Managing Exchange ActiveSync
By default, Exchange ActiveSync is enabled. All users who have an Exchange mailbox can synchronize their mobile device with the Microsoft Exchange server.
You can perform the following Exchange ActiveSync tasks:
-
Enable and disable Exchange ActiveSync for users
-
Set policies such as minimum password length, device locking, and maximum failed password attempts
-
Initiate a remote wipe to clear all data off a lost or stolen device
-
Run a variety of reports for viewing or exporting into a reporting solution
Security in Exchange ActiveSync
You can configure Exchange ActiveSync to use Secure Sockets Layer (SSL) encryption for communications between the Exchange server and the mobile device client. Certificate-based authentication works with a self-signed certificate, a certificate from an existing public key infrastructure, or a third-party commercial certificate. You can use certificate-based authentication together with other security features, such as local device wipe and a device password, to turn the mobile device into a smartcard. The private key and certificate for client authentication are stored in memory on the device. If an unauthorized user tries to bypass the device password, all user data is purged. This includes the certificate and private key. For more security, you can deploy RSA SecurID two-factor authentication on the Exchange server.
Device Security Features in Exchange ActiveSync
In addition to the ability to configure security options for communications between the Exchange server and your mobile devices, Exchange ActiveSync offers the following features to enhance the security of mobile devices:
-
Remote wipe If your device is lost, stolen, or otherwise compromised, you can issue a remote wipe command from the Exchange Server computer or from any Web browser by using Microsoft Office Outlook Web Access. This command erases all data from the mobile device.
-
Device password policies Exchange ActiveSync lets you configure several options for your device password. These options include the following:
-
Minimum password length (characters) This option specifies the length of the password for the device. The default length is four characters, but can include as many as 18.
-
Require alphanumeric password This option determines password strength. You can enforce the usage of a character or symbol in the password in addition to numbers.
-
Inactivity time (seconds) This option determines how long the device must be inactive before the user is prompted for a password to unlock the device.
-
Wipe device after failed (attempts) This option lets you specify whether you want the device memory wiped after multiple failed password attempts.