Comments on: Restricting Exchange ActiveSync Access

By: Andreas

Andreas — Fri, 19 Aug 2011 22:26:24 +0000

withanHdammit,

Thanks for the BIS tip!

Yes, the Get/Set-ActiveSyncOrganizationSettings are new to Exchange 2010 – if you’re running 2007 you’re out of luck there.

Pre-existing ActiveSync relationships will be blocked, but you may possible avoid that by manually adding the device id as allowed before you activate a policy. (Don’t remember testing this however.)

By: withanHdammit

withanHdammit — Fri, 19 Aug 2011 19:26:43 +0000

Oh shoot, is this for 2010 only? I don’t have the cmdlets Get-ActiveSyncOrganizationSettings or Set-ActiveSyncOrganizationSettings.

Bummer!

By: withanHdammit

withanHdammit — Fri, 19 Aug 2011 19:21:47 +0000

@Andreas,

What happens if there are pre-existing ActiveSync relationships? Will they get the message that their connection won’t work until it gets approved, or will they be OK because they already exist?

We have 6 or so execs with iPhones and we are planning on rolling out iPhones/Androids in the next 6 to 8 weeks. Right now I have ActiveSync only turned on for people who need it, but I’d like to be able to control what devices can connect.

Thanks!

By: withanHdammit

withanHdammit — Fri, 19 Aug 2011 18:42:56 +0000

@kris you can block the BIS access (which comes through via OWA) by blocking the RIM IP addresses from connecting over port 80 & 443 on the inbound side. Outbound access is fine, it’s because all BIS traffic goes through RIM’s datacenter then goes to your mail server. By blocking inbound traffic from RIM then BIS cannot connect. BTW I have this set on my firewall and have had zero issues.

The current RIM IP range can be found here http://bit.ly/oIqtxJ

By: Andreas

Andreas — Wed, 08 Jun 2011 11:46:50 +0000

Yes, as far as I can tell you can specify an external address. Not sure if this could be overriden by other policies in your Exchange configuration, but this specific cmdlet will let you specify external addresses without any errors, and an outbound mail is created when I attempt to set up a new device (using quarantine as the Access Level).

By: Thin

Thin — Wed, 08 Jun 2011 07:41:51 +0000

When is set up “–AdminMailRecipients admin@contoso.com“, can be specified an external email address?

By: Andreas

Andreas — Wed, 16 Feb 2011 19:23:47 +0000

I’m not a BlackBerry expert (have tried out a couple devices – didn’t like them), but as I remember it BIS access Exchange through POP/IMAP or OWA (not sure if they have implemented Exchange Web Services with 2010). POP/IMAP are easy to disable if you don’t need it, but then you can’t control any other parameters than username/password.

OWA can also be disabled of course, but if you want your users to have access to webmail you usually don’t want this I do not know if BIS connections identify themselves in a manner that would let you block them (I’m thinking something like blocking based on the user agent), but I’d try and run a connection with a device if you have one available and run WireShark on Exchange at the same time to try and see if you catch some parameter that is unique to the BB devices.

By: kris

kris — Tue, 15 Feb 2011 22:19:18 +0000

Is it possible to block Blackberry BIS accounts from accessing Exchange 2010…..please?

Thanx!

By: Andreas

Andreas — Sun, 18 Jul 2010 09:45:35 +0000

This setting only controls what is synced down by default when a new mail arrives. For instance the default is 3kb which means only 3kb will be downloaded if you receive a 10kb mail. But you can open the mail and select that you want to download the rest as well. The theory behind the setting behind that if you receive a large html-formatted mail you will not bother to download it all, and thus save on the data traffic. So while you can save on the data download for your users you still can’t prevent them from reading emails in general.

By: V detta

V detta — Wed, 14 Jul 2010 14:32:03 +0000

Hi there,

great post!

To answer Swift question about limiting to calendar and contacts only during allowed device active sync, I was wondering (since I didn’t test it) as a workaround, to set the value of this Exchange 2010 ActiveSync policy “Maximum e-mail body truncation size” to 0 (it is in kb). It would allow you to sync emails but maybe only subjects which is closer to what we want there.

So, Andreas, if you have tested this, can you please share the results?

thanks!!