To use EMS to get the list, run this command:

Get-ActiveSyncDevice -filter {deviceaccessstate -eq 'quarantined'}

If you want to use LDAP to get the list, this is the corresponding search filter:

(&(objectclass=msexchactivesyncdevice)(msexchdeviceaccessstate=3))

The device access state values are 1 for allowed, 2 for blocked, 3 for quarantined.

The reason for this is not explained clearly in Microsoft documentation, but can be inferred by this good post on the Exchange blog. It details the flow logic when a device is accessing a mailbox and the order in which permissive and preventative access is handled. This image from the post sums up the flow:

When a device attempts to sync with a mailbox, the Allow/Block list on the user object is checked first, followed by any device access rules defined at the org level, and then the global access rule (the decision point labeled as Anything Unknown).  The default configuration at the org level is a permissive organization, where any device not explicitly blocked at the user level or does not match any device access rule is allowed.

The important distinction, however, is that specifying an allowed device ID at the user level is not exclusive, while specifying a blocked device ID is [effectively] exclusive.  This means that the access logic doesn’t stop at the user level when an allowed device ID is specified, though it does when a blocked device ID is specified.  Therefore, in a default permissive organization, specifying an allowed device ID for a user does not restrict the user to only that device.  In order to restrict a user to the device ID(s) specified on the user object, it is also necessary to define a device access rule and/or change the global access policy so that a device will otherwise be blocked (or quarantined).

To understand the action taken by Exchange when a device attempts to synchronize, I have made my own flowchart (click to zoom):

]]> http://www.flobee.net/the-correct-way-to-restrict-users-to-specific-devices-with-exchange-activesync/feed/ 0 http://www.flobee.net/how-to-fix-your-presumably-bricked-wizard/ http://www.flobee.net/how-to-fix-your-presumably-bricked-wizard/#comments Wed, 07 Oct 2009 22:15:05 +0000 Scott http://www.flobee.net/?p=158 Recently I have been using various betas of CRACING’s CR96 Touch HD builds of Windows Mobile 6.5. When I tried to install 6.5.0.2.9, RUU kept crashing on my Windows 7 x64 workstation. I am pretty sure I installed previous CR96 Touch HD betas aftering installing Windows 7. I tried application compatibility when running RUU (XP SP2), running as administrator, different RUUs, all with the same MFC application error.

I sent time trying to get an RUU to run successfully, but then went on ShellTool. I started flashing the new ROM with it, but after an hour it was still sitting there. I disconnected the Wizard and either soft- or hard-reset the phone. Now it got ugly. The boot screen would come up, displaying the IPL,SPL,Radio, and OS (the latter being 6.5.0.0), but it would never go past it.

I was able to boot the Wizard into the bootloader, so I tried MTTY. I couldn’t get the USB port to be listed in the drop-down, thinking it was something with Windows 7 or x64. I then went on to nueTTY. I was able to connect with it, so I ran d2s, which backs up the on-chip ROM to SD. This was successful in that I was now able to put a ROM on the SD card and boot into the bootloader, which prompted me to flash the ROM (I could not get it do this prior to running d2s. Unfortunately, now booting showed only an IPL, SPL, and Radio version….no ROM version installed.

Telling it to flash the ROM resulted in the BINFS being written successfully and then immediately failing with a checksum error. Now I was really stuck. I couldn’t get RUU to run, couldn’t flash from SD card, there is no OS on the device anymore, and I couldn’t find anything helpful while using TTY. So I finally decided to try Windows XP Mode in Windows 7. After getting that installed and running, I installed ActiveSync 4.5. Running the RUU that came with 6.5.0.2.9 only resulted in errors about needing a newer RUU. I figure this had something to do with the fact that I no longer had any OS on the Wizard. But RUU didn’t crash, which was a good sign. I tried nueTTY again (which needs .NET FW 2.0 and VSTO 2008 runtime). It could see the Wizard connected, but then dropped right back to a command prompt. I tried MTTY again, learning that USB will only show up as a valid port if the ActiveSync processes are killed. MTTY connected, but I couldn’t find any commands that would help me.

Still with me? Well, we’re on the final leg now. While still using Windows XP Mode, I ran the RUU that is for the Wizard and doesn’t do any CID checks. This time it detected the Wizard and flashed 6.5.0.2.9 succesfully! Finally! That was a harrowing couple of days.

So, what are the key takeaways from this? No, it isn’t “Don’t flash with cooked ROMs that are only in beta.”

• Be sure to kill the ActiveSync/WMDC processes to get MTTY to see the USB port.
• Connecting to a Windows Mobile device works just fine in Windows XP Mode; the Pocket PC USB Sync driver will be installed automatically once you attach the port in the USB menu of Windows XP Mode.
• Running a terminal program, such as MTTY or nueTTY, really can brick your phone if you don’t know what you’re doing.
• The No ID version of RUU for the Wizard is always good to have on hand.

My aging Wizard is now running IPL and SPL 3.08, radio 2.19.11, and CR96 Touch HD ROM 6.5.0.2.9 beta. My Tilt is running HardSPL 3.29, radio 1.70.19.09, and shifu’s 3.2 ROM (6.5).

Navigate to HKLM\Software\Microsoft\Windows CE Services\AutoStartOnConnect. You will see a value for (Default) with the data set to what appears to be null (nothing visible in the data field). Click on the (Default) name and then press the delete key. This will change the data to be (value not set). If the same thing happens when you disconnect your handheld, do the same thing in the \AutoStartOnDisconnect key. The change takes effect immediately.

My work installation is beyond the one year of service, so I couldn’t download a skin for my AT&T Tilt.  My home installation (separate license), however, was within the service year, so I downloaded the skin and copied it to my work installation.  I could not find anything in the program or on SOTI’s site regarding copyright of the skin images, so I am posting the Tilt images (displayed half-size) for anyone who needs it.

So I figured it was time to either reflash with the Faria ROM or use another.  I settled on another, discussed here at XDA Developers.  This is a 6.1 ROM, which is nice because of some of the improvements, such as native threaded SMS.  I also have more memory after a reset: about 24MB versus 21MB with Faria.  Usage feels much snappier, too.  I thought that it might simply be because OMAPClock is included, but when I checked it I was still running at 180MHz.  So if it feels snappy now, I can’t wait to try it at 252MHz, which is what I normally run at.

Then I found this post on xda-developers.com which indicates that Wizards that have been upgraded to Windows Mobile 5 with AKU2 (notable for the DirectPush functionality) have the portion of the DOC (Disk on Chip) that stores the carrier ID set to read-only.  Faria’s instructions show how to successfully CID Unlock the device by first downgrading the ROM to a non-AKU2 version.  Of course, it can’t be any ROM since the CID is still locked, so it has to be one from Cingular or something cooked.

I could not find anywhere the Cingular 1.8 ROM that is recommend to use.  I trolled Google, AT&T forums, xda-developers, Google Groups, but the binaries had been pulled awhile ago.  The other option was a cooked ROM that doesn’t check for a carrier ID.  Again, I could not find the one mentioned, until I found a forum post that linked to another post on a French forum where the ROM is available.  That took awhile to download.

After finally having all the pieces necessary, I was able to downgrade this morning, CID Unlock the device, upgrade the IPL/SPL, radio, and finally Faria’s WM6 ROM:

Combining information and steps from a several different topics at xda-developers and elsewhere, this is what I did:

1. Downloaded and installed the custom 1.05 ROM, called CUSTOM__RUU_Wizard_1050412_WWE_101_11210_WWE.exe.
2. Downloaded and ran lokiwiz’s CID Unlocker .2b.
3. Downloaded and installed the T-Mobile 2.26 ROM.
4. Downloaded and installed IPL/SPL 3.08.
5. Downloaded and installed radio 2.19.
6. Downloaded and installed Faria’s WM6 ROM.

Woohoo!