How iPhone OS 3.1 Locked Some Out Of Exchange, And How To Fix It

December 1, 2009 by Stephen Leave a Comment

Is your non-3GS iPhone locked out of your Exchange 2007 ActiveSync server after upgrading to iPhone OS 3.1? It’s a feature, not a bug! Here’s how to get older iPhones up and running with Exchange Server 2007 SP1!

What’s The Problem?

Microsoft Exchange Server 2007 SP1 added a feature to require mobile ActiveSync devices to encrypt data, enhancing security. Before iPhone OS 3.1, all iPhones incorrectly told the Exchange server that they supported on-device encryption. This allowed all iPhone hardware to function with Exchange 2007 SP1 servers that required device encryption. But original and 3G iPhones do not support device encryption, undermining corporate security policies.

The iPhone 3GS hardware actually does support device encryption, and iPhone OS 3.1 correctly reports this capability. But iPhone OS 3.1 also (correctly) reports that earlier hardware (the original iPhone and the iPhone 3G) does not support device encryption, so some Exchange 2007 SP1 servers refuse to allow them to connect. Oops!

What’s The Solution?

There are four possible solutions, three of which require IT assistance. Your Exchange administrator can research the meaning and implications of these options:

Disabling device encryption allows all iPhones to connect, but does not force any Exchange ActiveSync device to encrypt data. This is not a great solution from a security perspective, so don’t bother trying to convince IT to implement it!
Allowing non-provisionable devices enables all iPhones to connect but weakens security in general, allowing each device to enforce or ignore policies. This is a slightly better solution, since encrypting devices like the iPhone 3GS will encrypt, but it’s still not a great idea.
Creating a special policy for “old” iPhones and applying it selectively is probably more acceptable. Administrators can allow certain users to ignore the device encryption policy but still apply it to all others. This commandlet (from Krypted) will create such a policy:
New-ActiveSyncMailboxPolicy -Name iPhone -AllowNonProvisionableDevices $true
Upgrading to an iPhone 3GS is probably the best answer. IT doesn’t need to get involved (as long as you know how to configure Exchange ActiveSync) and no security policies need to be weakened to make it work.

You might also want to read these other posts...

Ranting and Raving About the 2018 iPad Pro

I remain enthusiastic about the iPad Pro, despite getting a scratched screen and my concerns about durability. It’s a worthy successor to the original and offers enough improvements that I’d recommend the upgrade for just about anyone who uses their iPad for serious work. It’s still not yet a laptop replacement, but this is due more to a lack of desktop-class software for iOS than anything in Apple’s control.

The 2018 iPad Pro is a Beast!

The third-generation iPad Pro is a great machine but also a bellwether of change at Apple. It will be very hard for the rest of the mobile and client computing industry to keep up with this kind of progress!

Free as in Coffee – Thoughts on the State of OpenStack

May 2, 2016

Last week I headed to Austin, Texas to attend the semi-annual OpenStack Summit there. Along with the usual socializing, I was looking to understand the current state of the technology: What does OpenStack really mean these days, and where is it going? Let’s start with “free”. As “the Internet” is quick to point out, this critical word has multiple […]

Virtual Machine Mobility: Of What, and to Where and in What State?

January 16, 2012

Moving cold virtual machine images from system to system, or even across great distances, is one of the main selling points of server virtualization. But it becomes much more difficult to manage movement of virtual machines that are still running, especially outside cluster or across WAN links. When talking about virtual machine mobility, it is important to consider what is being moved, the state it is in, and where it is going.

My Advice For New Business Travelers: Get The Credit Cards!

March 20, 2014

New business travelers first should sign up for a preferred hotel and airline program and focus their travel dollars there. Then, they should get a Chase Sapphire card or American Express Platinum card to earn points on travel and transfer those points to the hotel or airline program for redemption. Finally, they should consider getting the co-branded credit card for their hotel chain and airline of choice.

How Will Cisco Recover From The Consumer Strategy Blunder?

January 2, 2013

Cisco made a massive strategic blunder in the last decade, aggressively moving into consumer devices rather than focusing on their core enterprise and service provider markets. It seems that Cisco is now in the process of rectifying this mistake, but charting a path to growth is an entirely different matter!

Ten Terrible Apple Products

June 14, 2012

I’m often accused of being an Apple fanboy. While it’s true that I love my vast selection of fruity products from Cupertino, I’m not blind when the company makes mistakes. In fact, I think Apple’s mistakes are as enlightening as their successes: They reveal a company that is fallible, sometimes learning but often allowing the junk to rot far longer than other companies would.

Thinking About Storage In a New Way, From Cloud to Flash, with Dropbox and Fusion-io

July 23, 2013

I’ve been a storage revolutionary for quite a while, looking for new ways of data storage rather than technologies that perpetuate the same old approaches. That’s why I’m excited about the implications of two very different API access methods announced by Dropbox at DBX and by Fusion-io today at OSCON.

SMB 3 is Going to be Huge, in both Scope and Impact

May 6, 2012

Microsoft is about to release the third major revision to their ubiquitous network storage protocol, SMB. Windows Server 2012 and Hyper-V 3 will really highlight this technology, and I predict it will transform the way people think about networked storage for Windows systems. But SMB 3 is big in another way, too: there are tons of new features, and not all will be implemented by everyone.

The Ideal pfSense Platform: Netgate RCC-VE 2440

September 21, 2015

After some frustration with stability and latency connecting my virtual pfSense router to my cable and DSL modems, I decided to switch to a physical box. I selected the Netgate RCC-VE 2440 as my hardware platform, since it’s the same box that pfSense themselves use as their OEM bundle. It also checks all the boxes with a dual-core Atom CPU, four Gigabit Ethernet ports, and low-power fanless design. Here’s my first impression and installation notes!

What’s The Problem?

What’s The Solution?

You might also want to read these other posts...

Reader Interactions

Leave a Reply