Dealing with Existing ActiveSync Device Associations when Changing Organization Settings

The default ActiveSync organization setting in Exchange Server 2010 is to allow any mobile device to connect to an Exchange mailbox without requiring approval from an administrator.

Consider a scenario where the business has decided that mobile devices should be blocked or quarantined by default, requiring administrator approval before they are allowed to connect.

As an example, the ActiveSync organization setting is set to quarantine.

In this case there are several users already using their mobile device to connect to Exchange. With the new setting applied one of them, Mary Hayes, is no longer able to connect, while the other person, Vik Kirby, is still able to connect without any issues.

In the view of quarantined devices we can only see Mary Hayes. Vik Kirby’s device has not been quarantined.

If the desired outcome was to quarantine all existing users and have their devices reviewed and approved where appropriate, then we need to work out how to deal with users such as Vik Kirby who were not affected by the change in policy.

In the help information for Set-ActiveSyncOrganizationSettings we can see the following notes for DefaultAccessLevel option.

The DefaultAccessLevel parameter specifies whether new devices or existing devices are allowed, blocked, or quarantined.

Note: If you use the ActiveSyncDeviceAccessRule rule to define an access group of Exchange mobile devices together with their access level for a specific set of devices, those devices are not affected by the DefaultAccessLevel parameter.

While it does refer to mobile devices that are permitted by an ActiveSync device access rule, what it doesn’t say is what to expect for an individual user’s device that has been explicitly granted access (for example during a previous period when the default access level was set to block/quarantine).

If we use Get-CASMailbox to review mailboxes that have ActiveSync device associations we can see the difference between Mary and Vik.

[PS] C:\>Get-CASMailbox | where {$_.HasActiveSyncDevicePartnerShip} | select name,activesyncallowed*,activesyncblocked* | ft -auto

Name        ActiveSyncAllowedDeviceIDs         ActiveSyncBlockedDeviceIDs
----        --------------------------         --------------------------
Alan.Reid   {1249054091, androidc259148960}    {}
Mahera.Bawa {1249054091, Appl87941C1N3NS}      {}
Mary.Hayes  {}                                 {}
Vik.Kirby   {F04016EDD8F2DD3BD6A9DA5137583C5A} {}

Vik has a previously allowed device that is letting him continue to connect despite the change to the organization default access level.

To remove this approved device all we need to do is null the ActiveSyncAllowedDeviceIDs attribute for Vik.

Set-CASMailbox vik.kirby -ActiveSyncAllowedDeviceIDs $null

This change may take a short time to replicate through your environment. On next connection attempt we can see that Vik’s device becomes quarantined as intended.