If your company has 500 or more employees, you can buy an iPhone “Enterprise” developer license.  It’s a bit more then the “Standard” individual and company licenses, but not much.  For more on developer licenses, go here.

Once you have the license, you can sign your LOB apps with your certificate and provision them to company devices.  “Enterprise” developer licensing allows what is called “Universal” application provisioning.  This is the same type of provisioning that is granted to applications deployed through the Apple Appstore and allows deployment of the application to any iPhone on the face of the Earth.

Wow, so with a developer license, you can deploy an app to any iPhone out there without going through the appstore….WRONG!  The “Enterprise” developer license EULA that you accepted dicatates that you are only allowed to deploy apps to iPhones operated by employees of your company.  Deployment to any other iPhones is illegal.  And, I’m absolutely sure that Apple is not going to stand by and let you break the law.

Well, you can deploy your LOB app to your company users and that’s the important thing, right?  At this point, you may be wondering how you go about deploying the application to the employee-operated iPhone.  There are currently two ways to do it.  Use the iPhone Configuration Utility (iPCU) or use Apple iTunes.  Both methods are described in the Apple iPhone Enterprise Deployment Guide.

The caveat here is that neither iPCU or iTunes app deployment can be performed directly between the iPhone and a server.  Both iPCU and iTunes are desktop applications that run on either a Mac or Windows machine.  But, they do support two different scenarios.  iPCU is best if you want to setup a bulk number of iPhones with your LOB before giving them to the user.  iTunes is better for deployment of the app or on-going updates when the iPhone is already in the user’s hands.

When deploying the LOB app, you have to get your Enterprise Developer License .mobileprovision file installed on the iPhone before you can install a .app file.  You can deploy the .mobileprovision file using desktop management that you may have deployed in your network to offload this task from the user.  When the iPhone is connected to the desktop running iTunes, the .mobileprovision file will be deployed.  Then the user must add the .app to their app library and select to install it on their iPhone.

However there is a catch – you have to place the orders on Thursdays and Fridays only in addition to using the THRFRIDAY coupon.

So in order to get the 15% off:

1) Go to www.bargaincell.com Thu or Fri ONLY

2) During checkout use THRFRIDAY coupon

3) Save 15% on your new Motorola Droid or iPhone or even Windows Mobile Accessories

However if you live in Europe, where the (re) branding of your phone by mobile operator is much less prevalent you are lucky – there are 3 updates available right now. See the links below and let me know how you like the new, shine WM 6.5

HTC Touch Pro 2

HTC Snap

Toshiba TG01

http://www.mobiledeployments.com/windows-mobile-6-5-feature-compare-to-6-1-and-6-01/

Starting today, ATT customers using the Apple iPhone can install an update that will allow them to send pictures and other multimedia to others via MMS – sometimes called by the general population “Picture Messaging.

Users can choose from the following plans:

And to install the update on your iPhone, go here

During the process of trying to help businesses to adopt iPhones as tools I run into couple obstacles. Some are small like the calendaring functionality and some were bigger.

However today, one of the large obstacles for using iPhone primary device was removed – TomTom has announced availability of their turn by turn navigation in the Apple App Store. It features some interesting technologies such as the one called IQ Routes, said the company. Instead of suggesting the quickest route based on travel time, IQ Routes taps into the actual experiences of other TomTom drivers to determine the fastest route to take. TomTom said this technology lets people reach their destinations quicker up to 35 percent of the time.

I prefer TomTom, mainly because on Windows Mobile, where I have been using it for years now, it allows you to select driving, walking biking and other types of transport, it uses my phone thus I don’t have to pay the extra 9.95 when renting a car for a dedicated GPS unit, has a great database for points of interest and I really like their performance and functionality. But they are not alone in providing turn by turn navigation for iPhone here are couple other solutions:

TomTom for iPhone – 99$ for US and Canada maps – more details here

Navigon – 69$ for US and Canada maps Comparison with iGo My Way is here

iGo My Way – 79$ for US and Canada maps Comparison with Navigon is here

Now only time will show if my friends will stop buying and using the sometimes bulky and overpriced standalone GPS units for their cars or paying for the software update in their car. One of them shared that to update the built-in navigation in a Japanese high end sedan it close to 700 US$! But I know that anybody who has an iPhone now has a good, reliable and well working alternative for turn by turn navigation How about you? Will you use iPhone instead of other GPS devices? Please share your opinion in the comments below.

Cancelled Sendo WM device

I have started to work with smartphones sometime in 1998. I even have a mint prototype of what supposed to be the first Windows Mobile powered phone by Sendo – project that got canceled in 2002. Read more about it here.

Anyway fast forward to 2006 and any IT executive that was thinking about deploying mobile email / PIM and mobile applications basically had two basic option RIM/Blackberry and Windows Mobile. Each had its advantages and issues but once you had your requirements and made your decision, there was a good chance for you to run homogeneous platform. IT Helpdesk and Support, Training, Security and other departments became aware of the platform of choice and while international presence may posed a challenge with availability and the Symbian disruption (especially in Europe) the job was quite easy.

But something did happen in 2007 – the Apple released iPhone and stirred the pot. While the first generation was not suited at serious business use, the second one in 2008 added support for Microsoft Exchange and history started to repeat itself. IT managers were asked by their executives to figure out how to support iPhone, instead of their Blackberries. Regular employees started to bring their own devices and peer support helped them to get corporate email enabled. And the numbers grew.

Today with the introduction of Palm Pre into the mix, the bigger use of ruggedized devices that almost exclusively run Windows Mobile OS, over 30 new smatphone devices running Android planned for release before the end of the year and iPhone being on its 3^rd generation, the 2006 homogenous era looks like a something that will never happen again.

The reality is that most if not all IT departments and business owners have to consider supporting multiple platforms and consider the impacts and risks of all of them. There are some tools that serve multiple platforms well but most are just in their infancy. Also how to make a decision on which support and which just allow /enable but don’t provide any support?

Enterprise Mobile has been building mobile expertise since 2006. If you have any questions about what to do why don’t you send quick email or attend one of the great webinars

If you were unable to attend you can also catch a glimpse of one of the speakers I know, David Field here on TechNet Edge:
http://edge.technet.com/Media/Enterprise-Mobile-Security-Interview/

Dave Field spoke at TechEd on mobile security and gives us some insight into mobile phone security on topics such as:

• Areas where Windows Mobile security is strong against the competition
• Scenarios where companies will want to look to 3rd party solutions for mobile security
• Recommended ways to implement 2 factor authentication for phones

The Windows Mobile security whitepaper Dave mentions is available here: http://www.enterprisemobile.com/resources/white-papers.htm

|\\arco..
mnielsen(at)enterprisemobile.com

Most of this boils down to how the Windows Mobile Connection Manager is handling the connections and the decisions it makes to route the traffic. The Connection Manager is well aware of the native L2TP and PPTP connection methods in Windows Mobile, but appears to lack direct support for the Windows Mobile 6.1 Mobile VPN that is used by SCMDM 2008. See more information here: http://msdn.microsoft.com/en-us/library/ms879581.aspx.

This article assumes you are already well familiar with the SCMDM network routing requirements and how to configure Group Policies.

Proxy Issues Today

1. If you set the proxy via the SCMDM 2008 Group Policy you may observe that the necessary connectivity to the SCMDM Device Management server and WSUS services break.

2. Trying to use the Work/Internet capabilities as currently documented breaks the SCMDM VPN.
Although http://technet.microsoft.com/en-us/library/dd261930.aspx does explain some of the necessary steps. Also on http://technet.microsoft.com/en-us/library/dd261921.aspx it also states to make sure that the SCMDM Gateway server is listed.

3. No visibility on the client of what is configured.
The Windows Mobile Connection Manager internally uses something called a URL Mapping Table to decide if a specific URL is destined for the Internet or the corporate network connection. It can use a URL pattern which we will go into in more detail below. Please see http://msdn.microsoft.com/en-us/library/aa455992.aspx.

Where to set the Proxy server setting in the SCMDM 2008 Group Policies:

The solution is to correctly configure the Internet proxy setting and also specify the routing of which URLs go to the “Internet” and through the configured proxy, and which are internal or go through “Work” back through the VPN connection.

Overall best practices

Keeping things as simply as possible will go a long way. The basics are:

1. “Internet” bound traffic = Route via proxy if defined, otherwise use Default Gateway on SCMDM Gateway Server.

2. “Work” bound traffic = Route traffic directly to internal network using local routing tables on SCMDM Gateway Server.

3. If the FQDN of the Proxy is part of an internal domain do not put the FQDN in the Proxy configuration!
This will not work, as it will be detected as an Internet domain, due to the dotted name and you won’t see it working as you think. The solution is to use the direct IP address. Example: instead of “proxy_host.company.com:8080″ use “172.16.1.1:8080″.

Where to configure the specific Internet/Work routing is done through a “hidden” existing Group Policy setting:

The dialog window has two areas. One for the Internet domains (which will be routed to a proxy if configured so) and at the bottom for Work domains (not routed to the proxy if configured). This is what the default values are:

Next we will go into how to configure these entries in more detail.

Connection Manager URL Mapping Pattern

The Windows Mobile Connection Manager uses a general *://*.*/* URL type format. This can be further broken down into these examples:

• "*" & "?" can be used anywhere.:
  • “*” = Zero or more of any type of characters.
  • “?” = Can take the place for any single character.
• *:// = Any protocol (usually http or https).
• /*.*/ = Any FQDN namespace
• /*/ = Any NetBIOS/WINS name
• *://servername/* = specific NetBIOS server name
• *://*.company.com/* = Any host in a FQDN domain called company.com.
• *://host1.company.com/* = Only host1, any protocol, any website on target.
• *://host?.company.com/* = All traffic to host[a-z, 0-9], any website.
• https://host1.company.com/home = Only https requests to host1’s "home’ directory.

Some things to think about when defining you own URL Mapping table:

- Obey classic firewall rules – most granular is processed first
- Define your targets and know your internal name space
- Put in sequence (most specific first, least specific last)
- Decide whether traffic goes via the “internet” or “work” network routing from your SCMDM Gateway Server

Example and Outcome

Here is what a working example of URL Mapping Filter entries could look like:

Please note the above setting details:
- *://www.company.com/* – Externally hosted Internet site
- *://mdmvpn.company.com/* – Route SCMDM Gateway Server access through Internet
- *://*.company.com/* – Internal work namespace
- *://*.*/* – Catch all for all other Internet requests
- *://*/* – Catch all for all other internal NetBIOS/WINS requests – However, not found to work in testing, and removed so Internet requests are not caught by it!

Outcome with the above setting details:
- SCMDM VPN will connect correctly through the Carrier/MO/ISP on the device
- SCMDM Device Management and WSUS traffic will require no further invention.
- Internal Line-Of-Business application traffic will go direct.
- Internet bound traffic will go to the corporate proxy (if defined in separate Group Policy).

Internal namespace sans WINS

Since most companies are well on their way to totally get rid of WINS and have put in place DNS suffix search order standards. Another solution is to push a default DNS suffix to your Windows Mobile. Brian Puhl from Microsoft IT blogged about this last year here:

http://imav8n.wordpress.com/2008/08/21/getting-single-label-name-resolution-on-mdm-enrolled-phones/.

So this could ensure proper name resolution to a FQDN for internal names used on the Windows Mobile device. In the example above this could be routed to the “work” side of things by the *://*.company.com/* URL Mapping.

For more information on creating custom ADM templates for use in SCMDM 2008 please see: http://blog.enterprisemobile.com/2008/10/writing-custom-gpos-for-scmdm-2008/.

SCMDM 2008 SP1 Source-based Routing

Another feature that can be used to better assist with the complex nature of network routing, proxies and Internet access is the source-based routing feature present in SCMDM 2008 SP1. Some details can be found here: http://technet.microsoft.com/en-us/library/dd252779.aspx

The source-based routing option on the Gateway Wizard:
One example of how this could work is instead of having the default gateway on the External NIC of the Gateway Server, you place one on the Internal NIC. You can then configure the source-based routing option to an IP address of an external firewall that is accessible from the Internal NIC. Now Internet IPSec traffic will come in and terminate on the external NIC, but return back to the device through the Internal NIC and the IP address of the source-based routing, back to the Internet. Now any traffic from the Windows Mobile devices not configured to the proxy will default out to the Internal NIC gateway. This could be useful for applications that are not proxy aware, or if you won’t want to use any proxy but direct all traffic to the internal side and to be taken care of there for either internal or external Internet routing..

Split DNS

Another idea that could perhaps assist in some architectures is the use of split-DNS. In the Gateway Wizard you can specify the DNS server the Windows Mobile clients will use to resolve hostnames. Many simply use the existing DNS server present internally and make sure connectivity on TCP port 53 is open to it. Another idea could be to use a separate DNS server that contains hostname zone entries that could be similar but resolve to different IP addresses to better resolve network routing or DMZ issues at hand. DNS forwarding could still be used to forward remaining requests to the primary internal DNS servers.

Tethering Devices

Another Enterprise Mobile colleague, Dave Field, also points out:

“Please note that if you have a proxy setup on the device and you partner the device to a desktop that has “automatic” setup for the Connection setting, it will auto-configure the device proxy and overwrite whatever you have. It will configure it for port 80 automatically too.”.

At this of this writing I’m not sure if the Group Policies will automatically refresh the settings again down to the device. A work around may be to disable the tethering functionality all together if this is a big concern.

Wrap up

The final best advice is to have patience in troubleshooting and testing the proxy and network routing. It can be complex and quite difficult to get setup correctly in a large organization. Logic flow, re-verifying settings, and looking at logs could be your best friends.

Thanks again to Patrick Salmon for getting the answers together. Also a thanks to Wayne Phillips and David Creedy from Airloom for their feedback and corrections!

Please leave a comment or contact me directly if you have additional findings or feedback on how these settings work and act for you!

Reference links – for additional information:
Default URL Mapping values in Connection Manager:
http://msdn.microsoft.com/en-us/library/aa456095.aspx
How Connection Manager works:
http://blogs.msdn.com/fzandona/archive/2005/10/10/ConnectionManager02.aspx
How the Mapping Index works and what are some of the high-end catch all values:
http://msdn.microsoft.com/en-us/library/aa455850.aspx
http://msdn.microsoft.com/en-us/library/aa456095.aspx
Using Connection Manager URL Mapping:
http://msdn.microsoft.com/en-us/library/aa455992.aspx
SCMDM Forum thread discussion on these settings:
http://social.technet.microsoft.com/Forums/en-US/SCMDM/thread/9a295dc0-55a6-4783-b43e-132748e8e7b5

|\\arco..

Updated on May 12, 2009 with some corrections.

This is a public website that can be used to troubleshoot Exchange server connectivity issues. Originally written by a Microsoft Escalation Engineer and continually updated.

You can test such things Exchange ActiveSync (EAS) issues, including Windows Mobile 5 and Windows Mobile 5 w/MSFP, Windows Mobile 6.1 clients with AutoDiscover, Outlook RPC over HTTP (Outlook Anywhere), Outlook 2007 and AutoDiscover and even inbound SMTP. The tool will give you a nice detailed report that you can drill down into and research where any failure might be.

It is accessed from here: https://www.TestExchangeConnectivity.com.

This could be very useful in testing your Exchange configuration and setup before you have Windows Mobile clients to access your environment. Validation of certificates and which Windows Mobile versions are supported is also included!

Main menu:

Apply test credentials:

Example report:

Reference Links:
Blog: http://msexchangeteam.com/archive/2009/03/25/450908.aspx
Video: http://edge.technet.com/Media/The-Remote-Connectivity-Analyzer-for-Exchange-Server/
Facebook Group: http://www.facebook.com/group.php?gid=58417140899
Twitter: http://twitter.com/ExRCA 

|\\arco..