Exchange 2010 SP2 with ActiveSync 14.2 and Blackberry devices

[dhicks]

Hello All,

 

Is anyone else running Exchange 2010 Service Pack 2, which uses ActiveSync protocol version 14.2, and having trouble with Blackberry devices not syncing email? Some older iPhones seem to have a problem, too. Anyone have any idea if it's possible to get Exchange to use a previous ActiveSync version for now?

[sukh]

14.2 is the Exchange version, you've got to make sure the devices have the correct EAS implementation on them, that's normally down to the manufacturer/service provider.

Exchange ActiveSync Client Comparison Table - TechNet Articles - Home - TechNet Wiki

[dhicks]

14.2 is the Exchange version

 

Ah, so there's no separation between the Exchange version and the ActiveSync protocol it uses, then? Exchange 2010 SP2 uses ActiveSync version 14.2 and there's no way to change that?

 

Yesterday I rebuilt the OWA and ECP client access virtual directories on the IIS server running on our mail server, as detailed here:

 

Reset Client Access Virtual Directories: Exchange 2010 Help

 

I also checked the user's account permissions in Active Directory by navigating to Active Directory Users and Computers -> Properties of user's account -> Security tab and giving the DOMAIN\Exchange Servers entity full control. This morning, someone with a Blackberry device reports that they are able to pick up email again, although they did also delete and re-add their account details at their end. I'm inclined to think that the upgrade from SP1 to SP2 mangled the permissions on the user's Active Directory accounts (which seem to mangled pretty easily) and the deleting-and-re-adding the email account details forced the Blackberry server to try a sync with our server, but I'll investigate a bit further. I don't think rebuilding the OWA and ECP client access virtual directories helped, but it was worth a try.

[sukh]

Which Version of BES are you using?

Or are you using BB with EAS?

[dhicks]

Which Version of BES are you using?

Or are you using BB with EAS?

 

BES as in Blackberry Enterprise Server? We don't have anything from Blackberry installed locally, these are teachers own devices that they are connecting to our Exchange server to pick up their email.

[dhicks]

Yesterday I rebuilt the OWA and ECP client access virtual directories on the IIS server running on our mail server

 

Thinking about it, either this or the original upgrade to Service Pack 2 may well have re-generated our self-signed HTTPS certificate - I'd better check.

 

--

David Hicks

[sukh]

OK no BES, I can;t remember if you have a native EAS app installed on the BB or if you have to use a 3rd part EAS app on BB to sync email. What do the teachers use on the BB? Also what model(s) are involved here?

 

Going to SP would not have changed account attributes, SP touches the Config partition if it was a simple upgrade.

 

Also, what error if any do you get or does it simply not sync any emails?

 

If you have a look at the IIS logs (c:\inetpub\logs\logfiles\w3svc1) what do you see in the logs when they attempt to sync?

[rbance]

BES as in Blackberry Enterprise Server? We don't have anything from Blackberry installed locally, these are teachers own devices that they are connecting to our Exchange server to pick up their email.

 

If teacher owned devices, just use the webmail feature on the BB, forget BES or ActiveSunc (unless you want to wipe devices and have a real security need). but remember these are teacher owned, not school owned, so unless there is a policy requirement, the webmail function is fine.

[dhicks]

but remember these are teacher owned, not school owned, so unless there is a policy requirement, the webmail function is fine.

 

The webmail is rather fiddly to use on a Blackberry's screen, so we would much rather have ActiveSync working properly (which, last thing on Friday, it seemed to be doing, so I think we're okay).

[dhicks]

OK no BES, I can;t remember if you have a native EAS app installed on the BB or if you have to use a 3rd part EAS app on BB to sync email. What do the teachers use on the BB? Also what model(s) are involved here?

 

I think it's simply whatever email application comes built in to the BlackBerry device. Manufacturers seem to have to license the use of ActiveSync, so it's more the kind of thing a handset manufacturer would deal with rather than a third-party app developer. I didn't pay much attention to what model of BlackBerry device people had, but the problem seemed to be the same on all devices.

 

Going to SP would not have changed account attributes, SP touches the Config partition if it was a simple upgrade.

 

You'd think so, but permissions on our Active Directory and Exchange server seem to change somewhat at whim at the moment. We curently have a Server 2003 Domain Controller and a Server 2003 server running Exchange 2003, plus another Server 2008 SP2 server running Exchange 2010. We're setting up a new Server 2008 SP2 Domain Controller and Server 2008 SP2 Exchange 2010 server to get things rather more neat and tidy.

 

Also, what error if any do you get or does it simply not sync any emails?

 

I don't have the log file for the Exchange server to hand, I'll check on Monday, although I think mail is syncing again okay now.

 

If you have a look at the IIS logs (c:\inetpub\logs\logfiles\w3svc1) what do you see in the logs when they attempt to sync?

 

I'll give it a look on Monday.

[rbance]

The webmail is rather fiddly to use on a Blackberry's screen, so we would much rather have ActiveSync working properly (which, last thing on Friday, it seemed to be doing, so I think we're okay).

 

Hi,

 

Outlook is a native client on the BB and it uses the webmail settings....there is nothing fiddly about it.

This is not using the browser, but a proper built in client....it works very well...

 

Richard

[rbance]

Hi,

 

Outlook is a native client on the BB and it uses the webmail settings....there is nothing fiddly about it.

This is not using the browser, but a proper built in client....it works very well...

 

Richard

 

Unless of course the ISP for the BB has not enabled the BIS mail icons on the BB, in which case you ask the teacher to tell there telco\ISP to set it up....would you like screenshots of the client????

[dhicks]

Outlook is a native client on the BB and it uses the webmail settings....

 

That's handy to know, thanks. I'm not sure, exactly, what client is being used on the BlackBerry devices - I'd assumed it was the client that comes included with the device, whatever that is. I understood that it picked up its email from BlackBerry's central servers, which in turn pick up email from our Exchange server. I don't have a BlackBerry myself, and I only get to see the device as it's quickly waved in front of me as someone tells me it isn't working, so I'll try and figure out tomorrow what client is running. We do have at least one person who couldn't previously pick up email now able to pick up email again, though, so it looks as though we've resolved the issue.

[dhicks]

Unless of course the ISP for the BB has not enabled the BIS mail icons on the BB, in which case you ask the teacher to tell there telco\ISP to set it up....would you like screenshots of the client????

 

All the BlackBerry clients in question were previously (before we upgraded Exchange to Service Pack 2) able to pick up email okay, so all those devices must have whatever is needed already enabled.

[Abaddon]

Had similar, and this solved my problem:

 

Exchange connection fix

 

There are some issues with ActiveSync for both Exchange 2007 and Exchange 2010 users whereby some users can connect their Mobile Devices (Windows Mobile Phones / iPhones / Motorola Droid etc) quite happily and ActiveSync pushes mail to the devices, but other users cannot connect and cannot sync anything at all.

 

There appear to be plenty of potential solutions for this problem around if you search the web, but the solution to the majority of these problems can be solved quite simply.

 

If you open up Active Directory Users and Computers and locate one of your users that is not working, Double-Click into the account and click on the Security Tab (if this is not visible, Click on View> Advanced Features from the Menu at the top of the screen then navigate back to your user). Once on the security tab, click on the Advanced Button and make sure that the ‘Include Inheritable Permissions From This Object’s Parent’ is ticked. Click OK twice to close the user account.

 

Once the box is ticked, you should then be able to connect up your Mobile Device to your Exchange Server and receive your mail like the rest of your users.

[dhicks]

If you open up Active Directory Users and Computers and locate one of your users that is not working, Double-Click into the account and click on the Security Tab (if this is not visible, Click on View> Advanced Features from the Menu at the top of the screen then navigate back to your user). Once on the security tab, click on the Advanced Button and make sure that the ‘Include Inheritable Permissions From This Object’s Parent’ is ticked.

 

But as sukh pointed out above, upgrading to service pack 2 shouldn't have affected individual account permissions in Active Directory.

[Abaddon]

Agreed, it shouldn't..

 

I've had a couple of issues like yours, with random connection errors (to mail boxes), on diverse handsets (iOS, Blackberry and one Android), and this fixed it on all occasions. May not work for you, but it was worth a try..

[PiqueABoo]

Some AD ubergeekery that *might* be relevant and has explained a Very Great & Perplexing Mystery[tm] for me in the past:

 

If you find a normal user where the AD Inherit permissions tick box is clear then look at the adminCount attribute on the user object. If that's 1, then that will usually explain why the tick box is clear and you must set that attribute to 0, otherwise any tick you put in the Inherit permissions box will be automagically cleared again.

 

If you want to find users where adminCount =1, make an ADUC custom query where the advanced tab LDAP query is:

 

(objectcategory=person)(samaccountname=*)(admincount=1)

 

** eliminate the space this forum puts in the word "admincount" **

 

Don't do this to Admin accounts without Googling, in fact Google first regardless. Here's some relevant MS info about AdminSDHolder, protected groups and SDPROP to get you started. In my world this has *always* been about Orphaned AdminSDHolder Objects i.e. someone temporarily put user accounts in a privileged group for some reason or other.

Edited February 28, 2012 by PiqueABoo