Securing Windows Mobile devices from the Exchange server

[windows]

Jaap van Ekris (from Modern Nomads) has written a detailed article about securing Windows Mobile devices from the Exchange server, even when the device is owned by the employee instead of the company.

This is a large problem since many people simply buy the device themselves and take it to their employer to hook it up to whatever they find there. This is cool if you want to have a device you want to use as an employee, but it might harm company interests by taking information unprotected outside the company. So, from an Exchange administrator point of view, this might require some guerrilla tactics to resolve this.

You can read more here.

[irblinx]

We have just recently applied Exchange security policies for our WM devices, all users (including the small number that we allow with their own devices) must have the MSFP on their device which means WM5 AKU2 and above on WM and then to be allowed to synchronise with the server they must accept the security policy on their device. This also allows remote wipe by our helpdesk and device wipe after a certain number of incorrect password attemps. So far it is working well, although I've just heard of some possible issues with the S310's, and after the initial moans about the device lock everyone seems to have gotten used to it.

[fowljr]

I'll agree, the device lock is a real pain if you want to run something like TomTom and the security policy doesn't allow you to move the timeout.... I've gone back to using the Loox for SatNav now....

[irblinx]

And as the adminstrator and someone who doesn't use satnav ..... I'll not be caring then!

[fowljr]

Hmmmmm, I can't think of anything polite to say here!

[hansonaj]

Hi,

I am a user who didn't realise the impact of agreeing to the security policy, no news there then!

As the device is my own I'd rather have ability to use TomTom than to access work email, can you help identify how I remove the security policy that is applied so that I can remove the lock?

Alec

[irblinx]

a Hard reset is the only way that I know of, this is of course part of the security

[fowljr]

I a in agreement, it can't be removed with a hard reset as far as I know..

[waveydavey]

Can't?

[irblinx]

If you have access to the Exchange server yourself it may conceivably be possible to change the policy at the server side to more lax and then re-apply the policy again so that you could this time say no.