Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid...

43
  • date post

    22-Dec-2015
  • Category

    Documents

  • view

    219
  • download

    3

Transcript of Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid...

Page 1: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.
Page 2: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Windows Mobile Device Management

Windows Mobile Device Management

Khalid SiddiquiMobility ArchitectMicrosoft Corporation

Khalid SiddiquiMobility ArchitectMicrosoft Corporation

Page 3: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

ScopeScope

Windows Mobile Device ManagementOverview

Provisioning

Standards and architecture

System apdates

System Management ServerMessaging and Security Feature PackScenarios

Windows Mobile Device ManagementOverview

Provisioning

Standards and architecture

System apdates

System Management ServerMessaging and Security Feature PackScenarios

Page 4: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

What is Device Management?What is Device Management?

SoftwareSoftwaredistributiondistribution

ProvisioningProvisioningOTAOTA

connectedconnected

Patch Patch managementmanagement

OS updateOS updateImage updateImage update

Inventory Inventory H/WH/WS/WS/W

AuditingAuditingandand

logginglogging

Help DeskHelp DeskTroubleshootingTroubleshooting

Page 5: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

MechanismMechanism

Device Management MechanismDevice Management Mechanism

PayloadPayload

ProtocolProtocol

DirectionDirection

XMLXMLCPF CPF CABCAB

RAPICONFIGRAPICONFIG WebsiteWebsite SD CardSD Card OMA CPOMA CP OMA DMOMA DMserverserver SMS / MSFPSMS / MSFP

DTASDTAS

CPF/CABCPF/CAB

HTTP/SHTTP/S

CPF/CABCPF/CAB WBXMLWBXML

SMSSMSSISISLSL

OMAOMADM XMLDM XML

SMSSMSHTTP/SHTTP/S

XML/XML/

PKGPKG

HTTP/SHTTP/SDTASDTAS

SDIOSDIO

Page 6: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Configuration ManagerConfiguration Manager

Configuration Manager hosts Configuration Service Providers (CSP)Each CSP is a block of settingsEach block of settings has a corresponding block of XML

Configuration Manager hosts Configuration Service Providers (CSP)Each CSP is a block of settingsEach block of settings has a corresponding block of XML

Configuration Configuration ManagerManager

Configuration Configuration Service ProviderService Provider

Configuration Configuration Service ProviderService Provider

Configuration Configuration Service ProviderService Provider

Page 7: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Accessing Configuration Service ProviderAccessing Configuration Service Provider

ROLE Configuration Service Provider

USER_AUTH

Access, Bluetooth, Browser Favorite, Clock, CM_GPRSEntries, CM_NetEnteries, CM_Networks, CM_Planner, CM_PPPEnteries, CM_ProxyEnteries, CM_VPNEnteries, CM_WIFIEnteries, CM_Planner, EMAIL2, FileOperation, Home, Locale, NAP, NAPDEF, Obex, Proxy, PXLOGICAL, Sounds, SpeedDial, Sync, Uninstall, VPN

OPERATOR Application, Bootstrap, DevDetail(R/O), DMAcc(R/O), NAPDEF, PXLOGICAL.

OPERATOR_TPS

Application, Bootstrap, GPRS_Entries, CM_PPPEntries, DevDetail(R/O), DMAcc(R/O), FwUpdate, LoaderRevocation, NAP, NAPDEF, PXLOGICAL, ROMPackage, WiFi

MANAGERCertificateStore, CM_Mappings, DeviceInformation(R/O), Metabase, Registry, SecurityPolicy, TAPI

Page 8: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Configuration Service ProvidersConfiguration Service Providers

Branding Home, notifications

CustomizationClock, browser favorites, email, sync, sounds

NetworkingGPRS, mapping, planner, proxy, VPN, WiFi, Bluetooth

SecurityPolicies, certificates

Branding Home, notifications

CustomizationClock, browser favorites, email, sync, sounds

NetworkingGPRS, mapping, planner, proxy, VPN, WiFi, Bluetooth

SecurityPolicies, certificates

Page 9: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

GPRS CSPGPRS CSP<wap-provisioningdoc>

<characteristic type="CM_GPRSEntries">

<characteristic type="GPRS1">

<parm name="DestId" value="{436EF144-B4FB-4863-A041- 8F905A62C572}" />

<characteristic type="DevSpecificCellular">

<parm name="BearerInfoValid" value="1" />

<parm name="GPRSInfoValid" value="1" />

<parm name="GPRSInfoProtocolType" value="2" />

<parm name="GPRSInfoL2ProtocolType" value="PPP" />

<parm name="GPRSInfoAccessPointName" value="your apn" />

<parm name="GPRSInfoAddress" value="" />

<parm name="GPRSInfoDataCompression" value="1" />

<parm name="GPRSInfoHeaderCompression" value="1" />

<parm name="GPRSInfoParameters" value="" />

</characteristic>

</characteristic>

</characteristic>

</wap-provisioningdoc>

Page 10: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

<wap-provisioningdoc>

<characteristic type=“Wi-Fi">

<characteristic type=“access-point">

<characteristic type=“Work Network">

<parm name=“NetworkKey"value=“key"/>

<parm name="DestId"value="{GUID}"/>

<parm name=“Authentication"value=“0"/>

</characteristic>

</characteristic>

</characteristic>

</wap-provisioningdoc>

WiFi CSPWiFi CSP

Page 11: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Bluetooth CSPBluetooth CSP<wap-provisioningdoc>

<characteristic type="Bluetooth">

<parm name="BtMode" value="2"/>

</characteristic>

</wap-provisioningdoc>

0=Off0=Off1=On1=On2=Discoverable2=Discoverable

Page 12: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

<characteristic type="Sync"> <characteristic type="Connection"> <parm name="User" value="test"/>

<parm name="Password" value="test"/> <parm name="SavePassword" value="1"/> <parm name="Server" value="labsrv.sphone.net"/> <parm name="Domain" value="sphone"/>

</characteristic> <characteristic type="Mail">

<parm name="Enabled" value="1"/><parm name="SyncSwitchPurge" value="1"/>

</characteristic> <characteristic type="Contacts">

<parm name="Enabled" value="1"/><parm name="SyncSwitchPurge" value="1"/>

</characteristic> <characteristic type="Calendar">

<parm name="Enabled" value="1"/><parm name="SyncSwitchPurge" value="1"/>

</characteristic> </characteristic>

Sync CSPSync CSP

Page 13: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Security Policies CSPSecurity Policies CSPSetting a security policySetting a security policy

<wap-provisioningdoc> <wap-provisioningdoc>

<characteristic type="SecurityPolicy"> <characteristic type="SecurityPolicy">

<parm-query name="4101"/><parm-query name="4101"/>

<parm-query name=“4102"/> <parm-query name=“4102"/>

</characteristic> </characteristic>

</wap-provisioningdoc></wap-provisioningdoc>

<wap-provisioningdoc><wap-provisioningdoc>

<characteristic type="SecurityPolicy"> <characteristic type="SecurityPolicy">

<!-- Unsigned CAB Policy: do not allow unsigned cab files   --> <!-- Unsigned CAB Policy: do not allow unsigned cab files   -->

    <parm name="4101" value="0" /> <parm name="4101" value="0" />

<!-- Unsigned Applications Policy: enabled   --> <!-- Unsigned Applications Policy: enabled   -->

    <parm name="4102" value="0" /> <parm name="4102" value="0" />

</characteristic></characteristic>

</wap-provisioningdoc></wap-provisioningdoc>

Querying a given security policyQuerying a given security policy

Page 14: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Provisioning the DeviceProvisioning the Device

Page 15: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

CAB ProvisioningCAB Provisioning

CPF = CAB provisioning fileContains XML configuration file instead of EXEShould be signed using SIGNTOOL tool and a certificate appropriate for the contents of the CPF (usually a certificate with Manager role on the device)May be distributed like a CAB fileDelivered via:

Pull CPF file from a website

OTA Push of CPF File

Load CPF file from MMC/SD card

SI and SL

CPF = CAB provisioning fileContains XML configuration file instead of EXEShould be signed using SIGNTOOL tool and a certificate appropriate for the contents of the CPF (usually a certificate with Manager role on the device)May be distributed like a CAB fileDelivered via:

Pull CPF file from a website

OTA Push of CPF File

Load CPF file from MMC/SD card

SI and SL

Page 16: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Creating CPF FileCreating CPF File

1. Create XML Configuration file, test it and name it _Setup.xml

2. Run makecab _Setup.xml Filename.cpf3. Sign and apply like a CAB file

1. Create XML Configuration file, test it and name it _Setup.xml

2. Run makecab _Setup.xml Filename.cpf3. Sign and apply like a CAB file

Page 17: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

OMA Provisioning StandardsOMA Provisioning Standards

Open Mobile Alliance v1.1.2“2 clients” on each Windows Mobile 5.0 device

“WAP-based” provisioningPrimarily for bootstrapping

Declarative (make the device settings be “this”)

Windows Mobile 2003 extends for continuous provisioning

“OMA-DM -based” provisioningPrimarily for continuous provisioning

Interactive session with a DM server

New for Windows Mobile 2005

Open Mobile Alliance v1.1.2“2 clients” on each Windows Mobile 5.0 device

“WAP-based” provisioningPrimarily for bootstrapping

Declarative (make the device settings be “this”)

Windows Mobile 2003 extends for continuous provisioning

“OMA-DM -based” provisioningPrimarily for continuous provisioning

Interactive session with a DM server

New for Windows Mobile 2005

Page 18: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

ProvisioningProvisioningServerServer

Push RouterPush Router

OTA Push Message StructureOTA Push Message Structure

Phone NumberDestination Port

Source Port

TID, PDU, Len, Media, SEC, MAC …… TPS, Push Flag

Version, Encoding, Tokens, Code Page, Strings

SMS SMS headerheader

WDP WDP headerheader

WBXML WBXML bodybody++++ ++++

WSP WSP headerheader ++++

Push Proxy Push Proxy gatewaygateway

ConfigurationConfigurationServiceServiceProviderProvider

ConfigurationConfigurationServiceServiceProviderProvider

ConfigurationConfigurationServiceServiceProviderProvider

ConfigurationConfigurationManagerManager

Over Over the Airthe Air

Page 19: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

OTA ProvisioningOTA Provisioning

Page 20: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

The OMA DM ArchitectureThe OMA DM Architecture

Mobile Device

OTA Provisioning Server

SMS Router

SMS/Data Bearer

WAP Stack

WAP Push Gateway

Push RouterSecurity

Providers

Other Push client

Config Host

Configuration Manager Metabase

CSP CSP CSP

Security Provider

OMA DM Transport Client

OMA DM DPU

Configuration Manager 2

CSP CSP

LegacyCSP Wrapper

WININET

Mobile Device

OTA Provisioning Server

SMS Router

SMS/Data Bearer

WAP Stack

WAP Push Gateway

Push RouterSecurity

Providers

Other Push client

Config Host

Configuration Manager Metabase

CSP CSP CSP

Security Provider

OMA DM Transport Client

OMA DM DPU

Configuration Manager 2

CSP CSP

LegacyCSP Wrapper

WININET

Page 21: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

OMA-DM: Continuous ProvisioningOMA-DM: Continuous Provisioning

Short Messaging Service (SMS)

IP data connection

IP data connection

1. Server trigger1. Server triggerBinary “blob” including:Binary “blob” including:•Message digest (hash)Message digest (hash)•Server ID (pre-configured on device)Server ID (pre-configured on device)•DM protocol versionDM protocol version•User interaction (optional)User interaction (optional)

3. Server-controlled interchange•Get (Query)•Add•Replace•Delete•Atomic•Execute•Sequence

2. Client initiates session

Page 22: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Patch Management Patch Management

OS updateImage updateOS updateImage update

Page 23: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

OS Update ScenarioOS Update Scenario

Update to the next version of OS is availableUser logs in to distribution siteUser provides device ID and request update fileSigned update file and appropriate tool is downloaded to laptopUser connects mobile device to laptop via ActiveSyncThe tool will update the connected device

Update to the next version of OS is availableUser logs in to distribution siteUser provides device ID and request update fileSigned update file and appropriate tool is downloaded to laptopUser connects mobile device to laptop via ActiveSyncThe tool will update the connected device

Page 24: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Image UpdateImage Update

Builds checked to match certificate in the update loader which is built by ODM

This certificate is not in the same stores as other certificates on the device; it’s hard-coded into the executable file

Ensuring appropriate updatesThis is checked through versioning, signatures, GUIDS and Device ID

Packages are differential packages so ODM needs to build your packagesKEY MESSAGE: Update package has to be created and signed by ODM

Builds checked to match certificate in the update loader which is built by ODM

This certificate is not in the same stores as other certificates on the device; it’s hard-coded into the executable file

Ensuring appropriate updatesThis is checked through versioning, signatures, GUIDS and Device ID

Packages are differential packages so ODM needs to build your packagesKEY MESSAGE: Update package has to be created and signed by ODM

Page 25: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

System Management System Management ServerServerSystem Management System Management ServerServer

Page 26: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

System Management Server Device Management RoadmapSystem Management Server Device Management Roadmap

Device Management Feature Pack v1 (11/04)Pocket PC 2002-2003 and Windows CE 3.0/5.0 management for corpnet-connected devicesPassword and settings management add-ons

Device Management Feature Pack Update (May 2006)

Support for Windows Mobile 5.0 Pocket PC and Phone EditionWindows Mobile 5.0 password application support and settings management

SMS V4 Everything above plus:Smartphone 2003 and 2005Internet-facing device support Fully integrated with SMS

SMS v4 ++Support for latest versions of Windows CE, Smartphone, and Pocket PC as they are releasedRegular post SMS V4 feature enhancements via download and in Service Packs

Device Management Feature Pack v1 (11/04)Pocket PC 2002-2003 and Windows CE 3.0/5.0 management for corpnet-connected devicesPassword and settings management add-ons

Device Management Feature Pack Update (May 2006)

Support for Windows Mobile 5.0 Pocket PC and Phone EditionWindows Mobile 5.0 password application support and settings management

SMS V4 Everything above plus:Smartphone 2003 and 2005Internet-facing device support Fully integrated with SMS

SMS v4 ++Support for latest versions of Windows CE, Smartphone, and Pocket PC as they are releasedRegular post SMS V4 feature enhancements via download and in Service Packs

Page 27: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Supported PlatformsSupported Platforms

Device Management Version 1 (shipped 11/04)Pocket PC and Phone Edition 2002Pocket PC and Phone Edition 2003Windows CE 5.0 Platform Builder (built-in client)Windows CE 3.0 and above (with OS dependencies)

Coming soon to DMFP (May 2006)Support for Windows Mobile 5 Pocket PC and Phone Edition

SMS V4 (mid-2007)Smartphone 2003, 2005Next Smartphone and Pocket PC release soon after

Partner support – Sybase iAnywhereFormerly XcelleNetSupport Palm, RIM, Symbian, Smartphone 02Integrated with SMS 2003 and DMFP

Partner support – Odyssey Software AthenaIntegrated with SMS 2003 and DMFP (announcing at MMS)Support for Windows Mobile, Windows CE, Smartphone in parallel with SMS DMFP supportAdditional features for Windows Mobile devices such as remote control

Device Management Version 1 (shipped 11/04)Pocket PC and Phone Edition 2002Pocket PC and Phone Edition 2003Windows CE 5.0 Platform Builder (built-in client)Windows CE 3.0 and above (with OS dependencies)

Coming soon to DMFP (May 2006)Support for Windows Mobile 5 Pocket PC and Phone Edition

SMS V4 (mid-2007)Smartphone 2003, 2005Next Smartphone and Pocket PC release soon after

Partner support – Sybase iAnywhereFormerly XcelleNetSupport Palm, RIM, Symbian, Smartphone 02Integrated with SMS 2003 and DMFP

Partner support – Odyssey Software AthenaIntegrated with SMS 2003 and DMFP (announcing at MMS)Support for Windows Mobile, Windows CE, Smartphone in parallel with SMS DMFP supportAdditional features for Windows Mobile devices such as remote control

Page 28: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Enterprise sideDevice side

Enterprise Enterprise serverserver

Programmatic interfaceProgrammatic interface• Microsoft SMS Server 2003 console adapterMicrosoft SMS Server 2003 console adapter• Device-side Logging (device to server)Device-side Logging (device to server)• Server-side Scripting (server to device)Server-side Scripting (server to device)

XML Web Services (SOAP) over HTTP/SXML Web Services (SOAP) over HTTP/SW

eb

Serv

er

Configuration Service

Secu

rity

File Manager Service

System Manager Service

Networking Service

Log Manager Service

Messenger Service

Remote Control Service

HTM

L T

em

pla

te E

ng

ine

HTM

L T

em

pla

te P

ag

es

WS

DL

Tracker Service

Browser interfaceBrowser interface• Interactive troubleshooting and Interactive troubleshooting and corrective actioncorrective action• Remote control Remote control (directly in browser)(directly in browser)

HTML over HTTP/S [Browser/Console]HTML over HTTP/S [Browser/Console]

Desktop PCDesktop PC

PocketPC, PocketPC, WinCE.NETWinCE.NET

DevicesDevices

Athena™ ArchitectureAthena™ Architecture

Page 29: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

DMFP Feature SetDMFP Feature Set

Hardware/software inventoryFile collectionSoftware distributionScript executionSettings managementPassword policy managementAutomated client distribution via SMS 2003 Advanced Client desktop

Hardware/software inventoryFile collectionSoftware distributionScript executionSettings managementPassword policy managementAutomated client distribution via SMS 2003 Advanced Client desktop

Page 30: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

SMS V4 Feature SetSMS V4 Feature Set

Hardware/software inventoryFile collectionSoftware distributionScript executionSettings managementConnection ManagementPassword policy managementAutomated client distribution via SMS Advanced Client desktop Over-the-air management of devicesInternet facing support for managing Internet-connected devices

Hardware/software inventoryFile collectionSoftware distributionScript executionSettings managementConnection ManagementPassword policy managementAutomated client distribution via SMS Advanced Client desktop Over-the-air management of devicesInternet facing support for managing Internet-connected devices

Page 31: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Messaging and Security Messaging and Security Feature PackFeature PackMessaging and Security Messaging and Security Feature PackFeature Pack

Page 32: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Security FeaturesSecurity Features

Remotely manage and enforce corporate IT policy over-the-air via Exchange 03 SP2 consoleEnable automatic reset of data when password is entered incorrectly X number of timesHelp to better protect device data with remote reset of on-device data via Exchange 03 SP2 consoleIncrease access security to Exchange 03 SP2 using Certificate-based Authentication to the serverHelp protect email content with native support for S/MIMEGAL Lookup over the air (no storage on device)

Remotely manage and enforce corporate IT policy over-the-air via Exchange 03 SP2 consoleEnable automatic reset of data when password is entered incorrectly X number of timesHelp to better protect device data with remote reset of on-device data via Exchange 03 SP2 consoleIncrease access security to Exchange 03 SP2 using Certificate-based Authentication to the serverHelp protect email content with native support for S/MIMEGAL Lookup over the air (no storage on device)

Page 33: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Keep Outlook Mobile Up-to-date with Direct Push Technology: An Illustrative View

Keep Outlook Mobile Up-to-date with Direct Push Technology: An Illustrative View

4. If new mail arrives 4. If new mail arrives before heartbeat interval before heartbeat interval expires, Exchange 2003 expires, Exchange 2003 notifies device that notifies device that changes have occurred changes have occurred in the mail boxin the mail box

1. Device sends PING 1. Device sends PING request to Exchange 2003 request to Exchange 2003 SP2 serverSP2 server

2. Exchange 2003 holds 2. Exchange 2003 holds the request pending until the request pending until heartbeat interval expiresheartbeat interval expires

5. Device immediately 5. Device immediately issues SYNC request to issues SYNC request to pull mail. Upon SYNC pull mail. Upon SYNC completion, go to step 1completion, go to step 1

3. If no mail 3. If no mail arrives before arrives before heartbeat expires, heartbeat expires, device sends device sends another PING another PING requestrequest

Windows Mobile Windows Mobile Device with Device with Messaging and Messaging and Security Feature Security Feature PackPack

Server running Server running Exchange 2003 SP2Exchange 2003 SP2

Direct Push = Device interacts directly Direct Push = Device interacts directly with Exchanger Server 2003 SP2with Exchanger Server 2003 SP2

Page 34: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Device and Server RequirementsDevice and Server RequirementsWinMobile device WinMobile device

requirementsrequirements

Requires a Windows Mobile Requires a Windows Mobile 5.0 device5.0 device

MSFP will not work on MSFP will not work on devices with versions prior to devices with versions prior to MagnetoMagneto

MSFP features will not need PC MSFP features will not need PC sync except Certificate-based sync except Certificate-based AuthenticationAuthentication

Certificate-based Certificate-based Authentication will require a Authentication will require a one-time connection to one-time connection to ActiveSync for certificate ActiveSync for certificate deploymentdeployment

Requires upgrade from Requires upgrade from Exchange Server 2003 to Exchange Server 2003 to Exchange Server 2003 SP2 Exchange Server 2003 SP2

No major changes beyond No major changes beyond SP upgradeSP upgrade

Need to increase IIS and Firewall Need to increase IIS and Firewall https connection timeout to the https connection timeout to the ActiveSync virtual directoryActiveSync virtual directory

Recommend 15-30minutes Recommend 15-30minutes for timeoutfor timeout

Certificate-based Authentication Certificate-based Authentication feature will require a Certificate feature will require a Certificate Authority (CA) deploymentAuthority (CA) deployment

Recommend using Windows Recommend using Windows Protocol Transition for CA Protocol Transition for CA deploymentdeployment

Exchange server Exchange server requirementsrequirements

Page 35: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

How Does MSIT Does Windows Mobile Device ProvisioningHow Does MSIT Does Windows Mobile Device Provisioning

Web site Windows Mobile ProvisionerWeb site Windows Mobile Provisioner

Page 36: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Windows Mobile ProvisionerWhat does it do?Windows Mobile ProvisionerWhat does it do?

Allows users to rapidly configure their Exchange ActiveSync settings in seconds via a single screenFacilitates the easy configuration of device data connections through the selection of a mobile operator from a listDisplays mobile applications, ring tones and other content that can be downloaded and installed on the deviceAllows administrators to push out patches, anti-virus definitions, ROM packages, and other software to selected devicesSends device inventory, health metrics, and other information to the server for analysis

Allows users to rapidly configure their Exchange ActiveSync settings in seconds via a single screenFacilitates the easy configuration of device data connections through the selection of a mobile operator from a listDisplays mobile applications, ring tones and other content that can be downloaded and installed on the deviceAllows administrators to push out patches, anti-virus definitions, ROM packages, and other software to selected devicesSends device inventory, health metrics, and other information to the server for analysis

Page 37: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Windows Mobile Provisioner Examples Windows Mobile Provisioner Examples

Page 38: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Device Management PartnersDevice Management Partners

CredantCAOdyssey SoftwareSOTISprite SoftwareSybase iAnywhere AvantGo SynchronicaTrust Digital

CredantCAOdyssey SoftwareSOTISprite SoftwareSybase iAnywhere AvantGo SynchronicaTrust Digital

Page 39: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

ScenariosScenarios

User has accidentally deleted their GPRS settings

SD Card, OMA CP, DTAS

Need to wipe the device contents over the air

MSFP

Revoke application in the ROM with known fault

OMA CP, OMA DM, System Management Server

Admin wants to find out the device configuration – OS Version, Memory

OMA DM , DT ActiveSync, System Management Server

Handset Vendor has a fix Image Update, OMA DM, SD Card, Web site, System Management Server

User has accidentally deleted their GPRS settings

SD Card, OMA CP, DTAS

Need to wipe the device contents over the air

MSFP

Revoke application in the ROM with known fault

OMA CP, OMA DM, System Management Server

Admin wants to find out the device configuration – OS Version, Memory

OMA DM , DT ActiveSync, System Management Server

Handset Vendor has a fix Image Update, OMA DM, SD Card, Web site, System Management Server

Page 40: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Device Management ArchitectureReview

Device Management ArchitectureReview

Windows Mobile DeviceWindows Mobile Device

SDIOSDIODeskTopDeskTop

ActiveSyncActiveSyncUSB USB SerialSerial

OTAOTAShort MessageShort Message

ServiceService

OTAOTADATADATA

GPRS/1XRTTGPRS/1XRTT(HTTP/S)(HTTP/S)

(HTTPS for Sync ML)(HTTPS for Sync ML)

USB USB SerialSerial

XML/XML/WBXMLWBXML

BinaryBinaryNotificationNotification CAB/CPFCAB/CPFXML/CAB/XML/CAB/

CPFCPFExchangeExchangeAir SyncAir Sync

SyncSyncMLML

XML/XML/CABCAB

OS UpdateOS UpdateSystemSystem

ManagementManagementServerServer

Messaging Messaging and Security and Security

FeatureFeaturePackPack

Rapi-Rapi-ConfigConfig

SDSDCardCard

OTAOTAOMAOMACPCP

SI/SLSI/SL OTAOTAOMA DMOMA DM

ImageImageUpdateUpdate

Page 41: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

Windows Mobile Enterprise Security Internals

Inside Microsoft: The Microsoft Corporate Windows Mobile Architecture

Using Systems Management Server with Windows Mobile Devices

Overview of Mobile Messaging with Windows Mobile and Exchange Server 2003

Windows Mobile Enterprise Security Best Practices

Q&AQ&A

ITP 401

ITP 307

ITP 311

ITP 302

ITP 310

Page 42: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

ResourcesResources

Need developer resources on this subject? Need developer resources on this subject? Need developer resources on this subject? Need developer resources on this subject?

Stop by the MED Content Publishing Team Station in Stop by the MED Content Publishing Team Station in the Microsoft the Microsoft Pavilion or Visit the MED Content Publishing Team Pavilion or Visit the MED Content Publishing Team Wiki Site:Wiki Site:http://http://msdn.microsoft.com/mobility/wikimsdn.microsoft.com/mobility/wiki

Stop by the MED Content Publishing Team Station in Stop by the MED Content Publishing Team Station in the Microsoft the Microsoft Pavilion or Visit the MED Content Publishing Team Pavilion or Visit the MED Content Publishing Team Wiki Site:Wiki Site:http://http://msdn.microsoft.com/mobility/wikimsdn.microsoft.com/mobility/wiki

Page 43: Windows Mobile Device Management Khalid Siddiqui Mobility Architect Microsoft Corporation Khalid Siddiqui Mobility Architect Microsoft Corporation.

© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it

should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.