Blackbe;rry ENTERPRISE SERVER FOR IBM LOTUS DOMINO Instruction Manual

Administration Guide
BlackBerry Enterprise Server for IBM Lotus Domino
Version: 4.1 | Service Pack: 6

SWD-494101-0708084821-001

Contents
1Creating administrator accounts..................................................................................................................................... 13
Administrative roles.................................................................................................................................................................... 13
Creating a BlackBerry Enterprise Server administrator in a Microsoft SQL Server environment................................... 14
Assign an administrative role to a new or existing Microsoft SQL Server database account..................................... 15
Creating a BlackBerry Enterprise Server administrator in an IBM DB2 UDB environment............................................. 15
Create a BlackBerry Enterprise Server administrator in an IBM DB2 UDB environment............................................ 16
Configure the BlackBerry Manager to use database authentication in a Microsoft SQL Server environment............ 16
Specify the administration email address............................................................................................................................... 16
2 Setting up security options............................................................................................................................................... 17
How the BlackBerry Enterprise Solution encrypts data on the transport layer................................................................. 17
Standard encryption algorithms that the BlackBerry Enterprise Solution uses............................................................ 17
Change the encryption type.................................................................................................................................................. 18
Options for extending messaging security.............................................................................................................................. 18
Protection of data using the PGP Support Package for BlackBerry devices.................................................................. 18
Prerequisites: Protecting data using the PGP Support Package for BlackBerry devices............................................. 19
Prerequisites: Protecting data using the S/MIME Support Package for BlackBerry devices...................................... 19
Support for decrypting IBM Lotus Notes encrypted messages and S/MIME-encrypted messages on BlackBerry
devices........................................................................................................................................................................................... 20
Turning on support for the BlackBerry device to decrypt IBM Lotus Notes and S/MIME-encrypted messages..... 20
How users turn off support for decrypting IBM Lotus Notes encrypted messages and S/MIME-encrypted
messages on BlackBerry devices.......................................................................................................................................... 21
Generating organization-specific encryption keys for PIN-to-PIN message encryption................................................ 21
Generate a new peer-to-peer encryption key.................................................................................................................... 21
Authenticating the BlackBerry MDS Integration Service to the BlackBerry Manager and web services...................... 22
Allow the BlackBerry MDS Integration Service to communicate with the BlackBerry Manager................................ 22
Allow client authentication between the BlackBerry MDS Integration Service and web services............................. 23
3 Setting up proxy servers for BlackBerry Enterprise Server components................................................................. 25
Configuring certain BlackBerry Enterprise Server components to use proxy servers...................................................... 25
Configure a BlackBerry Enterprise Server component to use a .pac file........................................................................ 25
Configure a BlackBerry Enterprise Server component to use a proxy server................................................................ 26
Configure a BlackBerry Enterprise Server component to authenticate to a proxy server on behalf of BlackBerry
devices....................................................................................................................................................................................... 26

4 Sharing BlackBerry Enterprise Server components..................................................................................................... 29
Configuring multiple BlackBerry Enterprise Server instances to use the same BlackBerry Enterprise Server
component.................................................................................................................................................................................... 29
Configure multiple BlackBerry Enterprise Server instances to use the same BlackBerry MDS Connection Service
.................................................................................................................................................................................................... 29
Configure multiple BlackBerry Enterprise Server instances to use the same BlackBerry MDS Integration Service
.................................................................................................................................................................................................... 30
Configure multiple BlackBerry Enterprise Server instances to use the same BlackBerry Collaboration Service
.................................................................................................................................................................................................... 30
5 Setting up user accounts................................................................................................................................................... 31
Adding user accounts to the BlackBerry Enterprise Server.................................................................................................. 31
Add user accounts to the BlackBerry Enterprise Server.................................................................................................... 31
Creating user groups................................................................................................................................................................... 32
Create a user group................................................................................................................................................................. 32
Add a user account to a user group...................................................................................................................................... 32
Synchronizing organizer data items with BlackBerry devices.............................................................................................. 32
Option 1: Create a roaming user profile to support organizer data synchronization................................................... 33
Option 2: Configure the messaging server to support synchronization of personal organizer data......................... 33
Option 3: Allow users to access their messaging profiles using a browser................................................................... 34
6 Sending software and Java applications to BlackBerry devices............................................................................... 35
Making BlackBerry Device Software and Java applications available to users................................................................. 35
Making software and applications available on a network drive......................................................................................... 35
Install the BlackBerry Device Software on a network drive.............................................................................................. 35
Add a Java application to a network drive........................................................................................................................... 36
Add a collaboration client to a network drive..................................................................................................................... 36
Add the BlackBerry MDS Runtime to a network drive....................................................................................................... 36
Indexing applications on a network drive................................................................................................................................ 37
Create or update a software index for applications on a network drive......................................................................... 37
Share a network drive for applications................................................................................................................................ 37
Defining software configurations............................................................................................................................................. 37
Create a software configuration........................................................................................................................................... 38
Define an application control policy.................................................................................................................................... 38
Assign an application control policy to an application..................................................................................................... 39

Assign a software configuration to a user group............................................................................................................... 39
Assign a software configuration to a user account............................................................................................................ 39
Send an application to a BlackBerry device over the wireless network.............................................................................. 40
Monitor wireless application push failures.............................................................................................................................. 40
Error messages: Wireless application push......................................................................................................................... 40
Install the BlackBerry Device Software or BlackBerry Applications on a BlackBerry device using the BlackBerry
Manager........................................................................................................................................................................................ 43
Installing the collaboration client on BlackBerry devices..................................................................................................... 43
7 Setting up the messaging environment......................................................................................................................... 45
Creating email message filters.................................................................................................................................................. 45
Create an email message filter that applies to all users................................................................................................... 45
Turn on an email message filter that applies to all user accounts.................................................................................. 46
Create an email message filter that applies to a user group............................................................................................ 46
Turn on an email message filter that applies to a user group.......................................................................................... 47
Create an email message filter that applies to a specific user account......................................................................... 47
Turn on an email message filter that applies to a specific user account........................................................................ 48
Enforcing secure messaging using classifications................................................................................................................. 49
Configure message classifications............................................................................................................................................ 49
Create a message classification............................................................................................................................................ 49
Create a message classification based on an existing classification.............................................................................. 50
Order message classifications.............................................................................................................................................. 50
Delete message classifications............................................................................................................................................. 51
Mapping address book fields for synchronization and address lookups............................................................................ 51
Map an address book field in the email application to an address book field on all BlackBerry devices................. 52
Map an address book field in the email application to an address book field on a specific BlackBerry device....... 52
Map address book fields that users defined to address book fields on all BlackBerry devices.................................. 52
Map address book fields that users defined to address book fields on a specific BlackBerry device........................ 53
8 Making BlackBerry MDS Runtime Applications available to users.......................................................................... 55
Creating BlackBerry MDS Runtime Applications and sending them to BlackBerry devices........................................... 55
Preparing BlackBerry devices to install BlackBerry MDS Runtime Applications.............................................................. 57
Configuring access to web services and managing signed and unsigned applications.................................................. 58
Allow BlackBerry MDS Runtime Applications to access web services using HTTPS.................................................... 58
Define a BlackBerry MDS Runtime Application as a trusted application...................................................................... 58
Configure whether users can install unsigned BlackBerry MDS Runtime Applications on BlackBerry devices...... 59

Configuring how users access and use BlackBerry MDS Runtime Applications............................................................... 59
Create a BlackBerry MDS Integration Service device policy............................................................................................ 59
Assign a BlackBerry MDS Integration Service device policy to a user group................................................................ 60
Assign a BlackBerry MDS Integration Service device policy to a specific user............................................................. 60
Sending BlackBerry MDS Runtime Applications to BlackBerry devices............................................................................. 60
Install a BlackBerry MDS Runtime Application on BlackBerry devices.......................................................................... 61
Install a BlackBerry MDS Runtime Application on a specific BlackBerry device.......................................................... 61
Applying an application control policy to a BlackBerry MDS Runtime Application......................................................... 62
Add the application launcher file for a BlackBerry MDS Runtime Application to the network drive........................ 62
Assign an application control policy to a BlackBerry MDS Runtime Application......................................................... 63
9 Configuring how users access enterprise applications and web content............................................................... 65
Specifying a BlackBerry MDS Connection Service as the central push server.................................................................. 65
Specify the central push server............................................................................................................................................. 65
Configuring how BlackBerry devices authenticate to content servers............................................................................... 65
Configure how BlackBerry devices authenticate to content servers.............................................................................. 66
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content servers that
use NTLM.................................................................................................................................................................................. 66
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content servers that
use Kerberos............................................................................................................................................................................. 67
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content servers that
use LTPA.................................................................................................................................................................................... 67
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to the RSA Authentication
Manager.................................................................................................................................................................................... 67
Configuring how the BlackBerry MDS Connection Service manages requests for web content.................................... 68
Configure the BlackBerry MDS Connection Service to manage HTTP cookie storage................................................ 68
Configure the timeout limit for HTTP connections with BlackBerry devices................................................................. 68
Configure the timeout limit for HTTP connections to web servers.................................................................................. 69
Configure the maximum number of times that the BlackBerry Browser accepts HTTP redirections........................ 69
Allowing push applications to make trusted connections to the BlackBerry MDS Connection Service........................ 69
Create a key store to store certificates for use with HTTPS connections....................................................................... 70
Add a certificate for the BlackBerry MDS Connection Service........................................................................................ 70
Export the BlackBerry MDS Connection Service certificate to make it available to push applications.................... 71
Import the BlackBerry MDS Connection Service certificate to the key store of a push application.......................... 71
Configuring how applications open trusted connections to web servers........................................................................... 72

Allow BlackBerry devices to connect to untrusted web servers....................................................................................... 72
Configure the BlackBerry MDS Connection Service to retrieve certificates for web servers...................................... 72
Configure the BlackBerry MDS Connection Service to retrieve the status of certificates for web servers............... 73
Add retrieved certificates for web servers........................................................................................................................... 74
Configuring how the BlackBerry MDS Connection Service connects to BlackBerry devices.......................................... 74
SpecifythemaximumamountofdatathattheBlackBerryMDSConnectionServicecansendtoBlackBerrydevices
.................................................................................................................................................................................................... 74
Specify the pending content timeout limit for the BlackBerry MDS Connection Service........................................... 74
Allow Java applications to use persistent socket connections with the BlackBerry MDS Connection Service........ 75
Specify the thread pool size of the BlackBerry MDS Connection Service...................................................................... 75
Specify the maximum number of persistent socket connections.................................................................................... 75
Specify the port number that the web server listens on for push application requests............................................... 76
Specify how often the BlackBerry MDS Connection Service polls for configuration information............................. 76
10 Assigning BlackBerry devices to users........................................................................................................................... 77
Preparing to distribute BlackBerry devices............................................................................................................................. 77
Change how the BlackBerry Enterprise Server loads users’ existing messages onto BlackBerry devices................ 77
Prevent the BlackBerry Enterprise Server from loading legacy messages onto new BlackBerry devices................. 77
Assigning BlackBerry devices to user accounts...................................................................................................................... 78
Option 1: Activate a BlackBerry device using the BlackBerry Manager......................................................................... 78
Option 2: Activating BlackBerry devices over the wireless network............................................................................... 78
Option 3: Activating BlackBerry devices over the LAN..................................................................................................... 82
11 Managing administrator accounts.................................................................................................................................. 83
Assign a BlackBerry Enterprise Server administrator to a different administrative role................................................. 83
Delete an administrator account from a BlackBerry Enterprise Server.............................................................................. 83
12 Controlling the BlackBerry environment....................................................................................................................... 85
Controlling BlackBerry device access to the BlackBerry Enterprise Server....................................................................... 85
Turn on the Enterprise Service Policy.................................................................................................................................. 85
Permit a user to override the Enterprise Service Policy.................................................................................................... 86
Controlling BlackBerry device behavior using IT policies..................................................................................................... 86
Create an IT policy.................................................................................................................................................................. 86
Assign an IT policy to a group of users................................................................................................................................ 87
Assign an IT policy to a user account................................................................................................................................... 88
Enforcing IT policy changes over the wireless network.................................................................................................... 88

Deactivating BlackBerry devices without applied IT policies........................................................................................... 89
Changing the default behavior of the BlackBerry devices and BlackBerry Desktop Software in your organization
.................................................................................................................................................................................................... 89
Returning to the original default behavior of BlackBerry devices and the BlackBerry Desktop Software............... 90
Creating new IT policy rules to control third-party applications..................................................................................... 91
13 Managing user accounts................................................................................................................................................... 93
Managing user groups................................................................................................................................................................ 93
Change the properties of a user group................................................................................................................................ 93
Rename a user group.............................................................................................................................................................. 93
Delete a user group................................................................................................................................................................. 94
Managing user accounts............................................................................................................................................................ 94
Move a user account to a different user group................................................................................................................... 94
Move a user account out of a user group............................................................................................................................. 94
Move a user account from one BlackBerry Enterprise Server to another....................................................................... 95
Delete a user account from the BlackBerry Enterprise Server......................................................................................... 95
14 Protecting and reassigning BlackBerry devices........................................................................................................... 97
Protecting lost, stolen, or replaced BlackBerry devices......................................................................................................... 97
Protect a lost BlackBerry device........................................................................................................................................... 97
Protect a lost BlackBerry device that a user might recover.............................................................................................. 98
Protect a stolen BlackBerry device....................................................................................................................................... 98
Reissuing BlackBerry devices to new users............................................................................................................................. 98
Preparing a BlackBerry device for redistribution............................................................................................................... 99
15 Managing wireless applications...................................................................................................................................... 101
Managing applications on BlackBerry devices....................................................................................................................... 101
Upgrade an application on a BlackBerry device over the wireless network.................................................................. 101
Remove applications from BlackBerry devices over the wireless network..................................................................... 101
Change an application control policy.................................................................................................................................. 101
Managing software configurations........................................................................................................................................... 102
Delete a software configuration from a user account....................................................................................................... 102
Create a software configuration based on an existing software configuration............................................................ 102
16 Managing organizer data synchronization.................................................................................................................... 103
Turning off organizer data synchronization............................................................................................................................ 103

Turn off synchronization of organizer data for all user accounts.................................................................................... 103
Turn off synchronization of organizer data for a user group............................................................................................ 103
Turn off synchronization of organizer data for a specific user account.......................................................................... 103
Changing how organizer data synchronizes........................................................................................................................... 104
Change the direction of organizer data synchronization for all user accounts............................................................. 104
Change the direction of organizer data synchronization for a user group.................................................................... 104
Change the direction of organizer data synchronization for a specific user account.................................................. 105
Change how conflicts during organizer data synchronization are resolved for all user accounts............................. 105
Change how conflicts during organizer data synchronization are resolved for a user group..................................... 105
Change how conflicts during organizer data synchronization are resolved for a specific user account.................. 106
17 Managing your messaging environment and attachment support........................................................................... 107
Managing message forwarding................................................................................................................................................. 107
Forward messages to a BlackBerry device when no filter rules apply............................................................................ 107
Do not deliver messages to a BlackBerry device when no filter rules apply.................................................................. 107
Forward messages from inbox subfolders to a BlackBerry device................................................................................... 108
Turn off synchronization for messages sent from BlackBerry devices that belong to a user group.......................... 108
Turn off synchronization for messages sent from a BlackBerry device.......................................................................... 108
Turn off message forwarding to user accounts in a user group....................................................................................... 109
Turn off message forwarding to a user account................................................................................................................. 109
Managing wireless message reconciliation............................................................................................................................. 109
Turn off wireless message reconciliation............................................................................................................................ 109
Managing content in RTF and HTML-formatted messages.................................................................................................. 110
View settings for HTML-formatted messages..................................................................................................................... 110
Turn off rich content and inline images for groups of users............................................................................................. 110
Turn off rich content and inline images in messages for individual users..................................................................... 110
Managing access to remote message data............................................................................................................................. 111
Turn off the ability to check meeting invitee availability on the BlackBerry device..................................................... 111
Turn off the ability to search for remote email messages from the BlackBerry device................................................ 111
Managing message signatures and disclaimers..................................................................................................................... 112
Add a signature to all messages sent by members of a user group................................................................................ 112
Add a signature to all messages sent from a user’s BlackBerry device.......................................................................... 112
Add a disclaimer to all messages sent from BlackBerry devices..................................................................................... 112
Add a disclaimer to all messages sent by members of a user group............................................................................... 113
Add a disclaimer to all messages sent from a user’s BlackBerry device......................................................................... 113

Specify conflict rules for disclaimers.................................................................................................................................... 114
Turn off disclaimers................................................................................................................................................................. 114
Monitor messages that users send from their BlackBerry devices...................................................................................... 114
Managing the incoming message queue................................................................................................................................. 115
Delete messages for a specific user from the incoming message queue....................................................................... 115
Managing the wireless backup and recovery of organizer data.......................................................................................... 115
Turn off the wireless backup of organizer data for a user group..................................................................................... 115
Turn off the wireless backup of organizer data for a user account................................................................................. 116
Delete a user’s organizer data from the BlackBerry Enterprise Server........................................................................... 116
Sending notification messages to users.................................................................................................................................. 116
Send a notification message to all users in the BlackBerry Domain............................................................................... 116
Send a notification message to all users on a BlackBerry Enterprise Server................................................................. 117
Send a notification message to the members of a user group......................................................................................... 117
Send a notification message to a specific user................................................................................................................... 117
Automated notification messages............................................................................................................................................ 117
Change the subject for automated notification messages............................................................................................... 117
Turn off automated notification messages.......................................................................................................................... 118
Managing instant messaging.................................................................................................................................................... 118
Change the instant messaging server that the BlackBerry Collaboration Service connects to................................. 118
Changing the transport protocol that the BlackBerry Collaboration Service uses to connect to the instant
messaging server..................................................................................................................................................................... 119
Specify the Microsoft Windows domain name for users who log in to the collaboration client................................. 120
Managing instant messaging sessions.................................................................................................................................... 120
Specify the maximum number of instant messaging sessions that can be open at the same time........................... 121
Specify the idle timeout limit for instant messaging sessions......................................................................................... 121
Specify the inactivity timeout limit for instant messaging sessions............................................................................... 121
Managing instant messaging features..................................................................................................................................... 121
Prevent users from sending specific file types to instant messaging contacts using the BlackBerry Client for IBM
Lotus Sametime....................................................................................................................................................................... 122
Specifying the maximum size of file types that users can send using the BlackBerry Client for IBM Lotus Sametime
.................................................................................................................................................................................................... 122
Prevent users from sending instant messaging conversations in email messages...................................................... 122
Prevent users from saving instant messaging conversations........................................................................................... 123
Manage the icon that appears on the BlackBerry device for mobile contacts.............................................................. 123

Make additional contact information and phone numbers available for the BlackBerry Client for IBM Lotus
Sametime users........................................................................................................................................................................ 123
Troubleshooting: Instant messaging........................................................................................................................................ 124
Users cannot view phone numbers for contacts in the BlackBerry Client for IBM Lotus Sametime.......................... 125
Optimizing how the BlackBerry Attachment Service converts attachments..................................................................... 126
Optimize how the BlackBerry Attachment Service converts attachments.................................................................... 126
BlackBerry Attachment Service optimization settings...................................................................................................... 127
Change the maximum file size for attachments that users can receive......................................................................... 128
Suggested file sizes for attachments................................................................................................................................... 128
Change the maximum dimensions for image attachments that users can view........................................................... 129
Optimizing how the BlackBerry Messaging Agent reconciles attachments to the messaging server........................... 129
Change the maximum file size for attachments that users can send............................................................................. 130
Prevent users from sending large attachments.................................................................................................................. 130
Change the maximum file size of attachments that users can download...................................................................... 130
Turn off support for an attachment file format....................................................................................................................... 131
Add support for additional attachment file formats.............................................................................................................. 131
18 Managing BlackBerry MDS Runtime Applications....................................................................................................... 133
Upgrade a BlackBerry MDS Runtime Application on BlackBerry devices.......................................................................... 133
Remove a trusted certificate from the BlackBerry MDS Integration Service..................................................................... 134
Making installed BlackBerry MDS Runtime Applications unavailable on BlackBerry devices........................................ 134
Make an installed BlackBerry MDS Runtime Application unavailable on BlackBerry devices................................... 134
Make an installed BlackBerry MDS Runtime Application available on BlackBerry devices again............................. 134
Removing BlackBerry MDS Runtime Applications................................................................................................................. 135
Make a BlackBerry MDS Runtime Application unavailable for installation................................................................... 135
Remove an installed BlackBerry MDS Runtime Application from BlackBerry devices................................................. 135
Remove an installed BlackBerry MDS Runtime Application from a specific BlackBerry device................................. 136
Configuring a new connection between a BlackBerry MDS Integration Service and a BlackBerry MDS Connection
Service........................................................................................................................................................................................... 136
Make a BlackBerry MDS Connection Service available to a BlackBerry MDS Integration Service............................ 137
Make a BlackBerry MDS Connection Service unavailable to a BlackBerry MDS Integration Service....................... 137
19 Managing how users access enterprise applications and web content................................................................... 139
Restricting user access to content on web servers................................................................................................................ 139
Restrict requests for content on web servers from BlackBerry devices.......................................................................... 139
Specify web address patterns................................................................................................................................................ 139

Create a pull rule..................................................................................................................................................................... 140
Restrict or allow web address patterns using a pull rule.................................................................................................. 140
Assign a pull rule to a user group......................................................................................................................................... 141
Assign a pull rule to a specific user...................................................................................................................................... 141
Restricting user access to media content in the BlackBerry Browser................................................................................. 141
Prevent users from accessing specific media types........................................................................................................... 142
Configure a maximum file size for media types.................................................................................................................. 142
Restricting the push application content that users can receive........................................................................................ 142
Restrict push applications from sending data to BlackBerry devices............................................................................. 143
Create push initiators for push applications....................................................................................................................... 143
Turn on push authorization.................................................................................................................................................... 144
Create a push rule................................................................................................................................................................... 144
Assign push initiators to a push rule.................................................................................................................................... 145
Assign a push rule to a user group....................................................................................................................................... 145
Assign a push rule to a specific user.................................................................................................................................... 145
Encrypt push requests that push applications send to BlackBerry devices................................................................... 146
Associate a push initiator with the BlackBerry MDS Integration Service...................................................................... 146
Managing push application requests....................................................................................................................................... 147
Specify device ports for application-reliable push requests............................................................................................ 147
Store push application requests in the BlackBerry Configuration Database................................................................ 148
Configure the settings for storing push requests in the BlackBerry Configuration Database................................... 148
Configure the maximum number of active connections that the BlackBerry MDS Connection Service can process
.................................................................................................................................................................................................... 148
Configurethe maximum numberof queued connectionsthat the BlackBerryMDS Connection Servicecan process
.................................................................................................................................................................................................... 149
Delete requests from the push request queue manually.................................................................................................. 149
20 Monitoring a BlackBerry Domain.................................................................................................................................... 151
How the BlackBerry Controller monitors the BlackBerry Enterprise Server components............................................... 151
Changing how the BlackBerry Controller monitors the BlackBerry Enterprise Server components and restarts
services.......................................................................................................................................................................................... 151
Change how the BlackBerry Controller restarts the BlackBerry Messaging Agent...................................................... 151
Change how the BlackBerry Controller restarts the BlackBerry Enterprise Server services....................................... 154
Monitoring the BlackBerry MDS Integration Service notification messages..................................................................... 156
Set up monitoring of the BlackBerry MDS Integration Service notification messages for a BlackBerry device...... 156

Monitor the BlackBerry MDS Integration Service notification messages for a BlackBerry device............................ 157
Filter the BlackBerry MDS Integration Service notification messages by date and time............................................ 157
Block notification messages from a web services host...................................................................................................... 157
Remove all notification messages for the BlackBerry MDS Integration Service........................................................... 158
Monitoring PIN messages, SMS text messages, and calls.................................................................................................... 158
Change the default location for the PIN message, SMS text message, and phone log files....................................... 158
Monitor PIN messages........................................................................................................................................................... 158
Monitor SMS text messages.................................................................................................................................................. 159
Turn off call logging................................................................................................................................................................ 160
Log files for the BlackBerry Enterprise Server components.................................................................................................. 160
Changing where the BlackBerry Enterprise Server components write log files................................................................ 160
Change the location where the BlackBerry Enterprise Server components write log files......................................... 160
Store all of the BlackBerry Enterprise Server component log files in one folder.......................................................... 161
Changing how the BlackBerry Enterprise Server components create log files................................................................. 161
Add a prefix to the file names of all the BlackBerry Enterprise Server component log files....................................... 161
Configure the maximum size for a BlackBerry Enterprise Server component log file.................................................. 161
Change the logging level for a BlackBerry Enterprise Server component..................................................................... 162
Create a new BlackBerry Enterprise Server component log file when the current log file reaches the maximum
size............................................................................................................................................................................................. 162
Change the identifier for a BlackBerry Enterprise Server component log file.............................................................. 163
Prevent a BlackBerry Enterprise Server component from creating a daily log file....................................................... 163
Configure when to delete BlackBerry Enterprise Server component log files............................................................... 163
Changing how the BlackBerry MDS Connection Service creates a log file....................................................................... 164
Change the logging level for the BlackBerry MDS Connection Service......................................................................... 164
Change the location where the BlackBerry MDS Connection Service writes log files................................................. 164
Change the interval at which the BlackBerry MDS Connection Service writes information to the log file.............. 165
Change the logging level for the UDP log file.................................................................................................................... 165
Change the port number that the BlackBerry MDS Connection Service connects to when sending UDP log file
messages.................................................................................................................................................................................. 165
Change the logging level for the TCP log file..................................................................................................................... 166
Change the port number that the BlackBerry MDS Connection Service connects to when sending TCP log file
messages.................................................................................................................................................................................. 166
Change the logging level for the Event log file.................................................................................................................. 166
Change which BlackBerry MDS Connection Service activities are written to the log file............................................... 166
Change which BlackBerry Collaboration Service activities are written to the log file..................................................... 168

21 Managing a BlackBerry Domain...................................................................................................................................... 169
Managing multiple BlackBerry Domain instances................................................................................................................. 169
Connect the BlackBerry Manager to a different BlackBerry Domain............................................................................. 169
Managing CAL keys..................................................................................................................................................................... 169
Add or delete a CAL key......................................................................................................................................................... 169
Copy a license key to a text file............................................................................................................................................. 170
22 Glossary................................................................................................................................................................................ 171
23 Legal notice.......................................................................................................................................................................... 175

Creating administrator accounts 1
Administrative roles
The BlackBerry® Enterprise Server uses predefined roles, which correspond to common administrative roles in organizations,
to control who can perform specific tasks and limit who can access sensitive data in your organization.
YouassigneachBlackBerryEnterpriseServeradministrator toanadministrativerole.If youalreadymanageyourorganization
using Windows® groups, assign those groups to the administrative roles so that you can manage role membership through
the group.
When an administrator starts the BlackBerry Manager, the BlackBerry Manager checks the authentication credentials,
determines the administrative role, and displays a list of the tasks that the administrator can perform.
Role Description
security administrator (rim_db_admin_security) These administrators can perform all tasks. They are the
only administrators who can manage role membership and
change sensitive security properties, such as licenses and
encryption keys.
The administrator account that you created during the
installation process is assigned the security administrator
role automatically.
If you are using an IBM® DB2® UDB database, this role is
not required.
enterprise administrator (rim_db_admin_enterprise) These administrators can perform all tasks that relate to
user accounts, services, instances of the BlackBerry
Enterprise Server, and global application data.
These administrators cannot view role membership,
licenses, or encryption keys.
device administrator (rim_db_admin_handheld) These administrators can perform all tasks that relate to
user accounts and BlackBerry device management,
including:
• supporting new user accounts
• implementing BlackBerry devices
Administration Guide Creating administrator accounts
13

Role Description
• managing software configurations
•managing the installation and behavior of third-party
applications on BlackBerry devices
senior help desk administrator
(rim_db_admin_sr_helpdesk)
These administrators can perform all tasks that relate to
user account management, including:
• adding, moving, and deleting user accounts
•updating and sending IT policies to BlackBerry devices
• sending IT administration commands to BlackBerry
devices
junior help desk administrator
(rim_db_admin_jr_helpdesk)
These administrators can perform tasks that relate to user
account management, including:
• creating and sending passwords for activating
BlackBerry devices over the wireless network
• resending service books or IT policies
These administrators cannot add, move, or delete user
accounts or send certain IT administration commands.
auditor (rim_db_admin_audit_<role>)These administrators can view all tasks and properties that
relate to the role, but they cannot perform the tasks or
change the properties. Use this view-only role when
training new administrators.
Creating a BlackBerry Enterprise Server administrator in a Microsoft SQL Server
environment
BlackBerry® Enterprise Server administrators are database users who can access the BlackBerry Configuration Database
using the BlackBerry Manager. This access is restricted to the administrative roles that the BlackBerry Enterprise Server
administrators are assigned to.
Only administrators who are assigned to the security administrator role can create other BlackBerry Enterprise Server
administrators accounts. When creating administrator accounts, perform one of the following tasks:
• assign an administrative role to an existing database account
• create a new database account and assign it an administrative role
Administration Guide Creating a BlackBerry Enterprise Server administrator in a Microsoft SQL Server environment
14

Assign an administrative role to a new or existing Microsoft SQL Server database account
Note: Donotassign an administrative role using theMicrosoft®SQLServer®consolesorassignmore than one administrative
role to an administrator. The BlackBerry® Configuration Database uses the most restrictive settings to determine which
tasks the BlackBerry Manager displays, so an administrator who is assigned both enterprise and junior help desk roles sees
only the tasks for the junior help desk role.
Before you begin:
• Verify that you have the system administrator role on the database server.
• If you are creating a new database account and want to use Windows® authentication, verify that the Windows user
account or group already exists.
1. In the BlackBerry Manager, in the left pane, click BlackBerry Domain.
2. On the Role Administration tab, click a role.
3. Complete one of the following actions:
• To add an administrative role to an existing Microsoft SQL Server database account, click List Administrators.
• To create a new Microsoft SQL Server database account and assign it to an administrative role, click Add
Administrators.
4. Complete one of the following actions:
•To add an administrative role to an existing administrator account, click the administrator account that you want to
add the role to.
• To create a database account only and add an administrative role to the account, type a user name.
• To create a database account for an existing Windows user account or group and add an administrative role to the
account, type a user name preceded by a domain name (for example, DOMAIN\username).
5. If prompted, type and confirm a password.
6. Click OK.
Creating a BlackBerry Enterprise Server administrator in an IBM DB2 UDB
environment
BlackBerry® Enterprise Server administrators are Windows® users who are assigned to Windows groups that correspond to
the administrative roles on the BlackBerry Enterprise Server. With a Windows account, administrators can access the
BlackBerry Configuration Database by using the BlackBerry Manager. The access to the BlackBerry Configuration Database
is restricted to the administrative roles that the BlackBerry Enterprise Server administrators are assigned to.
Administration Guide Creating a BlackBerry Enterprise Server administrator in an IBM DB2 UDB environment
15

Create a BlackBerry Enterprise Server administrator in an IBM DB2 UDB environment
Note: Do not assign more than one administrative role to an administrator. The BlackBerry® Configuration Database uses
the most restrictive settings to determine which tasks the BlackBerry Manager displays, so an administrator who is assigned
both enterprise and junior help desk roles sees only the tasks for the junior help desk role.
1. On the database server, open the Windows® Computer Management console.
2. Assign Windows users or groups to one of the following Windows groups:
• rim_db_admin_audit_enterprise
• rim_db_admin_audit_handheld
• rim_db_admin_audit_jr_helpdesk
• rim_db_admin_audit_sr_helpdesk
• rim_db_admin_enterprise
• rim_db_admin_handheld
• rim_db_admin_jr_helpdesk
• rim_db_admin_sr_helpdesk
Configure the BlackBerry Manager to use database authentication in a Microsoft
SQL Server environment
During the installation process, if you choose to connect to the BlackBerry® Configuration Database using Windows®
authentication, the BlackBerry Manager uses Windows authentication automatically. If you create database accounts for
your administrators, you must change the type of authentication that the BlackBerry Manager uses.
1. In the BlackBerry Manager, on the Tools menu, click Options.
2. Click Database.
3. In the Authentication drop-down list, click Database Authentication.
4. Click OK.
5. Restart the BlackBerry Manager.
Specify the administration email address
Specify the address that the BlackBerry® Manager sends system messages or enterprise activation passwords from.
1. Create an email account on your messaging server.
2. In the BlackBerry Manager, in the left pane, click BlackBerry Domain.
3. On the Global tab, click Edit Properties.
4. In the Administration section, double-click Email Sender Address.
5. Type the email address that you want the BlackBerry Manager to send messages from.
6. Click OK.
Administration Guide Configure the BlackBerry Manager to use database authentication in a Microsoft SQL Server environment
16

Setting up security options 2
How the BlackBerry Enterprise Solution encrypts data on the transport layer
The BlackBerry® Enterprise Solution uses a symmetric key encryption algorithm (Triple DES or AES) to protect all data that
the BlackBerry® Enterprise Server and a BlackBerry device send between them.
The BlackBerry Enterprise Solution uses the symmetric key encryption algorithm to create message keys and master
encryption keys, and uses those encryption keys to encrypt all data that the BlackBerry device sends or receives, while the
data travels between the BlackBerry device and the BlackBerry Enterprise Server.
Thisdataencryptionprocessoccursautomaticallyandisdesigned to verify that a message that a user sends froma BlackBerry
device, which is outside the organization's firewall, remains protected on the transport layer until the BlackBerry Enterprise
Server receives the message.
Standard encryption algorithms that the BlackBerry Enterprise Solution uses
Encryption type Description
Triple DES • default encryption method
• uses the Triple DES algorithm to encrypt and decrypt all data that the
BlackBerry® Enterprise Server and all BlackBerry devices on the BlackBerry
Enterprise Server send between them
AES •uses the AES algorithm to encrypt and decrypt all data that the BlackBerry
Enterprise Server and all BlackBerry devices on the BlackBerry Enterprise
Server send between them
•designed to use a longer encryption key to provide a better combination of
security and performance than Triple DES
•designed to protect user data and encryption keys from traditional attacks
and side-channel attacks
•requiresBlackBerry®DesktopSoftware version4.0orlaterandBlackBerry®
Device Software version 4.0 or later
Triple DES and AES •permits use of either the Triple DES algorithm or AES algorithm to encrypt
anddecrypt alldatathatthe BlackBerryEnterpriseServerandall BlackBerry
devices on the BlackBerry Enterprise Server send between them
Administration Guide Setting up security options
17

Encryption type Description
• uses Triple DES encryption on BlackBerry devices that do not support AES
(BlackBerry devices that are running BlackBerry Device Software versions
earlier than version 4.0)
• by default, uses AES encryption on BlackBerry devices that support AES
Change the encryption type
1. In the BlackBerry® Manager, in the left pane, click a BlackBerry® Enterprise Server.
2. On the Server Configuration tab, click Edit Properties.
3. Click General.
4. In the Security section, click Encryption Algorithm.
5. In the drop-down list, select an encryption type.
6. Click OK.
After you finish: If you changed the encryption type, you must reactivate all of the BlackBerry devices in the BlackBerry
Domain so that users can send and receive messages on their BlackBerry devices.
Related topics
Assigning BlackBerry devices to user accounts, 78
Options for extending messaging security
When a user sends a message from the BlackBerry® device, by default, the BlackBerry® Enterprise Server does not encrypt
the message when it forwards the message to the message recipient. To extend the messaging security that standard
BlackBerry encryption provides, the user must install additional secure messaging technology on the BlackBerry device, and
you must set the BlackBerry device to use that secure messaging technology.
To offer an additional layer of messaging security between the sender and recipient of an email message or PIN message,
you can turn on S/MIME technology or PGP® technology for BlackBerry devices. When you use either one of these
technologies, you allow sender-to-recipient authentication and confidentiality. These technologies also help to maintain
the integrity and privacy of the data from the time that a BlackBerry device user sends a message from the BlackBerry device
to when the message recipient decrypts and opens the message.
Protection of data using the PGP Support Package for BlackBerry devices
BlackBerry® devices that are running the PGP® Support Package for BlackBerry® devices can digitally sign, encrypt, or sign
and encrypt data that they send to the BlackBerry® Enterprise Server.
Administration Guide Options for extending messaging security
18