Exchange gurus

[Davie_GLA]

Hello all,

I've recently put into place 2x HTC Desire phones running android that has the capability of connecting to exchange via active sync.

I perhaps stupidly told them this was easy to set up, then realised that i really don't know that much about this side of exchange.

Anyone got any experience?

Do i need an SSL cert from godaddy? What else is required?

Any fancy routing?

If someone has a list of requirements i can see if i meet them

Thanks in advance,

David.

[LordGrover]

IIRC cyberface had some fun with this. Much cursing was involved.
Try a search for about a month ago.

[joewilliams]

Generally, if you have OWA available, simply point the activesync client to OWA's URL. Magic will happen and email will flow.

[LordGrover]

Here I think: click.

[Davie_GLA]

Ooh, i do have OWA available. It's nto that simple is it of simply entering the username and password?

How does exchange push it out, or is it not pushing, but the phone is polling for emails?

[pantscat]

AFAIK you don't *have* to have an SSL cert to use ActiveSync, but I've never done it without before, and it's generally not a good idea to do it this way as all traffic to and from the devices will be in plain-text for all to view!

Easiest option is to buy an SSL cert that is already in your mobiles root certificates store (usually the premium certificates do this, but you can ask GoDaddy or whoever which one you should buy to achieve this), alternative is to buy a cheaper SSL (or generate your own) and copy it to each device, double click-it and it will install in the certificate store.

Now all you have to do is to point the ActiveSync client to your Exchange server...

Worth checking that mobile access is enabled (it is by default, but may have been switched off...) - If you're running Exchange 2003 then open System Manager, double click Global Settings and right-click Mobile Services and click properties - all options should be ticked. If you're using Exchange 2007, then it's somewhere in the CAS settings, but I can't remember off the top of my head, and if you're using Exchange 2010 then I've got no idea!

Hope this helps...

Ant

[Davie_GLA]

Right, i've got it working but had to go over the VPN, which for now is OK.

Although, and perhaps i'm being thick, but i can't see a button to sent a new mail from active sync, i can reply forward from within a mail etc but can't send a new one. Perhaps that's the point and active sync'ing is just for syncing with your inbox etc.

I can send a new mail over active sync if i choose to send a mail to someone in the contacts, i then get an option of what account to use.

Is this OK?

D.

[malman]

Davie_GLA said:

Ooh, i do have OWA available. It's nto that simple is it of simply entering the username and password?

How does exchange push it out, or is it not pushing, but the phone is polling for emails?

basically the phone opens an http or https session to the exchange server. it logs in with your credentials and registers its interestes (inbox, calendar etc). from then on the exchange server can notify it of any changes at the server end. At the end of a variable timeout a new heartbeat is sent if no data has been sent during the last hearbeat interval. The server and phone automatically try to tune the hearbeat period depending on connection/firewalls etc default is 15 minute but can be up to 59minutes

[Davie_GLA]

There's more to this.

If i want to do it using a sub domain then it will be an issue as i don't have control over the domain. Yet.

I can't get it to connect using anything but VPN, which will of course work but will caue sync errors when not connected.

I think i'll have to bite the bullet and go for a cert.

Thanks,

David.

[itsnotarace]

Can you not just create a self signed certificate and install that on the handheld devices?

You don't mention what version of Exchange you have but you would need to do New-ExchangeCertificate from the shell if it's 2007, and then make sure it's bound to IIS

In Exchange 2003 you can generate the certificate using IIS on the website that hosts OWA

Ok so the self signed cert is only valid for a year but it saves buying one (unless you have >dozens of handhelds to configure)

ETA - How to package your cert as a cab http://blogs.msdn.com/windowsmobile/archive/2006/0...

Edited by itsnotarace on Thursday 1st April 13:59

[Davie_GLA]

Thanks,

Exchange is 2003 and i only have 3 handsets to configure so no biggie.

Also the phones are android so not sure that the cab will work? Although could be wrong.

I think it's more of a routing problem than anything else.

More investigation required it would seem.

It works fine when connected to wifi, but then it would.

David

[itsnotarace]

Are you using OWA externally? If it only works internally over wifi it sounds like you have not got an external address and opened port 443 on the firewall

[Davie_GLA]

I am using OWA externally and no i don't have a dedicated address and just opened 443 on the router.

[itsnotarace]

http://www.msexchange.org/tutorials/Creating-Certi... - that should get you started. Make sure you redirect port 443 requests to the box running IIS

[Davie_GLA]

Thanks,

As far as i can see i have 443 pointing to my exchange server - but still no joy.

I'm getting 'Authentication Failed' no matter what i put in the 'exchange server address' field.

Will put it down for now, long weekend and i've had enough!

Will pick it up again next week.

Thanks again.

David.

[LordGrover]

Is the default route on the exchange box the same as the router? Pretty sure it needs to be otherwise it's getting authorisation request for conflicting addresses.

[Davie_GLA]

DO you mean default gateway?

If so then the default gateway of the exchange box is the same IP address of the internal IP of the router.

[LordGrover]

Yep. Not that then... sorry dude.

[paddyhasneeds]

If it's Exchange 2003 then there shouldn't be much involved.

Go buy a commercial SSL cert, either a RapidSSL at $10 or a Thawte SSL123 at £30 is absolutely fine.

Make sure it is for the public dns name of your server and install it on the default website on IIS on your Exchange server.

Have a look at these too, I suspect it's something to do with forms and authentication:

http://support.microsoft.com/kb/817379
http://www.pocketpcfaq.com/faqs/activesync/exchang...

To check that SSL is happy on your phone just browse using its web browser to https://server.yourdomain.com/oma and check it works with no certificate errors etc.

I've found different phones give st levels of info when they're struggling so have a look in the event viewer and IIS logs on your Exchange server to see what's going on.

[buggalugs]

Davie_GLA said:

Thanks,

As far as i can see i have 443 pointing to my exchange server - but still no joy.

I'm getting 'Authentication Failed' no matter what i put in the 'exchange server address' field.

Will put it down for now, long weekend and i've had enough!

Will pick it up again next week.

Thanks again.

David.

*disclaimer* I haven't set up those particular phones before but I have done quite a few random ones. Its sometimes confusing which details the phone is asking for when you're setting it up, e.g. 'domain' often refers to the short domain name of the windows active directory domain, not to the email domain. The username and password will be the same as the ones used to log on to Windows. If theres no separate box for 'domain' then try domain_name\username as the username.

Re certs, the only difference on most handsets is that the first time you connect it will warn you that the cert is not valid and give you an option to 'accept permenantly', data on the connection will still be encrypted though.

Don't put the /exchange or /owa on the end of the address for the activesync server, just put it in up to the end of the .com or .co.uk and leave it at that.

Make sure outlook mobile access is enabled in the exchange system manager.

Make sure the user you're connecting as has outlook mobile access enabled in their properties in active directory.

You can get a free legit SSL cert from StartCom that works for OWA that's recognised by modern browsers, not sure that 100% of phones recognise theit certs yet though.

That's all I can think of for now... good luck