Posts
254
Comments
120
Trackbacks
120
February 2006 Entries
Windows Mobile 5.0 and SSL certs

I still owe y'all a review of my new Qtek 9100 PDA/cellphone running Windows Mobile 5.0, but in the meantime, as I'm working on some other WM5.0 projects, I wanted to share word of what is turning out to be a potentially huge problem with the new WM 5.0 devices, depending on which devices you buy and which carriers you get them from. This post from the Windows Mobile Team Blog, "Adding Root Certificates for Exchange Activesync", doesn't provide a lot of detail and background, but the comments give you a bigger picture of how much trouble this is causing folks.

The base problem is that some WM5.0 devices, depending on how they've been configured by the OEM (in many cases the carrier that sells the device), do not allow end-users to install additional root certificates. This is great if you're only using SSL certs from a major vendor, but if you're using self-signed certs, this becomes a problem. The Windows Mobile 2003 workaround of disabling SSL for EAS isn't an option in WM5.0. Normally, I'd be happy about how the use of SSL is enforced -- I've never advised using OWA/EAS/OMA over unencrypted connections -- but in this case, a lot of people are frustrated because they can't use their new devices to synchronize with Exchange. Since that was the only real functionality I was interested in for my Qtek, I have to say I'd have been extremely unhappy to find out I wasn't able to do it.

The moral of the story is simple: be very, very choosy about which vendors and carriers you buy your WM5.0 devices from. Insist that they either provide the tool you need to install your own root certificates (if you don't get management access to the device) or insist on having devices configured so that you have management access.

posted @ Wednesday, February 15, 2006 10:05 AM | Feedback (4)
ISA Server 2004 SP2 is out

ISA Server 2004 Service Pack 2 is now available for download from Microsoft and has just gone into deployment on my home network (which I often use as a test network). Aside from the expected hotfix rollup, there's a couple of nice new features. The SP2 biggies for me:

  • Support for proxying HTTP compression. Not only does ISA support serving compressed content from its cache, it also requests compressed content from upstream sites. This is very good news, as I've been eyeing the necessity of enabling HTTP compression to help deal with the traffic for the Community Server and DotNetNuke websites I host.
  • BITS caching allows ISA server's cache to download updates from Windows/Microsoft Update once, then serve additional requests out of cache. This is great news for small office/branch offices that aren't using WSUS. Updates only travel the WAN link once.
If someone at Microsoft wanted to make my life really easy, they'd include an updated auto-discovery wizard for building site-to-site IPsec/L2TP links. So far, every time I've gone to create one, I end up spending a couple of hours troubleshooting, then rolling back the configuration changes in disgust. ISA 2004 is an amazing firewall, but there's still much goodness to be committed.

Of course, maybe it's coming in theISA Server 2006 Beta. The ability to publish multiple Exchange and Sharepoint servers looks very interesting. I'm definitely going to have to give that a download one of these years.

posted @ Monday, February 13, 2006 7:36 PM | Feedback (1)
A few words about IMF

Microsoft's Intelligent Message Filter (IMF) add-on for Exchange Server 2003 is one of the niftiest free downloads you can put in your Exchange organization that will have direct effects your users can see. However, I've seen a few questions and issues popping up regarding IMF that tell me there's a mild bit of confusion out there. Let's straighten it out.

There are two versions of IMF. IMF version 1 is the version you can download separately. It's got the basic message filtering goodness built in, but lacks a lot of other nice features. IMF version 2, on the other hand, comes with Exchange Server 2003 SP2; you can't download it separately and you can't choose it as an optional component. It will automatically get installed when you apply SP2. Please note that you cannot downgrade to IMFv1 after installing SP2 and have things keep working. If you do install IMFv1 on a server that already has SP2 applied, you'll need to reinstall SP2.

IMF doesn't automatically upgrade from v1 to v2. It would have been nice if the SP2 installer did this for you, but you must manually uninstall IMFv1 from your Exchange server before you upgrade it to SP2.

IMFv2 is not automatically enabled. No matter your config before SP2, IMF will not be enabled by default -- which makes sense, since you don't need it running on every server in your organization. Happily, it's easy to enable it on a per-virtual server basis. You do it from the same property page that you enable connection filters, recipient filters, and sender filters from on the SMTP virtual server. Heck, you also enable Sender ID here.

IMFv2 is worth upgrading to. If you haven't upgraded to SP2 yet, why not? Beside all the other great features, IMFv2 includes built-in Sender ID integration, the ability to modify the word list so you can customize the filter, and auto-update capabilities.

Update: I talked a bit about some other IMFv1 to IMFv2 upgrade issues in my earlier post about SP2, so check it out too.

posted @ Friday, February 10, 2006 6:52 PM | Feedback (0)
Sender ID hotfix for Exchange Server 2003 SP2

As part of my ramp-up for Exchange Connections in April, I've been working on my slide deck for Sender ID. I've got the slide deck written; now I need to run through it and polish the presentation.

One of the interesting pieces of information I came across concerns a bug in the Sender ID implementation in Exchange Server 2003 SP2. (As an aside, I love the Exchange community. A very kind gentleman by the name of Mike Ruman saw that I will be doing a session on Sender ID and sent email to Paul to let us know about this issue.) At the time he sent me the information, a hotfix was available but the KB article wasn't yet available. As of February 1st, Microsoft published KB 910272, "The ‘Sender ID Filtering’ feature does not work correctly in an Exchange Server 2003 SP2 server." If you're using Sender ID on Exchange Server 2003, you should install this hotfix.

From the details I was given, this bug manifests when your policy uses the - (Fail) mechanism prefix combined with a reference to another domain. According to the KB, it can result both in false positives and false negatives, so this should probably be considered a mandatory hotfix for Sender ID.

posted @ Thursday, February 09, 2006 11:07 PM | Feedback (0)
News

Devin has moved on
to new adventures.
This blog is preserved
for historical purposes.

Please follow his
personal blog at:

Devin on Earth


Virtual Devin