Windows Mobile

A certificate roundup

Devin L. Ganger — Fri, 09 May 2008 23:55:07 GMT

Certificates are one of the biggest issues I keep hearing about with Exchange and OCS, and apparently I'm not the only one. Fellow MVP Michael B. Smith has recently posted two blog articles on certs: how to use SAN certificates with ISA 2006 and other certificate limitations. However, he's got a couple of points on the second article that I'm confused about:

According to this announcement on the Windows Mobile team blog, Windows Mobile 6.0 and up do in fact support wildcard certificates.
The first point he makes is also head-scratcher, because I've also heard this was an issue, but I'd also recently heard of a workaround for it:
1. In Outlook, go to the properties for your Exchange account (Tools, Account Settings, select your Exchange account and click Change) and click More Settings.
2. On the Connection tab, click Exchange Proxy Settings.
3. Look for the field Only connect to proxy servers that have this principal name in their certificate and make sure it's checked (you may need to check the Connect using SSL only checkbox first).
4. The value in this field should normally be set to msstd:server.external.fqdn, the FQDN the server is known as from the outside and that is the subject name of the certificate. So if my certificate was issued for 3Sharp, it would be msstd:mail.3sharp.com. To use this with a wildcard certificate issued to *.3sharp.com, this value would need to be set to msstd:*.3sharp.com.
  
  Let's try a diagram to make the point:

I'm doing more checking, trying to figure out what the deal is here; in the meantime, if you've got operational experience with either of these issues, please let me know.

At any rate, there's some more interesting factoids on certificates I've picked up:

If you want to use a certificate with the Exchange 2007 UM role, you need to have a certificate on the machine whose subject name matches the server's AD/DNS FQDN. It seems that you can't enable a certificate for the UM service using the Enable-ExchangeCertificate cmdlet if this does not match. Note that you can do this for other services, such as those hosted by the CAS role; the cmdlet performs different name checks on the certificate based on the services (SMTP, POP3, IMAP, HTTP, and UM) that you are enabling.
I've said it before, but it needs to be repeated: if you're not using the default self-signed certificate, simply use the Enable-ExchangeCertificate cmdlet to move all services to one or more additional certificates. Do not delete the default certificate; although in most cases Exchange will simply recreate it when the appropriate service is restarted, you can cause subtle errors that will take a while to figure out.
Learn more about certificate usage in Exchange in Creating a Certificate or Certificate Request for TLS.
And learn more about the Enable-ExchangeCertificate cmdlet.

More later!

Post-Connections report

Devin L. Ganger — Tue, 13 Nov 2007 22:37:00 GMT

Vegas was great again, this year; the hotel was as lovely as ever, but the overlap with the Latin Grammys sure did some interesting things to the elevators. Mandalay Bay felt full this year! On the other hand, the beach remodel was excellent; the wave pool and the Lazy River pool were both hits with my family. As is my wont, I'm making my session slide decks available for download.

EXC16: Advanced Exchange Protection using Data Protection Manager
Backing up and restoring Exchange servers is an essential part of keeping your messaging infrastructure up and running, even when you’re running an advanced clustering configuration. Why should you consider using the new version of Microsoft System Center Data Protection Manager (“v2“) to protect your Exchange server clusters? Is it any harder than backing up standalone servers? This session covers protecting Exchange 2003 and 2007 servers clustered configurations, including the new Exchange 2007 replication options.

I thought this session went pretty well; there was a Microsoft session on Tuesday morning that looked like it was going to cover the exact same material, but the overlap was both smaller and shallower than I expected. I got a lot of good questions from this session which I'll be answering in the next couple of days; I really hope that I was able to convey my own excitement about DPM and how it will make a great partner for protecting Exchange.
EXC17: Exchange Management Shell Annoyances
The Exchange 2007 Management Shell makes full use of the exciting new Windows PowerShell technology. It’s a great command-line management experience, but it’s still not perfect. You may have already been tripped up by annoyances and complications in what seem to be obvious tasks or you may just want to know what dangers lurk beneath the surface. This session will show you some common pitfalls and problems and give you the knowledge to successfully navigate them.

This session suffered from the inevitable technical glitches; my Exchange virtual environment died an hour or two before the session, so I ended up having to run it from a stock Windows PowerShell session. Luckily, I was able to cover most of the territory from there and even add a couple of things or two. Not having the Get-Help and cmdlet completion information for EMS, though, just sucked; my apologies.
EXC18: Getting Run Over by Exchange 2007
Common knowledge says that upgrading to Exchange 2007 isn’t nearly as hard as the upgrade from Exchange 5.5. That’s not to say that it doesn’t present its own set of challenges—and if you’re caught by them, it will still feel like getting run over by a truck. This session will present some of the common gotchas and how to avoid them. Be at the head of the upgrade parade, not caught in the wheels.

Wow. This was a great session; standing room only and a lot of good feedback and questions. This is clearly a topic of concern to people -- if you have any other upgrade gotchas, let me know!

Microsoft DST Guidance: How they did it

Devin L. Ganger — Thu, 15 Feb 2007 00:16:00 GMT

Once again, I've updated my DST rollup post to include the hot-off-the-presses Exchange Time Zone Update Tool: Guidance from Microsoft IT whitepaper. It's now available from Microsoft Downloads as a PDF.

"DST blues" revisited

Devin L. Ganger — Wed, 14 Feb 2007 22:32:00 GMT

Hello, everyone! Just a quick interruption to let you know I've updated my previous post on DST blues to include Windows Mobile resources.

Okay, back to the chocolate and flowers.

DST blues got you down?

Devin L. Ganger — Sun, 11 Feb 2007 08:29:00 GMT

Dealing with the Daylight Savings Time issue can be pretty confusing, especially since the tools and updates you need have been being made available over a period of time. Start with the Daylight Saving Time Help and Support Center. It gives you a centralized set of Microsoft's DST resources, including links to the updates for various products. From there, check out the following KB articles and updates especially pertinent for the Exchange admin:

The first step is to apply the patches appropriate for your operating systems. Microsoft recommends applying the OS patches, applications patches, and running the update tools as close to the same time as possible. It would have been nice if they'd not been pushing the OS patches out via Windows Update; your servers and workstations may already have the patch installed.
Update for daylight saving time changes in 2007 for Exchange 2003 -- apply this to your Exchange server to fix the issues in the Exchange program code, beyond what is covered by the OS patches.
You can no longer mount any of the Exchange databases after you apply hotfix 926666 to a computer that is running Exchange Server 2003 -- this is a problem that some people have been reporting after applying the Exchange update. Apply this at the same time.
How to address daylight saving time by using the Exchange Calendar Update Tool (for Exchange versions 2007, 2003, 2000, and 5.5) -- this tool is a server-side tool for adjusting appointments in the target date range. Read the KB thoroughly before using!
Virtual Machine for Microsoft Exchange Calendar Update Tool -- this one is particularly cool if you have a large organization, because it allows you to quickly deploy multiple workstations with the Exchange Calendar Update Tool and provide coverage for all of your servers.
How to address the daylight saving time changes in 2007 by using the Time Zone Data Update Tool for Microsoft Office Outlook (for Outlook versions 2000 through 2007) -- this is an alternative to the server-side tool, allowing users to go through and identify the appropriate appointments to be changed. This may be a better choice for your organization.
Daylight Savings Time 2007 Update -- this page gives steps on updating your Windows Mobile device with the necessary updates.
How to configure daylight saving time for the United States and Canada in 2007 and in subsequent years on Windows Mobile-based devices -- a KB article that explains the registry modifications necessary to update a Windows Mobile device if the previous update won't do the trick (see How to update daylight saving time for the United States, Canada, and Mexico in 2007 on Windows CE-based devices for the Windows CE version of the same guidance).
Exchange Time Zone Update Tool: Guidance from Microsoft IT -- finally, a walkthrough from Microsoft IT showing how they dealt with this issue internally.

Unfortunately, the U.S. Congress really didn't do any favors for IT pros with the expanded DST timeframe. There's no magic bullet fix; you have a lot of updates to coordinate, a choice of tools to run, and a lot of opportunities to have appointments messed up even if you do everything right. Oh, and you don't have much time to figure it out. It doesn't help much to know that everyone is feeling your pain, but right now, that's the best I can offer you. That, and keep an eye out on the regular Exchange news sources and blogs; a lot of smart people are taking the plunge to figure out where the pain points are, and they're busily writing about it.

Hang in there.

Updated Feb 14 1430: I've added the Windows Mobile links to the list. Additionally, apparently many people with resource accounts (conference rooms, etc.) that are steadily booked are running into problems using the rebasing tools, because those accounts don't own the events and can't move them authoritatively. I'm aware of one potential workaround in the works for this and will point you to it as soon as I can.

Updated Feb 14 1610: Updated again with the link to the Exchange Time Zone Update Tool: Guidance from Microsoft IT paper.

My take on the iPhone

Devin L. Ganger — Wed, 10 Jan 2007 22:48:00 GMT

iPod. Mac mini. MacBook Pro. OS X. These are Apple products that I have acquired in the last several years and that cause me much love, because for the most part, they just work. So what do I think about the iPhone?

Simple. I think it's going to be a boutique phone/media player for folks with money to burn and who want convergence between their phone, media players, and PDA. It's sleek and has a great-looking UI -- an Apple standard -- but the price tag keeps it from being a casual purchase.

I don't forsee it making inroads into the lucrative corporate messaging environment, though, because it doesn't offer any sort of synchronization support for the full Exchange experience. POP3 and IMAP don't cut it here. There's a reason RIM offers the BES option for BlackBerry devices, because individual cradle synch doesn't cut it. Businesses are demanding and using over-the-air sync with full support for all features of the messaging environment -- contacts, calendars, messaging, documents.

Now, I'm pretty certain the iPhone is going to hurt Windows Mobile in the consumer market...but its lack of support for Exchange or even Notes and Groupwise will keep it out of most enterprises.

BTW, note to Apple: I'd love to be proven wrong about this. You're more than welcome to send me a review unit, once they're available (FCC licensing is still pending according to the note at the bottom of Apple's website today), and I'll happily take it through its paces.

Cingular and Windows Mobile drama

Devin L. Ganger — Wed, 06 Dec 2006 00:45:00 GMT

Wherein I relate a spine-chilling tale of billing skullduggery, data plans gone wrong, and creeping telco horror! With a happy ending.

Taming the HTC Wizard stylus

Devin L. Ganger — Sun, 22 Oct 2006 20:45:00 GMT

If you're the owner of an HTC Wizard mobile device (Qtek 9100, I-mate K-Jam, T-Mobile MDA Vario, Cingular 8125, Orange SPV M3000a, and more), then you may have discovered one of the few design flaws of the device: the fact that the stylus, after a few months, stops staying in the body of the phone. It's a bit disconcerting to go to pull your stylus out and find that it's not there anymore.

I've seen lots of people posting on the Net about it, and there have been a variety of fixes and work-arounds posted. Some people wrap the stylus with Scotch tape, thus making it a bit thicker. Other brave souls have opened their devices up and fixed the liner that causes the problem. I found a third solution that seems to be working for me, and since I haven't seen it anywhere else, I figured I'd share it. And for the faint of heart, it requires no alternations or additions.

My tip is very simple: extend the stylus to its full length before putting it back in the slot. Yup, that's it. The stylus on these devices telescopes slightly. For whatever reason, it fails to grip fully if I collapse the stylus first; by fully extending the stylus, I can get it to make a solid contact inside the case and not fall out.

As a note, not all the cases are alike. My wife's Cingular 8125, for example, has a nifty ridged lip design that helps hold the stylus in place from the top. I don't think she'll be suffering from this problem.

Four minor Windows Mobile annoyances

Devin L. Ganger — Wed, 09 Aug 2006 01:30:00 GMT

Three of these annoyances are generic Windows Mobile annoyances; the third is a device-specific gripe.

I want to be able to sync my device with multiple machines -- if only so I can keep it charged. Inherent Windows ActiveSync limitation. When I've got at least one desktop and laptop to deal with...
While I'm at it...I want multiple Exchange profiles (and no, IMAP/POP3 doesn't cut it.)
And why can't I sync to Entourage? Windows Mobile devices in many ways are cooler than the Mac-compatible PDA options, and I know several Mac users who'd abandon Palm in a heartbeat if only they could sync with the Mac.
I've been bitten by the dreaded "loose stylus" problem that apparently all of the HTC Wizard-based devices share. In essence, something in the stylus receptacle loosens up over time, and the result is that the stylus drops out. Now I have to find what I did with my spare.

Deployment Guidance for Exchange 2003 SP2 and Windows Mobile 5.0 MSFP

Devin L. Ganger — Tue, 04 Apr 2006 11:43:00 GMT

Trying to deploy Windows Mobile 5.0 devices with the Messaging and Security Feature Pack, along with Exchange Server 2003 SP2, so you can get that Direct Push and remote administration love? Running into problems? Never fear -- Jason Langridge has your back. You can't get this one off of the official Microsoft download site yet, although it will be there soon enough.

This document covers everything from upgrading your Exchange servers, configuring your front-end and back-end servers (single server configurations aren't forgotten!), enabling and requiring SSL, installing ISA Server 2004, installing the new mobile management tools, provisioning and configuring your Windows Mobile devices, and setting device policies. It even, as a special bonus, tells you how to deploy certificate-based authentication -- the Holy Grail of Windows Mobile messaging -- as well as how to create CAB files to export root certificates to your devices. Needless to say, this is a must-get.