Exchange 2010 Activesync questions - remote wipe terminated user

Hello All,
Looking for some suggestions about how to send a wipe (Clear) instruction to mobile device(s) of a user upon termination if they do not go by IT to have access removed 'gently'.
The issue is that while we WANT to wipe the phone we HAVE to remove their network access by disabling their AD account. There was some discussion internally about whether or not the wipe would work if the AD account is disabled but MS support confirmed
that the user does have to authenticate in order to get that wipe command.
They also mentioned that it can take some time for a password change on the AD account to take effect so you could change the AD password to block the user from accessing the network, send the 'Clear' command and then give it some period of time to see if
the user authenticates and the phone is wiped.
This doesn't seem like a good way to do things. Most people back up their phone data pretty frequently so wiping it might have limited benefit.
Does anyone have a thought on how to achieve both goals - trying to wipe the phone while ensuring that the user cannot access corporate systems through the AD account? Changing the password for a set period of time MIGHT work but the idea of a process
that 'might' work depending on how quickly a password change takes effect seems kludgy at best. Absent a separate MDM product, anybody have a process that would allow us to wipe the phone without leaving a terminated user active in AD? We're automating
this with an IDM tool so I need something a little more well-defined than 'give it a while and see if it works' ;-)

Hi
I found the below article which might be worth a read for you.
http://www.techrepublic.com/article/why-does-my-old-password-work-via-activesync/
Not a solution as much as just more info on how changing the AD password and probably deleting the account is not going to work. Best is to setup a test user with active sync and deleting the test user's account to see if you are able to access mail from
the mobile device.

Similar Messages

Lumia 520 "Remote wipe of user data via Internet"

I'm interested in purchasing a Lumia 520 and read on the spec site that it can do "Remote wipe of user data via Internet" (http://www.nokia.com/in-en/phones/phone/lumia-520/specifications/).
Is there any special software that I need to be able to do this (like have it connected to a BlackBerry server in the case of enterprise BlackBerry devices) or is it as simple as stated on (http://www.noknok.tv/2013/05/02/how-to-find-your-lost-nokia-lumia-running-windows-phone-8/) where all you have to do is log into windowsphone.com where you can erase a linked phone?
This phone will be used for business so in case it is lost I need the ability te remote wipe it. Our company currently has a BB server and we all have BB devices, but with BB not doing so well I was thinking of getting a Nokia.
Thanks.
Solved!
Go to Solution.

WHNOKLUM520 wrote:
So far so good. That's great news. If I could ask one follow up question though:
Would it matter if the same SIM is installed on the phone? Lets say the 'thief' was able to get into the phone with a different SIM (if the security was not setup correctly) - would the phone be erased based on the SIM that's installed or on the IMEI number of the device?
Thanks
If there's no data connection, windowsphone.com cannot access your phone to send push notifications and if push notifications fail, then it will try to send SMS to your phone.
I just tried to ring my phone after taking out the SIM card, it was connected to wi-fi and I could ring it.
The silence will fall

After ICS update, stock email not syncing for exchange 2010 activesync.

After ICS update, stock email not syncing for exchange 2010 activesync.
My corporate email which was flawlessly working before ICS update. Even though I tried re-creating a new account, it hangs "waiting for sync"
Has any patch been released or explicit instructions have been provided ?
First sync:
5/3/2012 7:47 PM
Last successful sync:
Not Available
Folders synced:
0
Device name:
Not Available
Device model:
MT11i
Phone number:
Not Available
Mobile network:
Not Available
Device type:
Android
Device ID:
xxxxxxxxxxxxxxxxxxx
Device IMEI:
Not Available
Device OS:
Android 4.0.3
Device language:
Not Available
User agent:
Android/4.0.3-EAS-1.3
Access state:
Access Granted
Access set by:
Global Permissions
Policy applied:
Active Sync Policy - Partially applied
Policy updated:
5/5/2012 8:11 AM
ActiveSync version:
14.1
Also at http://talk.sonymobile.com/message/184221
Whyr is this defect "assumed answered" ? I went though all the posts and didnt find any solution?

Hopefully my reply to this can help.
http://talk.sonymobile.com/message/190149#190149
And please try to keep same problem in same thread.
- Community Manager Sony Xperia Support Forum
If you're new to our forums make sure that you have read our Discussion guidelines.
If you want to get in touch with the local support team for your country please visit our contact page.

Z10 with Exchange 2010 Activesync missing incoming messages

Z10 with Exchange 2010 Activesync won't download all messages, missing messages include messages sent to internal Exchange distribution groups and bulk email (I could live with this one, lol) Activesync works fine on iOS and android devices (100+ devices in my organization with no issues). Tried enabling secure IMAP on the exchange server, and with this config the messages are delivered, but the body of the same messages missing with the activesync setup have a [No body found] in the message body and are otherwise blank. Tried running the EAVT tool and it returns "Nothing was found for provided credentials" . My personal Gmail account works fine on the phone, tried loading the 10.1 Blackberry OS and had the same problem. Tried setting up the account multiple times, used both autodiscover and manual setup to no avail. Any thoughts? Thanks in advance for your help!

Hey cyberayk,
Welcome to the BlackBerry® Support Community Forums.
Do these email messages get redirected to a different folder on the Exchange Server? If yes, On the BlackBerry smartphone go to Settings > Accounts> Select the account> Edit Folder Settings, are these folders selected?
Thanks.
-HB
Come follow your BlackBerry Technical Team on twitter! @BlackBerryHelp
Be sure to click Kudos! for those who have helped you.Click Solution? for posts that have solved your issue(s)!

Exchange 2010: ActiveSync Report shows large amount of hits. So what should I do?

Hello,
We currently use the ActiveSync Report to run a daily report of Hits on the Exchange 2010 SP3 RU5 CAS servers (http://blogs.technet.com/b/exchange/archive/2012/01/31/a-script-to-troubleshoot-issues-with-exchange-activesync.aspx)
The script will report a large number of hits for several users, for different reasons. The question I have is what do we do about it? It's great to know we have a large number of hits, but I'm not sure why and what to do about it.
Examples:
1) No User, DeviceID, DeviceType (the columns are blank) and it shows 19,000 hits. Almost all are from IIS_4xx (what does that mean?)
2) A user with 16,200 hits and it looks like 15,661 were from PING
3) A user with 3,493 hits and it looks like 3224 were from SYNC
Any advice on how to investigate and resolve the data that the daily script for ActiveSync hits reports?
Thanks!

WHY are there so many PINGS for some device, and so many SYNC for others. And why is one deviceID/UserID blank?
because it is how the ActiveSync Client is setup. You will need to have the users to upgrade their client. for e.g. iOS verion (dont remember the version number) has some severe issue back in the past and brought down the CAS server due to so much log generation.
If your user still have the old OS/iOS on their device then you have to have them upgrade.
Why the userid or device id is blank -- I have no idea but I can't of there may be some Android devices.
Where Technology Meets Talent

Exchange 2010 - ActiveSync - Error:TooManyClientOperations

Hello,
For last 4 months, our mobile workforce is using ActiveSync access to Exchange 2010 in combination with McAfee Enterprise Mobility Management 12.0 that acts as an (kind of) ActiveSync proxy. Monitoring IIS logs on our Exchange CAS/MBX
server, I’ve noticed that one of our users recently started getting a lot of following errors:
Cmd=Sync&User=domain%5Cuser.name&DeviceId=SEC2FA0AC3DE555E&DeviceType=SAMSUNGSMG900F&Log=V121_LdapC1_RpcC24_RpcL63_Pk3978727234_Error:TooManyClientOperations_As:AllowedG_Mbx:server.domain.com_Throttle0_Budget:(A)Conn%3a0%2cHangingConn%3a0%2cAD%3a%24null%2f%24null%2f0%25%2cCAS%3a%24null%2f%24null%2f3%25%2cAB%3a%24null%2f%24null%2f0%25%2cRPC%3a%24null%2f%24null%2f1%25%2cFC%3a1000%2f0%2cPolicy%3aDefaultThrottlingPolicy%5Fcfff8eee-4334-
Mobile device has all the latest updates installed.
Searching Internet, only relevant article I managed to find is on Microsoft Exchange Japan blog:
http://blogs.technet.com/b/exchangeteamjp/archive/2014/07/24/3635022.aspx
As I cannot find any other reference on MaxNumberOfClientOperations, I am reluctant to make that change easily. I would also like to know is there any way to monitor what exactly is happening (e.g. I would like to have a way to get more
info on currently active operations that IIS log is reffering to).
Thanks, MiToZ

Hello Martin,
Thanks for answering. I am aware of Exchange Throttling Policy concept, but I am uncertain what is happening with this particular user and I am looking for ways to troubleshoot it further. Using ActiveSync troubleshooting script from Exchange Team Blog
(http://blogs.technet.com/b/exchange/archive/2012/01/31/a-script-to-troubleshoot-issues-with-exchange-activesync.aspx), I can
see that this user is not anywhere near our top users based on number of ActiveSync commands sent to our Exchange server. Is there any cmdlet, log or any other way that I could use to see currently (or at some point in time) active client
operations?
Thanks, MiToZ

Exchange 2010 Activesync Quarantine message to admin missing ECP URL?

Hi folks,
I have recently enabled the Active Sync quarantine feature in Exchange 2010 (running SP3) and it is working perfectly. However, a co-worker states that during his testing roughly a year ago, the message sent to administrators advising of the device being quarantined
contained a URL that you could click, it would take you to the ECP page where you would need to click approve. I have posted the message received currently by admins below, does anyone know why the URL is not embedded or is there another step somewhere I missed?
Is it possible that SP3 or another Exchange related update removed the URL from the message?
The Exchange ActiveSync service has quarantined the mobile phone listed below. It won't be able to synchronize Exchange content until you take action.
To perform an action for this device, select the device from among the quarantined devices displayed on the ActiveSync Access tab in the Exchange Control Panel.
Information about the device that triggered this notice:
User: [email protected]
Device model: Q10 xxxxxxxx
Device type: BlackBerry
Device ID: xxxxxxxxxxx
Device OS: BlackBerry 10
Device user agent: xxxxxxxxxxxxxxxx
Device phone number: *******9502
Device IMEI: xxxxxxxxxxxxxxxxx
Exchange ActiveSync version: 14.1
Device policy applied: Default
Device policies status: AppliedInFull
Device access state: Quarantined
Device access state reason: Global
Device access control rule:
Sent at 11/19/2014 11:21:33 AM to [email protected]
I should also mention that when I run "Get-EcpVirtualDirectory -server xxxxxxx | format-list" the internal URL is correct (https://webmail.domain.com/ecp) and the external URL is blank (which is fine by me).

I should also mention that when I run "Get-EcpVirtualDirectory -server xxxxxxx | format-list" the internal URL is correct (https://webmail.domain.com/ecp) and the external URL is blank (which is fine by me).
Hi,
Good that you mentioned that, cause that is the reason why you don't get a link in the Quarantine message sent to the AdminRecipient.
Martina Miskovic

TMG 2010 publishing Exchange 2010 OWA cannot change password if user must change password at first logon is set

Hi,
I have an odd issue whereby if I set "user must change password" on an AD account, the end user cannot logon, they're simply taken back to the OWA login page as if their password is incorrect.
My setup is as follows:
outer TMG -- uses a listener for email.contoso.com and is configured for no authentication.This uses a publishing rule to publish the inner TMG server. This server is not a domain member.
inner TMG - uses a listener for email.contoso.com and is configured for NLTM\kerberos negotiation with forms authentication (Windows Active Directory). This server is a domain member and use a publishing rule to publish the internal CAS. Allow users to change
password is selected in the publishing rules.
Exchange 2010 SP1 - uses integrated windows and basic authentication. Has the appropriate registry key configured to allow users to change their AD password on first logon.
I've registered an snp for "http/email.contoso.com mailserver-dc1", all SSL certificates being used are valid and my configuration used to allow users to login and change their password with "user must change password on first login"
set in AD.
If I launch a web browser on an internal server and point it to email.contoso.com I'm immediately presented with a generic Windows authentication request (similar to what's seen in ADFS) rather than the standard OWA page. No matter what I do, I cannot login
and change my password using the correct URL. However if I point my browser at
http://192.168.4.10/owa I'm prompted to login and I can change my password using the sam credentials.
The only recent changes made are:
- Disabling SSL 3.0 and enabling TLS (http://www.isaserver.org/articles-tutorials/configuration-security/improving-ssl-security-forefront-threat-management-gateway-tmg-2010-published-web-sites.html)
- Replacing the TMG listener certificates so that they now use SHA2 rather than SHA2 (certificates are trusted on each TMG server)
Looking on the outer TMG and the DC logs I can see schannel errors which I believe are related to the problem. TMG monitoring also shows "Failed connection attempt: 1907 The user'spassword must be changed before logging on for the first time"
I've checked that my inner TMG and DC are using the same certificate for server authentication and gone through this guide:
http://blogs.technet.com/b/keithab/archive/2012/02/29/setting-up-and-troubleshooting-ldaps-authentication-in-forefront-tmg-2010.aspx
If I try to use ldp.exe on the inner TMG, I get the error in the pic below
Thanks
IT Support/Everything

Hi,
You could try to analyze the TMG tracing and try the troubleshoot steps in the blog below.
TMG 2010 – FBA, troubleshooting the change password feature
http://blogs.technet.com/b/isablog/archive/2012/05/07/tmg-2010-fba-troubleshooting-the-change-password-feature.aspx
Best Regards,
Joyce

Exchange 2010 Activesync with the Windows 8.1 mail app limited to 10 MB attachments?

We have a few executives that want to use the mail app on their 8.1 tablets to access our Exchange 2010 SP3 Ru7 servers via Activesync. They get connected and can sync mail, but when they
try to download attachments that are larger than 10 MB, they get an error (Sorry I don't have the exact wording) the error doesn't say anything about attachment size limit, but it works if the attachment is 9.5 MB and they get the error as soon
as the attachment is greater than 10 MB.<o:p></o:p>
I tested the app with the same attachments greater than 10 MB with an Outlook.com account and it works ok on the Windows 8.1 tablet.<o:p></o:p>
I also tested using an IPad against the Exchange servers and I can download attachments greater than 10 MB just fine.<o:p></o:p>
So it looks like only the combination of Exchange (2010 in my case) and the Windows 8.1 mail app has the limitation?
<o:p></o:p>

ActiveSync is limited in the same manner that OWA and web services are. See the following page to see how to increase this limit:
http://technet.microsoft.com/en-us/library/aa996835(v=exchg.141).aspx

Exchange 2010 activesync, Personal archive access from Mobile devices like Iphone,IPAD and Android based Phones

Hi,
As of what i have found from different blogs is that all the activesync devices including IPhone , IPAD and Android based phones cannot access online archive/Personal archive in exchange 2010.
Is there any third party app in the market for the above devices which can support access of Online archive?
Thanks in Adavance

There must be a way! Since you can view the online archive through webmail with supported browsers on PC(IE, Firefox, Safari OSx) (so activeX is no must).
All it takes is a browser that can set a different 'agent' and that can interact with the webmail(OWA) website just like Safari on OSx.
I tried different browsers on the iPad, they all display the Online archive, but the navigation is broken. (scrolling by sliding your fingers does not work correct) The result is that you can not open(read) any mail in your online archive.
The browsers we tested and show the online archive but where the navigation doesn't work are:
On iPad:
- Kissmyagent
- Atomnic(the free AND payd version)
On android:
app: 'OWA for Android' (does not show the online Archive)
Maybe someone can come up with a browser and/or app that can show the online archive!

Exchange 2010 ActiveSync with Treo 755p

We're in the process of migrating from 2003 Exchange to 2010 and are having a problem with Treo's 755p. All other devices are able to synchronize using ActiveSync but Treo's are getting an error connecting to the server. I tried calling Palm and was told that Exchange 2010 is not supported.
We have a GoDaddy's 256-bit SSL class 2 certificate could this be a culprit?
Has anyone got it to work? How?
Post relates to: Treo 755p (Sprint)

itad wrote:
We have a GoDaddy's 256-bit SSL class 2 certificate could this be a culprit?
Did that certificate work with Exchange 2003 on the same host name? If so, then the certificate probably is not the culprit. If it's a new certificate or a new host name, you could search here for SSL threads. There may be issues with 128 vs. 256 bit certificates, and having the host name listed in the Subject Alternative Name field rather than being the main host name on the certificate.
I don't have any personal experience with 2010...

Q10, Exchange 2010 ActiveSync - Email will not be deleted on server

Hey Everyone,
If you have a Q10 with Exchange ActiveSync, can you remove emails on the server using "Delete from Hub and server" option??
I am testing this function both with an ipad and Q10. Emails removed from Ipad are removed from Exchange Server whereas emails removed from Q10 with "Delete from Hub and server" option selected are only removed from Q10 but not on the server.
Is this a broken functionality or are there incorrect settings on the phone?
Any help is greatly appreciated!
-T

the deletes can take a few on my Z30 or Z10
I know a quick delete would be prefered but maybe the OS deems them as not fast needed
Click here to Backup the data on your BlackBerry Device! It's important, and FREE!
Click "Accept as Solution" if your problem is solved. To give thanks, click thumbs up
Click to search the Knowledge Base at BTSC and click to Read The Fabulous Manuals
BESAdmin's, please make a signature with your BES environment info.
SIM Free BlackBerry Unlocking FAQ
Follow me on Twitter @knottyrope
Want to thank me? Buy my KnottyRope App here
BES 12 and BES 5.0.4 with Exchange 2010 and SQL 2012 Hyper V

Exchange 2010 ActiveSync Calendar Issues

We use Exchange 2010, SP1, RU6 in our enterprise. We are having many problems with calendar synchronization between Exchange and iOS 5.0.1 devices (iPad and iPhone). Is anyone else having the same problem? Anyone have answers. We opened a case with Apple and they told us that these are known issues with iOS 5 and they would be addressed in a future release. Anyone know when this will be addressed? Thanks.

48 hrs now since talking with Microsoft.
I agree it is an iOS issue but Microsoft can typically find a fix around the situation regardless of the root offender. The hope is that the events may still be tagged such that Microsoft may still be able to correct the events. Regardless, Microsoft has elevated the case two levels to correct the issue. This is much more than Apple has been willing to do. Their response thus far has literally been "let us know what Microsoft says". I am not necessarily working with Microsoft but more not working with Apple (for their dis-interest in the situation). Microsoft has been on the phone with us taking traces of email calendar activity to see what the underlying problem is.
I work in education and I have since halted all further deployments of iOS devices since the majority are administrative personnel and they would definitely be hooking into the Exchange environment. My recommendation has been to my student base is to also halt deployments if they are putting students into their Exchange environments.
Not that I am an Apple basher but I don't think Apple is ready for the enterprise. Now that I have moved to a Galaxy S II, I feel safer that I will not miss my meetings. i live by my calendar. My 4s in in my drawer for now.

EAS and Exchange 2010 Http 500 only on SOME users

We have had EAS and iPhones working really well for the past year in a Exchange 2003\2010 mixed mode environment.
NOTE: This is not related to the iOS v4 issue Apple is providing a fix for in v4.1
We have had no problems, but with the last batch of migrations (move mailbox) from e2k3 to e2k10 some users are not able to access mail once moved on their iPhones. I get "Cannot Get Mail - the connection to the server failed."
Yet we have many other users on the same Db from pervious migrations (move mailbox) from previous weeks that work just fine and continue to work fine while the others dont.
I have compared the accounts in ADSIEdit and one thought was the inclusion of the user's account + SELF in the permissions to the mailbox, but removing the user account did not help. I also moved the users to different Db's and the problem remains.
Both users started out in an AD site with non-internet facing CAS servers, but I have lots of other users over there who work fine. I also moved them to another AD site with internet-facing CAS and this didnt change anything.
If I run the testexchangeconnectivity.com I get a fail, yet I have also entered the credentials for the working users and they fail as well with and http 500 error yet they continue to work just fine on the device. Previous to adding the site with non-internet
facing CAS users did not fail this test. Any advice is appreciated. Here is the output:
ExRCA is testing Exchange ActiveSync.
The Exchange ActiveSync test failed.
Test Steps
Attempting to resolve the host name na.mail.reedelsevier.com in DNS.
Host successfully resolved
Additional Details
Testing TCP Port 443 on host na.mail.reedelsevier.com to ensure it is listening and open.
The port was opened successfully.
ExRCA is testing the SSL certificate to make sure it's valid.
The certificate passed all validation requirements.
Test Steps
The IIS configuration is being checked for client certificate authentication.
Client certificate authentication wasn't detected.
Additional Details
Testing Http Authentication Methods for URL https://na.mail.reedelsevier.com/Microsoft-Server-Activesync/
The HTTP authentication methods are correct.
Additional Details
An ActiveSync session is being attempted with the server.
Errors were encountered while testing the ActiveSync session
Test Steps
ExRCA is attempting to send the OPTIONS command to the server.
OPTIONS response was successfully received and is valid
Additional Details
ExRCA is attempting the FolderSync command on the Exchange ActiveSync session.
The test of the FolderSync command failed.
<label for="testSelectWizard_ctl12_ctl06_ctl05_ctl01_tmmArrow">Tell
me more about this issue and how to resolve it</label>
Additional Details
Exchange ActiveSync returned an HTTP 500 response.
Exchange Freak | @ntpro | http://geekswithblogs.net/ntpro

Hello Chris,
The affected users may be members of too many groups causing their user tokens to be larger than the maximum allowed size. Compare group membership of a problem with a successful user.
Also, compare the Security permissions on the active directory account as well. (Specifically inheritable permissions)
Exchange ActiveSync Returned an HTTP 500 Error - Remote Connectivity Analyzer
http://technet.microsoft.com/en-us/library/dd439375(EXCHG.80).aspx
How to troubleshoot server ActiveSync HTTP error codes
http://support.microsoft.com/?kbid=330463
Hope this helps,
Kevin Ca - MSFT

Outlook & Exchange 2010 AutoDiscover and 2008 R2 Terminal Services

Hi,
I have a strange issue with Outlook 2010 in Terminal Server 2008 R2 which we don't have on the standard user desktops.
When setting up a new outlook profile it does not populate the user and server details. The setup has to be done manually. Once the profile is set up it works fine (except that Out of office does not work and Calendars do not show Free/Busy correctly). I
understand this is a AutoDiscover issue (and I can fix this with putting a DNS entry in, but even without the cname entry in DNS it works fine on the user desktops), and looking at the two environments there is nothing that should be blocking the terminal
servers in getting this information.
On the Terminal Servers if I run the Test E-mail AutoConfiguration the first thing it comes up with in the log tab is :
Start AD lookup for e-mail address
AD Lookup for e-mail address Failed (0x80070035)
This does not happen at all on the user desktops. It finds the email address without issue and populates the E-mail Address field.
Why is this happening ? What is there on the terminal server that is preventing outlook from correctly retrieving this information ? Is there and LDAP issue from the terminal server to the DC ? What can be done to fix it ?
Thanks

OK. I think i sorted it out. There is clearly an issue with LDAP services and IP virtualization on Terminal Servers.
I found this quote on a page :
"The Directory Connector works by mapping IP addresses to usernames; any IP address sharing will mean the Directory Connector will not be able to tell theses users apart"
So I changed the IP Virtualization from per session to per application and specified the application to use that I have done all of this for, and voila.... Outlook stated working and ldp also connected without an
issue.

Exchange 2010 Activesync questions - remote wipe terminated user

Similar Messages

Maybe you are looking for