Deploying Windows Mobile 6 with Windows Small Business Server 2008

Transcription

1 Deploying Windows Mobile 6 with Windows Small Business Server 2008 Microsoft Corporation Draft: October, 2008 Abstract This document provides step-by-step instructions for deploying devices powered with Windows Mobile 6 in an IT infrastructure that is based on the Windows Small Business Server 2008 (Windows SBS 2008) server solution.

2 The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. Unless otherwise noted, the companies, organizations, products, domain names, addresses, logos, people, places, and events depicted in examples herein are fictitious. No association with any real company, organization, product, domain name, address, logo, person, place, or event is intended or should be inferred Microsoft Corporation. All rights reserved. Microsoft, Outlook, PowerPoint, Windows, Windows Media, and Windows Mobile are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. UPnP is a certification mark of the UPnP Implementers Corporation. All other trademarks are property of their respective owners.

3 Contents Deploying Windows Mobile 6 with Windows Small Business Server Windows Mobile Windows Mobile Before You Begin... 6 Skill Level... 6 Windows Mobile Requirements... 7 Server Requirements... 7 Process Steps... 8 Step 1: Install ActiveSync 4.5 or WMDC Step 2: Enable Mobile Services for Users... 9 Step 3: Configure the Firewall and Web Services Step 4: Install a Certificate Choose the Type of Certificate Configure the Certificate Option A: Using a Self-Issued Certificate Option B: Using a Third-party Certificate Step 5: Configure Windows Small Business Server Install the Exchange Server ActiveSync Web Administration Tool Assign the certificate to the SBS Web Applications site Step 6: Configure Device Synchronization Option A: Over-the-air Device Synchronization Option B: Device Synchronization using ActiveSync 4.5 or WMDC Device Synchronization Using ActiveSync Device Synchronization Using WMDC Step 7: Test the Deployment Test Over-the-Air Synchronization Test Direct Push Remote Management Remote Device Wipe Device Security Policies Conclusion Troubleshooting Installing ActiveSync on Client Computers Configuring ActiveSync Synchronizing the Mobile Device Some Users Cannot Synchronize... 35

4 No User Can Synchronize Accessing the Exchange Server ActiveSync Web Administration Tool Deploying Certificates Obtaining a Certificate Creating a Certificate Signing Request Configuring the Device Direct Push Messages Device Policy Synchronizing Related Links... 40

5 5 Deploying Windows Mobile 6 with Windows Small Business Server 2008 Microsoft Windows Small Business Server 2008 (Windows SBS 2008) is a new server operating system that provides small businesses with intuitive management of day-to-day tasks, comprehensive network and data protection, simplified device setup, and rich business productivity features all within the high-performance Windows environment. By deploying Windows Mobile 6 devices with Windows SBS 2008, you can offer your highly-mobile employees (such as sales staff or field personnel) access to , contact lists, calendars, and documents stored on the company Web site. You can also administer mobile devices as if they were on the local network, installing certificates or remotely wiping devices for security purposes. Windows SBS 2008 also includes the functionality that provides a single, simple, consolidated, and secure entry point for your mobile devices into the small business network. Use the instructions outlined in this document to learn how to deploy Windows Mobile 6 devices within your Windows SBS 2008 environment. Windows Mobile 6 Windows Mobile 6 is the successor to Windows Mobile 5.0. It provides new features and tools to improve productivity, connectivity, and security. Some of the new features in Windows Mobile 6 include: The ability to view s in their Rich Text formats, with access to live links to Microsoft Office SharePoint or other Web sites. Windows Live for Mobile, which provides access to a rich set of services like Windows Live Messenger with the ability to hold concurrent chats with multiple people, send image or data files, record or send voice notes. The newest mobile versions of Microsoft Office, including Microsoft Office Outlook, Microsoft Office Excel and Microsoft Office PowerPoint. A new and improved user interface. Windows Mobile 6 delivers features such as: Direct Push Technology: Items received on the Microsoft Exchange server, such as new messages, calendar changes, contact changes, or task updates, are immediately sent to a device that is running Windows Mobile 6. Direct Push

6 6 Technology uses an IP-based Internet connection and does not use Short Message Service (SMS), a form of text messaging. SMS is used by the previous Always-up-todate (AUTD) synchronization process. Wireless support for contact information: This feature enables over-the-air lookup of global address list (GAL) information that is stored in Microsoft Exchange Server. Remotely-enforced security policy: You can remotely manage and enforce security settings on the mobile devices over-the-air. Local device wipe: This feature resets the device after a specified number of incorrect logon attempts. Remote device wipe: This feature allows the administrator to remotely reset a Windows Mobile 6 device. Windows Mobile 6.1 Windows Mobile 6.1, a subsequent release to Windows Mobile 6, includes enhancements that help make setting up your phone, text messaging, and checking e- mail easier than ever. Windows Mobile 6.1 contains new time-saving features through easier device navigation. Users can flag, delete or move groups of messages and keep track of conversations through threaded text messaging. Windows Mobile 6.1 provides business professionals increased security safeguards for their Windows Mobile with the support for advanced mobile policies that help businesses manage and administer security for phones. Microsoft Exchange Server 2007 includes a new service called Autodiscover, which is supported by Windows Mobile 6.1 devices. The Autodiscover service enables administrators to configure these devices easily after a user signs in to their mailbox. Before You Begin Skill Level The intended audience for this document is Windows Small Business Server administrators. To complete the steps in this document, you should be familiar with Windows Small Business Server and have a basic understanding of Windows Mobile.

7 7 Windows Mobile Requirements In order to deploy a Windows Mobile 6 messaging solution within a Windows Small Business Server 2008 environment, make sure your setup meets the necessary requirements as shown in Table 1. Table 1: Mobile Device Requirements Requirement Windows Mobile device Wireless data connectivity Description A mobile device with Windows Mobile 6 or Windows Mobile 6.1 The mobile device must have access to the Internet. Wireless data connectivity can be provided through either of these methods: GPRS Wi-Fi network access Microsoft ActiveSync 4.5 (for Windows XP) Windows Mobile Device Center 6.1 (for Windows Vista) ActiveSync or Windows Mobile Device Center (WMDC) is the client-side tool required when a Windows Mobile device is synchronized with the client computer or configured with the Exchange Server on the network. You can download ActiveSync 4.5 from the Microsoft Web site ( WMDC is included in Windows Vista and is updated through Windows Update. If the client computer does not have the latest version of WMDC installed, you can download Windows Mobile Device Center 6.1 (WMDC) from the Microsoft Web site ( Server Requirements In addition to the Windows Mobile requirements above, make sure you have the following server-side software.

8 8 Table 2: Server Requirements Requirement Description Windows Small Business Server 2008 A server installed with Windows SBS Exchange Server ActiveSync Web Administration tool A third-party trusted Certificate or a Self-Issued certificate You can download the Exchange Server ActiveSync Web Administration tool from the Microsoft Web site ( A trusted certificate from a Certificate Authority is required to validate the session between the mailbox on Windows SBS 2008 and the Windows Mobile device. If a third-party trusted certificate is not available, you can follow the steps provided below to install the Windows SBS 2008 selfissued certificate onto Windows Mobile devices. Process Steps To deploy a mobile device on your Windows SBS 2008 network, complete the following steps: Step 1: Install ActiveSync 4.5 or WMDC 6.1 Step 2: Enable mobile services for users Step 3: Configure the firewall and Web services Step 4: Install a certificate Step 5: Configure Windows Small Business Server 2008 Step 6: Configure device synchronization Step 7: Test the deployment Step 1: Install ActiveSync 4.5 or WMDC 6.1 Windows Mobile device can be configured to synchronize over-the-air with an Exchange Server on Windows Small Business Server This will require the device to be on a data plan. The user must have the necessary information required to be able to configure the device to connect to the Exchange Server. The device user must be provided with the Exchange Server address, user name, password, and domain name. Configuration

9 9 instructions should be carried out after the server has been configured for Windows Mobile device over-the-air access. These instructions are provided in Step 6: Configure device synchronization. Mobile devices can also be connected to a client computer to copy files, install applications, and synchronize data directly with the computer. To exchange information between the mobile device to a client computer, you must install ActiveSync 4.5 on Windows XP client computers, or Windows Mobile Device Center (WMDC) for Windows Vista client computers. Manually install ActiveSync 4.5 or WMDC on client computers that will connect to a Windows Mobile device. Copy the setup file to each client computer and run the setup program. If you have not already downloaded the ActiveSync 4.5 setup file for Windows XP computers, download it from the Microsoft Web site ( Before you install ActiveSync 4.5 on any computer, ensure that the computer meets the minimum system requirements for ActiveSync 4.5, which you can find at the Microsoft Web site ( If you have not already downloaded the Windows Mobile Device Center setup file for Windows Vista, download it from the Microsoft Web site ( Before you install Windows Mobile Device Center on any computer, ensure that the computer meets the minimum system requirements for WMDC, which you can find at the Microsoft Web site Step 2: Enable Mobile Services for Users By default, new user accounts that are created in Windows SBS 2008 already have mobile services like Outlook Web Access and Exchange ActiveSync enabled. In case users are unable to access their Exchange mailbox from their Windows Mobile device, you can use the following steps to confirm that OWA and Exchange ActiveSync are enabled.

10 10 To ensure that Outlook Web Access is enabled for a user: 1. Open the Windows SBS Console, click Users and Groups, and double-click the user account. 2. Click Web Sites and ensure that Outlook Web Access check box is selected. Fig.1 Ensure that Outlook Web Access is enabled in the user s properties dialog box Outlook Web Access need not be enabled in order to provide a Windows Mobile device access to a user s Exchange mailbox. This feature will, however, help troubleshoot connectivity issues. To ensure that Exchange ActiveSync is enabled for a user: 1. Click Start, and then click All Programs. Select Exchange Server 2007 and click Exchange Management Console. 2. In the console tree of the Exchange Management Console, expand Recipient Configuration and select Mailbox.

11 11 3. Double-click the user s Display Name in the result pane. This will open the user s properties dialog box. 4. Click the Mailbox Features tab. View the Exchange ActiveSync status. If it is disabled, select Exchange ActiveSync and click Enable. Fig. 2 Ensure that Exchange ActiveSync is enabled in user s Mailbox Features Direct Push Technology Direct Push provides users with immediate access to new information or changes to information that is stored on the Exchange server, including , calendar, contacts, and tasks information. Exchange ActiveSync, which uses Direct Push technology, keeps mobile devices up to date with the user s Exchange mailbox. Direct Push only functions over a HTTPS connection. Exchange ActiveSync is enabled by default.

12 Step 3: Configure the Firewall and Web Services The firewall used in the Windows SBS 2008 network must be configured to allow and forward incoming secure HTTP (HTTPS) connections to the Windows SBS 2008 server. This enables mobile devices to access information stored on the Microsoft Exchange Server over-the-air using Exchange ActiveSync. HTTPS traffic is enabled on port 443, by default in Windows Firewall in Windows SBS If your network includes a third-party hardware/software firewall, you will need to configure it to direct HTTPS traffic to the Windows SBS 2008 server. The Connect to the Internet wizard in Windows SBS 2008 will automatically configure firewalls that support Universal Plug and Play (UPnP). 12 To start the Connect to the Internet wizard: 1. Open the Windows SBS 2008 Console. 2. Click the Network tab. 3. On the Network page, click Connectivity, and then click Connect to the Internet in the task pane to start the wizard. If you have already followed the instructions in the Connect to the Internet wizard and the server is unable to receive HTTPS traffic, click Fix my network in the tasks pane of the Connectivity page. Follow the instructions in the wizard to fix any network issues. The wizard tries to fix network-related issues by resetting services to their previous working states. If you are using a firewall that does not support UPnP, you will need to manually configure your firewall to direct incoming traffic on TCP port 443 to the IP address of the server that is running Windows SBS Ensure that you grant access rights to the correct set of users within the third-party hardware/software firewall policy, so that only authorized users will be able to access the Internet through the firewall. Unlike Windows SBS 2003 R2 Premium Edition, Windows SBS 2008 Premium does not include Microsoft Internet Security and Acceleration (ISA) Server. Microsoft ISA Server can be used in a Windows SBS 2008 network, but will have to be installed on a separate server (that meets its installation requirements).

13 Step 4: Install a Certificate This section provides guidance on choosing and configuring a certificate. A certificate helps securely synchronize data by using the Secure Sockets Layer (SSL) protocol. It is important to use SSL to help secure communications between the mobile device and the server. Choose the Type of Certificate You can use either of the following two certificate options: Third-party certificate (recommended): You can buy and install a certificate from a trusted root certification authority (CA). Windows Mobile 6 devices ship with a variety of trusted root certificates from major certificate vendors that are included in the certificate store of the device. Using a third-party trusted certificate is preferred over using a self-issued certificate to reduce the burden of certificate management. However, you can use a self-issued certificate if it isn t possible to use a third-party certificate. Self-issued certificate: You can use the self-issued certificate generated by Windows Small Business Server Windows Mobile 6 contains two certificate stores; the Device Store that contains all the factory-installed Root certificates, and the User Store into which additional certificates can be saved. Self-issued certificates generated by Windows SBS 2008 will be saved in this User Store. The following table summarizes the advantages and disadvantages of using these two types of certificates on Windows Mobile devices. Choose the certificate type that is best for your environment. 13

14 14 Table 3: Advantages and Disadvantages of Third-party and Self-issued Certificates Choice Advantages Disadvantages Third-party certificate No additional configuration is required on the Windows Mobile device. Can be used with all Windows Mobile Classic, Professional and Standard devices. Provides additional benefits with other Windows SBS 2008 features, such as Outlook Web Access, Remote Web Workplace, and Outlook Anywhere (RPC over HTTP). Must be purchased, and may require a recurring fee for renewals. Can cost approximately $25 to $1,000 annually. Cannot be installed immediately, because it requires independent verification of your company information before it is issued. However, there are some third-party certificates that can be immediately installed but these are exceptional cases. Self-issued certificate generated by Windows SBS 2008 Automatically generated by Windows SBS 2008 during installation. No additional cost. Fewer configurations are required in Windows SBS Requires additional configuration on the device. The certificate must be installed on each device. The certificate needs to be renewed after five years. A third-party certificate offers additional benefits of convenience to users of a Windows SBS 2008 network. For example, they can use Outlook Anywhere, Outlook Web Access, Remote Web Workplace, Microsoft Windows SharePoint Services, or other secure web sites hosted on the Windows SBS 2008 server without having to specifically install the self-issued certificate on the device. Configure the Certificate Depending on the type of certificate that you select, for Exchange ActiveSync synchronization to work correctly, you need to implement either of the following certificate configurations.

15 15 A certificate first needs to be requested (in case of a third-party root certificate) or generated (in case of a self-issued certificate). The certificate should then be installed on the mobile device. In case of a third-party certificate, the certificate may be present by default in the Windows Mobile certificate store. Make sure the third-party certificate s certificate chain is validated by a provider that is listed already in the device certificate store. To view a list of the certificate providers supported by Windows Mobile 6 devices, visit the Microsoft Web site. Option A: Using a Self-Issued Certificate By default the self-issued certificate generated by the private Certificate Authority in Windows SBS 2008 is used to authenticate the internal Web site. The self-issued certificate needs to be installed on the Windows Mobile device. A certificate installer package in Windows SBS 2008 makes it easier to deploy the certificate onto Windows Mobile devices. The certificate installer tool in Windows SBS 2008 is designed to work with Windows Mobile 6 (and higher) devices. Configure a Self-Issued Certificate This section describes how to install the self-issued certificate that is already created by Windows SBS 2008, onto each mobile device. From a computer that is in the Windows SBS 2008 network, perform the following steps to install the certificate on a mobile device: 1. Open a Web browser and type the following address into the address bar: \\sites\public\downloads Only download the certificate installer package from a computer that is directly connected to your organization's network. Do not download this package over the Internet. 2. Copy the file Install Certificate Package.zip to the desktop. If you need to install the tool on a computer that is not joined to the Windows SBS 2008 domain, copy the tool to portable storage media and continue from Step 3 onwards. 3. Open Windows Explorer navigate to the location where you copied Install Certificate Package.zip. 4. Right-click Install Certificate Package.zip, and click Extract All.

16 16 5. In the Extract Compressed (Zipped) Folders dialog box, type the folder location where you want to extract the files, and then click Extract. 6. Open the folder where the extracted files are located, and then double-click Install Certificate. 7. Ensure that the Windows Mobile device is connected to the client computer. Select Install the certificate on my mobile device, and then click Install. Fig. 3 The Certificate Installation tool installs the self-issued certificate to a Windows Mobile 6 device Option B: Using a Third-party Certificate Installing a third-party certificate requires you to purchase one from a trusted Certificate Authority. The Add a Trusted Certificate Wizard helps you generate a request for a trusted certificate from a certificate authority by using the information that you provided during installation. Some certificate authorities make the trusted certificate available immediately, while others validate the information with the user offline before providing the trusted certificate. For those providers, you can rerun the wizard to install the trusted certificate after you receive it. Generate a Third-party Certificate Request This process requires you to purchase a third-party trusted certificate. Additionally you will also need to: 1. Request for a third-party trusted certificate 2. Install the third-party trusted certificate Request for and install a third-party trusted certificate: 1. Open the Windows SBS 2008 Console. 2. Click Network, and then click the Connectivity tab.

17 17 3. Click Add a trusted certificate in the task pane. 4. Review the information on the Welcome page, and then click Next. 5. On the Get the certificate page, click I want to buy a certificate from a certificate provider, and then click Next. 6. Verify the information that is used to generate the request for the certificate, and change any of the information that is not correct. If all of the information is correct, click Next. If any of the information that is used to purchase a certificate is incorrect, the only way to change the information is to purchase another certificate. 7. Windows SBS 2008 generates the encoded information that the certificate authority requires, also referred to as the Certificate Signing Request (CSR) code. On the Generate a certificate request page, click Copy, and then paste the information into the space that is provided on the certificate authority's Web site, or save the encoded information to a text file. 8. Return to the wizard, and then click Next. 9. If you do not receive the certificate information from the certificate authority immediately, do the following: a. Verify that My certificate provider needs more time to process the request is selected, and then click Next. b. On Importing the certificate request is postponed page, click Finish. You should use third-party certificates only from a CA that has a root certificate present on the root store of Windows Mobile powered devices. Install the trusted third-party certificate on the server: If third-party certificate authority provides the certificate immediately or if you receive the information later, you need to do the following: 1. Open the Windows SBS Console. 2. Click Network, and then click the Connectivity tab. 3. Click Add a trusted certificate in the task pane, and then click Next. 4. Click I have a certificate from my certificate provider, and then click Next. 5. On the Import the trusted certificate file page, paste the information you received from the provider or browse to the location where you saved the trusted certificate file, and then click Next. 6. On The certificate file is installed page, click Finish.

18 18 Install a third-party certificate on a Windows Mobile device: If the third-party certificate authority is already present in the Windows Mobile certificate store, you may not need to transfer and install the certificate file on the device. Step 5: Configure Windows Small Business Server If you have already followed the instructions posed by the Connect to the Internet and Set up your Internet Address wizards, further server-side configurations will usually not be required. Essential services such as mail, OWA and the local firewall are configured to be fully functional after installation. Install the Exchange Server ActiveSync Web Administration Tool To take advantage of the remote-device wipe and the password enforce feature, you should install the Exchange Server ActiveSync Web Administration tool. The tool is available for download at the Microsoft Web site ( After you install the Exchange Server ActiveSync Web Administration tool, ensure that the installation was successful. To do this, open Microsoft Internet Explorer on the server, browse to and log on to the console by providing domain administrator credentials. Assign the certificate to the SBS Web Applications site If the trusted third-party certificate or the self-issued certificate needs to be re-assigned to the OWA site, you can use the Fix My Network wizard. This wizard opens the Fix My Network message box, which finds potential network issues and attempts to fix them by resetting the affected networking services to their previous working states. If a trusted certificate is found or a valid trusted certificate exists, the wizard binds the certificate to the Web site (including the TS Gateway). If no trusted certificate is found, the self-issued certificate is bound to the Web site. The certificate will be used to validate the connection with a Windows Mobile device.

19 19 You should now be able to access the Outlook Web Access page locally by typing the following address in your Web browser s address bar: After entering the OWA page, you may receive a certificates error. Click the error message, click View Certificates. The certificate s information will be displayed. Click Install Certificate so that you do not receive the error again while accessing the OWA home page. Step 6: Configure Device Synchronization Windows Mobile devices can be synchronized with Microsoft Exchange Server 2007 on Windows SBS 2008, in either of the following ways: a) Over-the-air from a Windows Mobile device b) Over the network, via a client PC with Windows Mobile Device Center or ActiveSync Option A: Over-the-air Device Synchronization You can use ActiveSync on a Windows Mobile 6 device to synchronize directly with their Exchange Server. The Windows Mobile device user will need to have the Exchange Server address, domain name, user name and password in order to successfully connect to the mailbox. The following steps will configure a Windows Mobile 6 device to connect to the user s mailbox on Windows SBS To connect a Windows Mobile 6 device to an Exchange Server over-the-air: 1. On the Home screen, choose Start, choose Programs, choose ActiveSync. 2. Choose Menu, and then choose Configure Server. If the mobile device has not yet been synchronized with Exchange Server, Add Server Source will be the available option. Fig. 4 Choose Add Server Source to edit server settings

20 20 3. In Edit Server Settings, enter the name of the server that is running Exchange, and then choose Next. Fig. 5 Enter the name of the server that hosts the user s mailbox 4. Enter the user name, password, and domain name, and then choose Next. Select the Save password check box. Fig. 6 Enter the user name, password, and domain name 5. Select the check boxes for the types of information items that you want to synchronize with Exchange Server. To change available synchronization settings, select the type of information that you want to synchronize, and then choose Settings.

21 21 Fig. 7 Select the items you want to synchronize with the Exchange Server 6. Choose Finish. The Windows Mobile device will try accessing the Exchange Server mailbox with the user credentials entered earlier, create a partnership and begin the synchronization process. Option B: Device Synchronization using ActiveSync 4.5 or WMDC Depending on the operating system that the client computer is running, device synchronization will happen using either ActiveSync (for Windows XP clients), or WMDC (for Windows Vista clients). Device Synchronization Using ActiveSync This section helps you configure a Windows Mobile device to synchronize with the server and with client computer that have Microsoft ActiveSync 4.5 installed on Windows XP. For guidance on installing ActiveSync 4.5, see Step 1: Install ActiveSync 4.5, earlier in this document. To configure a Windows Mobile device to synchronize with Windows SBS Connect the Windows Mobile device to a client computer. The connection method depends on the capabilities of the device and the computer, and it typically uses a USB, serial, Bluetooth, or infrared port. ActiveSync 4.5 must be installed on the Windows XP client computer.

22 22 2. After connecting the device to a client computer, the Synchronization Setup Wizard opens automatically on the client computer. If the device has already been configured once, the screens are different than those shown here. 3. Click Next on the Welcome page. 4. On the Synchronize directly with a server page, select the Synchronize directly with a server running Microsoft Exchange Server check box, and then click Next. Fig. 8 Configure the Windows Mobile device to synchronize with a Microsoft Exchange Server when not connected to a computer 5. On the Exchange server credentials page, type the public DNS name of the server and the logon credentials of the user. Select the This server requires an encrypted (SSL) connection and the Save password check boxes. Click Next.

23 23 Fig. 9 Enter the credentials that will authenticate the user to a Microsoft Exchange Server Fig. 10 ActiveSync attempts to connect to the server. If you receive any errors during the attempt, see Troubleshooting, later in this document. 6. On the Synchronization Options page, select the items that you want the device to synchronize. Select Exchange Server as the Source for Contacts, Calendar, Tasks, and . Additional items, such as Media and Favorites, can be synchronized with the client computer only.

24 24 Fig. 11 Select Exchange Server as the Source for the items that will be synchronized with the server 7. Click Next, and then click Finish to complete the wizard. Device Synchronization Using WMDC This section helps you configure a Windows Mobile device to synchronize with the server and with client computers that have Windows Mobile Device Center installed on Windows Vista. For guidance on installing WMDC, see Step 1: Install ActiveSync 4.5 or WMDC, earlier in this document. To configure a Windows Mobile device to synchronize with Windows SBS Connect the Windows Mobile device to the client computer. The connection method depends on the capabilities of the device and the computer, and it typically uses a USB, serial, Bluetooth, or infrared port. WMDC must be installed on the Windows Vista client computer.

25 25 2. After connecting the device to the client computer, click Start, then click Programs and click Windows Mobile Device Center. If the device has already been configured once, the following screens will be different than those shown here. 3. Click Set up your device on the Home page. Fig. 12 Use the Windows Mobile Device Center to set up your device 4. The following page will prompt you to check mark the elements that you want to synchronize. On this page, you will see Contacts, Calendar, , tasks and more. Click Next to proceed.

26 26 Fig. 13 Select the items that will synchronize with the Microsoft Exchange Server 5. This page will prompt you to enter information specific to your Exchange Server. On this page, you will need to enter the Server address, the User name, the Password and the Domain for your Exchange Server. If your server requires an encrypted (SSL) connection, you will need to select the This server requires an encrypted (SSL) connection check box. You can choose to save your password if you wish to. Click Next to proceed. WMDC will now attempt to connect to the server. Fig. 14 Enter the server credentials that will authenticate the user to a Microsoft Exchange Server

27 27 6. You will see a progress bar as WMDC attempts to set up a partnership between your Windows Mobile device and the Exchange Server. Fig. 15 The WMDC uses the credentials to set up a partnership with the mail server 7. After the synchronization is complete, the application will return to the Home screen, from where you can access Programs and Services, media files, File Management, and Mobile Device Settings. Fig. 16 Use the Home screen to access services and device settings

28 28 8. Now click Mobile Device Settings to expand a list of further options. Click more>> to proceed. Fig. 17 Expand Mobile Device Settings to configure sync settings 9. Click Change content sync settings. Fig. 18 Configure the content sync settings in the WMDC

29 This takes you the screen from which you can select the synchronization settings for your Windows Mobile phone s content. Fig. 19 Configure the sync settings for each item through the WMDC Step 7: Test the Deployment This section provides guidance on testing the deployment of the mobile devices. Test Over-the-Air Synchronization To test the configuration of over-the-air ActiveSync on the device 1. Ensure that the device is not connected to the client computer or to a wireless LAN with Internet access. 2. Ensure that wireless data connectivity to the Internet, such as GPRS, is available on the device. 3. Open ActiveSync on the device and begin to synchronize. The device connects to the Internet, if it is not already connected, and it synchronizes the items that you selected when you configured ActiveSync. If the synchronization does not work for any reason, see "Troubleshooting," later in this document, for more information.

30 30 Test Direct Push To test the configuration of Direct Push 1. Ensure that the mobile device is not connected to a client computer or to a wireless LAN with Internet access. 2. Ensure that wireless data connectivity to the Internet, such as GPRS, is available on the device. 3. Send a message to the user account for which the device is configured. 4. Verify that the device receives the new message immediately. Direct Push is not used for synchronization when the device is connected to a computer or to a wireless LAN with Internet access. Remote Management Windows Mobile 6 offers several new features that help you better manage mobile devices and better protect data. This section provides guidance on using the following two features: Remote device wipe Device security policies Remote Device Wipe The remote device wipe feature enables you to erase all information on a device remotely. This prevents any compromise of corporate data if a user misplaces a device. Before testing this feature, ensure that any important data is on the Windows Mobile device is correctly backed up. To remotely wipe all information from a device 1. On any computer in the network, open Internet Explorer, browse to and then log on using domain administrator credentials. 2. Click Remote Wipe. 3. Type the mailbox name or the default SMTP address of the user whose device you want to wipe, and then press ENTER.

31 31 Fig. 20 Use Remote Device Wipe to initiate a remote wipe for specific devices 4. Click the Wipe link next to the device name that you want to wipe remotely. If you plan to ever reuse the same device, go back to the Mobile Admin site and cancel the wipe command after the wipe is successful. Device Security Policies You can enforce device security policies on Windows Mobile 6 devices, such as password requirements and device feature too. This helps protect information that is stored on the mobile devices. You can configure device security policies on Windows Small Business Server 2008 with Exchange Server To define and enforce security policies for mobile devices 1. On the server, open the Exchange Management Console. 2. Expand Organization Configuration, expand Client Access. 3. Right-click the Exchange ActiveSync Mailbox Policy, and click Properties in the Actions pane. To create a new mailbox policy, 1. Click New Exchange ActiveSync Mailbox Policy in the Actions pane. The new policy can be assigned to each device from the user properties. 2. Expand Recipient Configuration, select Mailbox. 3. Double-click the user to view properties. Click the Mailbox Features tab. 4. Select Exchange ActiveSync, click the Properties button.

32 32 5. Click Browse to change the Exchange ActiveSync Mailbox Policy assigned to the device. Fig. 21 Configure user device access by editing the mailbox policy To view a list of the default Exchange ActiveSync policy settings, visit the Microsoft Web site ( Conclusion Windows Small Business Server 2008 includes several enhancements that make it easier for system administrators to deploy Windows Mobile devices on their network. New wizards such as the Internet Address Management and Add a Trusted Certificate simplify the process of running configuration tasks, and provide useful information during each stage of the deployment. You will also find it easier to identify and resolve network- and certificate-related issues with UI-driven troubleshooting procedures such as Fix my Network. With the help of this document, you will be able to almost effortlessly deploy Windows Mobile devices in a Windows SBS 2008 network.

33 33 Troubleshooting This section provides some troubleshooting steps and tips to resolve a number of issues that may occur while deploying Windows Mobile devices. The troubleshooting steps and tips are categorized into the following sections: Installing ActiveSync on client computers Configuring ActiveSync Synchronizing the mobile device Accessing the Exchange Server ActiveSync Web Administration tool Deploying certificates Configuring the device Installing ActiveSync on Client Computers If ActiveSync 4.5 is not installed successfully on a client computer, try the following: Ensure that you are logged on as a local administrator on the computer. The software cannot be installed without local administrative rights. If you are using Group Policy to install ActiveSync, ensure the following: The access control lists (ACLs) are set properly on the GPO. The Authenticated Users group must not be on the list, and the Windows SBS 2008 Mobile Users group must have Read and Apply Group Policy permissions checked. The GPO is linked to the proper organizational unit (OU). As long as a user account is configured to be part of the SBS-Users OU, it will be associated with the GPO by default. In this case, ActiveSync 4.5 will be automatically deployed on the client computers that are defined in the Group Policy. If you did not use the New User Setup wizards to create user accounts or if the user accounts are not in the SBS-Users OU for some reason, ActiveSync will not be installed when the users log on. Configuring ActiveSync The following are some errors that may occur while configuring ActiveSync: The following error indicates a problem with SSL connectivity with the server.

34 34 Fig 22 SSL connectivity issues may result in this error To troubleshoot this problem, see the section Check for Certificate-Related Problems, later in this document. When configuring the server, the following error indicates that the device cannot reach the server. The device has not reached the point of checking the certificate when this error occurs. Fig.19 The error indicates that the device is unable reach the server Check the firewall configuration and the IP connectivity. When configuring the server, the following error indicates that the device can reach the server, but there is a problem with the certificate. Fig. 23 The error indicates a problem with the security certificate Depending on the type of certificate you are using, perform one of the following: If you are using a third-party certificate, there is a problem with the server certificate. Try to access the server from a computer on the Internet by using the

35 35 steps in the section Check for Certificate-Related Problems, later in this document. If you are redirected to an SSL connection without a prompt for a certificate, ensure that the certificate is from a CA that is listed in the supported list for Windows Mobile. Windows Mobile devices do not support as many root CAs as Windows-based desktop computers. Your CA may be approved on Windows-based desktop computers but not on Windows Mobile devices. If you are prompted for a certificate and are not redirected to an SSL connection, verify that you have the right type of certificate (Web server certificate). You may also try reinstalling the certificate on the server by following the steps provided in the section Option B: Configure a Third-Party Certificate, earlier in this document. If none of these steps work, work with the CA to troubleshoot the issue. If you are using a self-issued certificate, you may have not installed the certificate on the device. Click Continue, and then install the certificate after the wizard finishes. You cannot synchronize until the certificate is installed on the device. If you have already installed the certificate on the device, there is a problem with the certificate. Use the steps in the section Check for Certificate-Related Problems, later in this document, to do the following: Ensure that the certificate on the server is installed correctly. Ensure that the certificate on the device is installed correctly. Try to reinstall the certificate to the device. Make sure that you receive a message on the device that the certificate has been successfully added to the root store. Synchronizing the Mobile Device Some Users Cannot Synchronize If some users cannot synchronize their devices, but others can, check the following: On the Exchange Features tab of the user account properties dialog, ensure that all mobile services are set to Enabled. Ensure that the device has Internet access by browsing to a Web site from the device. Some carriers require a SIM update to use data service. Check with your mobile operator for any such requirements. Ensure that the time and time zone is set properly on the device.

36 36 Some devices cache the IP address of DNS names. If your server uses a dynamic IP address in conjunction with Internet services such as DynDNS.org, you may need to reset the device if your IP address changes. No User Can Synchronize If no user can synchronize devices, do the following: Check for certificate-related problems. Check the Application event log. Check the firewall configuration. Check for Certificate-Related Problems To check for certificate-related problems, perform the following: If you are using a third-party certificate, check the certificate on the server. To do this, browse to on a computer (not connected to your LAN) that has Internet access, and ensure that you are redirected to an SSL connection without a prompt for a certificate. When you synchronize a device, click Attention Required on the ActiveSync screen. Review the error message to see if it refers to a certificate problem. If you are using a self-issued certificate, ensure that it is installed properly on the device. To do this, browse to on the device, and ensure that you are redirected to an SSL connection without a prompt for a certificate. You may receive an error when you try to install a self signed certificate on the device using the instructions in this document. In that case, try to manually export the certificate from a client computer that is connected to the server, rather than use the files in the \\server\clientapps\sbscert directory. You can export the certificate from the Trusted Root Certificate Authorities\Certificates folder in the Certificates console and then open it by running certmgr.msc from the command prompt. The certinst.exe tool is installed on many devices by the device manufacturers. You can use the tool to add a certificate by opening it on the device, as described in this document. Check the Application Event Log Check the application event log on the server for any errors related to ActiveSync. Check the Firewall Configuration To check the firewall configuration, check the following:

37 37 Ensure that port 443 is open and that traffic to that port is being directed to the server. Ensure that the checks for user-agent strings are disabled. Some firewalls have this enabled by default. Exchange ActiveSync does not send user-agent strings. Ensure that the timeout value is set high enough for SSL connections, typically 15 minutes. For more information, see Knowledge Base article , Enterprise firewall configuration for Exchange ActiveSync Direct Push Technology, at the Microsoft Web site ( If you are using ISA Server, you may need to implement a split DNS configuration to have a uniform experience both inside and outside the LAN. For more information, see "You Need to Create a Split DNS!" at the ISAServer.org Web site ( If you are using ISA Server 2004, and users can synchronize over-the-air but not from the cradle, you may be able to resolve some issues by configuring settings for ISA Server To configure settings specifically for ISA Server Open ISA Server Management. 2. In the console tree, expand Configuration, and then click General. 3. In the details pane, click Define Firewall Client Settings. 4. In the Firewall Client Settings dialog box, click the Application Settings tab, and then create the following three new application settings. Table 4. New Application Settings to Create in ISA Server Application Key Value WCESCOMM Disabled 0 WCESMGR Disabled 0 REPIMGR Disabled 0

38 Accessing the Exchange Server ActiveSync Web Administration Tool If you cannot access the Web site for the Exchange Server ActiveSync Web Administration tool, perform the following: When the tool is installed, a duplicate default Web site may be created if your original default Web site is bound to a specific IP address. To remove the duplicate default Web site, you can use do the following: a. Uninstall the tool. b. Change the IP address settings of the original default Web site to All Unassigned. c. Install the tool again. d. Revert the IP address settings of the default Web site back to the original values. To check the settings of the MobileAdmin virtual directory 1. In Internet Information Services (IIS) Manager, expand Default Web Site, click MobileAdmin, and then double-click SSL settings in the Features view in the Workspace area. 2. Ensure the Require SSL check box is cleared. Click Apply in the Tasks pane. 38 Ensure that the MobileAdmin virtual directory is running in the Exchange Application Pool. To ensure that the MobileAdmin virtual director is running in the Exchange Application pool 1. In Internet Information Services (IIS) Manager, expand Default Web Site in the Connections pane, right-click MobileAdmin, and then click Manage Application and select Advanced Settings. 2. Under General Settings, change the Application Pool to ExchangeApplicationPool. Deploying Certificates Obtaining a Certificate If you are having difficulty in obtaining a third-party certificate, perform the following: Ensure that your organization s Dun & Bradstreet (D&B) or other commercial directory information is up-to-date before you apply for a certificate. You can check

39 39 your D&B information at the Dun & Bradstreet Web site ( If you have a trade name, ensure that it is documented with your D&B information. Be prepared to provide proof of the trade name. Examples of items that are commonly accepted by root CAs for issuing a certificate include Articles of Incorporation, Business License, and D&B details. Depending on how you applied for the certificate, prepare as follows: Using a trade or DBA (Doing Business As) name: Provide a trading license, a copy of a utility bill, a bank statement, or else check with the trade name and the company name. Using a personal name: Provide a copy of your driver s license or passport. These requirements vary across CAs, but all CAs verify your identity before they issue a certificate. The information provided to the CA must exactly match the information you entered in the original certificate signing request. For example, if your articles of incorporation show an address that is different than the address you provide in the certificate signing request, the CA will not issue the certificate. Creating a Certificate Signing Request Perform the following checks when you are creating a certificate signing request: Ensure that there is no certificate on the server. If there is, you must remove it before you create the new certificate signing request. If you have installed a certificate from a CA on the server, ensure that the certificate signing request is not sent immediately to an online authority. This will not create a third-party certificate. Configuring the Device Direct Push Messages If messages are not being received immediately, ensure that the device is not cradled to a computer or connected to a wireless LAN. Direct Push works only with over-the-air synchronization. Device Policy If new policies pushed to the device are not applied, ensure that the device has synchronized since the policy was updated. Policies are applied during the ActiveSync cycle, and new policies are not applied until the next synchronization.