3.3 Optimizing Exchange ActiveSync Mailbox Policies
When you create an Exchange ActiveSync Mailbox policy, some
additional settings are configured automatically. By default, access to
both Windows file shares and Microsoft Windows SharePoint Services is
allowed. If you specified that passwords are required, by default, the
number of failed attempts allowed is eight. If the policy allows devices
to download attachments, there is no default limit on the attachment
size. You can modify these and other policy settings by completing the
following steps:
-
In the Exchange Management Console, right-click the policy, and select Properties.
-
On the General tab, shown on the left in Figure 2, use the options to configure whether nonprovisionable devices are allowed and optionally, set a refresh interval.
-
On the Password tab, also shown in Figure 2,
you must select the Require Password check box to set controls for
device passwords. The options available are the same as when you are
creating a policy, with one addition: Number Of Failed Attempts Allowed.
To limit the number of failed password attempts that can be made before
a user's account is locked, select this check box and then set the
allowed limit.
-
On the Sync Settings tab, shown on the left in Figure 3,
you can configure general device sync options. For past calendar and
e-mail items, you can specify whether all items should be synced or only
items from a specific period of time, such as the last two weeks. If
you want to limit message size, select the Limit E-Mail Size To check
box and then enter the size limit in kilobytes (KB), such as 512. If you
allow attachments and you want to limit the size of attachments that
users can download, select the Maximum Attachment Size (KB) check box
and then enter the size limit in kilobytes (KB), such as 900.
-
On the Device tab, shown on the right in Figure 3,
you can configure device-specific settings. To allow the use of a
device-specific setting, select the related Allow check box. To prevent
the uses of a device-specific setting, clear the related Allow check
box. You can:
-
Allow or disallow the device to access removable storage, such as memory cards.
-
Allow or disallow the device's built-in camera.
-
Allow or disallow the device to connect to a wireless network.
-
Allow or disallow the device to connect to other devices using infrared.
-
Allow or disallow another device to share the device's Internet connection.
-
Allow or disallow remote desktop connections.
-
Allow or disallow the device to connect to and synchronize with a desktop computer.
-
Using the Allow Bluetooth
list, you can specify whether and how the device can use Bluetooth. To
allow the device to use Bluetooth, select Allow. To allow the device to
use Bluetooth only in hands-free mode, select Handsfree Only. To prevent
the device from using Bluetooth, select Disable.
-
On the Device Applications tab, shown on the left in Figure 4, you can configure allowed or blocked applications. To enable features of the mobile device, you can:
-
Select Allow Browser to allow the device to use Pocket Internet Explorer.
-
Select Allow Consumer Mail to allow the device to access e-mail accounts other than Microsoft Exchange.
-
Select Allow Unsigned Applications to allow the device to execute unsigned applications.
-
Select Allow Unsigned Installation Packages to allow the device to install unsigned applications.
-
On the Other tab, shown on the left in Figure 4, identify allowed or blocked applications using the options provided.
-
Click OK to apply your settings.
In the Exchange Management Shell, you can modify Exchange ActiveSync Mailbox policies using the Set-ActiveSyncMailboxPolicy cmdlet. Example 6 provides the syntax and usage.
Example 6. Set-ActiveSyncMailboxPolicy cmdlet syntax and usage
Syntax
Set-ActiveSyncMailboxPolicy -Identity Name
[-AllowBluetooth <Disable | HandsfreeOnly | Allow>]
[-AllowBrowser <$true | $false>]
[-AllowCamera <$true | $false>]
[-AllowConsumerEmail <$true | $false>]
[-AllowDesktopSync <$true | $false>]
[-AllowExternalDeviceManagement <$true | $false>]
[-AllowHTMLEmail <$true | $false>]
[-AllowInternetSharing <$true | $false>]
[-AllowIrDA <$true | $false>]
[-AllowMobileOTAUpdate <$true | $false>]
[-AllowNonProvisionableDevices <$true | $false>]
[-AllowPOPIMAPEmail <$true | $false>]
[-AllowRemoteDesktop <$true | $false>]
[-AllowSimpleDevicePassword <$true | $false>]
[-AllowSMIMEEncryptionAlgorithmNegotiation <BlockNegotiation |
OnlyStrongAlgorithmNegotiation | AllowAnyAlgorithmNegotiation>]
[-AllowSMIMESoftCerts <$true | $false>]
[-AllowStorageCard <$true | $false>]
[-AllowTextMessaging <$true | $false>]
[-AllowUnsignedApplications <$true | $false>]
[-AllowUnsignedInstallationPackages <$true | $false>]
[-AllowWiFi <$true | $false>]
[-AlphanumericDevicePasswordRequired < $true | $false>]
[-ApprovedApplicationList AppList]
[-AttachmentsEnabled <$true | $false>]
[-DeviceEncryptionEnabled <$true | $false>]
[-DevicePasswordEnabled <$true | $false>]
[-DevicePasswordExpiration <dd.hh.mm:ss | Unlimited>]
[-DevicePasswordHistory NumPasswords]
[-DomainController DCName]
[-IsDefaultPolicy <$true | $false>]
[-MaxAttachmentSize <SizeKB | Unlimited>]
[-MaxCalendarAgeFilter <All | TwoWeeks | OneMonth | ThreeMonths
| SixMonths>]
[-MaxDevicePasswordFailedAttempts <Unlimited>]
[-MaxEmailAgeFilter <All | OneDay | ThreeDays | OneWeek | TwoWeeks
| OneMonth>]
[-MaxEmailBodyTruncationSize <Unlimited>]
[-MaxEmailHTMLBodyTruncationSize <MaxSizeKB | Unlimited>]
[-MaxInactivityTimeDeviceLock <hh.mm:ss | Unlimited>]
[-MinDevicePasswordComplexCharacters MinNumberOfComplexCharacters]
[-MinDevicePasswordLength MinPasswordLength]
[-MobileOTAUpdateMode <MajorVersionUpdates | MinorVersionUpdates |
BetaVersionUpdates>] [-Organization OrganizationId]
[-Name Name]
[-PasswordRecoveryEnabled <$true | $false>]
[-RequireDeviceEncryption <$true | $false>]
[-RequireEncryptedSMIMEMessages <$true | $false>]
[-RequireEncryptionSMIMEAlgorithm <TripleDES | DES | RC2128bit
| RC264bit | RC240bit>]
[-RequireManualSyncWhenRoaming <$true | $false>]
[-RequireSignedSMIMEAlgorithm <SHA1 | MD5>]
[-RequireSignedSMIMEMessages <$true | $false>]
[-RequireStorageCardEncryption <$true | $false>]
[-TemplateInstance Instance]
[-UnapprovedInROMApplicationList AppList]
[-UNCAccessEnabled <$true | $false>]
[-WSSAccessEnabled <$true | $false>]
Usage
Set-ActiveSyncMailboxPolicy -Identity "Primary ActiveSync Mailbox Policy"
-AllowNonProvisionableDevices $false
-DevicePasswordEnabled $true
-AlphanumericDevicePasswordRequired $true
-MaxInactivityTimeDeviceLock "00:08:00"
-MinDevicePasswordLength "6"
-MaxDevicePasswordFailedAttempts "5"
