Mobile Messaging with Exchange Server 2007

[LEFT][CODE]http://www.msexchange.org/articles_tutorials/exchange-server-2007/mobility-client-access/mobile-messaging-exchange-server-2007-part1.html[/CODE]

[B][B][SIZE=3]Part 1: New Device Features and Improvements[/SIZE][/B][/B]


[B]Introduction[/B]

Built-in support for Exchange ActiveSync (EAS) in the Exchange Server product has been available since the Exchange Server 2003 RTM version. But it wasn’t until the release of Exchange Server 2003 SP2, in which the DirectPush technology (aka AUTD v2) as well as device security policies were introduced, that mobile messaging got widely deployed in the organizations around the world. With DirectPush, the Exchange Server product suddenly provided a true over-the-air (OTA) push experience, where new items synchronized immediately to a device whenever changes occurred in the mailbox.
Exchange Server 2007 brings mobile messaging to the next level by providing several new end-user features, improved security, and management options built directly into the Exchange Management Console (EMC). In this part one of this article series, we’ll take a look at the new mobile device features and improvements.


[B]Mobile Device Improvements[/B]

One of the goals for the Exchange Product group was to make the mobile device experience more similar to the Outlook client experience, so Exchange Server 2007 provides several new end-user features. Bear in mind though that most of the new features require Windows Mobile 6.0 (formerly known as Crossbow) on the device.
As most of you are aware, a combination of Windows Mobile 5.0 with MSFP and Exchange Server 2003 provided us with the following features:

[LIST][*]Direct Push[*]GAL Lookup[*]Tasks synchronization[*]Device policies[*]Local Wipe[*]Remote Wipe (via separate Web tool)[*]Outlook Mobile Access (OMA)[/LIST]
For details on these features, see my [URL="http://www.msexchange.org/tutorials/Exchange-2003-Mobile-Messaging-Part1-Microsoft-DirectPush-technology.html"]Exchange Server 2003 Mobile Messaging[/URL] article series.
In the following I’ll go through the new Exchange 2007 specific end-user features made available by a combination of Exchange Server 2007 and Windows Mobile 5.0 with MSFP or Windows Mobile 6.0.
[B]Support for HTML messages[/B]

As shown in [B]Figure 1[/B], messages can now be viewed in HTML format, which means that you now can read messages containing HTML code, tables etc. (such as is the format used in most newsletters such as the MSExchange.org newsletter).
[IMG]http://www.msexchange.org/img/upl/image0011177926643240.jpg[/IMG]
[B]Figure 1:[/B] HTML Message
In addition, a reply to a HTML formatted e-mail message will not disrupt formatting either, but will keep HTML e-mail threads intact. In the past, the mobile device converted these types of message to plain text. This was also true when you replied to or forwarded the HTML formatted message.
[B]Support for follow-up flags[/B]

As can be seen in [B]Figure 2[/B], Exchange Server 2007 also supports the use of quick flags. This means that quick flags set from a device will be synchronized to the mailbox, and will then be visible in both Outlook and OWA. The same is of course true the other way. A quick flag can be set by selecting the respective message, and then selecting the Quick Flag option under the Menu button in the lower right corner.
[IMG]http://www.msexchange.org/img/upl/image0021177926643256.jpg[/IMG]
[B]Figure 2: [/B]Message Follow-Up Flags
[B]Support for fast message retrieval[/B]

Fetching the body of an e-mail message was also possible in Exchange server 2003 SP2, but has been improved further with Exchange Server 2007. For example, you no longer need to select Mark for download or click Get the rest of this message, instead this will happen automatically in the background and thereby make the end-user experience even better.
[B]Meeting attendee information[/B]

You can now synchronize information about attendee availability to your mobile device, actually pretty much the same information as is available in the Outlook client. You can forward or reply to a meeting request (great feature if you’re running late for a meeting!) as well as see acceptance status of each attendee. In addition, you can even look up additional information in the GAL for each attendee.
[IMG]http://www.msexchange.org/img/upl/image0031177926643256.jpg[/IMG]
[B]Figure 3:[/B] Replying to or forwarding a Meeting
Another nice improvement is that busy time is shown in a similar way to Outlook 2007 and OWA 2007.
[IMG]http://www.msexchange.org/img/upl/image0041177926794318.jpg[/IMG]
[B]Figure 4:[/B] Improved Calendar
[B]Enhanced Exchange Search[/B]

With the enhanced Exchange search feature, you can now search your whole mailbox, instead of just the messages cached locally on the mobile device. The search feature supports rich/query filters, meaning you can search for messages using the test, data, from, to, flags, categories, attachments, importance and restricted to specific fields. The number of items returned can be constrained and/or paged through. Lastly, the search is lightning fast, since it’s only initiated from the device and physically executed on the server.
[IMG]http://www.msexchange.org/img/upl/image0051177926794318.jpg[/IMG]
[B]Figure 5: [/B]Searching in Mailbox on Server
In [B]Figure 6[/B] we can see the results from the search initiated in [B]Figure 7[/B].Notice how easy it is to skim through each message subject.
[IMG]http://www.msexchange.org/img/upl/image0061177926794318.jpg[/IMG]
[B]Figure 6: [/B]Message Search Results
[B]Windows SharePoint and file share document access[/B]

As is the case with OWA 2007, you can access documents stored on either a file server (UNC shares) or a SharePoint server. The sender simply needs to include the internal link to the document as shown in [B]Figure 7[/B].
[IMG]http://www.msexchange.org/img/upl/image0071177927011209.jpg[/IMG]
[B]Figure 7:[/B] Document Link in Message
Clicking on the document link in [B]Figure 7 [/B]will open the respective document using Word Mobile as shown in [B]Figure 8[/B] below.
[IMG]http://www.msexchange.org/img/upl/image0081177927011224.jpg[/IMG]
[B]Figure 8: [/B] Open Word Document
[B]Reset PIN/Password [/B]

With Exchange Server 2007, you can require that a device password be entered on a mobile device after a period of inactivity. If this device password should be forgotten at a later time, it’s possible to unlock the device by using a device recovery password. This password can be retrieved by the user himself (via OWA 2007), so the amount of calls to the helpdesk is reduced.
[IMG]http://www.msexchange.org/img/upl/image0091177927011224.jpg[/IMG]
[B]Figure 9: [/B] Resetting password/PIN
[B]Enhanced device security through password policies[/B]

With Exchange Server 2007 you can enhance the security of a Windows mobile device by configuring additional password requirement settings such as password history tracking, password expiration, and by prohibiting the use of passwords that are too simple (password complexity). You even have the option of encrypting the data stored on the mobile device (including data on the storage card). We’ll take a closer look at the device security passwords available in Exchange Server 2007 in part two of this article series, where we’ll uncover the new features and improvements on the server side.
[IMG]http://www.msexchange.org/img/upl/image0101177927327881.jpg[/IMG]
[B]Figure 10:[/B] Applying an EAS Mailbox Policy
[B]Autodiscover for over the air (OTA) provisioning[/B]

Like Outlook 2007, Exchange 2007 ActiveSync supports the new web-based AutoDiscover service. Support for AutoDiscover simplifies provisioning, as you only need to specify the e-mail address and password when configuring the device.
[B]Support for Out of Office configuration[/B]

Like with Outlook 2007 and OWA 2007, you can set Out of Office (OOF) messages directly from your mobile device. The OOF messages are saved directly to the Exchange 2007 server, so that an OOF message set on a mobile device can be seen in Outlook and OWA as well.
[IMG]http://www.msexchange.org/img/upl/image0111177927327881.jpg[/IMG]
[B]Figure 11:[/B] Out of Office Assistant
[B]Discontinued or Missing Features[/B]

I bet you agree this is a pretty comprehensive list of new features and improvements. Unfortunately, there are also a few features that didn’t make it into the RTM version of Exchange Server 2007. Here is a list of those features:
[B]Always-Up-To-Date version1 (AUTD v1)[/B]
With Exchange Server 2007, the Exchange Server product no longer supports AUTD V1. AUTD V1 made it possible to keep your device up to date by generating an Exchange store event in the user’s mailbox. When the store event detected a change in the mailbox, it triggered a Short Message Service (SMS) control message, which was sent to the user’s mobile device. When the device received the SMS message it initiated synchronization with the Exchange server. The idea behind the AUTD technology was good, but unfortunately it didn’t work very well in reality, at least not in Europe where very few mobile operators supported AUTD v1. Microsoft IT became aware of this problem when they deployed Exchange 2003 based mobile messaging in their own organization – an organization spread all over the world.
[B]Information Rights Management (IRM)[/B]
Originally, the plan was to include IRM support for mobile devices in the RTM version of Exchange Server 2007, but because of some stability issues in rare situations, this feature was removed just before its release. IRM will be back when Exchange Server 2007 SP1 is released.
[B]Outlook Mobile Access (OMA)[/B]
OMA has been discontinued completely and will therefore not be back with Exchange Server 2007 SP1. I’m certain only a very few of us will miss this, should I say, a bit clumsy web-based mobile device web mail client.
[B]Support for S/MIME[/B]
Like in the case with OWA 2007, unfortunately the RTM version of Exchange Server 2007 doesn’t have support for S/MIME. This is not because the feature has been dropped, but due to the fact that the Exchange Product group simply didn’t have the time to finish it before its release. I am sure many of us would not have had any issues waiting a few more months for the RTM version, if S/MIME for OWA 2007 and Windows mobile devices were included. S/MIME support will be back when Exchange Server 2007 SP1 is released.
[B]Conclusion[/B]

As you have seen throughout this article, several new device features have been introduced with Exchange Server 2007. Bear in mind though that the more exciting new features require Windows Mobile 6.0 on the device. This is a shame for organizations that are already using devices running Windows Mobile 5.0 and earlier, especially because there’ll be no way of upgrading these devices to Windows Mobile 6.0. The good thing is that most of the new devices released today are running Windows Mobile 6.0.



[/LEFT]

[LEFT][CODE]http://www.msexchange.org/articles_tutorials/exchange-server-2007/mobility-client-access/mobility-client-access/mobile-messaging-exchange-server-2007-part2.html[/CODE][B][SIZE=3][B]Part 2: Managing Mobile Devices[/B][/SIZE][/B]


[B]Introduction[/B]

In part one of this two part article series on mobile messaging with Exchange Server 2007, we uncovered the new mobile device features and improvements available with a combination of Windows Mobile 6.0 devices and Exchange Server 2007. In this part two we’ll take a look at the new features and improvements that have been made available when it comes to managing mobile devices and Exchange ActiveSync enabled mailboxes.
Exchange ActiveSync (EAS) is enabled by default after an Exchange 2007 Client Access Server (CAS) has been deployed in your organization. In addition, EAS is enabled for all user mailboxes. This means that once you apply an SSL certificate that’s trusted by the mobile devices to the Default Web Site in IIS, your mobile device users can create an EAS profile and immediately begin to synchronize the device with their respective mailbox. Like Exchange 2003, Exchange 2007 still uses the virtual directory called Microsoft-Server-ActiveSync in IIS as the connection point for the mobile devices.
Although not much has changed when it comes to the direct push, I thought it would be a good idea to refresh your memory (just in case). [B]Figure 1[/B] below shows you how an Exchange 2007 CAS server communicates with a Windows mobile 5.0 with MSFP or 6.0 device.
[IMG]http://www.msexchange.org/img/upl/image0021179310738678.jpg[/IMG]
[B]Figure 1:[/B] Direct Push Technology Being the Scene
As you can see, direct push works by keeping an HTTPS connection alive between a mobile device and the Exchange 2007 CAS. Because the direct push technology uses long-standing HTTPS requests, it’s important that both your mobile carrier and your firewall are configured with a time-out value of a default of 15 to 30 minutes. If a short time-out value is configured, it will cause the device to initiate a new HTTPS request much more frequently, which not only can shorten battery life on your device but also be more expensive, since more data will be transferred. If the firewall solution in your organization is based on ISA Server 2004 or 2006, follow the steps mentioned in [URL="http://support.microsoft.com/kb/905013"]MS KB article 905013[/URL].
[B]Note
[/B]For in-depth coverage of direct push, see [URL="http://www.msexchange.org/tutorials/Exchange-2003-Mobile-Messaging-Part1-Microsoft-DirectPush-technology.html"]this article[/URL] from my Exchange 2003 Mobile Messaging series.


[B]Exchange ActiveSync Policies[/B]

Unlike Exchange Server 2003 where the mobile device security policy settings were applied to all EAS users in the Exchange organization (except those added to the exception list), Exchange Server 2007 supports multiple EAS mailbox policies. This allows you as an Exchange administrator to assign EAS mailbox policies to sets of users, for example at a country or department level, or even based on distribution group membership.
In order to create an EAS mailbox policy using the Exchange Management Console (EMC), select the Client Access node under Organization Configuration in the navigation tree. Now click New Exchange ActiveSync Mailbox Policy in the Action pane as shown in [B]Figure 2[/B].
[IMG]http://www.msexchange.org/img/upl/image0031179310738678.jpg[/IMG]
[B]Figure 2: [/B]New Exchange ActiveSync Mailbox Policy action
The New Exchange ActiveSync Mailbox Policy wizard will appear ([B]Figure 3[/B]). We now need to specify a name for the policy, and then select whether or not non-provisionable devices should be allowed to synchronize. What this basically means is whether legacy devices that don’t support the AutoDiscover service to connect to the Exchange 2007 Client Access Server (CAS) should be allowed to synchronize. In addition, we can specify whether it should be allowed to download attachments to a device.
[IMG]http://www.msexchange.org/img/upl/image0051179310738678.jpg[/IMG]
[B]Figure 3:[/B] New Exchange ActiveSync Mailbox Policy Wizard
Next we have to specify the password configuration settings. Several of these should be familiar to those of you who have deployed mobile messaging solutions based on Exchange Server 2003 SP2.
[B]Require alphanumeric password[/B]
Enable this option to require a strong alphanumeric password that contains both numeric and non-numeric characters.
[B]Enable password recovery[/B]
Enabling this option enables password recovery for the mobile device. The users can look up the recovery password in order to unlock their device using Outlook Web Access (OWA) 2007. In addition, you can as the Exchange administrator look up the recovery password via the EMC.
[B]Require encryption on device[/B]
Enabling this option will require a device to be encrypted, which will increase the security on the device significantly. All information including any data held on the storage card will be encrypted.
[B]Allow simple password[/B]
Enabling this option will allow users to use simple numeric passwords such as 8888.
[B]Minimum password length[/B]
Enabling this option will allow you as an Exchange administrator to specify a minimum password length. Bear in mind that the longer the password is the more the security is increased, but this will also decrease device usability.
[B]Time without user input before password must be re-entered (in minutes)[/B]
By enabling this option you as an Exchange administrator will have the option of specifying after how many inactive minutes the device should be locked and thereby require a password the next time the device is used. Setting this value too low will also affect device usability, so use it wisely.
[B]Password expiration[/B]
Enabling this option will allow you as the Exchange administrator to specify after how many days a password will expire. Don’t set this value too low as this will inspire the users to use weak passwords.
[B]Enforce password history[/B]
Finally we have the option of enabling password history and thereby force users to use new passwords when they expire.
When you have decided which values you want to set in your particular EAS mailbox policy, click New and voila the policy has been created as shown in [B]Figure 4[/B].
[IMG]http://www.msexchange.org/img/upl/image0071179311669834.jpg[/IMG]
[B]Figure 4: [/B]New Exchange ActiveSync Mailbox Policy listed in Exchange Management Console
By default an EAS policy will allow any mailbox user to which the particular policy has been assigned, to access documents on Windows file shares and SharePoint servers on the internal network. In order to deny users access to these documents from a Windows mobile device, open the property page for the policy, then de-select Windows File Shares and Windows SharePoint Services on the General tab ([B]Figure 5[/B]) and then click OK. As you can see, any other settings originally configured in the EAS policy can be changed from the Property page too, if required.
[IMG]http://www.msexchange.org/img/upl/image0091179311669834.jpg[/IMG]
[B]Figure 5:[/B] Property Page of EAS Policy
Now that we have created the EAS policy, the next step is to apply it to the respective mailboxes within the organization. This is done by opening the property page for the mailbox under the Recipient Configuration work center node. With the property page opened, select the Mailbox Features tab. Under this tab we can enable and disable the different client protocols for the mailbox, but since Exchange ActiveSync is enabled by default, let’s select Exchange ActiveSync and then click the Properties button as shown in [B]Figure 6[/B]. On the Exchange ActiveSync property page click Browse, select the EAS policy we just created and then make sure Apply an Exchange ActiveSync mailbox policy is checked. Click OK twice and the EAS policy has been applied to the mailbox.
[IMG]http://www.msexchange.org/img/upl/image0111179311669849.jpg[/IMG]
[B]Figure 6:[/B] Applying the EAS Policy to a User Mailbox
If you need to apply an EAS policy to, let’s say, hundreds or thousands of users, you would need to use Set-CASMAilbox cmdlet in the Exchange Management Shell (EMC). For example, applying the above EAS policy to all mailbox users, run the following command:
[I]Get-Mailbox | Set-CASMailbox -ActiveSyncMailboxPolicy (Get-ActiveSyncMailboxPolicy "Exchange Hosting - General").Identity[/I] [B]Managing Mobile Devices[/B]

The first time a user synchronizes his mobile device with his mailbox using EAS, a mobile device partnership is established. When the partnership has been established, a new option called Manage Mobile Device is added to the context menu. This appears when right-clicking on a mailbox-enabled user beneath the Recipient Configuration work center as shown in [B]Figure 7[/B].
[IMG]http://www.msexchange.org/img/upl/image0131179311870021.jpg[/IMG]
[B]Figure 7: [/B] Manage Mobile Device option in Context Menu
When selecting Manage Mobile Device, the Manage Mobile Device wizard ([B]Figure 8[/B]) is launched. Here you can see the mobile devices that have an established partnership with the respective user mailbox. Under Additional device information you can see when the first synchronization occurred, when the last device wipe was sent, the acknowledge time for the device wipe, when the device was last updated with a policy as well as the last ping heartbeat in seconds (this should be between 15-30 minutes depending on how keep alive sessions have been configured at your mobile service provider and on your firewall). Finally you can (if enabled) see the recovery password here.
Under Action you have the option of either removing (aka deleting) a mobile device partnership as well as perform a remote wipe of a mobile device. Performing a remote wipe of a mobile device will delete any data held in memory as well as on the storage card. Send in another way, the device will be reset to its factory defaults.
[B]Note:
[/B]Deleting a mobile device partnership will not delete any data on the mobile device itself. And next time a user tries to synchronize a device with his mailbox, a new partnership will be established.
[IMG]http://www.msexchange.org/img/upl/image0151179311870037.jpg[/IMG]
[B]Figure 8:[/B] Manage Mobile Device Wizard
If you want to view mobile device and Exchange ActiveSync statistics for a user by using the EMS, you can do so with the Get-ActiveSyncDeviceStatistics cmdlet. For example, to get EAS statistics for a mailbox with an alias of HEW, we would need to type:
[I]Get-ActiveSyncDeviceStatistics -Mailbox hew[/I]
This would give us the information shown in [B]Figure 9[/B].
[IMG]http://www.msexchange.org/img/upl/image0171179311870037.jpg[/IMG]
[B]Figure 9:[/B] Mobile Device Partnerships for a User Mailbox
[B]Note[/B]
If you want to view statistics for a specific partnership, you would need to specify the identity string instead of the mailbox alias.
As you can see in [B]Figure 10[/B], the recovery password is replaced with asterisks. If you want to show the recovery password, add the [I]-ShowRecoveryPassword $True[/I] parameter to the command we ran above.
To remove a partnership, use the [I]Remove-ActiveSyncDevice –Identity <DeviceID>[/I] cmdlet. [IMG]http://www.msexchange.org/img/upl/image0191179312125756.jpg[/IMG]
[B]Figure 10:[/B] Removing a Mobile Device Partnership using the Exchange Management Shell
To remote wipe a device use [I]Clear-ActiveSyncDevice -Identity <DeviceID> [/I]as shown in [B]Figure 11[/B].
[IMG]http://www.msexchange.org/img/upl/image0211179312125756.jpg[/IMG]
[B]Figure 11:[/B] Remote Wiping a Mobile Device using the Exchange Management Shell
[B]Self-Service Management[/B]

In order to reduce the load Windows mobile device incidents helpdesk staff in an organization, the Exchange Product group has also come up with a self-service management feature, allowing a user to manage a device partnership himself if required. These self-service features have been integrated directly into the OWA 2007 UI as shown in [B]Figure 12[/B]. As you can see, the mobile device management features are accessed via the Options page.
Basically a user can view and perform the same things from within OWA as the Exchange administrator can from the Manage Mobile Device wizard in the Exchange Management Console.
[IMG]http://www.msexchange.org/img/upl/image0231179312125756.jpg[/IMG]
[B]Figure 12:[/B] Mobile Device Self-Service Management from within OWA 2007
The user can even retrieve the recovery password for a device ([B]Figure 13[/B]) should he for some reason have forgotten it.
[IMG]http://www.msexchange.org/img/upl/image0251179312125818.jpg[/IMG]
[B]Figure 13:[/B] Retrieving Recovery Password in OWA 2007
[B]Conclusion[/B]

As you have seen throughout this article, the Exchange Product group have focused a lot on improving the mobile device/user features in Exchange Server 2007. We can now create multiple Exchange ActiveSync mailbox policies as well as perform all mobile device management directly from within the Exchange Management Console or Exchange Management Shell. Lastly the mobile device users themselves have the option of performing self-service management from OWA 2007 so that the load of incidents sent to the helpdesk staff is reduced.


[/LEFT]