Blackbe;rry PRD-10459-016 - Enterprise Server For MS... Instruction Manual

BlackBerry Enterprise Server for
Microsoft Exchange
Version: 5.0 | Service Pack: 3
Administration Guide

Published: 2011-09-16
SWDT487521-1597421-0916011607-001

Contents
1 Overview: BlackBerry Enterprise Server........................................................................................................... 21
Document revision history................................................................................................................................ 21
Getting started in your BlackBerry Enterprise Server environment................................................................. 22
2 Log in to the BlackBerry Administration Service for the first time................................................................... 25
There is a problem with this website's security certificate............................................................................... 25
This connection is untrusted............................................................................................................................. 26
3 Creating administrator accounts...................................................................................................................... 27
Administrative roles and permissions............................................................................................................... 27
Preconfigured administrative roles........................................................................................................... 27
Creating roles.................................................................................................................................................... 31
Create a role.............................................................................................................................................. 31
Create a role based on an existing role..................................................................................................... 32
Create an administrator account...................................................................................................................... 32
Add an administrator account to a group......................................................................................................... 33
Specify an email address for the BlackBerry Administration Service............................................................... 33
Permit an administrator to log in to the BlackBerry Administration Service using a messaging server
account............................................................................................................................................................. 34
Assign a BlackBerry device to an administrator account.................................................................................. 34
4 Using an IT policy to manage BlackBerry Enterprise Solution security............................................................. 35
Using IT policy rules to manage BlackBerry Enterprise Solution security......................................................... 35
Preconfigured IT policies................................................................................................................................... 36
Default values for preconfigured IT policies.............................................................................................. 37
Creating and importing IT policies.................................................................................................................... 40
Create an IT policy..................................................................................................................................... 40
Create an IT policy based on an existing IT policy..................................................................................... 40
Import IT policy data.................................................................................................................................. 40
Import IT policy rules from an IT policy pack............................................................................................. 41
Change the value for an IT policy rule.............................................................................................................. 41
Assign an IT policy to a group........................................................................................................................... 41
Assign an IT policy to a user account................................................................................................................ 42
Sending an IT policy over the wireless network............................................................................................... 42
Resend an IT policy to a BlackBerry device manually................................................................................ 42
Resend an IT policy to a BlackBerry device automatically......................................................................... 43
Assigning IT policies and resolving IT policy conflicts....................................................................................... 43
Option 1: Applying one IT policy to each user account............................................................................. 44

Option 2: Applying multiple IT policies to each user account................................................................... 45
View the resolved IT policy rules that are assigned to a user account...................................................... 48
Deactivating BlackBerry devices that do not have IT policies applied.............................................................. 48
Deactivate BlackBerry devices that do not have IT policies applied.......................................................... 48
Creating new IT policy rules to control third-party applications...................................................................... 49
Create an IT policy rule for a third-party application................................................................................ 49
Change or delete IT policy rules for third-party applications.................................................................... 49
Export all IT policy data to a data file................................................................................................................ 50
Delete an IT policy............................................................................................................................................ 50
5 Configuring security options............................................................................................................................. 51
Encrypting data that the BlackBerry Enterprise Server and a BlackBerry device send to each other.............. 51
Algorithms that the BlackBerry Enterprise Solution uses to encrypt data................................................ 51
Change the symmetric key encryption algorithm that the BlackBerry Enterprise Solution uses.............. 51
Managing device access to the BlackBerry Enterprise Server.......................................................................... 52
Turn on the Enterprise Service Policy........................................................................................................ 52
Configure the Enterprise Service Policy..................................................................................................... 53
Permit a user to override the Enterprise Service Policy............................................................................ 53
Extending messaging security to a BlackBerry device...................................................................................... 53
Extending messaging security using PGP encryption................................................................................ 54
Extending messaging security using S/MIME encryption.......................................................................... 54
Enforcing secure messaging using classifications............................................................................................. 57
Create a message classification................................................................................................................. 57
Create a message classification based on an existing message classification........................................... 58
Order message classifications.................................................................................................................... 58
Delete a message classification................................................................................................................. 58
Generating organization-specific encryption keys for PIN-message encryption.............................................. 59
Generate a PIN encryption key.................................................................................................................. 59
Turn off BlackBerry services that the BlackBerry MDS Connection Service, BlackBerry Collaboration
Service, and BlackBerry MVS provide............................................................................................................... 59
When a BlackBerry device overwrites data in the BlackBerry device memory................................................ 60
Changing when a BlackBerry device cleans the BlackBerry device memory............................................. 60
Best practice: Configuring additional memory cleaner settings for BlackBerry devices........................... 61
6 Configuring the BlackBerry Enterprise Server environment............................................................................. 62
Best practice: Running the BlackBerry Enterprise Server................................................................................. 62
Configuring certain BlackBerry Enterprise Server components to use proxy servers...................................... 62
Configure a BlackBerry Enterprise Server component to use a .pac file................................................... 63
Configure a BlackBerry Enterprise Server component to use a proxy server............................................ 63

Configure a BlackBerry Enterprise Server component to authenticate to a proxy server on behalf of
BlackBerry devices..................................................................................................................................... 64
Configuring the BlackBerry Administration Service to use a proxy server....................................................... 65
Configuring proxy selection for the BlackBerry Administration Service.................................................... 65
Configuring the BlackBerry Administration Service to authenticate with a proxy server......................... 67
Configuring multiple BlackBerry Enterprise Server instances to use the same BlackBerry Enterprise Server
component....................................................................................................................................................... 69
Configure multiple BlackBerry Enterprise Server instances to use the same BlackBerry MDS
Connection Service.................................................................................................................................... 69
Configure multiple BlackBerry Enterprise Server instances to use the same BlackBerry Collaboration
Service....................................................................................................................................................... 69
Configuring support for Unicode languages..................................................................................................... 70
Configure support for Unicode languages................................................................................................. 70
Change the character encoding that the BlackBerry Enterprise Server uses to send Unicode messages. 71
Configure support for Unicode text in calendars on BlackBerry devices in a Microsoft Exchange
environment.............................................................................................................................................. 72
7 Configuring user accounts................................................................................................................................ 73
Creating user groups......................................................................................................................................... 73
Create a group to manage similar user accounts...................................................................................... 73
Add user accounts to a group.................................................................................................................... 73
Adding a user account to the BlackBerry Enterprise Server............................................................................. 74
Add a user account.................................................................................................................................... 74
Create a user account that is not in the contact list in the BlackBerry Configuration Database............... 75
Export a list of user accounts..................................................................................................................... 75
Importing a list of user accounts to a BlackBerry Enterprise Server......................................................... 76
8 Assigning BlackBerry devices to users.............................................................................................................. 79
Preparing to distribute a BlackBerry device...................................................................................................... 79
Change how the BlackBerry Enterprise Server downloads a user's existing email messages onto the
BlackBerry device...................................................................................................................................... 79
Prevent the BlackBerry Enterprise Server from synchronizing existing email messages onto a
BlackBerry device...................................................................................................................................... 79
Assigning BlackBerry devices to user accounts................................................................................................. 80
Option 1: Activate a BlackBerry device using the BlackBerry Administration Service............................... 80
Option 2: Activating a BlackBerry device over the wireless network........................................................ 81
Option 3: Activating BlackBerry devices over the LAN.............................................................................. 84
Option 4: Activating BlackBerry devices using the BlackBerry Web Desktop Manager............................ 84
Option 5: Activating BlackBerry devices over an enterprise Wi-Fi network.............................................. 85

9 Configuring BlackBerry Enterprise Server high availability............................................................................... 88
Check the health of a BlackBerry Enterprise Server......................................................................................... 88
Availability state and failover status of the BlackBerry Enterprise Server................................................ 88
How the BlackBerry Enterprise Server uses health parameters....................................................................... 88
Defining when failover occurs................................................................................................................... 89
Changing the promotion threshold and failover threshold.............................................................................. 91
Change the promotion threshold and failover threshold and the order of the health parameters.......... 91
Changing when automatic failover occurs by customizing the health parameters for user accounts
and messaging servers............................................................................................................................... 93
Prerequisites: Configuring the BlackBerry Enterprise Server pair to fail over automatically........................... 94
Configure the BlackBerry Enterprise Server to fail over automatically............................................................ 94
Monitoring the BlackBerry Enterprise Server for an automatic failover event................................................ 95
Use the BlackBerry Administration Service to find the time and reason for the last automatic failover
event.......................................................................................................................................................... 95
Fail over the BlackBerry Enterprise Server manually using the BlackBerry Administration Service................. 95
Fail over the BlackBerry Enterprise Server manually using the BlackBerry Configuration Panel..................... 96
10 Configuring high availability for BlackBerry Enterprise Server components.................................................... 97
Creating a BlackBerry MDS Connection Service pool for high availability........................................................ 97
Create a BlackBerry MDS Connection Service pool for high availability.................................................... 97
Configure the BlackBerry MDS Connection Service and BlackBerry Collaboration Service to fail over
automatically.................................................................................................................................................... 98
Create a BlackBerry Collaboration Service pool for high availability................................................................ 98
Create a BlackBerry Attachment Service pool for high availability................................................................... 99
You cannot determine the BlackBerry Attachment Connector that the BlackBerry Enterprise Server or
the BlackBerry MDS Connection Service uses........................................................................................... 100
Create a BlackBerry Router pool for high availability....................................................................................... 101
Permit a BlackBerry Enterprise Server to connect to a remote BlackBerry Router................................... 102
Creating a BlackBerry Administration Service pool using DNS round robin that includes the BlackBerry
Web Desktop Manager..................................................................................................................................... 102
Configure the BlackBerry Administration Service instances in a pool to communicate across network
subnets...................................................................................................................................................... 103
Changing the name of the BlackBerry Administration Service pool................................................................. 103
Change the name of the BlackBerry Administration Service pool............................................................. 104
Fail over the BlackBerry MDS Connection Service or BlackBerry Collaboration Service manually................... 104
Monitoring the high availability status or job deployment status using the BlackBerry Administration
Service............................................................................................................................................................... 105

Monitor the high availability status or job deployment status using the BlackBerry Administration
Service....................................................................................................................................................... 105
Remove a BlackBerry MDS Connection Service instance from a pool.............................................................. 106
Remove a BlackBerry Collaboration Service instance from a pool................................................................... 106
Remove a BlackBerry Attachment Service instance from a pool...................................................................... 107
Remove a BlackBerry Router instance from a pool.......................................................................................... 107
11 Configuring BlackBerry Configuration Database high availability..................................................................... 108
Prerequisites: Configuring database mirroring or database replication of the BlackBerry Configuration
Database........................................................................................................................................................... 108
Configuring database mirroring........................................................................................................................ 109
Stop the BlackBerry Enterprise Server instances....................................................................................... 109
Configure database mirroring for the BlackBerry Configuration Database............................................... 109
Start the BlackBerry Enterprise Server instances...................................................................................... 110
Configure the BlackBerry Enterprise Solution to support database mirroring.......................................... 110
Resend the database mirroring parameters to BlackBerry Enterprise Server components...................... 111
Configuring the BlackBerry Configuration Database for one-way transactional replication in an
environment that includes Microsoft SQL Server 2005 or 2008....................................................................... 112
Stop the BlackBerry Enterprise Server instances....................................................................................... 112
Create the replicated BlackBerry Configuration Database from a backup................................................ 112
Permit access to the BlackBerry Configuration Database instances......................................................... 113
Configure the publication for the BlackBerry Configuration Database..................................................... 113
Increase the maximum data size for transactional replication................................................................. 114
Prepare the database server that hosts the replicated BlackBerry Configuration Database and
configure the subscription......................................................................................................................... 114
Start the BlackBerry Enterprise Server instances...................................................................................... 115
Reacting if the BlackBerry Configuration Database that you configured for transactional replication stops
responding........................................................................................................................................................ 115
Return to the BlackBerry Configuration Database when you configured transactional replication................. 116
Configuring a new mirror BlackBerry Configuration Database......................................................................... 116
12 Sending software and BlackBerry Java Applications to BlackBerry devices...................................................... 117
Managing BlackBerry Java Applications and BlackBerry Device Software........................................................ 117
Developing BlackBerry Java Applications for BlackBerry devices..................................................................... 118
Preparing to distribute BlackBerry Java Applications....................................................................................... 118
Specify a shared network folder for BlackBerry Java Applications............................................................ 119
Add a BlackBerry Java Application to the application repository.............................................................. 119
Add a collaboration client to the application repository........................................................................... 120
Specify keywords for a BlackBerry Java Application.................................................................................. 120

Configuring application control policies........................................................................................................... 120
Standard application control policies........................................................................................................ 121
Change a standard application control policy........................................................................................... 121
Create custom application control policies for a BlackBerry Java Application.......................................... 122
IT policy rules take precedence on the device........................................................................................... 123
Application control policies for unlisted applications....................................................................................... 123
Change the standard application control policy for unlisted applications that are optional.................... 124
Create an application control policy for unlisted applications.................................................................. 124
Configure the priority of application control policies for unlisted applications........................................ 125
Creating software configurations..................................................................................................................... 125
Create a software configuration................................................................................................................ 126
Add a BlackBerry Java Application to a software configuration................................................................ 126
Assign a software configuration to a group............................................................................................... 127
Assign a software configuration to multiple user accounts...................................................................... 127
Assign a software configuration to a user account................................................................................... 128
Install BlackBerry Java Applications on a BlackBerry device at a central computer......................................... 128
View the status of a job.................................................................................................................................... 129
View the status of a task............................................................................................................................ 129
Stopping a job that is running........................................................................................................................... 137
Stop a job that is running.......................................................................................................................... 138
View the users that have a BlackBerry Java Application installed on their BlackBerry devices........................ 138
View how the BlackBerry Administration Service resolved software configuration conflicts for a user
account............................................................................................................................................................. 139
Reconciliation rules for conflicting settings in software configurations........................................................... 139
Reconciliation rules: BlackBerry Java Applications.................................................................................... 140
Reconciliation rules: BlackBerry Device Software..................................................................................... 143
Reconciliation rules: Standard application settings................................................................................... 143
Reconciliation rules: Application control policies...................................................................................... 144
Reconciliation rules: Application control policies for unlisted applications.............................................. 145
13 Alternative methods for installing BlackBerry Java Applications on BlackBerry devices.................................. 146
Installing BlackBerry Java Applications on BlackBerry devices without using the BlackBerry Administration
Service............................................................................................................................................................... 146
Developing BlackBerry Java Applications for BlackBerry devices..................................................................... 146
Methods you can use to install BlackBerry Java Applications on BlackBerry devices....................................... 146
Installing BlackBerry Java Applications using the BlackBerry Desktop Software.............................................. 147
Prerequisites: Installing BlackBerry Java Applications using the BlackBerry Desktop Software................ 148
Make the BlackBerry Java Application available to the BlackBerry Desktop Software............................. 148
Install the BlackBerry Java Application using the BlackBerry Desktop Software....................................... 149

Installing BlackBerry Java Applications using the BlackBerry Application Web Loader.................................... 149
Prerequisites: Installing BlackBerry Java Applications using the BlackBerry Application Web Loader...... 149
Enable the BlackBerry Application Web Loader on a web server.............................................................. 150
Install the BlackBerry Java Application using the BlackBerry Application Web Loader............................. 151
Installing BlackBerry Java Applications using the standalone application loader tool..................................... 151
Prerequisites: Installing BlackBerry Java Applications using the standalone application loader tool....... 152
Add BlackBerry Java Application files to a shared network folder............................................................ 152
Share the Research In Motion folder that contains the BlackBerry Java Application............................... 153
Configure the standalone application loader tool to install the BlackBerry Java Application in
automated mode....................................................................................................................................... 153
Install the BlackBerry Java Application using the standalone application loader tool.............................. 153
Installing BlackBerry Java Applications using a web browser on BlackBerry devices....................................... 154
Prerequisites: Installing BlackBerry Java Applications using a web browser on BlackBerry devices......... 154
Install the BlackBerry Java Application on a web server........................................................................... 155
Install the BlackBerry Java Application using a web browser on the BlackBerry device........................... 155
14 Configuring how users access enterprise applications and web content......................................................... 156
Specifying a BlackBerry MDS Connection Service as a central push server...................................................... 156
Specify a BlackBerry MDS Connection Service as a central push server................................................... 156
Configuring how BlackBerry devices authenticate to content servers............................................................. 157
Configure how BlackBerry devices authenticate to content servers......................................................... 157
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content
servers that use NTLM............................................................................................................................... 157
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content
servers that use Kerberos.......................................................................................................................... 158
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content
servers that use LTPA................................................................................................................................ 158
Configuring the BlackBerry MDS Connection Service to authenticate devices to the RSA
Authentication Manager........................................................................................................................... 159
Configuring how the BlackBerry MDS Connection Service manages requests for web content...................... 160
Configure the BlackBerry MDS Connection Service to manage HTTP cookie storage............................... 161
Configure the timeout limit for HTTP connections with BlackBerry devices............................................. 161
Configure the timeout limit for HTTP connections with web servers....................................................... 161
Configure the maximum number of times that the BlackBerry Browser accepts HTTP redirections........ 162
Permitting push applications to make trusted connections to a BlackBerry MDS Connection Service............ 162
Create a key store to store certificates for use with HTTPS connections.................................................. 162
Add a certificate for the BlackBerry MDS Connection Service.................................................................. 163
Export the BlackBerry MDS Connection Service certificate to make it available to push applications..... 163
Import the BlackBerry MDS Connection Service certificate to the key store of a push application......... 164

Permit push applications to select the transport protocol for PAP requests................................................... 164
Configuring a BlackBerry MDS Connection Service to trust web servers......................................................... 165
Specify whether the BlackBerry MDS Connection Service requires trusted HTTPS connections from
web servers................................................................................................................................................ 165
Specify whether the BlackBerry MDS Connection Service requires trusted TLS connections from web
servers....................................................................................................................................................... 165
Configuring certificate server information for the BlackBerry MDS Connection Service.......................... 166
Add a retrieved certificate for a web server to the key store................................................................... 172
Permitting users to access intranet sites on BlackBerry devices using global login information..................... 172
Configure global login information for intranet site access...................................................................... 173
Configuring how the BlackBerry MDS Connection Service connects to BlackBerry devices............................. 173
Specify the maximum amount of data that a BlackBerry MDS Connection Service can send to
BlackBerry devices..................................................................................................................................... 173
Specify the pending content timeout limit for a BlackBerry MDS Connection Service............................. 173
Permit Java applications to use scalable socket connections with a BlackBerry MDS Connection
Service....................................................................................................................................................... 174
Specify the thread pool size of a BlackBerry MDS Connection Service..................................................... 174
Specify the maximum number of scalable socket connections................................................................. 174
Prevent the BlackBerry MDS Connection Service from using scalable HTTP............................................. 175
Specify the port number that the web server listens on for push application requests........................... 175
Specify how often a BlackBerry MDS Connection Service polls for configuration information................ 176
15 Setting up the messaging environment............................................................................................................ 177
Creating email message filters.......................................................................................................................... 177
Create an email message filter that applies to all user accounts on a BlackBerry Enterprise Server........ 177
Turn on an email message filter that applies to all user accounts on a BlackBerry Enterprise Server...... 178
Create an email message filter that applies to a specific user account..................................................... 178
Turn on an email message filter that applies to a specific user account................................................... 179
Copying existing email message filters to another BlackBerry Enterprise Server............................................ 179
Export email message filters for a BlackBerry Enterprise Server............................................................... 179
Import email message filters for a BlackBerry Enterprise Server.............................................................. 179
Copying existing email message filters to user accounts.................................................................................. 180
Export email message filters for a user account........................................................................................ 180
Import email message filters for a user account....................................................................................... 180
Extension plug-ins for processing messages..................................................................................................... 181
Install an extension plug-in application..................................................................................................... 181
Add an extension plug-in to a BlackBerry Messaging Agent..................................................................... 182
Change how a BlackBerry Messaging Agent uses extension plug-ins........................................................ 182
Mapping contact information fields for synchronization and contact lookups................................................ 183