With the increasing use of mobile devices in the workplace, Exchange Server administrators must ensure that mobile devices are secure and comply with organizational policies. Exchange Server provides a feature called ActiveSync, which enables mobile devices to synchronize with Exchange Server, allowing users to access their emails, contacts, and calendars on their mobile devices. In this blog post, we will explore how to manage Exchange Server mobile devices and ActiveSync policies.

Enabling and Configuring ActiveSync

Before we can manage mobile devices and ActiveSync policies, we need to ensure that ActiveSync is enabled and properly configured on Exchange Server.

To enable ActiveSync on Exchange Server, use the following PowerShell command:

• Set-CASMailbox -Identity <MailboxID> -ActiveSyncEnabled $true
• Replace <MailboxID> with the identity of the mailbox that you want to enable for ActiveSync.

To configure ActiveSync policies, use the following PowerShell command:

• New-ActiveSyncMailboxPolicy -Name <PolicyName>
• Replace <PolicyName> with the name of the policy that you want to create.

After you create the policy, you can configure the settings such as password requirements, device encryption, and device block or allow list.

Managing Mobile Devices

Once ActiveSync is enabled and configured, we can manage mobile devices that are connected to Exchange Server. Exchange Server provides several tools to manage mobile devices, including the Exchange Admin Center (EAC), Exchange Management Shell (EMS), and Microsoft Intune.

To manage mobile devices using EAC, follow these steps:

• Open EAC and go to the Recipients > Mobile tab.
• Click on the mobile device that you want to manage.
• From the mobile device details page, you can view information about the device, such as the model, operating system, and last sync time.
• You can also perform actions such as remote wipe, clear passcode, and block or allow the device.

To manage mobile devices using EMS, use the following PowerShell command:

• Get-ActiveSyncDeviceStatistics -Mailbox <MailboxID>
• Replace <MailboxID> with the identity of the mailbox that you want to view device statistics for.

This command retrieves information about the mobile devices that are connected to the mailbox, such as the device ID, device type, and device model.

To manage mobile devices using Microsoft Intune, follow these steps:

• Open Microsoft Endpoint Manager Admin Center and go to Devices > All devices.
• Select the mobile device that you want to manage.
• From the device details page, you can perform actions such as wipe, retire, and delete the device.

ActiveSync Policies

ActiveSync policies allow administrators to enforce security policies on mobile devices that are connected to Exchange Server. ActiveSync policies can be configured at the mailbox level or the organization level.

To configure ActiveSync policies at the mailbox level, use the following PowerShell command:

• Set-CASMailbox -Identity <MailboxID> -ActiveSyncMailboxPolicy <PolicyName>
• Replace <MailboxID> with the identity of the mailbox that you want to configure the policy for, and <PolicyName> with the name of the policy that you want to apply.

To configure ActiveSync policies at the organization level, use the following PowerShell command:

• Set-ActiveSyncOrganizationSettings -DefaultAccessLevel <Policy>
• Replace <Policy> with the policy that you want to set as the default access level for all mobile devices that connect to Exchange Server.

ActiveSync policies can be configured to enforce the following security settings:

• Password requirements: Enforce password length, complexity, and expiration.
• Device encryption: Require devices to be encrypted.
• Device block or allow list: Block or allow specific devices to connect to Exchange Server.
• Remote wipe: Allow administrators to wipe the data on a mobile device that is lost or stolen.
• Allow or block external devices: Allow or block devices that are not managed by the organization.

Managing ActiveSync Policies

To manage ActiveSync policies, use the following PowerShell command:

• Get-ActiveSyncMailboxPolicy <PolicyName>
• Replace <PolicyName> with the name of the policy that you want to view.

This command retrieves information about the policy, such as the password requirements, device encryption, and device block or allow list.

To create a new ActiveSync policy, use the following PowerShell command:

• New-ActiveSyncMailboxPolicy -Name <PolicyName>
• Replace <PolicyName> with the name of the policy that you want to create.

After you create the policy, you can configure the settings such as password requirements, device encryption, and device block or allow list.

To apply the ActiveSync policy to a mailbox, use the following PowerShell command:

• Set-CASMailbox -Identity <MailboxID> -ActiveSyncMailboxPolicy <PolicyName>
• Replace <MailboxID> with the identity of the mailbox that you want to apply the policy to, and <PolicyName> with the name of the policy that you want to apply.

Conclusion

Managing mobile devices and ActiveSync policies in Exchange Server is essential to ensure the security of organizational data. Exchange Server provides several tools, including EAC, EMS, and Microsoft Intune, to manage mobile devices. ActiveSync policies can be configured at the mailbox level or the organization level and can enforce security settings such as password requirements, device encryption, and device block or allow list. By properly managing mobile devices and ActiveSync policies, Exchange Server administrators can ensure that organizational data is secure and compliant with organizational policies.