Is it possible to only allow given MAC addresses to access ActiveSync in Exchange 2013?

We are designing a new Exchange 2013 environment for a client and one of their requests was to only allow known mobile devices to access ActiveSync.
I can see that you can allow or block remote devices based on IP Address, model, etc. but we'd need to allow devices based on their MAC Addresses.
Is it possible to use the built-in features of Exchange 2013 or IIS ARR to provide this feature?
Cheers for now
Russell
No, but you can use DeviceId.
The ActiveSyncAllowedDeviceIDs parameter specifies one or more Exchange ActiveSync device IDs that are allowed to synchronize with the mailbox. A device ID is a text string that uniquely identifies the device. Use the
Get-MobileDevice cmdlet to see the devices that have Exchange ActiveSync partnerships with the mailbox.
To enter multiple values and overwrite any existing entries, use the following syntax:
<value1>,<value2>.... If the values contain spaces or otherwise require quotation marks, you need to use the following syntax:
"<value1>","<value2>"....
To add or remove one or more values without affecting any existing entries, use the following syntax:
@{Add="<value1>","<value2>"...; Remove="<value1>","<value2>"...}.
https://technet.microsoft.com/en-us/library/bb125264(v=exchg.150).aspx
Twitter!: Please Note: My Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

Similar Messages

Is there any possible ways to get the MAC address?

Hi guys:
I am writing servlets on the server side. Is there any possible ways to get the MAC address when a HTTP request come in? Thank you very much for any helps.
all the best!

It is usually impossible to get the MAC address of the maker of a HTTP request in any programming language or system.
At best, you can get the MAC of the closest intervening router, firewall, whatever.
Are you sure you mean the MAC address? MAC looks like this: 8:ab:f0:0:71:bb:90 (Ethernet), or 01-23-45-67-89-ab (Token Ring), etc, depending on your network type.
In contrast, an IP address looks like this: 209.249.116.195. If you want the IP address, check out the javadoc for HttpServletRequest and ServletRequest. Caveat: load balancers, web caches, proxy servers, etc will mask the "true" peer's address. Don't do anything silly like try to use the IP address for security or authentication.

WRT54GS: without Windows, force a given MAC address to always get the same IP address via DHCP?

I have just now set up my WRT54GS to manage my home wireless network, and it works great. I just have one question that I haven't been able to find an answer for (forgive me if I have overlooked an obvious source of information).
I have set up the WRT54GS to be a DHCP server, and it assigns addresses in an ad hoc manner to all the devices that connect to it. In general, this is what I want, but in one case, I want a certain host to always get the same IP address, for example, 192.168.1.10.
You should know that I have no Windows machines on my network. Everything is either running Linux, MacOSX, or Symbian (on a Nokia N95 handheld). Therefore, I can't set up a static IP for my device using the software supplied on the CD that comes with my router, as that software only runs under Windows.
Using a different manufacturer's router, I am able to accomplish this by telling the DHCP software on that router to always assign 192.168.1.10 to the host who connects with a certain MAC address. I can then use this mechanism to force my specific host to always get this desired IP address. However, I haven't been able to find any way to do that with the WRT54GS without the software on the Windows-based CD. Is it possible at all? If I can indeed do this without that Windows software, could someone point me to some docs which explain how to accomplish this?
... or is there perhaps a different way to cause this to happen, perhaps by means of some sort of DHCP client ID?
Thank you very much in advance for any pointers you can give me.
Message Edited by HippoMan on 10-16-2007 05:27 PM
Take a hippopotamus to lunch today.

Forget about the CD. There is nothing on the CD which you don't configure better through the router web interface at http://192.168.1.1/ You don't need the CD. Never. I have never used the CD to configure any of my routers. The program on the CD is just a software which helps you with the initial configuration of the router. It is just a software which pretty much contacts the web interface in the background and sends some settings changes there. You can do everything yourself directly. Then you know what you change.
You have to configure the static IP address on the computer and on the computer only, e.g. on your Mac use Static IP instead of DHCP in the network preferences. Enter the IP address you want to use for the computer, the subnet mask, gateway address and DNS server(s). That's it. The router is not involved in any of this.
You just have to make sure that you use an IP address inside the LAN of the router. By default, Linksys routers use the IP address 192.168.1.1 on the LAN side for the the router. The subnet mask is 255.255.255.0. The IP address together with the subnet mask says that all IP addresses 192.168.1.0-255 are considered part of the LAN. Everything else is outside and needs to be routed to the router and from there into the internet. (If you want to know how the subnet mask works exactly read the wikipedia article on it or search for "subnet calculator" or similar in the internet)
Thus, if you connect a computer to your LAN and set a static IP address on the computer it should be inside this IP address subnet/range in order to have internet and LAN access on the computer. It does not matter which address you use as long as it is inside the IP subnet. The DHCP server on the router automatically assign a correct IP address inside the IP subnet and also automatically assigns the correct gateway address (its own address = the address to which everything should be sent which does not belong into the LAN, i.e. the internet traffic) and the DNS server. With static IP you have to assign those values yourself.
But again, there is no Windows computer or CD involved to do that nor is there any configuration on the router required to set the static IP address on the Mac. The IP address you set must simply match your LAN IP which is basically defined through the settings on the router as you want to have internet and thus need access to the router and its address 192.168.1.1.
Some routers allow you define fixed IP addresses for specific devices in the DHCP server of the router. With that function you can set a fixed IP address on the router. The computer can remain on DHCP. It will always get the IP address you have configured in the list on the router through the DHCP server. However, your Linksys router does not have this option. If any device inside your LAN is supposed to receive the same IP address at any time you have to configure that on the device only.
If you have not changed the default LAN IP address, subnet mask and DHCP server settings on the router, the router has 192.168.1.1, subnet mask 255.255.255.0 and the DHCP server uses 192.168.1.100-149 for dynamic assignments. To avoid potential address conflicts you should not use any static IP addresses inside the DHCP server address pool. This leaves you with IP addresses 192.168.1.2-99 and 150-254 as static IP addresses inside your LAN. You can pick any address you like as long as any device with a static IP address has a unique IP address inside your LAN.
Assign the subnet mask 255.255.255.0 on the computer and set the default gateway to 192.168.1.1. The DNS servers are a little bit more complicated. Generally it is better and faster if you use the DNS servers of your ISP. You can, however, also use the IP address of the router 192.168.1.1 as DNS server. The router will then operate as DNS proxy, i.e. it contacts the DNS servers of your ISP for any request from your computer.
If you want to use the DNS servers of your ISP, click on the Status tab in the router web interface. It shows you the current settings of the router on the internet port. It should show you multiple entries for DNS servers. Choose those DNS server IP addresses in the computer.
If you don't want to go through the hassle with the direct access to the DNS servers of your ISP, simple use 192.168.1.1 as only DNS server on the computer.
There are all settings you have to make on your Mac or other computers to assign a static IP address. As long as the IP address is inside 192.168.1.* it belongs to the LAN and has internet access through the router (as long as the default gateway address is 192.168.1.1 of course).
Firmware is loaded either through the web interface of the router, usually somewhere on the Administration tab or with tftp. Both ways work fine on any Mac or Linux box.

WRT610N - Reserving a specific IP address for a given MAC address

This is the first router that doesn't allow this. I have to set up a computer to get an address using DHCP then I need to use that IP address and related info to set up a static IP address. That's just plain dumb. Then if I take a laptop to another location, I have to fiddle with setting up for DHCP again. Then When I come home, I have to reset all the settings on the laptop to do the static IP thing. If you move the computer around a lot, that's a lot of unnecessary fiddling.
Why not just have the router keep a table of MAC address and the IP address assigned for those computers. It would be a lot easier to configure the router once than reconfigure a compter a whole bunch of time. It's not rocket science or brain surgery. A lot of other routers do this and allow the user to set up reserved addresses

You may have stumbled over a known bug!
What you want to do is click on [DHCP Reservation] on the Basic Setup page and assign the Ip address based on the MAC of the connecting device.
But there is a bug! The JavaScript code generated in DHCP_Static.asp puts an extra space in a few Array definitions which result your browser not properly rendering the HTML code. So you get a window that is intended to allow you to manage the Ip assignment based on MAC, but the page is BROKEN.
(Right click on the page a select "View Source" from the context menu and you'll see something like this.)
===================================
| (Note: angle brackets replace with square brackets to prevent errors in the forum post.)
| [script language="JavaScript"]
| document.title = adbutton.dhcpres;
| var statics_table = new Array(
| 'Dummy1','00:01:02:03:AA:FF','101'
| ,'Computer2','00:55:FF:ED:04:99','102'
| ,'Roku','00:0E:44:55:66:77','110'
|
| );
===================================
I believe that blank line between the last entry and the final ");" is causing the problem. At least in every browser I've tried, a JavaScript error is generated at that point with: Message: Expected ')'
My guess is the router work fine. But since your only way to communicate with the router is via a web page that is broken, you can't make the changes you want to make!
I was told by Tech Support that they know of this issue and are working on a fix. I was also told....
:: Since the problem you have is regarding the DHCP Reservation, we will escalate
:: this case to the Case Management Team Irvine.
and...
:: We will escalate this concern to the Headquarter and a Senior Technician would contact you within 48 hours.
We'll see... I'm not holding my breath.
-- Joe

Airport allows deleted MAC addresses on network

Am I misunderstanding Airport Security and timed access? I've deleted Mac addresses from devices previously on my network, but the devices are still able to join the Airport network again. (I have not changed the password.) I thought this set up required the device to be "on the list" in order to share the network. Is it only about the password?
Thanks for any advice.

Timed Access can be a bit tricky.
It helps to remember that the default under Timed Access will allow all devices unlimited access to the network. Double click on the default setting and a window will open with more details.
If you want to restrict this to certain devices, you must first change the default "rule" to not allow any access.
Then, list each device separately that you want to connect along with the "rule" or allowed connection times for that device.

How to allow batch file attachment to be sent in Exchange 2013

Hello,
We would like to send batch file attachments in our Exchange 2013 environment, this is current blocked and restricted.
Can you advise on how to perform this on the ECP?
Vijay

The only supported--and the best method--for sending something as simple as a batch file is append or rename the extension to .txt. Put in the instructions for the recipient to download the .txt file and rename the extension back to .bat.
Don't go messing with Exchange rules and such. This "limitation" is purpose built to protect you, your users, and your systems.
Is the recipient in the same organization as you? Do they have access to a share or portal? Then it may be just easier to place the batch file in the central location and just send the UNC path or URL. If the recipient is not in your organization
or does not have access to an accessible share or portal, then just rename the file extension and send via email.
This is a simple problem with a simple, safe solution; don't overthink or over-engineer a solution that will only open holes and vulnerabilities.

Is it possible to only allow HD content when HDCP is present, otherwise fall back to SD?

For any of the proposed ideas here, you will have to package your content twice, where each stream would require its own license:
1 package for SD bitrates
1 package for HD bitrates
[ Try to play & react if necessary ]
When the user wants to play HD content, attempt to do a license acquisition for the HD stream. If it fails with an error code indicating that the device doesn't not have the needed output protection requirements (DRMErrorEvent 3338 – 3342), the client would then fall back and play the SD stream, which would trigger a license acquisition of a license that doesn't require Output Protection enabled.
[ License Preview ]
When the user wants to play content, perform a "License Preview" of the HD stream to determine if the license can be consumed & enforced by the device (DRMManager.loadPreviewVoucher()). If the result of loading this Preview license fails with a DRM Error event around Output Protection requirements (#3338-3342), then play the SD stream.
[ Leverage an existing front-load license request that you're using to preemptively initialize the DRM system ]
This is similar to "License Preview", but attempts to front-load that check and retain the result for later use.
In our whitepaper to optimize "start to playback" experience (http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/video/pdfs/start-to-p layback-adobe-access.pdf), one of the things we recommended was to front-load a license acquisition on a non-existent content very early in the user workflow (Optimization #2). Doing this would initialize the DRM system so that when the real license acquisition happened later on, Adobe Access would already be primed.
To take this a step further, if you have this in place, since you already are doing a license acquisition ahead of time, you could use a policy that requires Output Protection. In your client, when it attempts to acquire a license, it can record whether or not the operation was successful. If it was successful, the client could have logic to show HD content options to the viewer. If the acquisition was unsuccessful, then the client could restrict viewing to only the SD content.

ok great thats what i thought
How do I check if I am running moutain lion
about this mack gives me Mac OS X
Version 10.7.5
I am running Software UPdate as I type
assuming that I have Moutain Lion how do I link the two ecternal HD's ?

Is it possible to only allow downward HTML / flash scaling of a project?

Hi, When I've exported from captivate 7 (latest update) with the "Scalable HTML" option enabled, it creates the output and makes it scale up or down to fit the needs of the device. The flash version also does the same. This is working as expected and works well.
However when viewing on a large computer screen, the project looks fuzzy / un-sharp / over-zoomed in because it has increased in size to fill the screen.. Does anyone know of a way in which you can set the project only to scale down, and not to scale up. For example, we are using 1024 x 672 for Ipad, but if it was on a 7 inch tablet, it would still scale down, but on a larger screen it would retain 1024 x 672.
Essentially, the same functionality as "max-width" and "max height" in CSS.
I imagine it will involve editing some code in HTML / CSS / JS in the output files, I've had a brief look, but haven't gone into depth on it yet.
Any help would be greatly appreciated.
Oen

I understand your dilema.
My point was that if you only served the HTML5 version for mobile, you would never be able to scale over a max width anyway, since the largest screen would be a tablet.
Desktops would be served the SWF version, which is possible to control the max-width since there are only 2 divs you need to worry about and it could still scale down.
It's conceivably possible to do it with the HTML5 version but you would have to write a script to change the css for all divs, the container div and all of it's children and their children and you'd have to run it for every slide. As some of the divs have no id you would also have to create a new id for those divs, or apply a class before you could change their css. You'd probaby have to evaluate which divs have classes, which have inline css, to sum it up it would be a nightmare to write the code. CSS specificity can be confusing enough, let alone trying to figure it out dynamically. If you ever got it to work it would probably take longer than the time it took to build the course, let alone the latency it would introduce.
I'm sure you've noticed that when you apply css rules the the main container div has absolutely no effect in the HTML5 version since the child divs have their own set of rules.

Is it possible to only allow unique submissions?

I would like to limit duplicate submissions of the form data. Can you restrict the submission if already submitted (Example: Address: 555 MANTUA BLVD. if this address already exists it would error.

Often asked for feature - just see the page this question appears on! Not supported unfortunately and no indication they're thinking of providing it.

When using multiple displays, is it possible to only have full screen zoom (universal access) only effect one display?

I am visually impaired which makes it difficult for me to use computers. The zoom feature in Mac OS is extremly useful to me and is the first reason I choose mac over windows. Although, now that I've been using a mac for 8 years, I would pick a mac any day! For my work flow, I utilize two displays. It would help me greatly if there was a way to only effect one display with the zoom feature.
Thank you for your input,
Zachary

http://support.apple.com/kb/PH11488
You can set the zoom to ONLY follow your mouse (And adjust the size of the "zoom window" that follows it). I used to use this with Quick time Editing when I had a 13" iMac.

I have set up an iCloud email account in my name on my iPad and wish to set one up for my husband in his name. I can't seem to find how to do this. Am I only allowed one email address? If not can someone talk me through this. Thanks

I wish to set up an alias address on my iPad. My iCloud address has already been established and I can find no way to get into my account to add any alias.

You can create up to 3 alias addresses but you have to do this on icloud.com from your computer browser. This article explains how: http://support.apple.com/kb/PH2622. Also, incoming email to an alias address will go to your current iCloud inbox so it really isn't a separate account; just a different email address for the same account.
Each iCloud account only has a single iCloud email account. If you really want to set up another, you would need to add a secondary iCloud account by going to Settings>Mail,Contacts,Calendars>Add Account>iCloud, then entering a different Apple ID to create the account. You can then turn on Mail to create the new account. Mail in secondary accounts, however, is fetch email, not push (which is only supported in the primary account).

Is there a way to configure iCloud to allow different email addresses to access one iCloud instance?

I would like to set up iCloud on my home PC using my Apple ID (email account). I would also like to set up my son and daughter to be able to access that iCloud instance from their iPhones and Macs - but it seems like I have to give them access to the email account that I use as my Apple ID.
Is there documentation that will show me how I need to configure the iCloud account that will grant them access, but not necessarily using my email account for this? I am not finding this kind of information in the online help files - although maybe I am looking in the wrong place.
I would like to set up my home Windows PC, two Macs, and 2 iPhones on the iCloud instance - with the probability of adding another iPhone and an iPad.
If I create a new apple email ID to create the iCloud account, will that require me to change my whole Apple ID as well?
Thanks for any help you can offer.

Thanks Roger.
I don't have as much an issue with the access to the Apple account so much as setting it up on my kid's iPhone (say...) also pulls my personal emails too. I want to give them access to the iCloud - just not my emails!
Should I do this by setting up an alias in iCloud and setting their access using *that* ID?

Built-in domain Administrator account not given full access to new Exchange 2013 server

I migrated from Exchange 2010 to 2013 over the weekend. I cannot log into the EAC with my domain administrator account I use to log into all my other servers. I also cannot run the clean-mailboxdatabase cmdlet logged in as this user. I
had no trouble moving mailboxes from the old server to the new server with this account though.
This account is a member of: Domain Admins, Enterprise Admins, Exchange Full Admin, Exchange Organization Admin, Organization Management, Schema Admins, Server Management.
I can log into the EAC with another admin account that has the same memberships as the Administrator account.
I tried giving the account the role of "Databases" as suggested by others to fix the clean-mailboxdatabase issue but that did not work for me either.
The Administrator mailbox has been moved to the new database on the Exchange 2013 server. The Exchange 2010 has been decommissioned and is turned off.

Hi,
Based on my research, to retrieves the mailbox statistics for the disconnected mailboxes for all mailbox databases in the organization, we can try the following command:
Get-MailboxDatabase | Get-MailboxStatistics -Filter 'DisconnectDate -ne $null'
http://technet.microsoft.com/en-us/library/bb124612(v=exchg.150).aspx
Additionally, The Identity parameter specifies the disconnected mailbox in the Exchange database and it can be display name instead of mailbox GUID.
http://technet.microsoft.com/en-us/library/jj863439(v=exchg.150).aspx
Hope it can help you.
Thanks,
Angela Shi
TechNet Community Support

Catalyst 520 more then one mac address

How do I allow more then one device on all ports of the 520 Switch. When I hook another switch to any port on the switch it will only allow one Mac address/ or device to that connections. How would I disable that. Any step by step instructions would be great.

Sounds like mac based port security is enabled. I've never worked on the Catalyst 520 but there must be a config section under security. However, be very careful connecting switches to other switches. An Ethernet loop can ruin your day.

Blocking MAC addresses

I have my airport set to only allow certain MAC addresses to have access to my network. However, the person I am trying to restrict access to has figured out how to reset the settings using the reset hole and gain access to the network. Is there any other way that I have to block access to the network if the airport is reset?

The only way to prevent this is to prevent physical access to the base station.
Nothing you configure will work, if the person can physically reset the base station to its default settings.
iFelix

Is it possible to only allow given MAC addresses to access ActiveSync in Exchange 2013?

Similar Messages

Maybe you are looking for