Why You Can’t Trust Mobile Device Reports
The Problem
Let’s say you’re an exchange administrator and you use EAS (Exchange Active Sync) to plug smart phones into your Exchange environment. You’re probably one of the many out there who do this…I do it in my environment.
Then you stumble across a handy powershell script that will allow you to query your environment for mobile phones that have synched on user accounts and report back the last successful synch as well as any phone details that are reported. I found this one somewhere (can’t remember):
$devices = @()
$mailboxes = Get-CASMailbox -ResultSize:Unlimited | Where-Object {$_.HasActiveSyncDevicePartnership -eq $true -and $_.ExchangeVersion.ExchangeBuild -ilike "8*"}
foreach ($m in $mailboxes)
{
$devices += Get-ActiveSyncDeviceStatistics -Mailbox $m.Identity
}
$devices | Export-Csv DeviceStats.csv
You get a nice little list of stuff right? This should be every single EAS enabled account that has a phone synching with Exchange right? Wrong. It absolutely is NOT an accurate list of phones that have synched with your Exchange server.
When I executed that powershell scriptlet above on my system it reported back quite a few phones…but my phone, a HTC Evo, was not on the list. In fact, my account wasn’t reported on the list. This despite my device synching just fine every 15 minutes. The integrity of this ‘report’ has been challenged. So what’s the deal?
Workaround Solution
A quick investigatory glancing at google brings little results…However, I did notice when using the EMC to highlight my account and going to ‘Manage mobile device” I was in for a suprise….because that link wasn’t there on my account. That’s right, “manage mobile device” is missing on my account. This despite having Active Synch enabled under the ‘mailbox features’ tab on my account and despite having my device pair up with Exchange in 15 minute intervals.
Searching google for this problem yeilds much better results. It seems that a flag embedded for a value in Active Directory doesn’t toggle correctly OR isn’t added into AD at all (perhaps bad replication). Either way, it means you’ll be whipping out trusty adsiedit.msc (per the forum thread linked to above). The setting that needs toggled is “msExchMobileMailboxFlags” which should be set to 1. After setting this, you’ll be able to manage the mobile device AND your synch will be picked up by the powershell report above.
The Real Crux
The real crux of the matter is that this toggle shouldn’t have to be set at all and regardless if it is set or not, powershell should be able to report if a device is synching with Exchange. There is a reason why RIM is #1 when it comes to businesses and smartphones…it’s because you can have 100% accountability for what is on your network at any given time. With Exchange 2007 and above, it is unfortunately, much like a ring toss at a circus…sometimes you get a ring on that bottle and win a stuffed giraffe but other times you’re going home without plush pals.
Microsoft has a problem here because you can’t trust your own powershell queries. If it doesn’t work for this individual area (phones, EAS) then what else doesn’t work? Do we call into question the entire integrity of all powershell commands and commandlets? What do you think? I know this workaround is pretty silly on a huge environment with multiple user containers in AD or even mutlipe forests. Is the workaround something that is tolerable or should Microsoft do more to fix this broken part of their product?
