Windows Mobile

Windows Mobile Device management is coming to enterprise ready

Kay Sellenrode — Thu, 13 Sep 2007 09:23:13 GMT

With the new Exchange 2007 SP1 microsoft now releases a way to lock down windows Mobile devices.
See the snapshot below for what you can do with the new SP.

I can now tell customers to not drill the camera lenses on windows mobile devices and to stop worrying about Bluetooth.
I am not able to test these functions at the moment , and am wondering if it will also work for older windows mobile devices like 2003se and mobile 5. As soon as i have details on this i will update my blog

These functions are available since the Exchange SP1 beta 2

DMFP v2 (Device Management Feature Pack)

Kay Sellenrode — Wed, 03 May 2006 06:52:00 GMT

Endly it seems like microsoft is going to release it long awaited DMFP update.
since march we were already waiting for this feature pack to release but now endly the first info starts to come live.

here are the release notes on microsoft's website.
http://support.microsoft.com/?kbid=915607&SD=tech

what has caught my eye in these release notes are the following

The device client for windows mobile is released unsigned. This could set you back in your project schedule if you want to use the code signing, and especially when you have locked down devices that need you to purchase a code signing certificate especially for this app with manager rights.
The Password application that is part of the DMFP will not support devices that have the MSFP on it.
So we need to create separate policies for MSFP (Messaging and Security Feature Pack) devices.
ofcourse we need to wait till the product is live to see what happens if the pda gets this software pushed but i doesn't make me real happy. We then need to manage the MSFP devices by deploying a xml file to them.

For the rest we will see what happens when it will be released.
Hopefully soon.

How to manage the mobile device

Kay Sellenrode — Wed, 19 Apr 2006 06:15:00 GMT

Since i'm working on a windows mobile 5.0 project we are looking for a solution how to manage these devices.
and until now i found out that most management is done by just adding or changing registry keys on the device.
Since we already have SMS implemented in the it environment we were looking for an add on or a solution how we could change some parts in windows mobile so it would fit our needs.

What i know now, the best solution is just searching which registry keys you need to change.
To find out which registry key does what i was looking for some snapshot tools for windows mobile 5.0.

I havn't found tools that work like WISE packagestudio takes snapshots form the pc but well i got verry close.
on the site http://s-k-tools.com/ they have some great tools to take a snapshot (SSNAP) of the device, this will register all files and registry entries on the device.
After taking a before and after snapshot i copy the files to my pc and use WINDIFF.EXE (from the xp support tools) to compare the two text files created by SSNAP.

This way it is quite easy to find out which files/registry changes are needed to disable bluetooth or other functions on the device.
We are currently still waiting for the DMFP from microsoft to deploy the cab's we made to the devices.
when i have some standard cab files with their own functions i will post them here.

Windows Mobile 5.0 in a enterprise

Kay Sellenrode — Tue, 28 Mar 2006 11:09:00 GMT

I'm currently working as an Technical Consultant on a Windows Mobile 5.0 project.

My goal is to set up an evironment with around the 100 mobile devices that can connect to exchange and some other applications.
I started on this project early in february and it should have been finished early april.
But right now i already know we won't finish in time, this is due to several factors which cause from short to quite long delays. Ofcourse all to the perspective of the project.

So now i'm working with the mobile 5.0 platform for a while but this was the first project where there was an enterprise deployment need. We want to deliver an environment where the setup and support is easy.
in my past experience i've seen lots of implementations of pda just by installing each device for each user by hand.
and since the PDA keeps getting more functions these days there is much more need to have these devices under management.
During the whole project i found out that even though the Windows Mobile 5.0 platform is on the market for more than half a year. It is just starting to take off since a month or so, you see that a lot of software you would like to have in an enterprise environment is still not available or not mobile 5.0 compatible.
And this also concerns Microsoft's own software. Don't understand me wrong, I'm an consultant on the microsoft products and earn my money with their products, but it was quite a dissapointment to see that the enterprise management is not available at all for the mobile 5.0 platform.

When i think about a microsoft product and how to incorporate it into the network. i always prefer to work with the microsoft solutions. Only in the case of a need that can't be fulfilled then i would take a third party solution.
But if you wanted to deploy the Windows Mobile 5.0 platform in the past few months, you couldn't do much more than choose one of the very few third party solutions. or be one of the lucky few that could become a tap for one of the microsoft management products for mobile 5.0

Due to the availability of the software from not only microsoft but also virusscanner vendors etc. it already set us back 1 month in the project schedule.

I know not everyone thinks the way i do, but i see these devices as small laptops, I think you should also treat them the same way when looking at corporate security policies. Nowadays people store so much info on these devices, and this will only become more and more.

So how should you set up an evironment where you want to accomplish these goals:
- Create a manageable environment for Windows Mobile 5.0
- Protect these devices from becomeing compromised in the event of loss or theft.
- Keep the device low level for the user and easy to handle
- Provide up to date info on the device
- deploy software to the devices

All these choices i will discuss in a separate entry

So to give you an outline of what we will be doing in the next month:
- we will try to get our hands on SMS DMFP v2 which will be released end march/begin april.
- we will evaluate the SMS DMFP v2 and start our basic tests of the devices managed by SMS.
- Define our corporate Password policy for the Windows Mobile devices.
- Deploy software using SMS DMFP v2 to the devices
- setup an secured network to enable users to synchronize their pda over infrared access points.

i will continue soon in a new post.

If anyone has any comments or ideas I would love to hear them, if you want info just drop me an email or post a comment and I will get in touch with you.