Securing Windows Mobile devices from the Exchange server - Page 2

hansonaj · 30-07-2007, 12:10 PM

Thanks. So it looks like Microsoft strikes again!

Would have been nice to be able to remove it somehow, other than a hard reset if that does work. Simple solution would be to check when you connect if you still have it assigned!

hansonaj · 30-07-2007, 01:04 PM

Excellent I have just found out how to disable the security policy:

If anyone is interested is is defined at Removing Exchange Direct Push Device Security Policy - xda-developers

Now I can use TomTonm with no hassles!

waveydavey · 30-07-2007, 02:32 PM

That's fine as long as your admin hasn't stopped you installing software.

irblinx · 30-07-2007, 04:33 PM

pretty sure (ok, absolutely certain

) you can run regedit apps without the need to install!

waveydavey · 30-07-2007, 04:59 PM

Only if the you have the application signed with appropriate certificates, as you can enforce this too. It also gets more restrictive in 2007:

In Exchange 2007 you can even set multiple policies which allows you to make distinction between different usergroups. These policies are pushed to any mobile device that connects to the Exchange server befor picking up any data. After that you can set the interval that the policy is checked by the device by setting the DevicePolicyRefreshInterval to the appropriate length.

irblinx · 30-07-2007, 06:27 PM

I have used a regedit app the the S310 which is tied down to not allow cab files to run for installing root certs for example, there was no confirmation required, it just opened up and displayed the registry as if using File Explorer

fowljr · 30-07-2007, 07:08 PM

Doesn't the fact that you can circumvent the security in the first place make a mockery of it in principal?

windows · 30-07-2007, 08:21 PM

But to do this the registry editor has to be signed as well I think?

fowljr · 30-07-2007, 09:22 PM

Even on the PPC? I'll re-install Resco soon and see if I can get to the keys mentioned on XDA-Devs...

irblinx · 30-07-2007, 09:39 PM

Well you do need to use the security to unlock it in the first place to be able to perform the hack so the security does its job with regards to the wrong people getting their hands on the device initially.

As you probably know, the most difficult thing to legislate against are "expert" users. I already have a list of users who's devices will be getting audited more often than most!