The Mobile Device Manager Support Team Blog : KB Article

New MDM KB article: Code Word policy for System Center Mobile Device Manager 2008 is not correctly applied when disabled

jchornbe — Mon, 24 Aug 2009 17:03:47 GMT

Just an FYI that we published a new Knowledge Base article for System Center Mobile Device Manager 2008 last week.

I mentioned this issue here last week but we now have an official KB documenting it as well:

KB974680 - The Group Policy setting "Code Word" for System Center Mobile Device Manager 2008 is not correctly applied to Windows Mobile 6.1 mobile devices when the policy is Disabled

J.C. Hornbeck | Manageability Knowledge Engineer

New MDM KB article: Code Word Frequency policy for System Center Mobile Device Manager 2008 is not correctly applied when disabled

jchornbe — Mon, 17 Aug 2009 17:14:02 GMT

Just an FYI that we published a new Knowledge Base article for System Center Mobile Device Manager 2008 last week.

I mentioned this issue here last week but we now have an official KB documenting it as well:

KB974606 - The Group Policy setting "Code word frequency" for System Center Mobile Device Manager 2008 is not correctly applied to Windows Mobile 6.1 mobile devices when the policy is "Disabled"

J.C. Hornbeck | Manageability Knowledge Engineer

Two new Mobile Device Manager 2008 Knowledge Base articles for the week ending 03/21/2009

jchornbe — Mon, 30 Mar 2009 17:14:31 GMT

Sorry for the lag in getting these posted but I’ve been out of the office for a while and then had a project to finish up so I’m just now getting back to my regular day-to-day. Some of these may be old news by now but I wanted to go back and give them a mention anyway just in case:

KB969162 - Unable to run the adconfig /validateinstance instance command from a Windows XP SP2 computer in the domain

KB969204 - Error message when installing MDM Reporting Services from the SCMDM 2008 Resource Kit Tools

Enjoy!

J.C. Hornbeck | Manageability Knowledge Engineer

Solution: The Group Policy setting “Block unsigned theme installation” for System Center Mobile Device Manager 2008 is not correctly applied to Windows Mobile 6.1 mobile devices

jchornbe — Wed, 11 Mar 2009 18:06:01 GMT

Just a quick FYI on an issue we came across recently. This should be a Knowledge Base article soon but I figured I’d post it here first to give all you faithful readers first notice. If you’re trying to use the Group Policy setting “Block unsigned theme installation” for System Center Mobile Device Manager 2008 and it’s not working correctly then this one’s for you:

Issue: When you Enable the Group Policy setting Block unsigned theme installation by using Microsoft System Center Mobile Device Manger (MDM) 2008 Group Policy management functionality, some Windows Mobile 6.1 mobile devices may not allow the installation of default built-in themes.

When you Disable the Group Policy setting Block unsigned theme installation by using Microsoft System Center Mobile Device Manger (MDM) 2008 Group Policy management functionality, some Windows Mobile 6.1 mobile devices may continue to block the installation of unsigned themes.

Cause: This group policy setting affects Windows Mobile Security Policy 4103 SECPOLICY_UNSIGNEDTHEMES when applied to the device. The default value for this policy is SECROLE_USER_UNAUTH, however when the group policy setting is set to Disable the value SECROLE_USER_AUTH is applied.

When this policy is set to Enable the value SECROLE_NONE is applied. Theme files as well as other cab files do not receive special permissions as executable files do, even if they are placed in-rom, so this policy continues to affect these default theme files and blocks their installation.

Note: SECROLE_USER_UNAUTH corresponds to the decimal value 64, and SECROLE_USER_AUTH corresponds to 16.

Workaround: To work around the behavior when set to Enable, you must sign the default theme files you want to enable users to install. To work around the behavior when set to Disable follow the procedures below:

Important: The following workaround applies only to the English version of Microsoft System Center Mobile Device Manger 2008. There are no workarounds for other language versions of the product at this time.

Warning: Serious problems might occur if you modify system files incorrectly. These problems might require that you reinstall server software or components of server software. Microsoft cannot guarantee that these problems can be solved. Modify the system files at your own risk.

Important: The following workaround requires you to modify an important system file. Make sure that you back up the referenced file before you modify it. Make sure that you know how to restore the system file if a problem occurs. Do not proceed with the following procedure if you do not know how to back up and restore a file. Revert to the original file if you encounter any problems with the workaround.

The following steps modify the ADM template file that includes the Block unsigned theme installation Group Policy setting. When you have successfully modified the file, you can use the Block unsigned theme installation Group Policy setting to correctly update managed devices.

1. On the computer on which you have installed the MDM Administrator Tools, navigate to the %windir%\INF folder.
2. Type the following at a command prompt to make a backup copy of the mobile.adm file:

copy mobile.adm mobile.adm.bak

3. In a text editor, such as Notepad, edit the mobile.adm file to change the VALUEOFF setting for Policy_BlockUnsignedThemes

Replace this:

        POLICY !!Policy_BlockUnsignedThemes
        EXPLAIN !!Explain_BlockUnsignedThemes
        VALUENAME "4103"
        VALUEON NUMERIC 0
        VALUEOFF NUMERIC 16
END POLICY

with this:

        POLICY !!Policy_BlockUnsignedThemes
        EXPLAIN !!Explain_BlockUnsignedThemes
        VALUENAME "4103"
        VALUEON NUMERIC 0
        VALUEOFF NUMERIC 64
END POLICY

4. Save the file and exit the text editor.

To apply the new setting to managed devices, you must update the Block unsigned theme installation Group Policy setting in MDM. To refresh the setting in MDM, in the MDM Console run the following cmdlet:

Update-MobilePolicyCalculation <device>

Where <device> is the managed device on which you want to update the Group Policy setting. New settings are pushed down to managed devices during the next synchronization with MDM.

This information applies to:

• Microsoft System Center Mobile Device Manager 2008
• Microsoft Windows Mobile 6.1 mobile devices

Hope this helps,

J.C. Hornbeck | Manageability Knowledge Engineer

New Knowledge Base articles for 12-14 through 12-20

jchornbe — Tue, 06 Jan 2009 17:14:24 GMT

For the week of 12-14 through 12-20 we had three new System Center Mobile Device Manager 2008 KB articles. Links and titles are below:

========

KB960829 - Error message when you try to upgrade to System Center Mobile Device Manager 2008 Service Pack 1: "Failed to determine status of MDM databases on SQL instance"
Sys Ctr Mobile Dvc Mgr 2008 EN
EN-US

KB960920 - Constraint violation 0x8007202F running AdConfig /enableGPSecurity
Sys Ctr Mobile Dvc Mgr 2008 EN
EN-US

KB961018 - Upgrade to System Center Mobile Device Manager SP1 Database Credential Failure
Sys Ctr Mobile Dvc Mgr 2008 EN
EN-US

========

Enjoy!

J.C. Hornbeck | Manageability Knowledge Engineer

New Knowledge Base article for 11-30 through 12-6

jchornbe — Mon, 08 Dec 2008 18:21:00 GMT

For the week of 11-30 through 12-6 we had one new MDM Knowledge Base article. The link and title is below:

========

http://support.microsoft.com/?kbid=960920
Constraint violation 0x8007202F running AdConfig /enableGPSecurity
System Center Mobile Device Manager 2008

========

Enjoy!

J.C. Hornbeck | Manageability Knowledge Engineer

New and updated Knowledge Base articles for 11-16 through 11-22

jchornbe — Tue, 02 Dec 2008 17:23:08 GMT

For the week of 11-16 through 11-22 we had one updated KB article for System Center Mobile Device Manager. The link and title is below:

========

Sys Ctr Mobile Dvc Mgr 2008 EN
951840 - Attempts to validate Windows Mobile device certificates and to authenticate System Center Mobile Device Manager 2008 fail
Published - Updated

========

Enjoy!

J.C. Hornbeck | Manageability Knowledge Engineer