Database Users

ActiveSync Exchange Issues

HI guys,
Got my new TyTn out the box, set it up with some of my files, now i am trying to sync with my exchange server.
If I take off SSL, it tells me I don't have permission to initiate sync, which i know i do, cause i set it up on my account.
If i put SSL on, it says the server cannot be reached,
Could someone out there please help me. I have been trying for weeks, in the end i thought it was the unit, so this is my new unit now.

Be sure that the OWA folder (http://yourserver/exchange) has the "require SSL" unticked in security option of IIS, also check that integrated authentification is ticked.
Check that your tytn trust the CA and that the cert match the server name (with both internal/external DNS if possible).
If you want to go without SSL (which is far from being a good idea, everything will go through the network in plain text) have a check in the server log; there will be a critical event explaining you what is going on and what to do in that case

Hi man,
Thanks for the response, how do i issue the CA certificate for the Tytn from the server?
Is that maybe my problem that the relationship between the device and the server hasn't been established properly?
I just want to get my e-mail, why has microsoft made it such an issue?
Surely if you enter in all the correct details for the server and the user account it should work, just like setting up teh IMAP with the send and recieve schedule like u used to on the IIi's?
Appreciate the help mate
Thanks

Microsoft deny you to check your email if you don't trust the CA. This is normal and a part of the SSL security; SSL certs are used to cipher AND to auth.
If the certificat is not issue by a trusted root CA it won't be trusted by your device. You have to connect to http:/ca_server/certsrv and here select "download" CA cert. Just transfert the cert to your device and set it up. If you can not acces the CA web service that way you may be able to gather the certificate while surfing to te OWA with explorer: go to https://your_server/exchange click on the little lock, go to "certification's path" double click the certificat on the top of the "tree" go to detail and select save to file. Select *.cert format and then finaly send this file to your PPC.

No can't connect to the Cert page, and with the OWA page, if you mean the little lock that appears at the bottom of some web pages in one of the blocks, I don't get that with my OWA. I am a bit lost...

ruski said:
No can't connect to the Cert page, and with the OWA page, if you mean the little lock that appears at the bottom of some web pages in one of the blocks, I don't get that with my OWA. I am a bit lost...
Click to expand...
Click to collapse
use https://your/owa instead of http://your/owa. Using the OWA without cipher is far from being a good idea; your user/password (wich is in fact an active directory user, that a some power) goes in plain text through the internet.

aaw, man, Thanks so much, I see now... OK, I will get the certificate off tomorrow and copy it onto my Tytn. I really hope that works! Thanks for your help!

OK, now I have made the certificate and copied it onto the Tytn, Still says The server could not be reached! Support code: 0x80072EE2
Ok, just want to check, when setting up the server, under server name, I have the servers external IP address. SSL is ticked, the user name and password and domain should be correct, username is @domain.local
Other than that, not much complicated, i don't seem to be understanding microsofts issue here, i have searched for white papers, which seem to be very vague and no step by step on how to set it up.

Hooooaarg speaking english is giving me headache
You are only satisfying one of the requirement at now:
-Your tytn trust your CA
In IIS you have issued a certificat to a name, for instance server.domain.local; if you contact this server through a SSL connexion by another name you will get an error; the name you accessed doesn't match the name in the certificate; so for IE and your PPC the security may be compromised. In active sync, under server name, you have to enter the exact same name you entered when you issued the SSL certificat in IIS, if it is internal (server.domain.local) it will only work as long as you are on your network. There are several ways to solve that; you can revoque this certificat in IIS and issue a new one matching your external DNS, with this solution you will be able to setup your activesync to connect through the external name of your server, keep in mind that NAT forwarding must be configured to route the traffic from HTTP socket (80) to the exchange server.
You can also setup a VPN server (L2TP/IPSEC should work fine), so that you will always be on the internal network and so able to get your email. This should be the safest way to go, but I guess that it generate more traffic, thanks to the encapsulation; so if you are greedy and pay per byte, avoid this solution.
You could, at last, also disable the SSL encryption; but in my opinion this FAR from being the good way to go, it should only be used for testing purpose.

If you can speak afrikaans I will happily change! lol
OK, if I turn off SSL and connect to the server external IP, it says I don't have permission to synchronise,
If i turn on SSL it tells me the server can't be reached, wish it would make up it's mind.
I am not very good with IIS, I am staring at it now. I am not sure if i did the certificate thing right. As there are 2 options to export , DER encoded and Base-64, I used DER first time round.
If i try and access the server name ie. https://servername it says i cannot use my existing connection and must check properties.....
Thanks for your help man!

You may want to check that you are also forwarding port 443 or what ever port you are using for https access for external use at the server end.

You had to get ActiveSync permitted for your account (by administring it with "Active Directory users and computers" in one of the tab for your users) but you also need it activated on the Exchange "System Manager" under organisation settings (have a look at www.httpsync.net)
André

how do you guys switch smtp server?

Hello,
This may be a strange question, but how do you guys switch SMTP servers? I'd like to access the same mailbox over different connections (gprs, 2 different wifi). Reading mails is not an issue.
But for sending them, I need a different SMTP server for each of the connections (as I suspect everybody does). On my symbian phone, I could change the sending options of a mail, and one of the options is the mail-account used to send it. But this is not possible on the built in Outlook.
How do you guys do it?
(I'm planning to use QMail, which does support changing the account by which a mail is sent; but to make it more comfortable I also am working on a MortScript to change account settings when I want. There were some certificate issues in configuring QMail, but I think I solved it. The reason switching is important to me, is that my GPRS subscription has a volume limit, above which I have to pay extra. So if I can use an alternate connection, I prefer this.)
Jörg

V J said:
Hello,
This may be a strange question, but how do you guys switch SMTP servers? I'd like to access the same mailbox over different connections (gprs, 2 different wifi). Reading mails is not an issue.
But for sending them, I need a different SMTP server for each of the connections (as I suspect everybody does). On my symbian phone, I could change the sending options of a mail, and one of the options is the mail-account used to send it. But this is not possible on the built in Outlook.
How do you guys do it?
(I'm planning to use QMail, which does support changing the account by which a mail is sent; but to make it more comfortable I also am working on a MortScript to change account settings when I want. There were some certificate issues in configuring QMail, but I think I solved it. The reason switching is important to me, is that my GPRS subscription has a volume limit, above which I have to pay extra. So if I can use an alternate connection, I prefer this.)
Jörg
Click to expand...
Click to collapse
Exactly the same q was aksed either here or some other PPC forum some days ago.
My answer (I pretty much know everything about mailer clients and internal database / file formats - see http://www.pocketpcmag.com/blogs/index.php?blog=3&p=569&more=1&c=1&tb=1&pb=1 ) is as follows: just switch your Qmail config files (the one that contains the SMTP server) from, say, a Mort script and restart Qmail.

If your mail server supports SMTP Auth, u don't need to do anything.
In the config pages, click on "my outgoing server requires authentication" then click on "use same settings as incomming"
Should solve the problem IF the smtp supports authentication.

Menneisyys:
Yes, that was my post (sorry, I should have linked to that particular thread). I'm just wondering if I'm the only one finding this a huge issue. Either way, I'm writing scripts as we speak (couldn't have done it without you referring to QMail). I also like to show on the today-screen which "smtp-profile" is active (found some ways of doing this too), and while I'm at it the script will also change PIE settings (not load images on gprs, load images on wifi). I'll make the necessary steps (along with the scripts and required softwares) in some tutorial, for reference.
(I had some issues with QMail, but I needed to add the certificate for my servers first).
armedmetallica said:
If your mail server supports SMTP Auth, u don't need to do anything.
Click to expand...
Click to collapse
Yes, but neither my mobile operator, nor my work, nor my analog dialup provider (still need it) support smtp authoring... Come to think of it, I could always set up a VPN to my work, which will allow me to use their mail server (but the VPN is also traffic limited, and sometimes VERY slow)...
Jörg

V J said:
Menneisyys:
Yes, that was my post (sorry, I should have linked to that particular thread). I'm just wondering if I'm the only one finding this a huge issue. Either way, I'm writing scripts as we speak (couldn't have done it without you referring to QMail). I also like to show on the today-screen which "smtp-profile" is active (found some ways of doing this too), and while I'm at it the script will also change PIE settings (not load images on gprs, load images on wifi). I'll make the necessary steps (along with the scripts and required softwares) in some tutorial, for reference.
(I had some issues with QMail, but I needed to add the certificate for my servers first).
Yes, but neither my mobile operator, nor my work, nor my analog dialup provider (still need it) support smtp authoring... Come to think of it, I could always set up a VPN to my work, which will allow me to use their mail server (but the VPN is also traffic limited, and sometimes VERY slow)...
Jörg
Click to expand...
Click to collapse
Did you finally manage to achieve with something useful ... ? I'm in the same situation and looking for something easy to use to switch from one SMTP to another depending on the channel used (3g or Wifi).

Unfortunately, no...
My current solution is to use my work server: it requires me to set up a VPN first and then log on to it. When doing so, I can use it from anywhere; it works but is far from efficient (starting the VPN takes some time).
I thought of using a windows mobile program to have the equivalent of the hosts file in Windows (this is a small hackers trick: configure the software with a dummy name, and use the hosts file to have this resolve to the IP address you want), but it doesn't allow for easy switching, particularly as I needed a logon for one server. If you need this hosts utility, I should search for it (let me know if you need it); but it doesn't make switching that much easier from changing the settings in the mail client.
A possibility could be to use QMail as the mail client, but this is not possible for me due to some security settings I need (it never could download the mail bodies).
Jörg

Did the Mortscript avenue not pan out? I would of thought this would be something that it could easily solve.

Yes, but apparently the SMTP server settings are not stored in the registry, but in the outlook file which holds the account settings.
Editing this file is possible (founds some references on it), but generally not recommended as it easily is corrupted.
Jörg

gmail's servers?
V J said:
Yes, but apparently the SMTP server settings are not stored in the registry, but in the outlook file which holds the account settings.
Editing this file is possible (founds some references on it), but generally not recommended as it easily is corrupted.
Jörg
Click to expand...
Click to collapse
can't you just setup a gmail account, enable it for POP access, and use their provided SMTP server with your gmail username/password? leave incoming via POP on your existing one...

V J said:
Unfortunately, no...
My current solution is to use my work server: it requires me to set up a VPN first and then log on to it. When doing so, I can use it from anywhere; it works but is far from efficient (starting the VPN takes some time).
I thought of using a windows mobile program to have the equivalent of the hosts file in Windows (this is a small hackers trick: configure the software with a dummy name, and use the hosts file to have this resolve to the IP address you want), but it doesn't allow for easy switching, particularly as I needed a logon for one server. If you need this hosts utility, I should search for it (let me know if you need it); but it doesn't make switching that much easier from changing the settings in the mail client.
A possibility could be to use QMail as the mail client, but this is not possible for me due to some security settings I need (it never could download the mail bodies).
Jörg
Click to expand...
Click to collapse
Well ... no thanks ... I'd like very much to have something easy to use ...
It is like to make sure that when wifi is available than use wifi and drop GPRS.
We can then easily imagine that knowing about an available existing Wifi network, the soft should be able to automatically modify the smtp server accordingly, switching back to "normal" when out of the coverage of the WIFI network ... not really a big deal for good programmer, a trip to the moon for me ...
thanks anyway for your proposal ... wait and see what clever people will bring to us

landwomble said:
can't you just setup a gmail account, enable it for POP access, and use their provided SMTP server with your gmail username/password? leave incoming via POP on your existing one...
Click to expand...
Click to collapse
That wasn't an option for me: my incoming mailserver requires a VPN connection (when using the wifi at work). I think that some internet traffic over the VPN is blocked, preventing me from accessing another SMTP server.
DR400 said:
We can then easily imagine that knowing about an available existing Wifi network, the soft should be able to automatically modify the smtp server accordingly, switching back to "normal" when out of the coverage of the WIFI network ... not really a big deal for good programmer, a trip to the moon for me ...
thanks anyway for your proposal ... wait and see what clever people will bring to us
Click to expand...
Click to collapse
Hehe...
The easiest thing would be something more userfriendly that exploits the possibiliy of using the "hosts" file to alter the IP address of the SMTP server (this is how most of the network switching tools on laptops do it). The downside to this approach is that you cannot change logon settings. In order to do this, they need to be able adjust the settings in the mailclient; either via some interface (not sure this is available), or by altering the configuration file.
Jörg

The gmail route absolutely works for me - no mucking about with scripts etc. I followed this link (http://lifehacker.com/software/email-apps/how-to-use-gmail-as-your-smtp-server-111166.php)
only difference is that the smtp is [email protected]. Follow the instructions to set up gmail with your primary address and bingo.
Robert

ActiveSync config for Exchange

Trying to set up ActiveSync on my Telus P4000 (Titan), although the issue should be the same with an WM6.1 phone...
I can't for the life of my figure the right server settings to enter in the Configure Server section, and I have yet to find a definitive "this is how you do it" procedure for it. As near as I've been able to glean, for the "Server address" section, you give it JUST the domain name of the Exchange server, without an http:// or a /exchange or /oma or anything... correct so far? But the catch in my particular instance is that Exchange web access is on port 8080, rather than 80 or 433.
I've tried adding a :8080 to the server address, I've tried adding the http:// and/or https://, I've tried adding the /oma and /exchange to the end, and all combinations of the above, with no luck... when I go back into the settings, it's reverted to JUST the domain name. Is there somewhere else I can tell it to use a non-standard port? Registry key, maybe?

I'm not sure it works with other ports than 80 (HTTP) and 443 (HTTPS).
You just need to put your external A record in the server value.
Try using standard ports first to be sure everything is working, then switch.

Okay, well I managed to get rid of the "Cannot reach server" messages by switching back to "require SLL", and as it turns out, the server wasn't set up for SSL (it is now). So now I'm connecting, but getting certificate errors. At least I've found plenty of info about solving that issue, so on to the next step...

Soundy106 said:
Okay, well I managed to get rid of the "Cannot reach server" messages by switching back to "require SLL", and as it turns out, the server wasn't set up for SSL (it is now). So now I'm connecting, but getting certificate errors. At least I've found plenty of info about solving that issue, so on to the next step...
Click to expand...
Click to collapse
You will probabby have to install a certificate on the phone to be able to communicate with the exchange server. At least i had to...

playerkiller said:
I'm not sure it works with other ports than 80 (HTTP) and 443 (HTTPS).
You just need to put your external A record in the server value.
Try using standard ports first to be sure everything is working, then switch.
Click to expand...
Click to collapse
I've searched everywhere for info on using non-standard ports for activesync, and I haven't found anything, and I couldn't get it to work.

jeen said:
You will probabby have to install a certificate on the phone to be able to communicate with the exchange server. At least i had to...
Click to expand...
Click to collapse
Yeah, did that... still not helping

Go to first new post ActiveSync config for Exchange
Exchange ActiveSync cannot access the server if SSL is set to be required. For
information about how to correctly configure Exchange virtual directory

jeen is right. Unless the certificate is issued form a Trusted Certificate Authority, you will need to import the issuing CA in the Root Certification Authority store of your Phone.
If it's a self signed cert, just export it from exchange server (without Private key) and copy it to your phone. Then, double click it from File Manager. This should be enough.

^Yeah, I did that right off the top (see my reply to jeen). Still no joy.
Perhaps Tendulkar can finish his thought...

To disable SSL requirements for Activesync service is very easy:
Win2003 (IIS6.0)
Open IIS on your cas, expand the Default Website (or the website where ASVritualDir resides) right click on Microsoft-Server-ActiveSync and choose properties.
Go to the tab Directory Security, choose EDIT under Secure Communication.
Remove flag from Require Secure Channel.
Obvsiulsy Click ok.
Win2008 (IIS7)
Open IISManager.
Navigate through site, default website, hilight Microsoft-Server-ActiveSync.
Make sure you have the features view selected (should be by default).
Choose SSL Settings.
Unflag "Remove SSL".
Obviusly click Accept.

playerkiller said:
To disable SSL requirements for Activesync service is very easy:
Win2003 (IIS6.0)
Open IIS on your cas, expand the Default Website (or the website where ASVritualDir resides) right click on Microsoft-Server-ActiveSync and choose properties.
Go to the tab Directory Security, choose EDIT under Secure Communication.
Remove flag from Require Secure Channel.
Obvsiulsy Click ok.
Click to expand...
Click to collapse
Hmmm... "require SSL" was already un-checked. I've re-checked it, let's see what happens with that.

OK lemme know.

make sure you have the same root certificate installed also. you have to trust the same certificate authority as the certificate that you have on your exchange server.

Did anyone find solution
I am having same problem. Certificate installed and tried all connection settings that can find on internet. Cannot get ActiveSync to syn with my server (same certificate error, but hosting company states tested with WM6.1 that all is working fine on their end) and also cannot get Windows Live Messenger to work, states there's a connectivity problem. Funny thing is MMS, surfing net with IE, and Google Maps with GPRS work fine. Only Microsoft network products are not working. My phone is Palm Treo Pro with WM6.1 Professional. Vodaphone version but bought in China and have since added A4 Chinese text editor, which I think could be problem, but need to hard reset phone to check. Any ideas? Better yet, any solutions?

One tip for getting this working in my case (same certificate errors) was that I had to get the certificate off the internally facing OWA server, rather than the externally facing version. Although they're both the same server, the external one goes through an IAS box which seems to be presenting its own certificate rather than the one on the exchange server. Don't ask me - I don't run the system.
As soon as I add the Internal version of the cert, Exchange, OTA Sync and ActiveSync spring into life.

Change default IMAP folder names

Hello everybody.
I'm absolutely new to this topic as the HD mini is my first smart phone and maybe this is an absolute trivial question, but I did not find an answer:
Is it possible to change the default IMAP folder names the phone's client is using?
I unfortunately can't switch the complete phone's language to English but I definitely need this for the IMAP folders.
Is there a solution to have "INBOX", "SENT" (or is it "SENT-ITEMS"?) and "DRAFTS" also for non-English systems?
Thank you for your time and answers.
Arno

Hello Arno,
As far as I know, this is not possible. I have looked for a way to change the default IMAP root directory (e.g. /imap instead of / or /INBOX) but I never found a solution.
It is probably not what you need but the only thing I found is that it is possible to use a custom port for a server: just add ":Port#" at the end of its address. This partially solved my problem since our sysadmin has been kind enough to run another IMAPS server on port 10993 (instead of the standard IMAPS port which is 993) through which I am able to access to ~/imap as my IMAP root instead of ~/ (my IMAP root is in my UNIX account home directory).
Regards,

That's a pity darthrider. I doubt that "smart phone" is the right wording if something simple like this isn't possible.
My mail provider is neither able nor willing to introduce some symbolic links (e.g. map "Gesendete Objekte" and "Sent Items" to the same folder). And while Outlook, Thunderbird and my web mail client are able to configure it as wanted, the most important software (my phone which was bought to replace Thunderbird and web mail) isn't.
At least I've learned something. Maybe 7 will introduce this possibility...
Nevertheless thank you for your response

Proxy Settings

Hello
I hope I'm posting this in correct area!
I have several WM devices (6.1 and 6.5, Professional and Standard - e.g. Touch 2, Snap, Tytn2), connecting to an exchange server for mail, calendar etc, and they also go through a proxy server for web access .
I want to find an easy way to change proxy server settings on them all without having to go in and manually change proxy server IP address and Port. I've done some searching on here and web in general, and subsequently messed around with creating a CAB file, and an XML provisioning file but neither worked (I found some provider specific proxy settings in registry but maybe these are red herring?)
Then I realised my creations would probably never work anyway because they're unsigned apps which aren't allowed on devices connecting to my exchange server!
Am I missing an obvious and much easier method? Any ideas on best way to approach this?
Thanks in advance
Mantog

Very nice idea, but I don't know a solution.
Where are the IP-adresses stored?
If it works with registry settings, a cab file should be sufficent.
I'm trying to find a way to do this, but hopefully someone already has a solution.
playdo