Blackbe;rry PRD-10459-016 - Enterprise Server For MS... Instruction Manual

BlackBerry Enterprise Server for
Microsoft Exchange
Version: 5.0 | Service Pack: 3
Administration Guide

Published: 2011-09-16
SWDT487521-1597421-0916011607-001

Contents
1 Overview: BlackBerry Enterprise Server........................................................................................................... 21
Document revision history................................................................................................................................ 21
Getting started in your BlackBerry Enterprise Server environment................................................................. 22
2 Log in to the BlackBerry Administration Service for the first time................................................................... 25
There is a problem with this website's security certificate............................................................................... 25
This connection is untrusted............................................................................................................................. 26
3 Creating administrator accounts...................................................................................................................... 27
Administrative roles and permissions............................................................................................................... 27
Preconfigured administrative roles........................................................................................................... 27
Creating roles.................................................................................................................................................... 31
Create a role.............................................................................................................................................. 31
Create a role based on an existing role..................................................................................................... 32
Create an administrator account...................................................................................................................... 32
Add an administrator account to a group......................................................................................................... 33
Specify an email address for the BlackBerry Administration Service............................................................... 33
Permit an administrator to log in to the BlackBerry Administration Service using a messaging server
account............................................................................................................................................................. 34
Assign a BlackBerry device to an administrator account.................................................................................. 34
4 Using an IT policy to manage BlackBerry Enterprise Solution security............................................................. 35
Using IT policy rules to manage BlackBerry Enterprise Solution security......................................................... 35
Preconfigured IT policies................................................................................................................................... 36
Default values for preconfigured IT policies.............................................................................................. 37
Creating and importing IT policies.................................................................................................................... 40
Create an IT policy..................................................................................................................................... 40
Create an IT policy based on an existing IT policy..................................................................................... 40
Import IT policy data.................................................................................................................................. 40
Import IT policy rules from an IT policy pack............................................................................................. 41
Change the value for an IT policy rule.............................................................................................................. 41
Assign an IT policy to a group........................................................................................................................... 41
Assign an IT policy to a user account................................................................................................................ 42
Sending an IT policy over the wireless network............................................................................................... 42
Resend an IT policy to a BlackBerry device manually................................................................................ 42
Resend an IT policy to a BlackBerry device automatically......................................................................... 43
Assigning IT policies and resolving IT policy conflicts....................................................................................... 43
Option 1: Applying one IT policy to each user account............................................................................. 44

Option 2: Applying multiple IT policies to each user account................................................................... 45
View the resolved IT policy rules that are assigned to a user account...................................................... 48
Deactivating BlackBerry devices that do not have IT policies applied.............................................................. 48
Deactivate BlackBerry devices that do not have IT policies applied.......................................................... 48
Creating new IT policy rules to control third-party applications...................................................................... 49
Create an IT policy rule for a third-party application................................................................................ 49
Change or delete IT policy rules for third-party applications.................................................................... 49
Export all IT policy data to a data file................................................................................................................ 50
Delete an IT policy............................................................................................................................................ 50
5 Configuring security options............................................................................................................................. 51
Encrypting data that the BlackBerry Enterprise Server and a BlackBerry device send to each other.............. 51
Algorithms that the BlackBerry Enterprise Solution uses to encrypt data................................................ 51
Change the symmetric key encryption algorithm that the BlackBerry Enterprise Solution uses.............. 51
Managing device access to the BlackBerry Enterprise Server.......................................................................... 52
Turn on the Enterprise Service Policy........................................................................................................ 52
Configure the Enterprise Service Policy..................................................................................................... 53
Permit a user to override the Enterprise Service Policy............................................................................ 53
Extending messaging security to a BlackBerry device...................................................................................... 53
Extending messaging security using PGP encryption................................................................................ 54
Extending messaging security using S/MIME encryption.......................................................................... 54
Enforcing secure messaging using classifications............................................................................................. 57
Create a message classification................................................................................................................. 57
Create a message classification based on an existing message classification........................................... 58
Order message classifications.................................................................................................................... 58
Delete a message classification................................................................................................................. 58
Generating organization-specific encryption keys for PIN-message encryption.............................................. 59
Generate a PIN encryption key.................................................................................................................. 59
Turn off BlackBerry services that the BlackBerry MDS Connection Service, BlackBerry Collaboration
Service, and BlackBerry MVS provide............................................................................................................... 59
When a BlackBerry device overwrites data in the BlackBerry device memory................................................ 60
Changing when a BlackBerry device cleans the BlackBerry device memory............................................. 60
Best practice: Configuring additional memory cleaner settings for BlackBerry devices........................... 61
6 Configuring the BlackBerry Enterprise Server environment............................................................................. 62
Best practice: Running the BlackBerry Enterprise Server................................................................................. 62
Configuring certain BlackBerry Enterprise Server components to use proxy servers...................................... 62
Configure a BlackBerry Enterprise Server component to use a .pac file................................................... 63
Configure a BlackBerry Enterprise Server component to use a proxy server............................................ 63

Configure a BlackBerry Enterprise Server component to authenticate to a proxy server on behalf of
BlackBerry devices..................................................................................................................................... 64
Configuring the BlackBerry Administration Service to use a proxy server....................................................... 65
Configuring proxy selection for the BlackBerry Administration Service.................................................... 65
Configuring the BlackBerry Administration Service to authenticate with a proxy server......................... 67
Configuring multiple BlackBerry Enterprise Server instances to use the same BlackBerry Enterprise Server
component....................................................................................................................................................... 69
Configure multiple BlackBerry Enterprise Server instances to use the same BlackBerry MDS
Connection Service.................................................................................................................................... 69
Configure multiple BlackBerry Enterprise Server instances to use the same BlackBerry Collaboration
Service....................................................................................................................................................... 69
Configuring support for Unicode languages..................................................................................................... 70
Configure support for Unicode languages................................................................................................. 70
Change the character encoding that the BlackBerry Enterprise Server uses to send Unicode messages. 71
Configure support for Unicode text in calendars on BlackBerry devices in a Microsoft Exchange
environment.............................................................................................................................................. 72
7 Configuring user accounts................................................................................................................................ 73
Creating user groups......................................................................................................................................... 73
Create a group to manage similar user accounts...................................................................................... 73
Add user accounts to a group.................................................................................................................... 73
Adding a user account to the BlackBerry Enterprise Server............................................................................. 74
Add a user account.................................................................................................................................... 74
Create a user account that is not in the contact list in the BlackBerry Configuration Database............... 75
Export a list of user accounts..................................................................................................................... 75
Importing a list of user accounts to a BlackBerry Enterprise Server......................................................... 76
8 Assigning BlackBerry devices to users.............................................................................................................. 79
Preparing to distribute a BlackBerry device...................................................................................................... 79
Change how the BlackBerry Enterprise Server downloads a user's existing email messages onto the
BlackBerry device...................................................................................................................................... 79
Prevent the BlackBerry Enterprise Server from synchronizing existing email messages onto a
BlackBerry device...................................................................................................................................... 79
Assigning BlackBerry devices to user accounts................................................................................................. 80
Option 1: Activate a BlackBerry device using the BlackBerry Administration Service............................... 80
Option 2: Activating a BlackBerry device over the wireless network........................................................ 81
Option 3: Activating BlackBerry devices over the LAN.............................................................................. 84
Option 4: Activating BlackBerry devices using the BlackBerry Web Desktop Manager............................ 84
Option 5: Activating BlackBerry devices over an enterprise Wi-Fi network.............................................. 85

9 Configuring BlackBerry Enterprise Server high availability............................................................................... 88
Check the health of a BlackBerry Enterprise Server......................................................................................... 88
Availability state and failover status of the BlackBerry Enterprise Server................................................ 88
How the BlackBerry Enterprise Server uses health parameters....................................................................... 88
Defining when failover occurs................................................................................................................... 89
Changing the promotion threshold and failover threshold.............................................................................. 91
Change the promotion threshold and failover threshold and the order of the health parameters.......... 91
Changing when automatic failover occurs by customizing the health parameters for user accounts
and messaging servers............................................................................................................................... 93
Prerequisites: Configuring the BlackBerry Enterprise Server pair to fail over automatically........................... 94
Configure the BlackBerry Enterprise Server to fail over automatically............................................................ 94
Monitoring the BlackBerry Enterprise Server for an automatic failover event................................................ 95
Use the BlackBerry Administration Service to find the time and reason for the last automatic failover
event.......................................................................................................................................................... 95
Fail over the BlackBerry Enterprise Server manually using the BlackBerry Administration Service................. 95
Fail over the BlackBerry Enterprise Server manually using the BlackBerry Configuration Panel..................... 96
10 Configuring high availability for BlackBerry Enterprise Server components.................................................... 97
Creating a BlackBerry MDS Connection Service pool for high availability........................................................ 97
Create a BlackBerry MDS Connection Service pool for high availability.................................................... 97
Configure the BlackBerry MDS Connection Service and BlackBerry Collaboration Service to fail over
automatically.................................................................................................................................................... 98
Create a BlackBerry Collaboration Service pool for high availability................................................................ 98
Create a BlackBerry Attachment Service pool for high availability................................................................... 99
You cannot determine the BlackBerry Attachment Connector that the BlackBerry Enterprise Server or
the BlackBerry MDS Connection Service uses........................................................................................... 100
Create a BlackBerry Router pool for high availability....................................................................................... 101
Permit a BlackBerry Enterprise Server to connect to a remote BlackBerry Router................................... 102
Creating a BlackBerry Administration Service pool using DNS round robin that includes the BlackBerry
Web Desktop Manager..................................................................................................................................... 102
Configure the BlackBerry Administration Service instances in a pool to communicate across network
subnets...................................................................................................................................................... 103
Changing the name of the BlackBerry Administration Service pool................................................................. 103
Change the name of the BlackBerry Administration Service pool............................................................. 104
Fail over the BlackBerry MDS Connection Service or BlackBerry Collaboration Service manually................... 104
Monitoring the high availability status or job deployment status using the BlackBerry Administration
Service............................................................................................................................................................... 105

Monitor the high availability status or job deployment status using the BlackBerry Administration
Service....................................................................................................................................................... 105
Remove a BlackBerry MDS Connection Service instance from a pool.............................................................. 106
Remove a BlackBerry Collaboration Service instance from a pool................................................................... 106
Remove a BlackBerry Attachment Service instance from a pool...................................................................... 107
Remove a BlackBerry Router instance from a pool.......................................................................................... 107
11 Configuring BlackBerry Configuration Database high availability..................................................................... 108
Prerequisites: Configuring database mirroring or database replication of the BlackBerry Configuration
Database........................................................................................................................................................... 108
Configuring database mirroring........................................................................................................................ 109
Stop the BlackBerry Enterprise Server instances....................................................................................... 109
Configure database mirroring for the BlackBerry Configuration Database............................................... 109
Start the BlackBerry Enterprise Server instances...................................................................................... 110
Configure the BlackBerry Enterprise Solution to support database mirroring.......................................... 110
Resend the database mirroring parameters to BlackBerry Enterprise Server components...................... 111
Configuring the BlackBerry Configuration Database for one-way transactional replication in an
environment that includes Microsoft SQL Server 2005 or 2008....................................................................... 112
Stop the BlackBerry Enterprise Server instances....................................................................................... 112
Create the replicated BlackBerry Configuration Database from a backup................................................ 112
Permit access to the BlackBerry Configuration Database instances......................................................... 113
Configure the publication for the BlackBerry Configuration Database..................................................... 113
Increase the maximum data size for transactional replication................................................................. 114
Prepare the database server that hosts the replicated BlackBerry Configuration Database and
configure the subscription......................................................................................................................... 114
Start the BlackBerry Enterprise Server instances...................................................................................... 115
Reacting if the BlackBerry Configuration Database that you configured for transactional replication stops
responding........................................................................................................................................................ 115
Return to the BlackBerry Configuration Database when you configured transactional replication................. 116
Configuring a new mirror BlackBerry Configuration Database......................................................................... 116
12 Sending software and BlackBerry Java Applications to BlackBerry devices...................................................... 117
Managing BlackBerry Java Applications and BlackBerry Device Software........................................................ 117
Developing BlackBerry Java Applications for BlackBerry devices..................................................................... 118
Preparing to distribute BlackBerry Java Applications....................................................................................... 118
Specify a shared network folder for BlackBerry Java Applications............................................................ 119
Add a BlackBerry Java Application to the application repository.............................................................. 119
Add a collaboration client to the application repository........................................................................... 120
Specify keywords for a BlackBerry Java Application.................................................................................. 120

Configuring application control policies........................................................................................................... 120
Standard application control policies........................................................................................................ 121
Change a standard application control policy........................................................................................... 121
Create custom application control policies for a BlackBerry Java Application.......................................... 122
IT policy rules take precedence on the device........................................................................................... 123
Application control policies for unlisted applications....................................................................................... 123
Change the standard application control policy for unlisted applications that are optional.................... 124
Create an application control policy for unlisted applications.................................................................. 124
Configure the priority of application control policies for unlisted applications........................................ 125
Creating software configurations..................................................................................................................... 125
Create a software configuration................................................................................................................ 126
Add a BlackBerry Java Application to a software configuration................................................................ 126
Assign a software configuration to a group............................................................................................... 127
Assign a software configuration to multiple user accounts...................................................................... 127
Assign a software configuration to a user account................................................................................... 128
Install BlackBerry Java Applications on a BlackBerry device at a central computer......................................... 128
View the status of a job.................................................................................................................................... 129
View the status of a task............................................................................................................................ 129
Stopping a job that is running........................................................................................................................... 137
Stop a job that is running.......................................................................................................................... 138
View the users that have a BlackBerry Java Application installed on their BlackBerry devices........................ 138
View how the BlackBerry Administration Service resolved software configuration conflicts for a user
account............................................................................................................................................................. 139
Reconciliation rules for conflicting settings in software configurations........................................................... 139
Reconciliation rules: BlackBerry Java Applications.................................................................................... 140
Reconciliation rules: BlackBerry Device Software..................................................................................... 143
Reconciliation rules: Standard application settings................................................................................... 143
Reconciliation rules: Application control policies...................................................................................... 144
Reconciliation rules: Application control policies for unlisted applications.............................................. 145
13 Alternative methods for installing BlackBerry Java Applications on BlackBerry devices.................................. 146
Installing BlackBerry Java Applications on BlackBerry devices without using the BlackBerry Administration
Service............................................................................................................................................................... 146
Developing BlackBerry Java Applications for BlackBerry devices..................................................................... 146
Methods you can use to install BlackBerry Java Applications on BlackBerry devices....................................... 146
Installing BlackBerry Java Applications using the BlackBerry Desktop Software.............................................. 147
Prerequisites: Installing BlackBerry Java Applications using the BlackBerry Desktop Software................ 148
Make the BlackBerry Java Application available to the BlackBerry Desktop Software............................. 148
Install the BlackBerry Java Application using the BlackBerry Desktop Software....................................... 149

Installing BlackBerry Java Applications using the BlackBerry Application Web Loader.................................... 149
Prerequisites: Installing BlackBerry Java Applications using the BlackBerry Application Web Loader...... 149
Enable the BlackBerry Application Web Loader on a web server.............................................................. 150
Install the BlackBerry Java Application using the BlackBerry Application Web Loader............................. 151
Installing BlackBerry Java Applications using the standalone application loader tool..................................... 151
Prerequisites: Installing BlackBerry Java Applications using the standalone application loader tool....... 152
Add BlackBerry Java Application files to a shared network folder............................................................ 152
Share the Research In Motion folder that contains the BlackBerry Java Application............................... 153
Configure the standalone application loader tool to install the BlackBerry Java Application in
automated mode....................................................................................................................................... 153
Install the BlackBerry Java Application using the standalone application loader tool.............................. 153
Installing BlackBerry Java Applications using a web browser on BlackBerry devices....................................... 154
Prerequisites: Installing BlackBerry Java Applications using a web browser on BlackBerry devices......... 154
Install the BlackBerry Java Application on a web server........................................................................... 155
Install the BlackBerry Java Application using a web browser on the BlackBerry device........................... 155
14 Configuring how users access enterprise applications and web content......................................................... 156
Specifying a BlackBerry MDS Connection Service as a central push server...................................................... 156
Specify a BlackBerry MDS Connection Service as a central push server................................................... 156
Configuring how BlackBerry devices authenticate to content servers............................................................. 157
Configure how BlackBerry devices authenticate to content servers......................................................... 157
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content
servers that use NTLM............................................................................................................................... 157
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content
servers that use Kerberos.......................................................................................................................... 158
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content
servers that use LTPA................................................................................................................................ 158
Configuring the BlackBerry MDS Connection Service to authenticate devices to the RSA
Authentication Manager........................................................................................................................... 159
Configuring how the BlackBerry MDS Connection Service manages requests for web content...................... 160
Configure the BlackBerry MDS Connection Service to manage HTTP cookie storage............................... 161
Configure the timeout limit for HTTP connections with BlackBerry devices............................................. 161
Configure the timeout limit for HTTP connections with web servers....................................................... 161
Configure the maximum number of times that the BlackBerry Browser accepts HTTP redirections........ 162
Permitting push applications to make trusted connections to a BlackBerry MDS Connection Service............ 162
Create a key store to store certificates for use with HTTPS connections.................................................. 162
Add a certificate for the BlackBerry MDS Connection Service.................................................................. 163
Export the BlackBerry MDS Connection Service certificate to make it available to push applications..... 163
Import the BlackBerry MDS Connection Service certificate to the key store of a push application......... 164

Permit push applications to select the transport protocol for PAP requests................................................... 164
Configuring a BlackBerry MDS Connection Service to trust web servers......................................................... 165
Specify whether the BlackBerry MDS Connection Service requires trusted HTTPS connections from
web servers................................................................................................................................................ 165
Specify whether the BlackBerry MDS Connection Service requires trusted TLS connections from web
servers....................................................................................................................................................... 165
Configuring certificate server information for the BlackBerry MDS Connection Service.......................... 166
Add a retrieved certificate for a web server to the key store................................................................... 172
Permitting users to access intranet sites on BlackBerry devices using global login information..................... 172
Configure global login information for intranet site access...................................................................... 173
Configuring how the BlackBerry MDS Connection Service connects to BlackBerry devices............................. 173
Specify the maximum amount of data that a BlackBerry MDS Connection Service can send to
BlackBerry devices..................................................................................................................................... 173
Specify the pending content timeout limit for a BlackBerry MDS Connection Service............................. 173
Permit Java applications to use scalable socket connections with a BlackBerry MDS Connection
Service....................................................................................................................................................... 174
Specify the thread pool size of a BlackBerry MDS Connection Service..................................................... 174
Specify the maximum number of scalable socket connections................................................................. 174
Prevent the BlackBerry MDS Connection Service from using scalable HTTP............................................. 175
Specify the port number that the web server listens on for push application requests........................... 175
Specify how often a BlackBerry MDS Connection Service polls for configuration information................ 176
15 Setting up the messaging environment............................................................................................................ 177
Creating email message filters.......................................................................................................................... 177
Create an email message filter that applies to all user accounts on a BlackBerry Enterprise Server........ 177
Turn on an email message filter that applies to all user accounts on a BlackBerry Enterprise Server...... 178
Create an email message filter that applies to a specific user account..................................................... 178
Turn on an email message filter that applies to a specific user account................................................... 179
Copying existing email message filters to another BlackBerry Enterprise Server............................................ 179
Export email message filters for a BlackBerry Enterprise Server............................................................... 179
Import email message filters for a BlackBerry Enterprise Server.............................................................. 179
Copying existing email message filters to user accounts.................................................................................. 180
Export email message filters for a user account........................................................................................ 180
Import email message filters for a user account....................................................................................... 180
Extension plug-ins for processing messages..................................................................................................... 181
Install an extension plug-in application..................................................................................................... 181
Add an extension plug-in to a BlackBerry Messaging Agent..................................................................... 182
Change how a BlackBerry Messaging Agent uses extension plug-ins........................................................ 182
Mapping contact information fields for synchronization and contact lookups................................................ 183

Map a contact information field in an email application to contact list fields on BlackBerry devices...... 183
Map a contact list field in an email application to a contact list field on a BlackBerry device.................. 183
Map a contact information field in an email application to contact list fields on BlackBerry devices...... 184
Map a contact list field in an email application to a contact list field on a BlackBerry device.................. 184
16 Configuring BlackBerry devices to enroll certificates over the wireless network............................................. 186
Configure the certificate information using IT policies..................................................................................... 186
Configure the BlackBerry MDS Connection Service to connect to the certificate authority............................ 187
Add communication information to a BlackBerry MDS Connection Service configuration set................. 188
Assign a BlackBerry MDS Connection Service configuration set to a BlackBerry MDS Connection
Service instance......................................................................................................................................... 189
Add certificate information to a Wi-Fi profile................................................................................................... 189
Managing an enrolled certificate...................................................................................................................... 190
Change the polling interval, logging, and pool size for the BlackBerry MDS Connection Service connection
to the certificate authority............................................................................................................................... 190
Properties in the rimpublic.properties file................................................................................................ 191
17 Making the BlackBerry Web Desktop Manager available to users................................................................... 192
Installing the client components of the BlackBerry Web Desktop Manager on users' computers.................. 192
Publish the client files for the BlackBerry Web Desktop Manager in a Windows GPO for Windows XP.......... 192
Publish the client files for the BlackBerry Web Desktop Manager in a Windows GPO for Windows Vista...... 193
Configure the Microsoft ActiveX Installer on Windows Vista.................................................................... 194
Configure users' computers to install the client file for the BlackBerry Web Desktop Manager
automatically.................................................................................................................................................... 194
Make the BlackBerry Web Desktop Manager available to users...................................................................... 196
18 Configuring the BlackBerry Web Desktop Manager......................................................................................... 197
Permit users to activate BlackBerry devices using the BlackBerry Web Desktop Manager............................. 197
Permit users to back up and restore data using the BlackBerry Web Desktop Manager................................. 197
Configure the domains for backing up data using the BlackBerry Web Desktop Manager.............................. 198
Change the text colors in the BlackBerry Web Desktop Manager.................................................................... 198
BlackBerry Web Desktop Manager text colors.......................................................................................... 199
Display a custom image in the BlackBerry Web Desktop Manager.................................................................. 199
Display the domain name on the login page of the BlackBerry Web Desktop Manager.................................. 200
19 Creating and configuring Wi-Fi profiles and VPN profiles................................................................................. 201
Creating and configuring Wi-Fi profiles............................................................................................................ 201
Prerequisites: Creating Wi-Fi profiles and VPN profiles............................................................................ 201
Create a Wi-Fi profile................................................................................................................................. 203
Create a Wi-Fi profile based on an existing Wi-Fi profile.......................................................................... 203

Configure a Wi-Fi profile on a BlackBerry device....................................................................................... 203
Assign a Wi-Fi profile to a group................................................................................................................ 203
Assign a Wi-Fi profile to a user account.................................................................................................... 204
Configure a Wi-Fi profile............................................................................................................................ 204
Creating and configuring VPN profiles.............................................................................................................. 205
Create a VPN profile.................................................................................................................................. 205
Create a VPN profile based on an existing VPN profile............................................................................. 205
Configure a VPN profile............................................................................................................................. 206
Assign a VPN profile to a group................................................................................................................. 206
Assign a VPN profile to a user account...................................................................................................... 206
Associate a VPN profile with a Wi-Fi profile.............................................................................................. 207
Delete a Wi-Fi profile........................................................................................................................................ 207
Delete a VPN profile......................................................................................................................................... 207
Importing profile information from a .csv file.................................................................................................. 208
Best practices: Creating a .csv file that contains profile information that you want to import................ 208
Create a .csv file that contains profile information that you want to import............................................ 208
Import profile information from a .csv file................................................................................................ 210
20 Configuring encryption and authentication methods for Wi-Fi enabled BlackBerry devices........................... 211
Configuring WEP encryption............................................................................................................................. 211
Configure WEP keys for BlackBerry devices using a Wi-Fi profile............................................................. 211
Configuring PSK encryption.............................................................................................................................. 212
Configure PSK encryption data for BlackBerry devices using a Wi-Fi profile............................................. 212
Configuring LEAP authentication...................................................................................................................... 213
Configure LEAP authentication data for BlackBerry devices using a Wi-Fi profile.................................... 213
Configuring PEAP authentication...................................................................................................................... 214
Configure PEAP authentication data for BlackBerry devices using a Wi-Fi profile.................................... 214
Prerequisites: Distributing a certificate using the BlackBerry Desktop Manager...................................... 215
Distribute a certificate using the BlackBerry Desktop Manager................................................................ 215
Configure PEAP configuration settings in the Wi-Fi profile on a BlackBerry device.................................. 216
Configuring EAP-TLS authentication................................................................................................................. 217
Configure EAP-TLS authentication data for BlackBerry devices using a Wi-Fi profile............................... 217
Configure EAP-TLS configuration settings in the Wi-Fi profile on a BlackBerry device............................. 218
Configuring EAP-TTLS authentication............................................................................................................... 218
Configure EAP-TTLS authentication data for BlackBerry devices using a Wi-Fi profile............................. 219
Configure EAP-TTLS configuration settings in the Wi-Fi profile on a BlackBerry device........................... 220
Configuring EAP-FAST authentication............................................................................................................... 220
Configure EAP-FAST authentication.......................................................................................................... 221
Send EAP-FAST authentication data to a BlackBerry device using a Wi-Fi profile..................................... 221

Configure EAP-FAST configuration settings in the Wi-Fi profile on BlackBerry devices............................ 222
21 Configuring software tokens for BlackBerry devices........................................................................................ 223
Prerequisites: Configuring BlackBerry devices for RSA authentication............................................................ 223
Configure BlackBerry devices for RSA authentication...................................................................................... 224
Configure RSA authentication over a Wi-Fi network using a software token................................................... 224
Configure RSA authentication over a VPN network using a software token.................................................... 225
Assign software tokens to a user account........................................................................................................ 225
22 Changing the security settings of the BlackBerry Administration Service and BlackBerry Web Desktop
Manager............................................................................................................................................................ 227
Import a new SSL certificate for the BlackBerry Administration Service and BlackBerry Web Desktop
Manager............................................................................................................................................................ 227
Configuring Microsoft Active Directory authentication in an environment that includes a resource forest... 228
Change the information for Microsoft Active Directory authentication................................................... 229
Configuring single sign-on authentication for the BlackBerry Administration Service and BlackBerry Web
Desktop Manager............................................................................................................................................. 230
Configure constrained delegation for the Microsoft Active Directory account to support single sign-on
authentication........................................................................................................................................... 230
Turn on single sign-on authentication for the BlackBerry Administration Service.................................... 230
BlackBerry Administration Service web addresses and BlackBerry Web Desktop Manager web
addresses that support BlackBerry Administration Service single sign-on................................................ 231
Changing password settings for BlackBerry Administration Service authentication........................................ 232
Change password settings for BlackBerry Administration Service authentication.................................... 232
Regenerate the system credentials for the BlackBerry Administration Service............................................... 232
23 Protecting and redistributing devices............................................................................................................... 233
Preparing a device for redistribution to a new user......................................................................................... 233
Use the BlackBerry Administration Service to delete user data and assign the device to a new user...... 233
Use the BlackBerry Administration Service to delete user data and remove the BlackBerry Device
Software before assigning the device to a new user................................................................................. 233
Deleting only work data from a device............................................................................................................. 234
Delete only work data from a device......................................................................................................... 235
Using IT administration commands to protect a lost or stolen device............................................................. 236
Protect a stolen device.............................................................................................................................. 237
Protect a lost device.................................................................................................................................. 238
Protect a lost device that a user might not recover.................................................................................. 238
24 Managing administrator accounts.................................................................................................................... 240
Change role permissions................................................................................................................................... 240

Change the roles for an administrator account................................................................................................ 240
Delete a role..................................................................................................................................................... 240
Delete an administrator account...................................................................................................................... 241
25 Managing groups and user accounts................................................................................................................ 242
Managing groups.............................................................................................................................................. 242
Using default groups to manage user accounts and administrator accounts........................................... 242
Remove a user account from a group....................................................................................................... 243
Change the properties of a group.............................................................................................................. 243
Rename a group........................................................................................................................................ 243
Delete a group........................................................................................................................................... 244
Managing user accounts................................................................................................................................... 244
Move a user account to a different group................................................................................................. 244
Move a user account from one BlackBerry Enterprise Server to another................................................. 245
Delete a user account from the BlackBerry Enterprise Server.................................................................. 245
Update a user account manually............................................................................................................... 246
Add an administrator role to a user account............................................................................................. 246
Update the contact list manually............................................................................................................... 246
Resend service books to a BlackBerry device............................................................................................ 246
26 Managing the delivery of BlackBerry Java Applications, BlackBerry Device Software, and device settings to
BlackBerry devices............................................................................................................................................ 248
Managing the default distribution settings for jobs......................................................................................... 248
Change default settings for a job schedule............................................................................................... 248
Change how IT policies are sent to BlackBerry devices............................................................................. 249
Change how to install, update, or remove BlackBerry Java Applications.................................................. 250
Change how to install or update the BlackBerry Device Software............................................................ 251
Change how the BlackBerry Enterprise Server sends standard application settings to BlackBerry
devices....................................................................................................................................................... 252
Managing the distribution settings for a specific job....................................................................................... 253
Specify the start time and priority for a job.............................................................................................. 254
Change how a job sends IT policies to BlackBerry devices........................................................................ 254
Change how a job sends BlackBerry Java Applications to BlackBerry devices.......................................... 255
Change how a job sends the BlackBerry Device Software to BlackBerry devices...................................... 256
Change how a job sends standard application settings to BlackBerry devices......................................... 258
Managing BlackBerry Java Applications on BlackBerry devices........................................................................ 259
Make a BlackBerry Java Application unavailable for installation.............................................................. 259
Remove a BlackBerry Java Application from BlackBerry devices over the wireless network.................... 259
Managing software configurations................................................................................................................... 260

Remove a software configuration from a group....................................................................................... 260
Remove a software configuration from multiple user accounts............................................................... 260
Remove a software configuration from a user account............................................................................ 261
Delete a software configuration................................................................................................................ 261
27 Managing how users access enterprise applications and web content............................................................ 262
Restricting user access to content on web servers........................................................................................... 262
Restrict requests for content on web servers from BlackBerry devices.................................................... 262
Specify web address patterns.................................................................................................................... 262
Create a pull rule....................................................................................................................................... 263
Restrict or permit web addresses and Intranet addresses using a pull rule.............................................. 263
Assign a pull rule to the members of a group............................................................................................ 264
Assign a pull rule to user accounts............................................................................................................ 265
Restricting user access to media content in the BlackBerry Browser............................................................... 265
Prevent users from accessing specific media types................................................................................... 265
Configure download limits for media content types................................................................................. 266
Default download limits for media content types..................................................................................... 266
Configuring Integrated Windows authentication so that users can access resources on your organization's
network............................................................................................................................................................. 267
Configuring the Microsoft Active Directory account to delegate access................................................... 267
Configuring the BlackBerry MDS Connection Service when the messaging server is located in a
remote Microsoft Active Directory domain............................................................................................... 270
Turn on Integrated Windows authentication so that users can access resources on your organization's
network..................................................................................................................................................... 271
Restricting the push application content that users can receive...................................................................... 272
Restrict push applications from sending data to BlackBerry devices........................................................ 272
Create push initiators for push applications.............................................................................................. 272
Turn on push authorization....................................................................................................................... 273
Create a push rule...................................................................................................................................... 274
Assign push initiators to a push rule.......................................................................................................... 274
Assign a push rule to the members of a group.......................................................................................... 274
Assign a push rule to user accounts.......................................................................................................... 275
Encrypt push requests that push applications send to BlackBerry devices............................................... 275
Managing push application requests................................................................................................................ 275
Specify device ports for application-reliable push requests...................................................................... 276
Store push application requests in the BlackBerry Configuration Database............................................. 276
Configure the settings for storing push requests in the BlackBerry Configuration Database................... 277
Configure the maximum number of active connections that a BlackBerry MDS Connection Service can
process....................................................................................................................................................... 277

Configure the maximum number of queued connections that a BlackBerry MDS Connection Service
can process................................................................................................................................................ 278
28 Managing organizer data synchronization........................................................................................................ 279
Managing the wireless backup and recovery of organizer data....................................................................... 279
Turn off the wireless backup of organizer data for a user account........................................................... 279
Delete organizer data for members of a user group from the BlackBerry Enterprise Server................... 279
Delete a user's organizer data from a BlackBerry Enterprise Server......................................................... 280
Turning off organizer data synchronization...................................................................................................... 280
Turn off organizer data synchronization for all user accounts that are associated with a BlackBerry
Enterprise Server....................................................................................................................................... 280
Turn off organizer data synchronization for a specific user account......................................................... 280
Changing how organizer data synchronizes...................................................................................................... 281
Change the direction of organizer data synchronization for all user accounts on a BlackBerry
Enterprise Server....................................................................................................................................... 281
Change the direction of organizer data synchronization for a specific user account................................ 281
Change how the BlackBerry Administration Service resolves conflicts during organizer data
synchronization for all user accounts on a BlackBerry Enterprise Server................................................. 282
Change how the BlackBerry Administration Service resolves conflicts during organizer data
synchronization for a specific user account............................................................................................... 282
Synchronizing contact pictures......................................................................................................................... 283
Turn off synchronization of contact pictures for a user account............................................................... 283
29 Managing your organization's messaging environment and attachment support........................................... 284
Managing message forwarding......................................................................................................................... 284
Forward email messages to a BlackBerry device when no filter rules apply............................................. 284
Do not deliver email messages to a BlackBerry device when no filter rules apply.................................... 284
Forward email messages from inbox subfolders to a BlackBerry device................................................... 285
Turn off email message forwarding to user accounts in a group.............................................................. 285
Turn off email message forwarding to a user account.............................................................................. 286
Turn off synchronization for email messages sent from a BlackBerry device........................................... 286
Turn off email message forwarding when a user connects a BlackBerry device to a computer............... 287
Managing the incoming message queue.......................................................................................................... 287
Delete email messages for user accounts from the incoming message queue......................................... 287
Managing wireless message reconciliation...................................................................................................... 288
Turn off wireless message reconciliation for a BlackBerry Enterprise Server........................................... 288
Turn on reconciliation for email messages that are hard deleted............................................................. 288
Managing access to remote message data....................................................................................................... 289
Prevent a user from checking the availability of meeting participants on the BlackBerry device............. 289

Prevent a user from searching for remote email messages using a device............................................... 289
Managing email messages that contain HTML and rich content...................................................................... 290
View whether a user turned on support for email messages that contain HTML and rich content for a
BlackBerry device...................................................................................................................................... 290
Turn off support for rich text formatting and inline images in email messages for users on a
BlackBerry Enterprise Server..................................................................................................................... 291
Turn off support for rich text formatting and inline images in email messages using an IT policy rule.... 291
Synchronizing folders on the BlackBerry device............................................................................................... 292
Control which published public contact folders a user can synchronize to a BlackBerry device.............. 292
Control which personal contact subfolders a user can synchronize to a BlackBerry device..................... 293
Control which personal mail folders a user can synchronize with a BlackBerry device............................ 293
Configuring access to documents on remote file systems............................................................................... 294
Configure the BlackBerry MDS Connection Service to communicate with a remote file system.............. 294
Add communication information to a BlackBerry MDS Connection Service configuration set................. 295
Assign a BlackBerry MDS Connection Service configuration set to a BlackBerry MDS Connection
Service instance......................................................................................................................................... 296
Managing signatures and disclaimers in email messages................................................................................. 297
Add a signature to email messages that a user sends from a BlackBerry device...................................... 297
Add a disclaimer to email messages that users send from BlackBerry devices......................................... 297
Add a disclaimer to email messages that a user sends from a BlackBerry device..................................... 298
Specify conflict rules for disclaimers......................................................................................................... 298
Turn off disclaimers for email messages................................................................................................... 298
Monitor email messages that users send from BlackBerry devices.................................................................. 299
Sending notification messages to users............................................................................................................ 300
Send a notification message to all users in a BlackBerry Domain............................................................. 300
Send a notification message to all users on a BlackBerry Enterprise Server............................................. 300
Send a notification message to group members....................................................................................... 300
Send a notification message to a user....................................................................................................... 301
Change the size of the message state database............................................................................................... 301
How the BlackBerry Attachment Connector communicates with BlackBerry Attachment Service instances.. 301
Change how a BlackBerry Attachment Connector retries sending requests to a BlackBerry Attachment
Service....................................................................................................................................................... 302
Change how a BlackBerry Attachment Connector restores a lost connection to a BlackBerry
Attachment Service................................................................................................................................... 303
Attachment file formats that the BlackBerry Attachment Service supports.................................................... 303
Limitations for supported attachment file formats................................................................................... 304
Changing how a BlackBerry Attachment Service converts attachments.......................................................... 305
Change how a BlackBerry Attachment Service converts attachments...................................................... 305
Change the maximum file size for attachments that users can receive.................................................... 307

Turn off support for an attachment file format for a BlackBerry Attachment Service..................................... 308
Add support for an additional attachment file format to a BlackBerry Attachment Service............................ 308
Changing how the BlackBerry Messaging Agent reconciles attachments to the messaging server................. 309
Change the maximum file size for attachments that users can send........................................................ 310
Prevent users from sending large attachments......................................................................................... 310
Change the maximum file size of attachments that users can download................................................. 310
30 Managing calendars.......................................................................................................................................... 312
Configuring the BlackBerry Enterprise Server to use Microsoft Exchange Web Services or MAPI and CDO
libraries............................................................................................................................................................. 312
Prerequisites: Configuring the BlackBerry Enterprise Server to use Microsoft Exchange Web Services.. 312
Turn off client throttling in Microsoft Exchange 2010............................................................................... 313
Configure the BlackBerry Enterprise Server to use Microsoft Exchange Web Services............................ 313
Configure the BlackBerry Enterprise Server to use MAPI and CDO libraries............................................. 314
Configure the BlackBerry Messaging Agent instances to use a web address for a specific Microsoft
Autodiscover service.................................................................................................................................. 314
Configure the BlackBerry Messaging Agent instances to use a specific web address for a client access
server for Microsoft Exchange................................................................................................................... 315
Configuring the BlackBerry Messaging Agent instances to look up the user's status using only
Microsoft Exchange Web Services............................................................................................................. 316
Correcting calendar synchronization errors on devices.................................................................................... 317
Configuration levels using the BlackBerry Enterprise Trait Tool............................................................... 317
Turn off corrective calendar synchronization............................................................................................ 317
View the current settings for corrective calendar synchronization........................................................... 318
Turn off automatic error correction in corrective calendar synchronization............................................ 319
Configure the range of days to check for calendar synchronization errors............................................... 319
Configure when corrective calendar synchronization runs....................................................................... 320
Logging information for corrective calendar synchronization................................................................... 321
Delete a setting for corrective calendar synchronization.......................................................................... 322
Start corrective calendar synchronization manually for a user account.......................................................... 322
Improving the flow of email messages and calendar synchronization when the BlackBerry Enterprise
Server runs on Windows Server 2008............................................................................................................... 323
Change how the BlackBerry Enterprise Server creates temporary MAPI profiles for the CalHelper
application................................................................................................................................................. 323
31 Managing instant messaging............................................................................................................................ 324
Installing a collaboration client on BlackBerry devices..................................................................................... 324
Change the instant messaging server or pool that a BlackBerry Collaboration Service connects to................ 324
Change the transport protocol for a Microsoft instant messaging environment............................................. 325

Specify the Windows domain name for users who log in to a collaboration client.......................................... 326
Managing instant messaging sessions.............................................................................................................. 326
Specify the maximum number of instant messaging sessions that can be open at the same time.......... 326
Specify the inactivity timeout limit for instant messaging sessions.......................................................... 326
Managing instant messaging features.............................................................................................................. 327
Prevent users from sending specific file types to instant messaging contacts using the BlackBerry
Client for IBM Lotus Sametime.................................................................................................................. 327
Specifying the maximum size of file types that users can send using the BlackBerry Client for IBM
Lotus Sametime......................................................................................................................................... 327
Prevent users from sending instant messaging conversations in email messages.................................... 327
Prevent users from saving instant messaging conversations.................................................................... 328
Hide the icon that appears on BlackBerry devices for mobile contacts.................................................... 328
Make additional contact information and phone numbers available for the BlackBerry Client for IBM
Lotus Sametime users................................................................................................................................ 328
32 Managing a BlackBerry Domain........................................................................................................................ 330
Restarting BlackBerry Enterprise Server components...................................................................................... 330
Restart a BlackBerry Enterprise Server component using the BlackBerry Administration Service........... 331
Restart a BlackBerry Enterprise Server component using Windows Services........................................... 331
Best practice: Restarting more than one BlackBerry Administration Service instance............................. 331
Using the BlackBerry Enterprise Trait Tool....................................................................................................... 331
Use the BlackBerry Enterprise Trait Tool................................................................................................... 332
BlackBerry Enterprise Trait Tool traits.............................................................................................................. 332
Permit the BlackBerry Messaging Agent to write statistics to Microsoft Exchange mailboxes........................ 343
Managing BlackBerry CAL keys......................................................................................................................... 344
Add or delete a BlackBerry CAL key........................................................................................................... 344
Copy a BlackBerry CAL key to a text file.................................................................................................... 344
Configuring the BlackBerry Mail Store Service instance that updates the contact list..................................... 345
Configure the BlackBerry Mail Store Service instance that updates the contact list................................ 345
Configuring a Hosted BlackBerry services environment................................................................................... 346
Configuring Hosted BlackBerry services when you permit your organization’s customers limited
access to Microsoft Active Directory......................................................................................................... 346
Configure Hosted BlackBerry services when your organization’s customers have full control of their
subtree in Microsoft Active Directory....................................................................................................... 348
Configuring the BlackBerry Enterprise Server to use LDAP to retrieve email addresses and organizer data... 348
Configure the BlackBerry Enterprise Server to connect to Microsoft Active Directory............................. 349
Configure the BlackBerry Enterprise Server to retrieve email addresses and organizer data using LDAP 350
Prevent the BlackBerry Enterprise Server from retrieving contact information for specific users........... 351

Restrict the location in Microsoft Active Directory that the BlackBerry Enterprise Server can retrieve
email addresses and organizer data from................................................................................................. 351
Configuring BlackBerry Policy Service throttling............................................................................................... 352
View the current settings for BlackBerry Policy Service throttling............................................................ 352
Configuring BlackBerry Policy Service throttling for IT policies and service books................................... 353
Configuring BlackBerry Policy Service throttling for PIN encryption keys................................................. 354
Configuring BlackBerry Policy Service throttling for application polling................................................... 355
Delete a BlackBerry Policy Service throttling setting................................................................................. 355
Change the port number that BlackBerry Enterprise Server components use to connect to the BlackBerry
Configuration Database.................................................................................................................................... 356
Change the port number that the syslog tools use to monitor BlackBerry Enterprise Server events.............. 356
33 BlackBerry Controller and BlackBerry Enterprise Server Component Monitoring........................................... 358
How the BlackBerry Controller monitors the BlackBerry Enterprise Server components................................ 358
Change how the BlackBerry Controller restarts the BlackBerry Messaging Agent.................................... 358
Change how the BlackBerry Controller restarts a BlackBerry Enterprise Server service........................... 360
BlackBerry Enterprise Server Alert Tool............................................................................................................ 363
Configuring notifications using the BlackBerry Enterprise Server Alert Tool............................................ 363
34 BlackBerry Enterprise Server log files............................................................................................................... 365
Monitoring PIN messages, SMS text messages, and calls................................................................................. 365
Change the default location for the log files for PIN messages, SMS text messages, and calls................ 365
Log files for BlackBerry Enterprise Server components.................................................................................... 366
Changing the location where BlackBerry Enterprise Server components save log files............................ 366
Changing how BlackBerry Enterprise Server components create log files................................................ 367
Component identifiers for log files............................................................................................................ 371
BlackBerry MDS Connection Service log files................................................................................................... 372
Changing how the BlackBerry MDS Connection Service creates a log file................................................ 372
Using BlackBerry MDS Connection Service log files to view information for proxied connections to
BlackBerry devices..................................................................................................................................... 375
BlackBerry Collaboration Service log files......................................................................................................... 376
Change which activities the BlackBerry Collaboration Service writes to a log file.................................... 376
35 BlackBerry Enterprise Solution connection types and port numbers............................................................... 378
BlackBerry Administration Service connection types and port numbers......................................................... 378
BlackBerry Attachment Service connection types and port numbers.............................................................. 380
BlackBerry Collaboration Service connection types and port numbers........................................................... 381
BlackBerry Configuration Database connection types and port numbers........................................................ 382
BlackBerry Controller connection types and port numbers............................................................................. 383