw_p=tweetbutton&url=http%3A%2F%2Fwww.msexchange.org%2Farticles-tutorials%2Fexchange-server-2010%2Fmanagement-administration%2Fmobile-device-management-part2.html%23.U6NrcV234mc.twitterhttp://twitter.com/search?q=http%3A%2F%2Fwww.msexchange.org%2Farticles-tutorials%2Fexchange-server-2010%2Fmanagement-administration%2Fmobile-device-management-part2.htmlhttp://www.msexchange.org/http://www.packtpub.com/microsoft-exchange-2013-high-availability/bookhttp://www.msexchange.org/articles_tutorials/exchange-server-2010/management-administration/mobile-device-management-part1.htmlhttp://www.packtpub.com/microsoft-exchange-2013-high-availability/bookhttp://www.msexchange.org/pages/contact-us.htmlhttp://www.msexchange.org/white-papers/http://forums.msexchange.org/http://www.msexchange.org/blogs/http://www.msexchange.org/software/Free-Exchange-Tools/http://www.msexchange.org/articles-tutorials/product-reviews/http://www.msexchange.org/software/http://www.msexchange.org/kbase/ExchangeServerTips/http://www.msexchange.org/articles-tutorials/http://www.msexchange.org/http://www.packtpub.com/microsoft-exchange-2013-high-availability/bookhttp://www.msexchange.org/articles_tutorials/exchange-server-2010/management-administration/mobile-device-management-part1.htmlhttp://www.msexchange.org/authors/nuno-mota/http://www.msexchange.org/articles-tutorials/exchange-server-2010/management-administration/http://www.msexchange.org/articles-tutorials/exchange-server-2010/http://www.msexchange.org/articles-tutorials/http://www.msexchange.org/http://twitter.com/search?q=http%3A%2F%2Fwww.msexchange.org%2Farticles-tutorials%2Fexchange-server-2010%2Fmanagement-administration%2Fmobile-device-management-part2.htmlhttps://twitter.com/intent/tweet?original_referer=http%3A%2F%2Fwww.msexchange.org%2Farticles-tutorials%2Fexchange-server-2010%2Fmanagement-administration%2Fmobile-device-management-part2.html&text=Mobile%20Device%20Management%20(Part%202)%20%3A%3A%20Management%20%26%20Administration%20%3A%3A%20Exchange%202010%20Articles%20%3A%3A%20Articles%20%26%20Tutorials%20%3A%3A%20MSExchange.org%3A&tw_p=tweetbutton&url=http%3A%2F%2Fwww.msexchange.org%2Farticles-tutorials%2Fexchange-server-2010%2Fmanagement-administration%2Fmobile-device-management-part2.html%23.U6NrcV234mc.twitterhttp://www.msexchange.org/


2/21

As we saw in the first part of this article, there are 3 ways of controlling the access s tate for mobile devices. Admin istrators can configure:

1. Exchange ActiveSync [EAS] organization settings ;

2. Organization access rules for mobile device families or specific models;

3. Personal exemptions for users .

Although I will explain each method in this o rder for simplicity, remember that they are applied in the reverse order as explained in the Determining Access States section.

Before we start, it is better to clarify the difference between a device family and model and how to get this information.

The devices family and model is communicated by the device itself to Exchange as part of the EAS protocol. Basically, the difference is that family is broader like Pocket PC while themodel is more s pecific like HTC HD2 T8585 or Palm Treo 850 . This distinction exists because many device manufacturers release the same device with different names on differentcarriers.

There are several methods which adminis trators can use to obtain information regarding device families and models . As EAS uses HTTP, every request is recorded in the IIS web logs , bydefault saved in C:\inetpub\logs\logfiles\W3SVC1\ . In there, we can search for ActiveSync entries where we will have entries s imilar to the one below where we can see the usernam e,DeviceID and DeviceType among other information:

Figure 2-1: Exchange ActiveSync IIS logs

As normally these logs have thousand s of entries, it might not be easy to search them . A more effective method is to use the Exchange Management Shell [EMS] and the Export- ActiveSyncLog, Get-ActiveSyncDeviceStatistics or Get-ActiveSyncDevice cmdlets . The first reads a s ingle IIS log file and exports the relevant information regarding EAS into 6 different CSVfiles. The ones we are interested in are the UserAgents and Users files as they include device models and families.


3/21

Figure 2-2: Export-ActiveSyncLog results

The last two cmdlets provide slightly different information, but for the purpose of this article both provide the information we are looking for: DeviceId , DeviceMobileOperator , DeviceOS ,DeviceType , DeviceUserAgent and DeviceModel . We can easi ly collect the information for every user that has used EAS at leas t once, export it to a CSV file and then analyze the res ults:


4/21

(Get-CASMailbox Resul tSize Unlimi ted -Filter {HasActiveSyncDevicePartnership -eq $True} | Get-Mailbox) | ForEach {Get-ActiveSyncDeviceStatistics -Mailbox $_} | Export-CsvE:\Logs\EAS.csv -NoType

We can automatically group the statistics by DeviceModel , for example:

Figure 2-3: Sort Exchange ActiveSync Stats by Device Model

Or simply check the details for a s ingle user:


5/21

Figure 2-4: User's ActiveSync Device Statistics

The final method is to use the Exchange Control Panel [ECP] as we will see later in this article.

EAS Organization Settings
http://www.googleadservices.com/pagead/aclk?sa=L&ai=CGuB4WGujU_LtOc2n-gO4jYLYBI2wzbUE1fitqJsB-P7-ywEQASC5nPUCUJqA9_P6_____wFg2wGgAbf9iP0DyAECqQLWFrP8nwSWPqgDAcgDwQSqBNsBT9DrKfWZVe-VouRRbaoPQtqLwEpUzyR2E80zWDAKVN5MIw27QpExx8q6K7sueE1kluBbDExCtzA9x3UJ7ALnhIYq2zumJHrMvn6Fv_hoI4-slz_ngVvT5c52SVtcE4cPf8DuUcwSxpULqqLUcACT_-LjY8GRwmgw92cS4zP5mUv7xYpbZDgzRAy_1R7emP72NcR1HuVRAtoC7M4EwPZxN4r7ataQ6YTCHjJiMPqdKsK9WLnw1i-PBHfAymo_ZgF06QHschTGCmO2rLW7t4FQDPvGpwiPtPiHAfsAiAYBoAYCgAexgvcC#=1&cid=5GiK00D6REXY5h_qWKfRgyuA&sig=AOD64_21Xk05aRgnNtCn39gz3GceCUMPlA&client=ca-pub-5272454170345870&adurl=http://www.codetwo.com/exchange-migration/pdf-guide%3Fsts%3D3633


6/21

This is the first step into configuring access levels. When Exchange 2010 is first installed, the default access level is s et to Allow , which means that any device is able to automaticallyconnect to Exchange as long as they comply with the EAS policy. This value can be s et to Allow , Block or Quarantine by using the EMS or the ECP.

With the EMS, we use the Set-ActiveSyncOrganizationSettings cm dlet with the DefaultAccessLevel parameter.

This cmdlet also allows us to configure two other useful settings using the following parameters:

Admin MailRecipients - s pecifies the e-mail address (es) of the adminis trator(s) (can als o be a dis tribution list) that will receive an e-m ail when a device is quarantined;

UserMailInsert - s pecifies the text to be added to the e-mail mes sage s ent to users when their mobile device is blocked or quarantined.

Set-ActiveSyncOrganizationSettings DefaultAccessLevel Quarantine -AdminMailRecipients [email protected], (mailto:[email protected],)

mes [email protected] (mailto:[email protected]) UserMailInsert Your m obile device is temporarily blocked from s ynchronizing with the s erver whilepermiss ions are verified.

To use the ECP, follow these s teps:

1. Log in to the ECP;

2. Make sure you are managing My Organization (you will only see this option if you have Exchange Adm inistrator access);

3. Select Phone & Voice -> ActiveSync Access tab;

4. Click on the Edit button and you will be pres ented with the following screen where we will see all the options we s et up using the EMS:
mailto:[email protected]:[email protected],


7/21

Figure 2-5: The ActiveSync Access page


8/21

Figure 2-6: Configuring EAS Organization Settings through the ECP

In this picture we can confirm the settings we configure using the EMS and the text that the user received when the mobile device was quarantined ( Figure 1-2 ).


9/21

Note:The default organization settings will be applied only if a rule s pecific for a de vice or us er does not match!

Setting the access level to Quarantine at the organizational level, allows adminis trators to monitor which devices and us ers are making new connections to Exchange. This means that if there is no rule for a device or if there is no exemption for the particular user, then any unknown device will be quarantined. This process might be us eful in cases where adminis tratorswant to gradually allow only particular devices that are supported and block all other devices.

These rules allow adminis trators to control the access level of a group of devices b ased on their family or model. The easies t way to create a new rule is to use to the ECP by clicking inNew... under Device Access Rules on the ActiveSync Access tab where we configured the EAS organization settings previously.

Organization Access Rules


10/21

Figure 2-7: New Device Access Rule

In here you can click on Browse to see a list of all the device families and models that have already connected to Exchange. If this is a brand new installation of Exchange and no devicehas ever connected, these lis ts will be empty.


11/21

Figure 2-8: Device families and m odels


12/21


13/21

6 S l t h th t ll bl k ti th h d i


14/21

6. Select whether to allow , block or quarantine the chosen devices;

7. Click Save to create the rule.

The rule will now appear in the main screen as the examples above. However, note that these rules dont apply just for that user, but for everyone with identical devices!

To create these rules using the EMS, you use the New-ActiveSyncDeviceAccessRule cmdlet with the AccessLevel (the s tate for the device), Characteristic (either DeviceType or DeviceModel ) and QueryString (which device type) parameters:

Figure 2-13 : Creating New Device Access Rule through EMS

To check for any created rules, we use the ECP or the Get-ActiveSyncDeviceAccessRule cmdlet which will provide the exact same information as seen in Figure 2-13 .

Note: Remember that if a device tries to connect to Exchange and there is no access rule in place that matches the user or the device, the default organization settings will be applied.

Personal Exemptions for U sers

The final method of controlling mobile devices is by creating rules that onlyapply to s pecific users These rules allow administrators to either allow or block (you cannot quarantine)


15/21

The final method of controlling mobile devices is by creating rules that only apply to s pecific users. These rules allow administrators to either allow or block (you cannot quarantine)particular devices (bas ed on the DeviceID ) for a us er regardless of EAS organizational s ettings or access rules. If a user tries to connect a different device that does not m atch anexemption, that device's access state will be determined by the EAS organizational s ettings or access rules.

As with all previous m ethods , this one can be achieved through the ECP and through the EMS with the Set-CASMailbox cmdlet and the ActiveSyncAllowedDeviceIDs and ActiveSyncBlocke dDeviceI Ds parameters.

To use the ECP, the method is s imilar to the last one dem onstrated in the Organization Access Rules section. To perform it, you must as k the user to attempt to synchronize the devicewith Exchange so that it appears in the us ers ECP. As an adm inistrator (not as the us er), login to the ECP:

1. Select Manage My Organization and then click on Users & Groups ;

2. Search the user for whom you want to create the exemption for, and then select Details ;3. Under Phone & Voice Features , select Exchange ActiveSync and then s elect Edit ;

4. Under Mobile Devices , select the device that you want to exempt and then cl ick either Allow or Block ;

5. Click Save to create the exemption.

Figure 2-14 : Creating Personal Exemption Rule through ECP

To achieve the same result from the EMS we must know the DeviceID which we get from the e-mail we as an administrator receive when a device is quarantined or by using any of the


16/21

To achieve the same result from the EMS, we must know the DeviceID which we get from the e mail we as an administrator receive when a device is quarantined or by using any of themethods explained in the beginning of this article. After we know the DeviceID , creating the rule is straightforward:

Set-CASMailbox nuno ActiveSyncAllowedDeviceIDs SAMSUNG1355310041884853

To verify any of these methods, we can again use the ECP by following the previous steps until step 4 and by clicking on Details instead of Allow or Block. A new window with details aboutthe selected mobile device will open. The Access state and Access set by tell us what the access level is and how it was as signed. As we can see, the device was granted access by anIndividual Assignment (exemption):


17/21

Figure 2-15 : Mobile Device Details window

To check us ing the ECP there are 3 cm dlets we can use: Get-ActiveSyncDevice, Get-ActiveSyncDeviceStatistics (identical output for the information we want) or Get-CASMailbox:


18/21

Figure 2-16 : Check Personal Exemption through EMS

In the picture above, we can s ee that the Samsung device has been allowed to connect to Exchange because of the exemption we jus t created while the iPod is also allowed but becauseof a device rule instead.

Unfortunately, there is no GUI to check for exemptions. We can us e EMS to search for users that have either ActiveSyncAllowedDeviceI Ds or ActiveSyncBlocke dDeviceI Ds set up with thefollowing cmdlet:


19/21

Nuno is an Exchange MVP workingas a Senior Microsoft Mess agingCons ultant for a UK IT ServicesProvider in London. He specializes inExchange, Lync, Active Directory andPowerShell.

Figure 2-17 : Searching for Personal Exemptions

The new Mobile Device Management functionality of Exchange 2010 is a big step forward. However, with so many new MDM solutions out there, Microsoft should improve this even more.

Maybe the next steps will be an easier way to control what applications can be ins talled on devices or being able to geographically locate a device if a us er reports it as stolen.

If you would like to be notified of when Nuno Mota releases the next part in this article series please sign up to our MSExchange.org Real Time Article Update newsletter (http://www.msexchange.org/pages/newsletter.asp).

If you would like to read the first part in this article series please go to Mobile Device Management (Part 1) (http://www.msexchange.org/articles_tutorials/exchange-server-2010/management-administration/mobile-device-management-part1.html).

Conclusion

See Also

Mobile Device Management (Part 1)(http://w w w .msexchange.org/articles-tutorials/exchange-server- 2010/management-administration/mobile-device-management-part1.html)

Using Exchange Control Panel (ECP) to manage anExchange Organization (Part 4)(http://w w w .msexchange.org/articles-tutorials/exchange-server-2010/management-administration/using-exchange-

control-panel-ecp-manage-exchange-organization-part4.html)

Exchange 2003 Mobile Messaging Part 2 - Uncovering theDevice Security Policies(http://w w w .msexchange.org/articles-tutorials/exchange-server-2003/mobility-client-access/Exchange-2003-Mobile-Messaging-Part2-Uncovering-Device-Security-Policies.html)

Load Balancing Exchange 2010 Client Ac cess Serversusing an Hardw are Load Balancer Solution (Part 1)(http://w w w .msexchange.org/articles-tutorials/exchange-

The Aut hor Nuno Mota

Latest Contributions

Exchange 2013 w ith Rights Management Connector (Part1) (http://w w w .msexchange.org/articles-tutorials/exchange-server-2013/security-message-hygiene/exchange-2013-rights-management-connector-part1.html) on 19 June 2014 (2014-06-19 11:48)

Off ice 365 w ith Internet Explorer 8(http://w w w .msexchange.org/kbase/ExchangeServerTips/MicrosoftOffice365/ExchangeOnline/office-365-internet-explorer-8.html) on 18 June 2014 (2014-06-18 15:49)

Off ice 365 Multi-Factor A uthentication (Part 3)

server-2010/high-availability-recovery/load-balancing- (http://w w w .msexchange.org/articles-tutorials/off ice-
http://www.msexchange.org/articles-tutorials/office-365/exchange-online/office-365-multi-factor-authentication-part3.htmlhttp://www.msexchange.org/kbase/ExchangeServerTips/MicrosoftOffice365/ExchangeOnline/office-365-internet-explorer-8.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2013/security-message-hygiene/exchange-2013-rights-management-connector-part1.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2010/high-availability-recovery/load-balancing-exchange-2010-client-access-servers-using-hardware-load-balancer-solution-part1.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2003/mobility-client-access/Exchange-2003-Mobile-Messaging-Part2-Uncovering-Device-Security-Policies.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2010/management-administration/using-exchange-control-panel-ecp-manage-exchange-organization-part4.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2010/management-administration/mobile-device-management-part1.htmlhttp://www.msexchange.org/articles_tutorials/exchange-server-2010/management-administration/mobile-device-management-part1.htmlhttp://www.msexchange.org/pages/newsletter.asphttp://www.msexchange.org/articles-tutorials/office-365/exchange-online/office-365-multi-factor-authentication-part3.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2010/high-availability-recovery/load-balancing-exchange-2010-client-access-servers-using-hardware-load-balancer-solution-part1.html


20/21

TechGenix Ltd is an online mediacompany which sets the standardfor providing free high qualitytechnical content to ITprofessionals.(http://www.techgenix.com)

Windows Server 2012 / 2008 / 2003 &Windows 8 / 7 networking resource s ite(http://www.windowsnetworking.com/)

Network Security & Information Securityresource for IT administrators(http://www.windowsecurity.com/)

The essential Virtualization resource sitefor adminis trators(http://www.virtualizationadmin.com/)

The No.1 Forefront TMG / UAG and ISAServer res ource site(http://www.isaserver.org/)

Cloud Computing Res ource Site for ITPros(http://www.cloudcomputingadmin.com/)

Networking & Server software / hardwarefor Windows 2003, 2000, NT & Linux(http://www.wservernews.com/)

About Us Advertise With Us Contact Us

exchange-2010-client-access-servers-using-hardware-load-balancer-solution-part1.html)

Designing a Site Resilient Exchange 2010 Solution (Part 1)(http://w w w .msexchange.org/articles-tutorials/exchange-server-2010/high-availability-recovery/designing-site-resilient-exchange-2010-solution-part1.html)


The Garage Series f or Off ice 365: Extending Exchange,Outlook and OWA acr oss platf orms and devices w ith thenew app model(http://w w w .msexchange.org/blogs/patricio/get-news /garage-series-off ice-365-extending-exchange-outlook-and-owa-across-platforms-and-devices-new -app-model.html)


System Center Capacity Planner 2006 Overview (Part 2)(http://w w w .msexchange.org/articles-tutorials/exchange-server-2003/planning-architecture/System-Center-Capacity-Planner-2006-Overview -Part2.html)

Uncovering the new RPC Client Access Service inExchange 2010 (Part 4)(http://w w w .msexchange.org/articles-tutorials/exchange-server- 2010/high-availability-recover y/uncovering-new -rpc-client-access-service-exchange-2010-part4.html)

365/exchange-online/office-365-multi-factor-authentication-part3.html)on 5 June 2014 (2014-06-05 11:55)

Product Review: Netw rix Auditor (http://w w w .msexchange.org/articles-tutorials/product-reviews/product-review -netwrix-auditor.html)on 4 June 2014 (2014-06-04 13:44)

Off ice 365 Multi-Factor A uthentication (Part 2)(http://w w w .msexchange.org/articles-tutorials/off ice-365/exchange-online/office-365-multi-factor-authentication-part2.html)on 22 May 2014 (2014-05-22 11:52)
http://www.msexchange.org/articles-tutorials/office-365/exchange-online/office-365-multi-factor-authentication-part2.htmlhttp://www.msexchange.org/articles-tutorials/product-reviews/product-review-netwrix-auditor.htmlhttp://www.msexchange.org/articles-tutorials/office-365/exchange-online/office-365-multi-factor-authentication-part3.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2010/high-availability-recovery/uncovering-new-rpc-client-access-service-exchange-2010-part4.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2003/planning-architecture/System-Center-Capacity-Planner-2006-Overview-Part2.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2010/high-availability-recovery/designing-site-resilient-exchange-2010-solution-part3.htmlhttp://www.msexchange.org/blogs/patricio/get-news/garage-series-office-365-extending-exchange-outlook-and-owa-across-platforms-and-devices-new-app-model.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2010/high-availability-recovery/designing-site-resilient-exchange-2010-solution-part2.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2010/high-availability-recovery/designing-site-resilient-exchange-2010-solution-part1.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2010/high-availability-recovery/load-balancing-exchange-2010-client-access-servers-using-hardware-load-balancer-solution-part1.htmlhttp://www.msexchange.org/pages/contact-us.htmlhttp://www.techgenix.com/advert/index.htmhttp://www.techgenix.com/aboutus.htmhttp://www.wservernews.com/http://www.cloudcomputingadmin.com/http://www.isaserver.org/http://www.virtualizationadmin.com/http://www.windowsecurity.com/http://www.windowsnetworking.com/http://www.techgenix.com/


21/21

mobile device management (part 2) __ management & administration __ exchange 2010 articles __...

Documents

mobile device management (part 2) management & administration exchange 2010 articles __...