Dave Stork's IMHO : ActiveSync

The mysterious Exchange App, the new ActiveSync?

dmstork — Tue, 16 Apr 2013 17:45:00 GMT

Recently the backend of my Office 365 P1 account was upgraded to the Wave 15 series of products, which obviously includes Exchange 2013. But going through the settings of the Exchange Admin Center, I noticed something that made me curious.

When you go to the Exchange Admin Center, click to Recipients>Mailboxes and select a user, you can see in the Mobile Devices section the option to disable the Exchange App below the option to disable Exchange ActiveSync. I’ve highlighted it in the screenshot on the left.

This is probably the same thing what was previously named the Outlook App in the Exchange 2013 Preview version. Check my previous blog post on exactly this topic.

Some interesting observations: the rename from Outlook app to Exchange app. Is this to distinguish between this app and the Office 2013 Outlook that may or may not become available for Windows RT tablets?

The option to disable the Exchange App is separate from Exchange ActiveSync is interesting. Does this mean the Exchange App does not use the ActiveSync protocol and uses for instance Exchange Web Services (EWS)? That could mean that mobile devices with the Exchange app can have a lot more features compared to only ActiveSync, which sadly hasn’t been enhanced in this most recent release of Exchange as you can read in another blog post of mine. Or will it just be a special ActiveSync “device” which may overrule disabled ActiveSync?

I’ve checked whether these options were present in Exchange 2013 Cumulative Update 1 (CU1), but this isn’t the case. That suggests that these options will be available at the earliest in CU2 and thus at the end of Q2 following the new servicing plan for Exchange. I would expect the Exchange App would be released around the time these options become general available in Exchange with a CU (or Service Pack?). And hopefully for a lot of different Mobile OSs.

But practically all of this is speculation, we will have to wait and see. An announcement or perhaps even release during TechEd 2013 North America is somewhat logical, seeing the timeframe and it being a big event (plus some wishful thinking on my part, as I am attending this event ).

The Windows 8 Mail app

dmstork — Tue, 27 Nov 2012 07:39:00 GMT

A few hours back the Microsoft Exchange team published a blog post on how to connect and support your Windows 8 Mail app with Exchange. It has a lot of good info on which Exchange ActiveSync (EAS) policy settings are supported and how the App reacts.

Most of those things I already discovered in earlier blog posts of mine, using the Windows 8 Consumer Preview. It seem as if there are no massive changes since then. But I did dig somewhat deeper into some specific features. So, check my two blog posts out as well:

Yes, there is ActiveSync in Windows 8!
More about Windows 8 CP and ActiveSync

iOS6 and ActiveSync bug fixed in Zarafa/Z-Push

dmstork — Thu, 18 Oct 2012 15:04:00 GMT

Yesterday Zarafa published a blog post in which they announced their fix for the iOS6 ActiveSync appointment issue.

For those who don’t know, Zarafa is an open source Exchange clone (a bit like Zimbra) and uses the open source “plug-in” Z-Push for its server side ActiveSync implementation.

Although the work seems solid and commendable, I do have some issues with the post (No, I’m not trying to be mean). Especially when they describe their fix for Exchange (which is not the main focus of the post BTW):

How to fix it in Exchange

The real fix is that Apple changes the organizer logic back to what it was, or even better, uses the MeetingStatus field in the WBXML response to find out if it is an organizer. I don't know why this wasn't done in the first place.

If you do any of the following, the chance of it happening will be lower, but not zero:

– Make sure you send meeting requests only to the delegate, not to both the attendee and the delegate. (this is an option in your delegation options in Outlook)

– Turn off the inbox assistant (which has various names in various Exchange versions), which automatically processes incoming meeting requests

My main issue is with the term fix. If it’s an issue, only Microsoft can fix it with an hotfix, rollup update or service pack etc.. What they describe here is a workaround. The issue is still there, but you have changed your own behavior in order to circumvent the issue. That is NOT a fix.

As for the suggestions the first one is a change in user behavior, which is probably difficult to achieve. The setting can possibly be changed via GPO (I haven’t checked).

The second suggestion has more impact (disabling the Calendar attendant for each mailbox), especially if you have room mailboxes. Personally I would consider using Allow/Block/Quarantine (ABQ) to filter iOS devices, this way you keep functionality and users can still manage appointments via Outlook and OWA.

It depends on your situation which limitations you can live with, but as Exchange MVP Paul Robichaux wrote in a blog post about this issue and the Zarafa/Z-Push solution, it's probably also an issue that you could live with.

Having said this all, do check out their blog post as it is still an interesting read.

So, what about ActiveSync in Exchange 2013?

dmstork — Wed, 08 Aug 2012 21:29:00 GMT

Over the years Exchange ActiveSync (EAS) has grown into the standard in mobile mail, calendar and contact synchronization. Even groupware products other than Exchange have implemented this protocol to ensure synchronization with iOS, Android and Windows Mobile/Phone devices.

It has been adopted to almost any mobile device, even BlackBerry has succumbed with (yet to be released) BBOS10. And with Windows 8 and Outlook 2013, also a desktop OS (or whatever) will be able to use the protocol. Check out my blog posts on the Windows 8 EAS implementation here and here. So you could say it's rather successful!

With every major Exchange release and sometimes with Service Packs, additions where made in the protocol. Adding more features to devices that obviously have to support the newest protocol version.

So, are there any new features in Exchange 2013 Preview Release? If so, what would that be and which devices would support those new features? Well, especially Windows Phone 8 (WP8) comes to mind and not all features of that smartphone OS are yet revealed and the expected release dates of Exchange 2013 and WP8 are close together. Maybe I can learn something new about WP8 via Exchange 2013? Yes, that would be very sneaky. ;-)

The new Exchange Administration Center is no help here. There are no new options to be configured, there are even less options than in Exchange 2010's Exchange Management Console. That doesn’t tell us anything, the Exchange Management Shell had always more configuration options.

So, looking into Exchange Management Shell. Best bet is to look into the New-ActiveSyncMailboxPolicy cmdlet, as it would create a new EAS policy and thus should have new parameters if there are any new features. Checking the cmdlet does not reveal any real changes, see TechNet documentation for the 2010 version and the 2013 Preview version. The differences?

Exchange 2010 SP2	Exchange 2013 PR
IsDefaultPolicy <$true \| $false>	IsDefault <$true \| $false>

Just one parameter name change. Mhhh. That doesn't look very promising. There was one thing that struck me when reading the TechNet documentation, but I'll get to that later.

As EAS transport is in fact HTTPS based, I checked the Microsoft-Server-ActiveSync virtual directory in IIS.

Well, in the Xsd subfolder there are several folders of which the folder names correspond with the different EAS protocol versions that are supported since Exchange 2003. No v14.2 or v15 what I would expect with new features.

But I am making an assumption that the new EAS version would have a separate folder. What options do we have? At that time I started digging in the EAS protocol specification. It seems that during connection a protocol version is negotiated between the client and the Exchange server. This is done via the HTTP 1.1 OPTIONS command and the MS-ASProtocolVersions header in the server response lists the versions the server supports and the client then talks with the highest version it supports.

Because EAS traffic is secure by default I used Fiddler2 to intercept HTTPS traffic, decrypt it and see the responses. Basically a Man-in-the-Middle attack, but me being all men in this equation :-). I've used Exchange 2013 Preview Release installed on Windows Server 2012 RC. As an ActiveSync client I used Outlook 2013 Preview, it doesn't make a difference if I used other clients as the response of the OPTIONS command is the only thing we actually need.

So, the OPTIONS command and it's response (I’ve stripped some irrelevant or non interesting bits):

OPTIONS https://172.16.0.156/Microsoft-Server-ActiveSync HTTP/1.1
Connection: Keep-Alive
User-Agent: Microsoft.Outlook.15
X-MS-WL: Outlook/1.0

HTTP/1.1 200 OK
Cache-Control: private
Allow: OPTIONS,POST
Content-Type: application/vnd.ms-sync.wbxml
Server: Microsoft-IIS/8.0
X-TargetBEServer: lab02-ex2013a.wave15.nl
MS-Server-ActiveSync: 15.0
MS-ASProtocolVersions: 2.0,2.1,2.5,12.0,12.1,14.0,14.1
MS-ASProtocolCommands: Sync,SendMail,SmartForward,SmartReply,GetAttachment,GetHierarchy,
CreateCollection,DeleteCollection,MoveCollection,FolderSync,
FolderCreate,FolderDelete,FolderUpdate,MoveItems,GetItemEstimate,
MeetingResponse,Search,Settings,Ping,ItemOperations,Provision,
ResolveRecipients,ValidateCert
Public: OPTIONS,POST
X-FEServer: LAB02-EX2013A
Content-Length: 0

This is exactly the same as the earlier noted Virtual Directory subfolders. And again, no v15 or even a v14.2. Perhaps some hidden MS-ASProtocolCommands? I've checked this again on an Exchange 2010 server. Below is the response:

HTTP/1.1 200 OK
Cache-Control: private
Allow: OPTIONS,POST
Content-Length: 0
Server: Microsoft-IIS/7.5
MS-Server-ActiveSync: 14.16
MS-ASProtocolVersions: 2.0,2.1,2.5,12.0,12.1,14.0,14.1
MS-ASProtocolCommands: Sync,SendMail,SmartForward,SmartReply,GetAttachment,GetHierarchy, CreateCollection,DeleteCollection,MoveCollection,FolderSync, FolderCreate,FolderDelete,FolderUpdate,MoveItems,GetItemEstimate, MeetingResponse,Search,Settings,Ping,ItemOperations,Provision, ResolveRecipients,ValidateCert
Public: OPTIONS,POST

Nope, nothing hidden. Both commands are the same on Exchange 2010 and 2013. There are some headers previously not present, such as X-TargetBEServer and X-FEServer. I'm fairly certain these refer to the Front-End and a Back-End architecture in Exchange 2013. They both refer to the same server, which has both the Client Access and Mailbox role. But as far as these responses go, I would say that Exchange 2013 PR has the same function set regarding ActiveSync as Exchange 2010SP1+.

So… you remember the Exchange 2013 New-ActiveSyncMailboxPolicy I mentioned earlier? If you look at the TechNet documentation you can see an ominous warning:

Yeah, New-ActiveSyncMailboxPolicy will be replaced by New-MobileMailboxPolicy. Mhhhkay… the cmdlet is already implemented in the Exchange 2013 Preview, so let's compare it! In this table only the differences are shown. If a parameter exists in both cmdlets, it is not shown.

New-ActiveSyncMailboxPolicy (2010 SP2)	New-MobileDeviceMailboxPolicy (2013PR)
AllowSimpleDevicePassword <$true \| $false>	AllowSimplePassword <$true \| $false>
AlphanumericDevicePasswordRequired <$true \| $false>	AlphanumericPasswordRequired <$true \| $false>
DevicePasswordEnabled <$true \| $false>	PasswordEnabled <$true \| $false>
DevicePasswordExpiration <Unlimited>	PasswordExpiration <Unlimited>
DevicePasswordHistory <Int32>	PasswordHistory <Int32>
IsDefaultPolicy <$true \| $false>	IsDefault <$true \| $false>
MaxDevicePasswordFailedAttempts <Unlimited>	MaxPasswordFailedAttempts <Unlimited>
MaxInactivityTimeDeviceLock <Unlimited>	MaxInactivityTimeLock <Unlimited>
MinDevicePasswordComplexCharacters <Int32>	MinPasswordComplexCharacters <Int32>
MinDevicePasswordLength <Int32>	MinPasswordLength <Int32>

Although the name of the cmdlet creating new ~~ActiveSync~~ Mobile policies has changed, no new parameters are present. All that are new can be related to similar Exchange 2010 parameters with another name; almost everywhere the word "device" has been omitted.

Conclusion

I think we can safely assume that there is no new EAS version or hidden ActiveSync features in the Exchange 2013 Preview. That means we can't say anything new about features in Windows Phone 8 or the Windows 8 Mail app.

The question is if this will be the same for the RTM release or perhaps a 2013 Service Pack 1. But I'm a bit pessimistic about that. The new cmdlet, does not hint to any new features and is basically the same as the old cmdlet and actually more a name change than anything else.

The renaming of the cmdlet and it's parameters and omitting "device" in almost all parameters suggests… well what does it suggest? What's the significance? Could be just reminding people that not just devices can connect to Exchange, but also programs like Outlook 2013 and the Windows 8 Mail App? Why would you change the name of cmdlet and annoy anyone who has used this in scripts just for that?

Rebranding of ActiveSync? De-emphasis of ActiveSync? What's up, Microsoft?

Thanks to Michael Van Horenbeeck and John A. Cook for the Fiddler tip!

Exchange 15 OWA Offline and Extensible?

dmstork — Fri, 20 Apr 2012 18:47:00 GMT

A few hours ago Mary-Jo Foley posted a blog in which she states (among other things not mentioned here) that the next version of Exchange (codename Exchange 15) could get an offline OWA. A requirement would be IE10.

Considering Windows 8 tablets, this could be quite the competitor for Microsoft's own ActiveSync (EAS, also incorporated in all versions of Windows 8). It would depend on the functionality while in offline mode; it’s only reasonable to assume functionality is limited when offline.

Offline OWA (OOWA? ) could be also interesting for those who don't want ActiveSync due to imposed (security) policies for instance. It will be interesting to see how this would impact Mobile Device Management in regards to BYOD, as SCCM 2012 and Windows Intune use ActiveSync for this purpose. I would expect a server side disable switch for this option in updated OWA Policies, but I suppose a remote wipe option would be harder to realize. But then again, the Windows 8 Mail app only removes relevant data and Windows does not revert to a factory state. The same strategy could be used here and should probably be sufficient.

In my opinion that wasn't actually the most interesting of her post, it mentioned the possibility of OWA Extensibility. Customization of OWA was pretty much limited to editing themes and adding functionality like Microsoft Lync integration. If this rumor is true, that could be quite exciting depending on the scope of possibilities and to what extent it will be supported by Microsoft. Perhaps part of your business application inline in OWA? Where would the limits be? Will this this also be possible with Offline OWA?

But remember, this is not confirmed by Microsoft. But my mind was already exploring the opportunities and caveats of these (hypothetical) features and I just had to share them. Finally some good rumors regarding Exchange 15!

More about Windows 8 CP and ActiveSync

dmstork — Fri, 02 Mar 2012 15:36:04 GMT

Since yesterday’s blog post “Yes, there is ActiveSync in Windows 8!”, I have fiddled some more with the Windows 8 Mail app.

So, which other ActiveSync settings do work within Windows 8? There are quite a few, and some aren’t supported by all devices. So, which are important and could I use as a baseline? Well, Microsoft already made a baseline:

Exchange ActiveSync Logo Program

The Exchange ActiveSync Logo program was created to easily identify devices which had a certain minimum ActiveSync capabilities. I have checked to see whether these options are available in the Windows 8 Mail app:

Direct Push email, contacts & calendar – Yes
Accept, Decline & Tentatively Accept meetings – No (not within Mail or Calendar App)
Rich formatted email (HTML) – Yes
Reply/Forward state on email – Partial. Not from Mail app to Exchange, other way yes
GAL Lookup – No (in both Mail and People app)
Autodiscover – Yes
ABQ strings (device type and model) provided – Yes & Yes*
Remote Wipe – Well, not whole device. No?
Password Required – Yes
Minimum Password Length – Unknown
Timeout without User Input – Yes
Number of Failed Attempts – Yes

* Device Family is “WindowsMail” and Model has two entries: “Windows PC” and “WindowsMail”.

So, no Logo then…

ActiveSync password settings

The ActiveSync password settings are a bit funny though, as I log into Windows 8 with my Live account. That account has it’s own password rules. This will also be the case with domain joined computers. Furthermore, I’m guessing that the local computer security settings also provide a baseline rule.

I did notice that Windows 8 locked itself sooner due to the 1 minute time-out setting in the ActiveSync policy. Which makes this the first indication that some ActiveSync settings do affect the OS directly.

The maximum number of failed attempts was also a affected by ActiveSync, normally you get a warning after about 5/6 wrong entries. With a Failed Attempts setting of 4 (the minimum) you get the same warning:

So no wipe, just a reboot. I’ve checked and all data and settings where still present. If you check the options in the Exchange Control panel, it mentions wipe:

Concluding this part: After setting only the four settings mentioned in the logo program Exchange regards the policy as fully applied:

How about some other features?

I’ve made some changes in my default Exchange ActiveSync Policy in order to further test the ActiveSync implementation not part of the Logo program. I choose some that were easy to check on my virtual Windows 8 device:

Limit email size to (KB): 10 (was unlimited)
Allow attachments to be downloaded to device: Unchecked (was Checked)
Allow camera: Unchecked (was Checked)

Limit email size

I could read mails larger than 10KB in the Mail app and on my iPad, but not on Windows Phone 7.5

Allow attachments

Can’t save (right click on icon) it anymore and can’t downloaded it. Same behavior as most ActiveSync devices.

Allow camera

My virtual Windows 8 CP didn’t have a camera, so this is a bit speculating. But if you check the permissions within the app (Charm bar>Permissions), you can set the camera permission manually. The Webcam and Microphone permission is disabled at default. After enabling it and changing the EAS policy, the option was still enabled.

It is not a 100% check, but interesting enough… The Camera app was also still present. Surprising enough it also still works within Windows Phone 7.

Within iOS (my iPad 2) all camera related apps disappear. It would be interesting to see this (and other) function work, especially on Windows 8 slates/tablets.

And on Exchange

Let’s see on the Exchange end how the new EAS policy is applied.

Ha, it’s partially applied! This is probably the Camera setting and it’s positive that this is visible in feedback.

Conclusion

So, ActiveSync in Windows 8? Well, not exactly.

As stated, it does not deliver all the features as required by the Exchange ActiveSync Logo Program (EALP). If this doesn’t change, this would mean no Windows 8 device would receive the ActiveSync logo.

Furthermore, the functionality is apparently (mostly) confined to the Mail app within Windows 8. The most important proof of this is the remote wipe option, which only wipes the synced information and not the whole device.

The above observation is an important distinction as ActiveSync policies are mostly only valid within the App and not the OS. Aside from the partial Remote Wipe, this could have some impact on Mobile Device Management for Windows 8 devices, especially Windows on ARM (WOA).

As we are told that WOA would have almost no differences regarding the x86 versions, this would mean that ActiveSync functionality would also be an App and not OS functionality. We can somewhat expect that WOA devices will not be EALP compliant as the iPad is.

This is another indication on how Microsoft regards WOA; a consumer device as ActiveSync policies are more Enterprise features. It is however still possible that functionality will change in the coming months. I personally would hope so, as I regard ActiveSync as a sort of light mobile device management tool.

If an organization will not have WOA devices, there are ActiveSync Device Security settings that do have an impact on Windows 8 (x86 based) computers. Which setting will win? ActiveSync polices? Active Directory Polices? Or the most constricting one? This will undoubted lead to interesting discussions between users, those responsible for Exchange ActiveSync policies and those for Active Directory Group Policies…

Granted, most organizations probably also have Outlook (2010 with the option of multiple accounts) and thus no need for the Windows 8 Mail app. But still, I already think it a best practice to at least consider blocking out the Mail app within AD environments…

Yes, there is ActiveSync in Windows 8!

dmstork — Thu, 01 Mar 2012 01:48:00 GMT

*** updated: Also read the followup blog post: More about Windows 8 CP and ActiveSync

I think it was already present in the Developer Preview, but it is definitely present in the Consumer Preview. Chris Brownie has blogged about it and has some screenshots. Go ahead and read his blog!

As can be seen in his screenshots, ActiveSync policies are applied to the device (or computer) and it is listed in the Exchange Control Panel.

But how should we treat the Windows 8 computer? Does it work the same as Windows Phone? Hell, does it work as Windows Mobile 6.1+ which still has (painfully…) more supported options of ActiveSync than Windows Phone 7.5? Well, let’s dig somewhat deeper.

We’ve already seen the list of Mobile devices connected with Exchange, or in this case specifically Office 365. Let’s see the specific properties. Most interestingly: we see that Windows 8 has a Device Type of WindowsMail.

Some of you may know you can Allow, Block or Quarantine ActiveSync devices since Exchange 2010. So, of course first of: can we block Windows 8? YES! After syncing the device you can make an new Device Access Rule as the device type is now selectable. Nice!

So, we can also see that the ActiveSync version used by Windows 8 (or the Mail app) is 14.0, which not the most recent version (14.1 with Exchange 2010 SP1) as can be seen in this ActiveSync Overview.

Most important difference is Information Rights Management (IRM) over AES. Perhaps this is because Windows 8 is also a Desktop OS and Microsoft wants this combined with Outlook (and an Office license). It is in any case an Enterprise feature, so consumers will feel no loss here. Business users will probably still want to use Outlook. It will however still be interesting to see how this plays out with Slates/Tablets and Windows on Arm (WOA) form factors and the combination of Office 15 or better yet Outlook 15.

I wonder if WOA does support ActiveSync 14.1. We will have to wait for that… and… As Windows Phone 7.5 now supports ActiveSync 14.1, what will happen with Windows Phone 8 (WP8) as there are rumors/indications that Windows 8 and WP8 will share more code and functionality than previous versions of the mobile/phone OS and same generation Desktop OS… Something to keep an eye on. But I digress.

The fact that there is no IRM on Windows 8 Mail app could be a very valid reason to block these clients al together with ABQ. And now I also wonder how ActiveSync Client Certificate-based authentication will work. Can we install certificates via AD? As WOA will not include domain join (can’t find a link, but it basically means that WOA is consumer focused, not enterprise), it becomes imperative to be able to install certificates on the devices. But then again, Client Certificate-Based Authentication is more a Enterprise feature than Consumer.

Moving on…

Another question that popped in my head was how the Remote Wipe would work. Would it reset the whole machine to factory setting as with (most) ActiveSync mobile devices? Windows 8 does have built-in Reset and Refresh functionality. Would a Remote Wipe trigger that functionality? Would a Remote Wipe even work?

As we can see the Remote Wipe works, you even get confirmation in the ECP and per mail.

But the wipe is not a reset to factory settings. It just removes the data from the device which was synced via that specific ActiveSync connection. All other information, ActiveSync accounts, apps and so forth are still present.

Before Remote Wipe:

After Remote Wipe:

You can ask yourselves how this works security wise, but I’m glad that I don’t have to reinstall my whole computer. A mobile device is much faster restored, but then again the lines of what a mobile device and a desktop is are blurring…

So far my findings around Windows 8 Consumer Preview ActiveSync. Obviously features and it’s implementation could change in next builds. But even with just the ActiveSync feature there are still a lot of questions I have about how Exchange admins have to handle ActiveSync devices and how Microsoft is going to treat it’s Windows 8 devices. Whatever the form factor may be…