Develop Bugs

Removing Exchange Direct Push Device Security Policy

I had been searching all over for this solution, and was not able to find anything to remove the policy our exchange admins put on my device upon syncing which required a strong password to unlock the device after only 30 minutes of inactivity.
After some digging and trial and error I came up with a solution...
Here is how to remove and/or modify the policy that is pushed down from the server:
using a device registry editor (remote, or PHM) modify the following key(s)
The Exchange Security Policy (4131) updates the device policy:
HKLM\Security\Policies\00001023: 0 = Enabled; 1 = Disabled
To change the inactivity timer:
HKLM\Comm\Security\Policy\LASSD\AE\{50C13377-C66D-400C-889E-C316FC4AB374}\
AEFrequencyType: 0 = No inactivity time; 1 = Activity time enable
AEFrequencyValue: = number of minutes before timeout
To change the password strength policy:
HKLM\Comm\Security\Policy\LASSD\LAP\lap_pw\
MinimumPasswordLength: minimum number of characters in password (0 defaults to 1)
PasswordComplexity: 0 = Require Alphanumeric; 1 = Require numeric (PIN); 2 = No restriction
And finally to change the Device wipe settings:
HKLM\Comm\Security\Policy\LASSD\
DeviceWipeThreshold: -1 = disabled; (any positive number) = # failed attempts before device memory gets whacked
CodewordFrequency: # of attempts before a codeword is displayed to prevent accidental device wipe.
From what I've seen, the exchange server only pushes the policy down once, unless the exchange admin updates the policy, in which case you'd have to reset the registry entries.
Enjoy!

Thank you! So far, so good on my WM6 Wizard ROM. I've been trying to convince our network admin that this was a stupid policy, and now I don't have to

You totally saved me from wiping my TyTN and reinstalling from scratch.
Thank you!!!

cptcoconut said:
Thank you! So far, so good on my WM6 Wizard ROM. I've been trying to convince our network admin that this was a stupid policy, and now I don't have to
Click to expand...
Click to collapse
The reason this is NOT a stupid policy is the fact that you are required to configure a policy such as this on the mobile devices in order to be able to implement the remote wipe capabilities of Exchange SP2 and windows Mobile 5.0.
Without this policy in place if someone steals your phone they will still have access to all of your data and email on the phone from the time they steal it. With this policy in place once you inform your Admins that your phone was stolen they can implement the remote wipe and within a few minutes your phone has been set back to factory defaults and all Company data has been removed.
There is generally a reason behind security policies.

The policy is not stupid. However, it's implementation can be a pain. You can enforce the policy and have remote wipe ability without requiring the password every x minutes/hours.

Timeout settings with Remote Wipe
Great work, Coderuckus...
Are there any registry tools out there to automate these sorts of "hacks"?? Sounds like a good addition to a commercial tool like PocketMecahnic?
Ideally having an "Advanced Mode" to allow for more granular settings changes would be ideal... (eg allow Bitwipe etc, but during business hours, allow the user to extend or snooze the auto-timeout)..
Anyone fancy writing the app? (We'd have a stack of customers for you!)...
Cheers
Andy
www.pressdigital.com.au
Press Digital Australia Support Team
(Australia's PDA People).

Take care! coderuckus registry tweaks work well, but the manual changes are overwritten by the exchange server every 24 hours or so, which requires you to change the registry again and again. An automated solution which works very well (at least with my Trinity WM5) you can find in this post http://forum.xda-developers.com/showthread.php?t=279073&highlight=zenyee

When I make these changes to the registry I am still prompted to enter the password.
When I go to the lock settings screen I can then disable the password.
Is there anyway around this??

I had nearly forgotten about this until yesterday when our exchange admin was messing around with the policy and forced an update which made my pocketpc go haywire. It looks like some good work has been done with the automated utility to auto-disable the password policy, if our admins decide to force policy updates more frequently I may have to try out that app. I'd rather not have to keep yet another program in memory though. It seems the only relevant setting would be setting policy 1023's value to 1, the rest can be reset using the "Lock" settings after the policy reset.

If the exchangeserver is set to re-enforce policies on every connect, you'll need an app that monitors and resets the key when necessary, like :
http://blogs.microsoft.co.il/files/folders/tamir/entry46249.aspx
(I found this to work better then the Zenyee tool, that turned my Touch HD into nothing more then an expensive brick.)

kkoenen said:
If the exchangeserver is set to re-enforce policies on every connect, you'll need an app that monitors and resets the key when necessary, like :
http://blogs.microsoft.co.il/files/folders/tamir/entry46249.aspx
(I found this to work better then the Zenyee tool, that turned my Touch HD into nothing more then an expensive brick.)
Click to expand...
Click to collapse
can you give more information on why the Stayunlock brick your Touch HD?
it's just a small program that monitors the exchange server security policy enforce activity, it shouldn't hang unless your office intrduce a program to be installed that always enforce the policy everything it's being undone, inwhich case it'll no doubt result into a 'hang' situation.

What about Zen on WM6.5? It's crucial application for me.
Best regard,
MCC

mcc666 said:
What about Zen on WM6.5? It's crucial application for me.
Best regard,
MCC
Click to expand...
Click to collapse
Have you had any luck with WM 6.5?

thanks and its stays after 24hrs

Thanks you for your effort.
i'am ok with them having the power to wipe my phone and all but when i dont want to use mobile email all the time, but only update it when i want its stupid to have it on.
my exchange server password is much stronger than the "minimum of 4 numbers" pin ****.

I was looking for more info about the security setting on my phone, when I found this in the Microsoft library:
It gives a detailed explanation of the LASS Registry Settings
LASS is short for Local Authentication Subsystem
Here a copy from the most interresting settings:
Exponential Backoff Registry Settings
The HKEY_LOCAL_MACHINE\Comm\Security\LASSD registry key is used to enable the LASS exponential backoff mechanism. This mechanism is designed to deter brute force attacks that rapidly try several authentications on a LAP by introducing an exponentially increasing time delay between unsuccessful consecutive attempts of the VerifyUser call to a LAP.
The time delay or lockout time is calculated by using the following expression:
Copy
(InitialPenalty + (2^(Number of failures above Threshold)) * IncrementalPenalty)
The following table shows the named values.
InitialPenalty (REG_DWORD): Time, in seconds, for the initial penalty. Default value is 0.
Treshold (REG_DWORD): The number of failures before the exponential backoff mechanism is activated. Default value is 0. This indicates that exponential backoff is disabled.
IncrementalPenalty (REG_DWORD): Time, in seconds, of the multiplier for the exponent. Default value is 0, indicating that there is no delay beyond the value set for InitialPenalty.
LAP Codeword and Device Wipe Registry Settings
The HKEY_LOCAL_MACHINE\Comm\Security\LASSD registry key is used to configure the LASS settings for codeword functionality and the threshold for device wipes. After a number of failed password attempts, defined by the CodeWordFrequency setting, the device completely locks up and prompts the user to enter a displayed codeword to unlock it again. The purpose of the codeword prompt is to be sure that the incorrect password attempts are not the result of accidental key presses. After entering the displayed codeword, the user is then able to make more password attempts. Once the device wipe threshold is reached, the device wipes the memory, including all data and certificates.
Note:
Do not implement a code word that includes Double Byte Character Set (DBCS) characters. While the CodeWord registry node will accept DBCS characters, users cannot enter DBCS characters on a device.
The following table shows the named values.
CodeWordFrequency (REG_DWORD): The number of times an incorrect password can be entered before a displayed codeword must be entered to continue. This is to prevent accidental password entry resulting in a local device wipe.
If the registry key either does not exist or is set to 4294967295 (0xFFFFFFFF), this policy is not enforced.
CodeWord (REG_SZ): Codeword that the user will be requested to type.
DeviceWipeThreshold (REG_DWORD): The number of authentication failures before the device will be wiped. A value of 0 disables device wipe functionality.
LAP Password Settings
The length and type of a password can be enforced on the Microsoft Default LAP using the MinimumPasswordLength and PasswordComplexity settings under the HKEY_LOCAL_MACHINE\Comm\Security\LASSD\LAP\lap_pw registry key. These settings will only be enforced if PasswordNotRequired is set to zero (0).
In the following example, the minimum length of the password is set to 9 characters and the complexity is set so that a strong password is required.
Copy
[HKEY_LOCAL_MACHINE\Comm\Security\LASSD\LAP]
"MinimumPasswordLength"="9"
"PasswordComplexity"="0"
The following table shows the settings and values.
MinimumPasswordLength (REG_DWORD): Sets the minimum device password length the user can enter. The length is measured in characters and can be set to any number less than or equal to the maximum number of characters allowed. Entering zero (0) for MinimumPasswordLength results in the default setting of 1.
Note: Using Wireless Access Protocol (WAP) allows for password lengths from 1 to 256 characters. However, setting this parameter with the Exchange Security Manager limits you to a minimum of 4 and a maximum of 18 characters. This value works in conjunction with security policy 4131, which when set to zero (0) indicates that password enforcement is required on the device. If password enforcement is not required, the value of MinimumPasswordLength is ignored.
PasswordComplexity (REG_DWORD): Sets the complexity of the Device Password.
The following list shows the possible values:
Zero (0) indicates that a strong password is required. 1 indicates that a numeric pin is required. Any other value indicates that a numeric or alphanumeric password can be used
Setting this parameter with the Exchange Security Manager results in a setting of zero (0) or 2. It is not possible to set this parameter to 1 using the Exchange Security Manager.
AE Registry Settings
To install a new authentication event (AE), create a subkey with the GUID of the AE under the HKEY_LOCAL_MACHINE\Comm\Security\LASSD\AE registry key. For examples, see Installing an AE.
The following table shows the named values.
FriendlyName (REG_SZ): String that indicates to the user what the AE represents.
DisplayText(REG_SZ): String that indicates the name of the application that is verifying the user in a call to VerifyUser.
AEFrequencyType (REG_DWORD): Type of frequency policy used to control an AE. It can be any one of the following values, and AEFrequencyValue is interpreted differently based on each value:
0: User authentication occurs at the frequency specified by AEFrequencyValue.
2: AEFrequencyValue represents the number of minutes since any AE returned from VerifyUser successfully.
3: AEFrequencyValue represents the number of minutes since the specified AE returned from VerifyUser sucessfully
AEFrequencyValue (REG_DWORD): Value indicating how often user authentication will occur. The interpretation of AEFrequencyValue depends on the value of AEFrequencyType. For more information about how AEFrequencyType and AEFrequencyValue are related, see Setting an AE Policy.
When AEFrequencyType is set to 0, AEFrequencyValue has the following special cases:
0: Call LAP every time VerifyUser is called.
0xFFFFFFFF : Never call into LAP.
N: Call into LAP every N-1 time(s) that VerifyUser is called.
Authentication Reset Settings
The Authentication Reset Settings determine whether a device can be reset by RemoteWipe. The messages displayed to users can be customized for authentication reset in the default Local Authentication Plug-in (LAP). All keys listed in the table are located in the path HKEY_LOCAL_MACHINE\Comm\Policy\LASSD\AuthReset.
AuthenticationReset (REG_DWORD): Specifies whether or not to allow authentication reset on the device. If this setting is enabled, the Reset Password option appears in the password menu.
0: Authentication Reset is disabled.
1: Authentication Reset is enabled.
RequestMessage (REG_SZ): This message is displayed to the user before the reset process begins. If no message is specified, a default message is displayed.
RequestSuccessMessage (REG_SZ): This message is displayed if the reset process completes successfully. If no message is specified, a default message is displayed.
RequestFailureMessage (REG_SZ): This message is displayed if the reset process fails. If no message is specified, a default message is displayed.
RecoveryMessage (REG_SZ): This message is displayed in the Recovery PIN entry dialog. If no message is specified, a default message is displayed.
RecoveryPhone (REG_SZ): This is a secondary string to be displayed following the recovery message.

Exchange Management Console
I know this is an old thread, but it might help anybody searching. I've just had a similar issue on Exchange 2010.
In the Exchange Management Console > Organization Configuration > Client Access select the Exchange ActiveSync Mailbox Policies. You can either remove the password requirement, or change it in the Default Policy. Alternatively you can create a new policy, then under Recipients Configuration > Mail Box, you can select the user properties, and then choose the Mailbox Features tab. Select Exchange ActiveSync and properties. You can then apply another policy. We have the default then a special one for those who request it.
One important thing, on our installation the default refresh in the policy was not set. We changed this to push out the change of "no password required" for some devices.
I hope this saves somebody some time!

Email HELP... PLEASE.

I'm gonna fire this thing out the door at 100mph soon..
Thanks for looking.
First off, I'm coming from a CrackBerry, which worked, not that it matters.
I have tried several roms, double checked all my settings etc .. but still not functioning properly.
I have a tilt2 (running on Bell Network (Canada)) and I like the unit, but need to perform as follows:
1,) Email,auto connect every 15mins or so, even if unit is a sleep in my pocket.
2.) NOTIFY me when an EMAIL comes in with a Buzz, ding/ring and screen Icon.
3.) Go WIFI first to check, then go G if wifi not connected. check mail
4.) THEN DISCONNECT It. period
I've tried 6 different roms and they all seem to behave different, some won't auto disconnect, some don't notify me till hours later, most don't auto Check every 15min as it is set to. (I'm not blaming the rom,.. but everyone seems to be different .. yet the same)
I'm at my wits end,
stupid comments about check this/ check that comments are WELCOME as it is probably something I'm doing not the device. (I consider myself 'puter savy but this sucker is winning.)
PS: Any roms with Transcriber working ?
Regards
HTCgonnagetTRASHED

1. What is the method of email retrieval? Microsoft Exchange? POP3/IMAP4? or WindowsLive mail (Hotmail)?
If Microsoft Exchange,
Open Activesync
Tap Menu -> Schedule
Set schedule accordingly
If POP3 or IMAP4,
Open the Messaging application.
Go into Options. (If at Account Picker, tap Menu->Options. If already in an account's inbox, tap Menu->Tools->Options.)
Tap "Send/Receive Schedule"
Set schedule accordingly
If Windows Live or Hotmail,
Open Windows Live
Tap Menu->Options
Tap "Sync schedule"
Set schedule accordingly
2. Go to Settings->Personal tab->Sounds&Notifications->Notifications tab. In the dropdown menu for "Event", select "Messaging: New e-mail message" and adjust accordingly.
3. Your device should always prioritize your wifi connection ahead of your cellular connection by default. But note that your device's wifi is inactive when in suspended mode unless you applied a registry edit. But also note that if you keep you wifi active all the time, you battery life will suffer.
4. There's nothing you need to do here. After your device finishes polling for mail and there's no other application using your connection, there's no data activity. You really shouldn't be concerned with disconnecting unless your carrier charges you by the hour.

[PRJ] XDA_Sync

Hello fellow XDA members,
Last week I flashed my favorite ROM to it's newest version again and once again I had to put some settings right and all. Now, this is nothing new and you can let the process be done for you with tools already availabe. However, I'm not pleased with the options given by the different apps to be set!
Synchronizing different data is one of the most important features on any smartphone at the moment in my opinion. Some you like to do manually, but lots of them you just let go on schedule. This is where my problem popped up. Quick searching didn't give any results, so I decided to start this tread. Example of a problem: you have to set every app to roaming or not and give them a refresh rate.
My idea/project I would like to start is making an app that has the following features:
setting up syncing schedules with the following options:
selecting days on which it syncs
timespan for synchronisation
refresh rate
roaming/no roaming
toggle list for assigning installed syncable programs fast and easy
assigning apps to different schedules
menu item for a list of schedules (with a subtext which programs follow and list of programs (with a subtext which schedule they follow)
Manila styled menus for known user interface
detection of different already syncing apps or syncable apps on the phone (adding them to the program list but not importing schedules since those would spam the list)
menu option to stop all syncing so everything is manual (useful when roaming but wanting to sync on demand)
import/export settings and automatic importing settings from the XDA_UC folder on install
making internet connection on sync and if it was off before turning it off after sync (don't know if some apps do this already, but then the turning off has to wait until the end of all synchronization)
option to show pop-up on sync fail with an option to retry in a given time or automatic retry time
I had some more features in mind but they fail to pop up right now.
What this solves:
schedules all crossing eachother which makes your phone connecting to and disconnecting from the internet all day (some have 3h option, some 4h)
unnessecary syncs, for example during your sleep
hopefully more options for selecting sync times (like with the FB-tab which can't go higher than 99)
one menu serving all the main apps on your phone
if importing settings on install works: no need to set everything up again, never!
There's only one big problem:
I'm not a developer and have no idea of any coding for WM devices at all. I do have some basic insight in structures and can help searching for entries and locations of different settings/manual sync triggers, but not much more than that. I'd like to see how this works during the project if there are others out there who like this app and a developer to take the big job!
Coding challenges I expect:
I think it has to set the apps assigned to a schedule to "manual" in the offical app/tab and has to trigger the manual synchronisation when schedule starts. If we really get into the core of other apps too: we could add the option "XDA_Sync schedule" to the drop down menus which pops up a schedule selector for the app. This way you could enable the automatic sync in the tab and the "roaming" item should be grayed out because that's fixed in the XDA_Sync schedule.
Locating all syncing.
Different devices (I have a Touch Pro2)
So: Good idea?
And: Any developer willing to take the challenge?
P.S. Not sure if I'm allowed to use the "XDA" part in the name, thread name could then be changed to "Cell_Sync" or something similar.

[Q] Internet connection popups

Hello
I have HTC Touch Pro2 rhodium with Windows. I have some applications frequently connecting to internet, e. g. email, weather etc. Now problem is, that I traveled abroad, where I don't have data tarif. So I disabled internet connection, but all apps are still trying to connect. As result, approximately every minute phone beep with popup screen "cannot connect" and backlite is turned on.
This behaviour
a) reduces batery life to less than eight hours from previous 1-2 days due to active backlite.
b) is making normal work with phone quite annoying as I must every moment click on some popup.
So my question is. Is it possible to somehow supress this popup?
(I don't want to hear advices about disabling automatic connecting in every single app
Thank you

No way the question could be answered comprehensively not knowing all your apps, but at least for the generic ones like Weather, Location, etc., as you noted there are check boxes that can disable the attempt-to-connect if you are in roaming state. If you don't want to do this manually, it would not be that hard to build a .REG file that includes the settings to turn this off, and either import the reg file into a reg editor or convert the reg file to a cab file you can just click on and run. In the past I have found those reg file settings documented in these forums if you want to go that route.

[APP][FREE][ANDROID] I'm OK, I'm here (geolocation app)

Short description
Link to the google store: https://play.google.com/store/apps/details?id=com.tim4dev.imokhere
Watching the location of the device.
The application allows you to track the location of Android devices (and their owners).
It can be: your's children, elderly relatives, friends, yourself.
The application must be installed on the device "observed" and "observers".
This is a MVP (minimum viable product).
Important: this is not a GPS tracker. Data is transmitted much less often and the data source is not just GPS.
Differences from competitors
Anonymous,
save battery,
free of charge,
no advertising,
no in-app purchases.
Requirements
Android 4.1 "Jelly Bean: (API level 16) and higher.
The "observable" device should be able to determine its location and have access to the Internet.
The "observer" device must have access to the Internet.
How it works
The user who installed the application can be either "observed" or "observer", possibly simultaneously.
In order to become "observable" you need to start the location service in the "I'm watched" menu, and allow the application to access the location and access to the Internet.
In this case, the "observed" will be assigned a certain identifier and data about its location will be periodically sent to the remote server (see privacy policy).
Important: You should not disclose your identifier to third parties.
When you exit the application or reboot the device, the service continues to run in the background. Stop the data transfer service through the same menu or by uninstall the application.
In order to become an "observer" you must obtain the identifier of the "observed". On the "watched" device in the "I'm watched" menu, send your ID to the "observer". After receiving the identifier, the "observer" through the "I'm watching" menu can receive data about the location of the "observed" and see it on the Google map. "Observed" can pass its identifier to several "observers".
"Observer" can receive data from few devices.
Screenshots
See attachments.
Privacy policy
The application does not start up on its own. You must start and configure the application yourself. You can uninstall the app at any time.
The application provides complete anonymity. Registration is not required.
A remote database stores an temporary anonymous identifier that is not associated with you personally, with your particular device, or with your phone number. Data that is transmitted and stored in a remote database is location data and some other data: longitude, latitude, time; If available: accuracy, altitude, speed, bearing, battery charge.
Only the last xx records are stored in the remote database (this restriction may be changed). No data is provided to third parties.
If you reinstall the application, you will be assigned a new anonymous identifier and link with all the old data will be lost.
The application does not hide the fact of its work. The application does not have any other hidden features, except those described here.
Usage limits
The last xx locations are remembered (this restriction may be changed).
https://firebase.google.com/pricing/
https://developers.google.com/maps/pricing-and-plans
https://developers.google.com/maps/documentation/geocoding/usage-limits
Firebase, simultaneous connections : 100.
Geocoding API : 2,500 free requests per day.
For beta testers
To become a member of the open beta-testers team, join the Google group (mailing list)
[email protected]
https://groups.google.com/d/forum/en-imokhere