Because sensitive data might be stored on a user’s mobile device with Exchange ActiveSync, several safeguards are in place to prevent unauthorized access to this data. The first safeguard is a device password, which can be reset remotely by the user or by an administrator. The second safeguard is a remote wipe feature that remotely instructs a mobile device to delete all its Exchange and corporate data. A third safeguard is a data encryption requirement, which can be enabled and enforced.

When you install Exchange 2013 or use Exchange Online, Exchange ActiveSync and Outlook Web App for Devices are automatically configured for use, which makes these features easy to manage. However, there are still some essential concepts you should know to manage them more effectively. This section explains these concepts.

Exchange ActiveSync allows users with smartphones and other mobile devices to initiate synchronization with Exchange to keep their data up to date and receive notices from Exchange that trigger synchronization through the Direct Push feature. Direct Push is a key feature about which you probably want to know a bit more. It works like this:

After synchronization, users can then access their data while they are offline. In Exchange 2013, Direct Push is either enabled or disabled as is Exchange ActiveSync itself. Because Direct Push uses HTTPS, TCP port 443 must be open on your firewall between the Internet and the Client Access server to which the user is connecting.

With Exchange Online, Exchange ActiveSync and Outlook Web App for Devices are enabled by default and you cannot change this setting. With Exchange 2013, Exchange ActiveSync is enabled for each user by default, but you can disable Exchange ActiveSync for specific users as necessary.

To disable Exchange ActiveSync for specific users, follow these steps:

To define organization-wide security and authentication options, you can use mobile device mailbox policies. When you install Exchange 2013 or use Exchange Online, a default mobile device mailbox policy is created. Through mobile device mailbox policy settings, you can precisely control mobile browsing capabilities for all users in the enterprise, including the following:

Although you configure many mobile device settings in Exchange Admin Center, you will need to use Exchange Admin Shell to fully customize mobile device options.

Two additional technologies you can use for mobile access are remote mail and Outlook Anywhere. These technologies require extra configuration for both Outlook clients and Exchange servers. This section discusses Outlook client configuration. See Chapter 6 for a discussion of Exchange server configuration.

Beginning with Outlook 2013 and Exchange Server 2013, Microsoft is moving away from remote mail. Previously, with remote mail you could configure Outlook to connect to Exchange Server using a dial-up connection to your organization’s modem bank. Remote mail was useful in the following scenarios:

Remote mail is being replaced by Outlook Anywhere, which is a technology that allows users to access Exchange Server over the Internet using Outlook. In current Outlook clients, Outlook Anywhere is the default access technology. With Outlook Anywhere, you don’t need to use a virtual private network (VPN) to securely connect Outlook to Exchange Server. Instead of relying on VPN for security, Outlook Anywhere takes advantage of standard Internet security features to ensure that communications are secure.

Outlook Anywhere is a dynamic communication protocol for remotely accessing Exchange Server using RPC over HTTP, with or without SSL encryption: With RPC over HTTP, remote procedure calls (RPCs) are nested within HTTP packets, which can either be encrypted or not encrypted with SSL, and then transmitted. By adding encryption to either technique, you help ensure that data transmitted between Outlook and Exchange Server is protected. Secure communication with SSL is the default configuration for Outlook Anywhere.

Outlook Anywhere is particularly useful in these scenarios:

Dial-up users can also use Outlook Anywhere. In this case, the users connect to the Internet by using their dial-up connection and then connect to Exchange using Outlook Anywhere.

Enabling Outlook Anywhere requires separate client and server configurations. You work with Outlook Anywhere by following the procedures discussed in the Managing Outlook Anywhere section of Chapter 6. Although Outlook 2013 or later should use Outlook Anywhere by default, Outlook 2007 and Outlook 2010 do not.

You can configure Outlook to use Outlook Anywhere by completing the following steps:

The Autodiscover service simplifies the provisioning process for mobile devices and for Outlook 2007 and later clients by returning the required Exchange settings after a user enters his or her email address and password. This provisioning eliminates the need to configure mobile carriers in Exchange Server, in addition to the need to download and install the carriers list on mobile devices.

Get-AutodiscoverVirtualDirectory -Server MyServer | fl

Get-AutodiscoverVirtualDirectory -ShowMailboxVirtualDirectories | fl

Remove-AutodiscoverVirtualDirectory -Identity ServerNameDirName
(WebSiteName)

Remove-AutodiscoverVirtualDirectory –Identity
"CorpMailSvr25Autodiscover (Default Web Site)"

New-AutodiscoverVirtualDirectory -Identity -Identity "CorpMailSvr25Autodiscover (Default Web Site)"

Syntax
Get-AutodiscoverVirtualDirectory [-Server ServerName | -Identity VirtualDirID]
[-ADPropertiesOnly <$true | $false>] [-DomainController DCName]
[-ShowMailboxVirtualDirectories <$true | $false>]

Usage
Get-AutodiscoverVirtualDirectory
-Identity "CorpMailSvr25Autodiscover (Default Web Site)"

Syntax
New-AutodiscoverVirtualDirectory [-ApplicationRoot RootPath]
[-AppPoolId AppPoolIdentity] [-BasicAuthentication <$true | $false>]
[-DigestAuthentication <$true | $false>] [-DomainController DCName]
[-ExternalURL ExternalURL] [-InternalURL InternalURL]
[-OAuthAuthentication <$true | $false>]
[-Path FileSystemPath] [-Role <ClientAccess | Mailbox>]
[-Server ServerName] [-WebSiteName WebSiteName]
[-WindowsAuthentication <$true | $false>]
[-WSSecurityAuthentication <$true | $false>]

Usage
New-AutodiscoverVirtualDirectory -WebSiteName "Default Web Site"
-BasicAuthentication $true –WindowsAuthentication $true
-OAuthAuthentication $true –WSSecurityAuthentication $true
New-AutodiscoverVirtualDirectory -WebSiteName "Exchange Back End"
-BasicAuthentication $true –WindowsAuthentication $true
-OAuthAuthentication $true –WSSecurityAuthentication $true
-Role Mailbox

Syntax
Set-AutodiscoverVirtualDirectory -Identity DirectoryIdentity
[-BasicAuthentication <$true | $false>]
[-DigestAuthentication <$true | $false>]
[-DomainController DCName]
[-ExternalURL ExternalURL] [-InternalURL InternalURL]
[-LiveIdBasicAuthentication <$true | $false>]
[-LiveIdNegotiateAuthentication <$true | $false>]
[-OAuthAuthentication <$true | $false>]
[-WindowsAuthentication <$true | $false>]
[-WSSecurityAuthentication <$true | $false>]

Usage
Set-AutodiscoverVirtualDirectory
-Identity "CorpMailSvr25Autodiscover(Default Web Site)"
-BasicAuthentication $false -DigestAuthentication $false
 –WindowsAuthentication $true

Syntax
Remove-AutodiscoverVirtualDirectory -Identity DirectoryIdentity
[-DomainController DCName]

Usage
Remove-AutodiscoverVirtualDirectory
-Identity "CorpMailSvr25Autodiscover (Default Web Site)"

Direct Push automates the synchronization process, enabling a mobile device to make requests to keep itself up to date. When the website used with Exchange ActiveSync has SSL enabled, Direct Push allows a mobile device to issue long-lived Hypertext Transfer Protocol Secure (HTTPS) monitoring requests to Exchange Server. Exchange Server monitors activity in the related user’s mailbox. If new mail arrives or other changes are made to the mailbox—such as modifications to calendar or contact items—Exchange sends a response to the mobile device, stating that changes have occurred and that the device should initiate synchronization with Exchange Server. The device then issues a synchronization request. When synchronization is complete, the device issues another long-lived HTTPS monitoring request.

Port 443 is the default TCP port used with SSL. For Direct Push to work, port 443 must be opened between the Internet and the organization’s Internet-facing Client Access server or servers. You do not need to open port 443 on your external firewalls to all of your Client Access servers—only those to which users can establish connections. The Client Access server receiving the request automatically proxies the request so that it can be handled appropriately. If necessary, this can also mean proxying requests between the mobile device and the Client Access server in the user’s home site. A user’s home site is the Active Directory site in which the mailbox server hosting his or her mailbox is located.

Although passwords help to protect mobile devices, they don’t prevent access to the device. You can protect the data on mobile devices in several ways. One such way is to apply a mobile device mailbox policy that controls access to the device and encrypts its content. Another way is to have a strict policy that requires users and administrators to remotely wipe lost or stolen devices. A remote device wipe command instructs a mobile device to delete all Exchange and corporate data.

Syntax
Get-MobileDevice [-Identity MobileDeviceId] {AddtlParams}
Get-MobileDevice -Mailbox MailboxId {AddtlParams}
{AddtlParams}
[-ActiveSync <$true | $false>] [-DomainController FullyQualifiedName]
[-Filter FilterValues] [-Monitoring <$true | $false>]
[-Organization OrgId] [-OrganizationalUnit OUId]
[-OWAforDevices <$true | $false>] [-ResultSize Size]
[-SortBy AttributeName]

Usage
Get-MobileDevice -OrganizationalUnit Sales

Syntax
Get-MobileDeviceStatistics -Identity MobileDeviceId {AddtlParams}
Get-MobileDeviceStatistics -Mailbox MailboxId {AddtlParams}
{AddtlParams}
[-ActiveSync <$true | $false>] [-DomainController FullyQualifiedName]
[-GetMailboxLog <$true | $false>] [-NotificationEmailAddresses
email1,email2,...emailN] [-OWAMobileApp <$true | $false>]
[-ShowRecoveryPassword <$true | $false>]

Usage
Get-MobileDeviceStatistics –Mailbox "David Pelton"

Syntax
Clear-MobileDevice -Identity MobileDeviceId
[-Cancel <$true | $false>] [-DomainController FullyQualifiedName]
[-NotificationEmailAddresses email1,email2,...emailN]

Usage
Clear-MobileDevice –Identity "Mobile_DavidP"
Clear-MobileDevice –Identity "Mobile_DavidP" –Cancel $true

Users can create passwords for their mobile devices. If a user forgets his password, you can obtain a recovery password that unlocks the device and lets the user create a new password. The user can also recover his device password by using Outlook Web App.

To use Outlook Web App to recover a user’s device password, complete the following steps:

You also can display the device recovery password by completing the following steps:

In the Exchange Management Shell, you can display the device recovery password by using the –ShowRecoveryPassword parameter of the Get-MobileDeviceStatistics cmdlet. Recovering a device password provides the syntax and usage.

Syntax
Get-MobileDeviceStatistics -Mailbox MailboxIdentity
 -ShowRecoveryPassword $true {AddtlParams}
Get-MobileDeviceStatistics -Identity MobileDeviceIdentity 
 -ShowRecoveryPassword $true {AddtlParams}
{AddtlParams}
[-ActiveSync <$true | $false>] [-DomainController FullyQualifiedName]
[-GetMailboxLog <$true | $false>] [-NotificationEmailAddresses
email1,email2,...emailN] [-OWAforDevices <$true | $false>]

Usage
Get-MobileDeviceStatistics -Mailbox "[email protected]"
 -ShowRecoveryPassword $true

By default, Exchange Server 2013 allows users to access files directly through Outlook, Outlook Web App, and related services. This means that users will be able to access files attached to email messages. You can configure how users interact with files by using one of three options in the Exchange Admin Center:

Table 7-1 lists the file extensions and Multipurpose Internet Mail Extensions (MIME) values that Exchange Server allows, blocks, or sets to force save by default. These settings are applied to the Outlook Web Access (OWA) virtual directory on Client Access servers. If a server has multiple OWA virtual directories or you have multiple Client Access servers, you must configure each directory and server separately.

Exchange Server considers all file extensions and MIME types not listed on the allow, block, or force save list to be unknown files and file types. The default setting for unknown file types is force save.

Based on the user’s selection, the configuration of her network settings, or both, Exchange divides all client connections into one of two classes:

For each Client Access server, you can enable or disable direct access to files separately for public computers and private computers. However, the allow, block, and force save settings for both types of computers are shared and applied to both public and private computers in the same way.

You can configure direct file access on front-end virtual directories by completing the following steps:

In the Exchange Management Shell, you can use the Set-OWAVirtualDirectory cmdlet to manage the direct file-access configuration. Use the –Identity parameter to identify the virtual directory with which you want to work, such as:

Set-OWAVirtualDirectory –Identity "Corpsvr127owa (Default Web Site)"

Then specify how you want to configure direct file access on the front-end and back-end virtual directory, such as:

Set-OWAVirtualDirectory –Identity "Corpsvr127owa (Default Web Site)"
 –DirectFileAccessOnPublicComputersEnabled $false
 –DirectFileAccessOnPrivateComputersEnabled $true
Set-OWAVirtualDirectory –Identity "Corpsvr127owa (Exchange Back End)"
 –DirectFileAccessOnPublicComputersEnabled $false
 –DirectFileAccessOnPrivateComputersEnabled $true

If you are unsure of the virtual directory identity value, use the Get-OWAVirtualDirectory cmdlet to retrieve a list of available virtual directories on a named server, as shown in the following example:

Get-OWAVirtualDirectory –Server "Corpsvr127" -ShowMailboxVirtualDirectories

Alternatively, you could get the OWAVirtualDirectory object for both the front end and back end and then set the desired options on both as shown in the following example:

Get-OWAVirtualDirectory –Server Corpsvr127 -ShowMailboxVirtualDirectories |
Set-OWAVirtualDirectory –DirectFileAccessOnPublicComputersEnabled $false
 –DirectFileAccessOnPrivateComputersEnabled $true

Although the server in this example has both the Client Access Server role and the Mailbox Server role installed, you could just as easily apply the changes to front-end and back-end Exchange servers throughout the organization. If you want to make changes across all servers, however, I recommend adding the -Whatif parameter to ensure the command is going to work exactly as expected before executing the command a second time without the -Whatif parameter. In the following example, you disable direct file access on public computers on all front-end and back-end OWA virtual directories:

Get-OWAVirtualDirectory -ShowMailboxVirtualDirectories |
Set-OWAVirtualDirectory –DirectFileAccessOnPublicComputersEnabled $false
-WhatIf

You configure allowed file types and allowed MIME types by using the -AllowedFileTypes and -AllowedMIMETypes parameters respectively. As these are multivalued properties, you must either enter the complete set of allowed values or use a special shorthand to insert into or remove values from these multivalued properties. The shorthand for adding values is:

@{Add="<ValuetoAdd1>","<ValuetoAdd2>"...}

Because you’ll typically want to configure the front-end and back-end virtual directories in the same way, the following example sets the allowed file types on both the front-end and back-end OWA virtual directories:

Get-OWAVirtualDirectory –Server Corpsvr127 -ShowMailboxVirtualDirectories |
Set-OWAVirtualDirectory –AllowedFileTypes @{Add=".log",".man"}

In this case, the server has both the Client Access Server role and the Mailbox Server role installed. The shorthand for removing values is:

@{Remove="<ValuetoRemove1>","<ValuetoRemove2>"...}

The following is an example:

Get-OWAVirtualDirectory –Server Corpsvr127 -ShowMailboxVirtualDirectories |
Set-OWAVirtualDirectory –AllowedFileTypes @{Remove=".log",".man"}

If you want to add values and remove others, you can do this as well by using the following shorthand:

@{Add="<ValuetoAdd1>","<ValuetoAdd2>"...;
Remove="<ValuetoRemove1>","<ValuetoRemove1>"...}

You can confirm that values were added or removed as expected by using Get-OWAVirtualDirectory. Because there are so many allowed file types, you won’t get a complete list of file types if you examine the -AllowedFileTypes property as shown in the following example:

Get-OWAVirtualDirectory –Identity "Corpsvr127owa (Default Web Site)" |
fl name, allowedfiletypes

A workaround to examine all the values of such a property follows:

$vdir = Get-OWAVirtualDirectory –Identity "Corpsvr127owa (Default Web
Site)"
$data = $vdir.allowedfiletypes
$data | fl *

In this case, you store the virtual directory object in the $vdir variable. Next, you store the values associated with this object’s AllowedFileTypes parameter in the $data variable. Finally, you list each allowed file type.

You can use similar techniques to work with

By default, Exchange Server 2013 allows users to access files remotely through Outlook Web App (OWA). This means users will be able to access Windows SharePoint Services and Universal Naming Convention (UNC) file shares on SharePoint sites. SharePoint sites consist of Web Parts and Windows ASP.NET–based components that allow users to share documents, tasks, contacts, events, and other information. When you configure UNC file shares on SharePoint sites, you enable users to share folders and files.

You configure remote file access by using configuration options for the ActiveSync virtual directory. The -RemoteDocumentsBlockedServers and -RemoteDocumentsAllowedServers parameters of the Set-ActiveSyncVirtualDirectory cmdlet specify the host names of servers from which clients are denied or allowed access respectively. If there is a conflict between the blocked servers list and the allowed servers list, the block list takes precedence.

Because the -RemoteDocumentsBlockedServers and -RemoteDocumentsAllowedServers parameters are multivalued properties, you must either enter the complete set of allowed values or use the special shorthand discussed earlier in this chapter in the Configuring direct file access section to insert into or remove values from these multivalued properties. To add a server to the blocked or allowed servers list, use the fully qualified domain name of the server, such as mailsvr83.cpandl.com.

The following example adds two servers to the allowed servers list throughout the Exchange organization:

Get-ActiveSyncVirtualDirectory -ShowMailboxVirtualDirectories |
Set-OWAVirtualDirectory –RemoteDocumentsAllowedServers
@{Add="mailsvr83.cpandl.com","corpserver18.treyresearch.net"}

Servers that are not listed on either the allow list or the block list are considered to be unknown servers. By default, access to unknown servers is allowed. You can use the -RemoteDocumentsActionForUnknownServers parameter to specify whether to allow or block unknown servers. Set the parameter value to Allow or Block as appropriate. Here is an example:

Get-ActiveSyncVirtualDirectory -ShowMailboxVirtualDirectories |
Set-OWAVirtualDirectory -RemoteDocumentsActionForUnknownServers Block

Users have access only to shares hosted on internal servers. For a server to be considered an internal server, you must tell Exchange about the domain suffixes that should be handled as internal by using the -RemoteDocumentsInternalDomainSuffixList parameter. This is a multivalued parameter.

To add a domain suffix, specify the fully qualified domain name of the suffix. An example follows:

Get-ActiveSyncVirtualDirectory -ShowMailboxVirtualDirectories |
Set-OWAVirtualDirectory -RemoteDocumentsInternalDomainSuffixList
@{Add="cpandl.com","treyresearch.net"}

To remove a domain suffix, specify the suffix to remove, such as:

Get-ActiveSyncVirtualDirectory -ShowMailboxVirtualDirectories |
Set-OWAVirtualDirectory -RemoteDocumentsInternalDomainSuffixList
@{Remove="proseware.com","litwareinc.com"}

WebReady Document Viewing allows users to view common file types in Outlook Web App without having the applications associated with those file types installed on their computer. WebReady Document Viewing allows users to view the following files:

For attachments, the following related MIME types are supported, in addition to related open XML formats for presentations, spreadsheets, and word processing documents:

When there are conflicting settings between the direct file, remote file, and WebReady Document Viewing settings, you can force clients to use WebReady Document Viewing first, if you want. This means that the documents will be opened within a client browser rather than in a related application, such as Word.

You can enable or disable WebReady Document Viewing separately for public computers and private computers. However, supported document settings for both types of computers are shared and applied to both public and private computers in the same way.

To configure WebReady Document Viewing and direct file access, complete the following steps:

In the Exchange Management Shell, you can use the Set-OWAVirtualDirectory cmdlet to manage the WebReady Document Viewing configuration. Use the –Identity parameter to identify the virtual directory you want to work, such as:

Set-OWAVirtualDirectory –Identity "Corpsvr127owa (Default Web Site)"

Then specify how you want to configure WebReady Document Viewing on the front-end and back-end virtual directory, such as:

Set-OWAVirtualDirectory –Identity "Corpsvr127owa (Default Web Site)"
 -WebReadyDocumentViewingOnPublicComputersEnabled $false
 -WebReadyDocumentViewingOnPrivateComputersEnabled $true
 -WebReadyDocumentViewingForAllSupportedTypes $true
Set-OWAVirtualDirectory –Identity "Corpsvr127owa (Exchange Back End)"
 -WebReadyDocumentViewingOnPublicComputersEnabled $false
 -WebReadyDocumentViewingOnPrivateComputersEnabled $true
 -WebReadyDocumentViewingForAllSupportedTypes $true

If you are unsure of the virtual directory identity value, use the Get-OWAVirtualDirectory cmdlet to retrieve a list of available virtual directories on a named server, as shown in the following example:

Get-OWAVirtualDirectory –Server "Corpsvr127" -ShowMailboxVirtualDirectories

When working with Set-OWAVirtualDirectory, you configure WebReady file types and WebReady MIME types by using the -WebReadyFileTypes and -WebReadyMime- Types parameters respectively. Because these are multivalued properties, you must either enter the complete set of allowed values or use a special shorthand to insert into or remove values from these multivalued properties. Typically, you’ll want to configure the front-end and back-end virtual directories in the same way.

When the Client Access server role is installed on an Exchange server, the setup process creates a default mobile device mailbox policy, which allows ActiveSync to be used without restrictions or password requirements. All users with mailboxes have this policy applied by default. You can modify the settings of this policy to change the settings for all users or create new policies for specific groups of users.

In the Exchange Admin Center, you can view the currently configured mobile device mailbox policies by selecting Mobile in the Feature pane, and then selecting Mobile Device Mailbox Policies. In the details pane, you’ll see a list of current policies.

In the Exchange Management Shell, you can list policies by using the Get-MobileDeviceMailboxPolicy cmdlet. Get-MobileDeviceMailboxPolicy cmdlet syntax and usage provides the syntax, usage, and sample output. If you do not provide an identity with this cmdlet, all available mobile device mailbox policies are listed. All devices running Windows Phone 8, Windows 8 RT, Windows 8.1 and later have device encryption that is enabled by default.

Syntax
Get-MobileDeviceMailboxPolicy [-Identity MailboxPolicyId]
[-DomainController FullyQualifiedName] [-Organization OrgId]

Usage
Get-MobileDeviceMailboxPolicy
Get-MobileDeviceMailboxPolicy
-Identity "Primary Mobile Device Mailbox Policy"

Output
RunspaceId                               :
AllowNonProvisionableDevices             : True
AlphanumericPasswordRequired             : False
AttachmentsEnabled                       : True
DeviceEncryptionEnabled                  : False
RequireStorageCardEncryption             : False
PasswordEnabled                          : False
PasswordRecoveryEnabled                  : False
DevicePolicyRefreshInterval              : Unlimited
AllowSimplePassword                      : True
MaxAttachmentSize                        : Unlimited
WSSAccessEnabled                         : True
UNCAccessEnabled                         : True
MinPasswordLength                        :
MaxInactivityTimeLock                    : Unlimited
MaxPasswordFailedAttempts                : Unlimited
PasswordExpiration                       : Unlimited
PasswordHistory                          : 0
IsDefault                                : True
AllowApplePushNotifications              : True
AllowMicrosoftPushNotification           : True
AllowStorageCard                         : True
AllowCamera                              : True
RequireDeviceEncryption                  : False
AllowUnsignedApplications                : True
AllowUnsignedInstallationPackages        : True
AllowWiFi                                : True
AllowTextMessaging                       : True
AllowPOPIMAPEmail                        : True
AllowIrDA                                : True
RequireManualSyncWhenRoaming             : False
AllowDesktopSync                         : True
AllowHTMLEmail                           : True
RequireSignedSMIMEMessages               : False
RequireEncryptedSMIMEMessages            : False
AllowSMIMESoftCerts                      : True
AllowBrowser                             : True
AllowConsumerEmail                       : True
AllowRemoteDesktop                       : True
AllowInternetSharing                     : True
AllowBluetooth                           : Allow
MaxCalendarAgeFilter                     : All
MaxEmailAgeFilter                        : All
RequireSignedSMIMEAlgorithm              : SHA1
RequireEncryptionSMIMEAlgorithm          : TripleDES
AllowSMIMEEncryptionAlgorithmNegotiation : AllowAnyAlgorithmNegotiation
MinPasswordComplexCharacters             : 1
MaxEmailBodyTruncationSize               : Unlimited
MaxEmailHTMLBodyTruncationSize           : Unlimited
UnapprovedInROMApplicationList           : {}
ApprovedApplicationList                  : {}
AllowExternalDeviceManagement            : False
MobileOTAUpdateMode                      : MinorVersionUpdates
AllowMobileOTAUpdate                     : True
IrmEnabled                               : True
AdminDisplayName                         :
ExchangeVersion                          : 0.1 (8.0.535.0)
Name                                     : Default
DistinguishedName                        : CN=Default,CN=Mobile Mailbox
Policies,CN=First Organization,CN=Microsoft
Exchange,CN=Services,CN=Configuration,DC=pocket-consultant,DC=com
Identity                                 : Default
Guid                                     :
ObjectCategory                           : pocket-consultant.com/Configuration/Schema/ms-Exch-Mobile-Mailbox-Policy
ObjectClass                              : {top, msExchRecipientTemplate, msExchMobileMailboxPolicy}
WhenChanged                              : 11/4/2014 10:02:34 PM
WhenCreated                              : 11/4/2014 10:02:34 PM
WhenChangedUTC                           : 11/5/2014 5:02:34 AM
WhenCreatedUTC                           : 11/5/2014 5:02:34 AM
OrganizationId                           :
OriginatingServer                        : CorpServer27.
pocket-consultant.com
IsValid                                  : True
ObjectState                              : Unchanged

The mobile device mailbox policies you create apply to your entire organization. You apply policies separately after you create them, as discussed later in this chapter in the Assigning mobile device mailbox policies section.

You can create a new policy by completing the following steps:

In the Exchange Management Shell, you can create new mobile device mailbox policies by using the New-MobileDeviceMailboxPolicy cmdlet. New-MobileDeviceMailboxPolicy cmdlet syntax and usage provides the syntax and usage. There are additional policy settings you can access in the shell that you cannot access in the Exchange Admin Center.

Syntax
New-MobileDeviceMailboxPolicy -Name PolicyName
[-AllowBluetooth <Disable | HandsfreeOnly | Allow>]
[-AllowSMIMEEncryptionAlgorithmNegotiation <BlockNegotiation |
OnlyStrongAlgorithmNegotiation | AllowAnyAlgorithmNegotiation>]
[-ApprovedApplicationList AppList] [-DevicePolicyRefreshInterval
Interval] [-DomainController FullyQualifiedName]
[-MaxAttachmentSize MaxSizeKB] [-MaxCalendarAgeFilter <All | TwoWeeks |
OneMonth | ThreeMonths | SixMonths>] [-MaxEmailAgeFilter <All |
OneDay | ThreeDays | OneWeek | TwoWeeks | OneMonth>]
[-MaxEmailBodyTruncationSize MaxSizeKB]
[-MaxEmailHTMLBodyTruncationSize MaxSizeKB] [-MaxInactivityTimeLock
InactiveTime] [-MaxPasswordFailedAttempts NumAttempts]
[-MinPasswordComplexCharacters MinComplexChars] [-MinPasswordLength
MinLength] [-MobileOTAUpdateMode <MajorVersionUpdates |
MinorVersionUpdates | BetaVersionUpdates>] [-Organization
OrgId] [-PasswordExpiration PasswordExp] [-PasswordHistory HistLength]
[-RequireEncryptionSMIMEAlgorithm <TripleDES | DES | RC2128bit |
RC264bit | RC240bit>] [-RequireSignedSMIMEAlgorithm <SHA1 | MD5>]
[-UnapprovedInROMApplicationList AppList] {OptionalTrueFalseParams}
{OptionalTrueFalseParams}
-AllowBrowser, -AllowCamera, -AllowConsumerEmail, -AllowDesktopSync,
-AllowExternalDeviceManagement, -AllowHTMLEmail, -AllowInternetSharing,
-AllowIrDA, -AllowMicrosoftPushNotifications, -AllowMobileOTAUpdate,
-AllowNonProvisionableDevices, -AllowPOPIMAPEmail,
-AllowRemoteDesktop, -AllowSimplePassword, -AllowSMIMESoftCerts,
-AllowStorageCard, -AllowTextMessaging, -AllowUnsignedApplications,
-AllowUnsignedInstallationPackages, -AllowWiFi,
-AlphanumericPasswordRequired, -AttachmentsEnabled,
-DeviceEncryptionEnabled, -IrmEnabled, -IsDefault, -PasswordEnabled,
-PasswordRecoveryEnabled, -RequireDeviceEncryption,
-RequireEncryptedSMIMEMessages, -RequireManualSyncWhenRoaming,
-RequireSignedSMIMEMessages, -RequireStorageCardEncryption,
-UNCAccessEnabled, -WSSAccessEnabled

Usage
New-MobileDeviceMailboxPolicy -Name "Primary Mobile Device Mailbox Policy"
 -AllowNonProvisionableDevices $true
 -PasswordEnabled $true
 -AlphanumericPasswordRequired $true
 -MaxInactivityTimeLock "00.15:00"
 -MinPasswordLength "8"
 -PasswordRecoveryEnabled $true
 -RequireDeviceEncryption $true
 -AttachmentsEnabled $true

When you create a mobile device mailbox policy, some additional settings are configured automatically. You can modify policy settings by using the Set-MobileDeviceMailboxPolicy cmdlet. By default, access to both Windows file shares and Microsoft Windows SharePoint Services is allowed. You can block access to file shares and SharePoint by setting the -UNCAccessEnabled and -WSSAccessEnabled parameters to $false.

If you specified that passwords are required, by default, simple passwords are not allowed. Additionally, by default, many device features are allowed. By using the TrueFalseParams shown in Set-MobileDeviceMailboxPolicy cmdlet syntax and usage, you can:

You can specify the maximum allowed size for email messages by using -MaxEmailBodyTruncationSize and -MaxEmailHTMLBodyTruncationSize. Both parameter values are set in kilobytes. If a standard email message exceeds the MaxEmailBodyTruncationSize value, the message is truncated (clipped). If an HTML-formatted email message exceeds the MaxEmailHTMLBodyTruncationSize, the message is truncated (clipped).

If the policy allows devices to download attachments, the attachment has no default limit size. You can block attachment downloads by setting -AttachmentsEnabled to $false. If you allow attachments and you want to limit the size of attachments that users can download, you can specify the maximum allowed attachment size in kilobytes by using -MaxAttachmentSize.

For past calendar and email items, you can use the -MaxCalendarAgeFilter and -MaxEmailAgeFilter parameters respectively to specify whether all calendar and mail items should be synced or only items from a specific period of time, such as the last two weeks. If you allow Bluetooth, you also can specify how the device can use Bluetooth. To allow the device to use Bluetooth in any mode, set -AllowBlueTooth to Allow. To allow the device to use Bluetooth only in hands-free mode, set -AllowBlueTooth to HandsfreeOnly. To prevent the device from using Bluetooth, set -AllowBlueTooth to Disable.

Syntax
Set-MobileDeviceMailboxPolicy -Identity MailboxPolicyId
[-AllowBluetooth <Disable | HandsfreeOnly | Allow>]
[-AllowSMIMEEncryptionAlgorithmNegotiation <BlockNegotiation |
OnlyStrongAlgorithmNegotiation | AllowAnyAlgorithmNegotiation>]
[-ApprovedApplicationList AppList] [-DevicePolicyRefreshInterval
Interval] [-DomainController FullyQualifiedName]
[-MaxAttachmentSize MaxSizeKB] [-MaxCalendarAgeFilter <All | TwoWeeks |
OneMonth | ThreeMonths | SixMonths>] [-MaxEmailAgeFilter <All |
OneDay | ThreeDays | OneWeek | TwoWeeks | OneMonth>]
[-MaxEmailBodyTruncationSize MaxSizeKB]
[-MaxEmailHTMLBodyTruncationSize MaxSizeKB] [-MaxInactivityTimeLock
InactiveTime] [-MaxPasswordFailedAttempts NumAttempts]
[-MinPasswordComplexCharacters MinComplexChars] [-MinPasswordLength
MinLength] [-MobileOTAUpdateMode <MajorVersionUpdates |
MinorVersionUpdates | BetaVersionUpdates>] [-Organization
OrgId] [-PasswordExpiration PasswordExp] [-PasswordHistory HistLength]
[-RequireEncryptionSMIMEAlgorithm <TripleDES | DES | RC2128bit |
RC264bit | RC240bit>] [-RequireSignedSMIMEAlgorithm <SHA1 | MD5>]
[-UnapprovedInROMApplicationList AppList] {OptionalTrueFalseParams}
{OptionalTrueFalseParams}
-AllowBrowser, -AllowCamera, -AllowConsumerEmail,
-AllowDesktopSync, -AllowExternalDeviceManagement, -AllowHTMLEmail,
-AllowInternetSharing, -AllowIrDA, -AllowMicrosoftPushNotifications,
-AllowMobileOTAUpdate, -AllowNonProvisionableDevices, -AllowPOPIMAPEmail,
-AllowRemoteDesktop, -AllowSimplePassword, -AllowSMIMESoftCerts,
-AllowStorageCard, -AllowTextMessaging, -AllowUnsignedApplications,
-AllowUnsignedInstallationPackages, -AllowWiFi,
-AlphanumericPasswordRequired, -AttachmentsEnabled,
-DeviceEncryptionEnabled, -IrmEnabled, -IsDefault, -PasswordEnabled,
-PasswordRecoveryEnabled, -RequireDeviceEncryption,
-RequireEncryptedSMIMEMessages, -RequireManualSyncWhenRoaming,
-RequireSignedSMIMEMessages, -RequireStorageCardEncryption,
-UNCAccessEnabled, -WSSAccessEnabled

Usage
Set-MobileDeviceMailboxPolicy -Identity "Device Policy for Executives"
-AllowNonProvisionableDevices $false -AllowBluetooth HandsfreeOnly
-DeviceEncryptionEnabled $true -PasswordRecoveryEnabled $true
-RequireDeviceEncryption $true -MaxAttachmentSize 5096
-MaxEmailBodyTruncationSize 10192 -MaxEmailHTMLBodyTruncationSize 10192

Mailbox servers automatically apply the default mobile device mailbox policy through implicit inheritance unless you assign a different non-default policy to a user. Any mailbox that has implicitly inherited policy automatically applies the current default policy and its settings. When you modify the default policy or configure a new default policy, you change the settings for all mailbox users that implicitly inherit the default policy.

To set a different policy as the default for new mailbox users, follow these steps:

To explicitly assign a policy to a mailbox, complete the following steps:

To explicitly assign a policy to multiple mailboxes, complete the following steps:

If you want mailbox users to use a mobile device mailbox policy other than the default, you can assign a policy directly to mailboxes by using the –ActiveSyncMailboxPolicy parameter of the Set-CASMailbox cmdlet. Assigning a Mobile Device Mailbox Policy to mailboxes provides the syntax and usage.

Syntax
Set-CASMailbox –Identity MailboxIdentity
 -ActiveSyncMailboxPolicy PolicyIdentity

Apply the policy to the mailbox user named MarkH
Set-CASMailbox –Identity "[email protected]"
 -ActiveSyncMailboxPolicy "Device Policy for Executives"

Apply the policy to every mailbox in the Exchange organization
Get-Mailbox -ResultSize Unlimited | Set-CASMailbox
-ActiveSyncMailboxPolicy "Device Policy for Executives"

Apply the policy to every mailbox in the Sales database
Get-MailboxDatabase "Sales" | Get-Mailbox -ResultSize Unlimited |
Set-CASMailbox -ActiveSyncMailboxPolicy "Device Policy for Executives"

Apply the policy to all mailboxes in every mailbox database on MailboxServer18
Get-Mailbox -Server MailboxServer18 -ResultSize Unlimited |
Set-CASMailbox -ActiveSyncMailboxPolicy "Device Policy for Executives"

When you no longer need a mobile device mailbox policy, you can remove it, provided that it isn’t the current default policy. In the Exchange Admin Center, select the policy, and then select the Delete button. When prompted to confirm, tap or click Yes to delete the policy. If users are assigned to the policy, they will stop using the policy and implicitly inherit the current default policy.

In the Exchange Management Shell, you can remove a mobile device mailbox policy by using the Remove-MobileMailboxPolicy cmdlet. Remove-MobileMailboxPolicy cmdlet syntax and usage provides the syntax and usage.

Syntax
Remove-MobileMailboxPolicy –Identity Name [-DomainController DCName]
[-Force <$true | $false>]

Usage
Remove-MobileMailboxPolicy -Identity "Primary ActiveSync
Mailbox Policy"