Several links fixed, and several devices purchased with WM 6.1.x builds now listed as reference as well. Interesting to see the slow uptake of devices having the 6.1.4 build finally that has the Internet Explorer Mobile 6 (IE6on6).

Included is the specific OS/AKU build for each device for SCMDM 2008 SP1 support.

If you know of others, updates or corrections, please let me know! 

|\\arco..
mnielsen(at)enterprisemobile.com
http://marco.blogsite.org

This technical paper recommends how enterprises can take advantage of the powerful security features of Windows Mobile to defend against malicious and unsupported application use. Taking a very pragmatic approach, the paper describes how various features work and how to implement them to protect devices based on Windows Mobile 5.0, 6.0 and 6.1.

Go ahead, download the WM Application Security White Paper now, I highly recommend it for any IT professional who’s interested in Windows Mobile security. Dave has put incredible detail into this paper, making it invaluable for an organization who is currently using (or planning to deploy) Windows Mobile devices and applications.

Next up, there’s an interesting Network World article by John Cox about Mobile browser security that Dave and I are quoted in.  The article focuses on the impact that a new generation of mobile web browsers will have on how enterprise IT organizations handle mobile device security.  John sums up the three key areas that enterprises should focus on:

IT departments, according to experts, need to focus on three areas: assessing the security architecture and features in the mobile browser and the underlying operating system; working with users on smart and safe browsing practices; and creating a solid handheld device management system.

In fact, choosing a mobile platform with a strong and flexible security model in hand with a solid device management system can help you minimize the headaches that users have to endure. With those first two handled, educating users on smart and safe browsing practices is something that is applicable to both traditional desktop web browsers as well as the new crop of full-featured mobile browsers. Read the full article, titled “Mobile browsers bring new security headaches” now for more information.

So, you’ll need to purchase an SSL certificate for your web server and any Windows Mobile clients should have the root of your SSL certificate in the device’s root certificate store. 

The problem comes when the root certificate is not already in the device root certificate store by default.  You can add certificates to the root store (this got a lot easier in Windows Mobile 6.0).  But, this will likely require a user trying to perform the task or the support tech will need to “touch” the device.  And, if the device is cold reset, you have to perform this task all over again.  It is much easier just to use an SSL server certificate from a Public Certificate Authority  that chains to a root certificate that’s already resident on the device.

Unfortunately, Windows Mobile has no root certificate updating service as included in Windows XP and Windows Vista.  With Windows Mobile, you get the root certifcates that were added when the image was built.

If you are using Windows Mobile 5.0 devices, you should not use GoDaddy or Comodo root certificates for the most part.   Here is a table showing which versions of Windows Mobile includes which Public CA certificates:

Another consideration is the use of wildcard certificates.  As you probably already know if you are reading this, a wildcard certificate allows the use of a wildcarded DNS name prefix such as “*.acme.com”.  You can use the same SSL certificate for many different web servers that all have assigned DNS names that end in “.acme.com”.  It is important for SSL security that the server’s internet DNS name matches the subj or subj alt name on the certificate.  So, if you wildcard th prefix in the certificate, you can use one cert for a lot of servers.

Windows Mobile started supporting wildcard certificates in Windows Mobile 6.0.  If you have Windows Mobile 5.0 devices, you should take a look at the offering from Digicert.  They allow you to pre-populate the subj alt name of the certificate with a list of server names.  This ends up giving you something approaching wildcard certificate features.  However, you do need to know the internet DNS names of all the web servers you’ll be using.  See more details on the Digicert site. Note that digicert is not shown on the list above because they actually chain back to the Entrust root.

Dave Field, CISSP, MCP
Device Management and Security Architect
Enterprise Mobile, Inc.

One of the most powerful things about Microsoft System Center Mobile Device Manager (SCMDM) is the ability to manage all of your Windows Mobile 6.1 or above devices through Active Directory (AD) Group Policy Objects (GPOs). A large percentage of the corporate market is already using GPOs to manage their desktop, notebook and server environments.

The GPO technology was introduced in Windows 2000 Server. Before that there were System Policies in Windows NT 4.0. There is already a fair amount of documentation and knowledge around extending GPOs to your own needs. But here I will go into some aspects more important around making use of SCMDM and supporting Windows Mobile in an enterprise running AD.

In this article I will go through how you can extend your own GPOs to have additional settings not available out of the box in the default Windows Mobile GPO template supplied by Microsoft in SCMDM 2008. I will expect that you already know how to access and use the default SCMDM GPO settings.

Windows Mobile Registry Keys

GPOs work by manipulating how registry keys are changed and written on the client machines. This is no different on Windows Mobile, compared to other Windows platforms at this point in time.

I will save the discussion on where to find and research Windows Mobile registry locations. But will point out that many are bound to specific OS levels, OEM and hardware requirements. So what works on one WM device may not work on another. So I can’t stress enough the aspect of testing such settings before a larger deployment to end-users.

For this article I have asked my colleague, Chris De Herrera, to suggest some registry keys to use:

Improve text rendering performance by increasing the GLYPH Cache to 32k (decimal):

[HKEY_LOCAL_MACHINE\System\GDI\GLYPHCACHE]
“limit”=dword:00008000

Internet Explorer Mobile homepage settings:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs]
“home_0409″=”file://\\windows\\default_0409.htm“
“version_0409″=”file://\\windows\\about_0409.htm“
“blank”=”res://webview.dll/blank.htm”

Configure Communicator Mobile:

[HKEY_CURRENT_USER\Software\Microsoft\Communicator\System Settings]
“ServerInternal”=”sip.yourcompany.com”
“Server”=”sip.yourcompany.com:443″

Furthermore I have also researched the following registry keys which may be helpful in corporate environments:

ClearType Activation:

[HKEY_LOCAL_MACHINE\System\GDI\ClearType][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
“ClearTypeText”=dword:1[HKEY_LOCAL_MACHINE\System\GDI\ClearTypeSettings]
“OffOnRotation”=dword:0

Browser History:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“DaysToKeep”=dword:00001E

Default Search Page:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“Search Page”=http://m.live.com/search/Results.aspx?q=%&mid=8001

Internet Explorer User Agent:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent]
“Default”=”Mozilla/4.0″
“Platform”=”Windows CE”
“Version”=”MSIE 6.0″

Menu Animations:

[HKEY_LOCAL_MACHINE\SYSTEM\GWE\Menu]
“AniType”=dword:0

Windows Animations:

[HKEY_LOCAL_MACHINE\SYSTEM\GWE]
“Animate”=dword:0

Error Reporting:

[HKEY_LOCAL_MACHINE\System\ErrorReporting\DumpSettings]
“DumpEnabled”=dword:0
[HKEY_LOCAL_MACHINE\System\ErrorReporting\UploadSettings]
“DontUpload”=dword:1[HKEY_LOCAL_MACHINE\System\ErrorReporting\UploadSettings]
“ConnectionFlags”=dword:0

Today Screen Text:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Shell\DeviceBeta]
“Today”=”EnterpriseMobile”

Display Time/Date in Taskbar or disable for battery indicator:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Shell]
“TBOpt”=dword:3
“ShowTitleBarClock”=dword:1

Permit Bluetooth and IrDA File Transfer:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Obex]
“IsEnabled”=dword:1

Please be aware that most of these settings require a soft reboot of the device before they become effective. The SCMDM policy agent should prompt you for a reboot of the device when an updated policy is synchronized from the Device Management Server.

Creating .ADM Files

Using the information published here about the correct registry key prefix to use for GPOs on Windows Mobile I created my own .ADM file with my sample registry keys listed above and a few other samples currently available.

You can download it here. I have noted in my sample the references used.

Look for a new folder called “Windows Mobile Settings-Extended” in the Computer Configuration section of the Group Policy Object Editor.

 
The single main trick was to prefix the native Windows Mobile registry keys with the <SOFTWARE\Policies\Microsoft\Windows Mobile Settings\Registry> path.

So the native:
<HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs> became the longer:
<SOFTWARE\Policies\Microsoft\Windows Mobile Settings\Registry\HKLM\Software\Microsoft\Internet Explorer\AboutURLs>.

Note the collapsed HKEY_LOCAL_MACHINE hive into the named HKLM. This also works for the HKEY_CURRENT_USER hive into HKCU.

Further Information on .ADM Files

Please see the reference links below for more details on the syntax used in the example .ADM file. The syntax and commands are not the easiest in the world of IT.

I also found a ADM file editor, called ADM Template Editor from a small company in Australia that may be useful if you are planning to write and manage a large number of custom .ADM/.ADMX files.

Again, please test the policies on the OS platform, level, and hardware you wish to broadly deploy your Windows Mobile settings out to.

Look for more articles soon on useful Windows Mobile registry keys and GPOs!

References:

• Microsoft articles on writing GPOs:
  • How to Write a Simple .Adm File for Registry-based Group Policy
  • KB225087: Writing Custom ADM Files for System Policy Editor
  • KB816662: Recommendations for managing Group Policy administrative template (.adm) files
• Creating a New Group Policy Object for (Windows Mobile) Devices
• SCMDM Technical Article: Deploying and Configuring Communicator Mobile with MDM
• SCMDM Technical Article: Name Resolution Considerations for Company Web Site Access
• ADM Template Editor: (Recommended, one of the few I believe out there!)

|\\arco..
mnielsen(at)enterprisemobile.com
http://marco.blogsite.org

PROBLEM: When accessing a website that is secured to use an NTLM authenticated password, the “Save Password” option does not work on Windows Mobile Pocket PCs and Smartphones.

Here are detailed steps that outline how to reproduce this problem using a Motorola/Symbol MC70 Pocket PC. Note that the test device was running Windows Mobile 5.0 AKU3.

1. Perform a “clean” reboot of the device which is a cold boot that resets all storage volumes on the device to factory defaults.
2. Configure a website connected to an Active Directory domain to use password authentication. During testing, you’ll need access to IIS Admin.
   1. Start out using basic authentication. In properties for the website, open the “Directory Securty” tab, click the “Edit” button for “Authentication and access control” and check the box for “Basic authentication”
   2. Use of HTTPS/SSL is irrelevant to the test. However, basic should not be used without SSL because the basic password is sent in clear text.
3. From the device, open the website in the Mobile IE browser. You will be prompted for the password. Note: “Realm” is included in the Basic authentication dialog box. For NTLM authentication, “domain” input is required.
4. Enter your domain\username and your password. Make sure to check the “Save Password” box. Then tap “OK”.
5. Confirm that your password-secured site renders in the Mobile IE browser.
6. At this point, if you were to refresh the page or even browse to a couple sites before revisting the site, you would not be asked for the password again. This is because the website page that was opened after authentication is cached. By exiting out of the browser session and re-opening the page, authentication occurs again. You can exist the browser session by warm resetting. But, it is easier to stop and restart the “internet explorer” process as follows:
   1. On the device, go to Settings/System tab/Memory/Running Programs tab.
   2. Select “Internet Explorer” from the “Running Programs List:”
   3. Tap the “Stop” button. This stops the browser process.
7. Re-open the Mobile IE browser on the device and browse to the website again. You should find that you do not need to enter the credentials this time for the web site because they are cached.

CONCLUSION: Save Password works with “Basic Auth”

8. Close the browser session again as described above in step #6.
9. In IIS admin, change the authentication for your website from basic to NTLM:
   1. Uncheck basic and check the box for “Integrated Windows Authentication” which is NTLM.
   2. Stop and restart the website to ensure the authentication change is implemented.
10. On the device, confirm that the “internet explorer” process is not running. If it is, stop the process.
11. Open Mobile IE and browse the website again. This time, you’ll see the following authentication dialog for NTLM (Windows Integrated) authentication. You’ll see that username and domain are cached from the previous use of your credentials for basic authentication. However, the previously cached password is not re-used.
12. Enter your password and be sure to check the “save password” box prior to tapping the “OK” button.
13. Confirm that your password-secured site renders in the Mobile IE browser.
14. Close the browser session again as described above in step #6.
15. Now re-open the website.
16. You will see the same authentication dialog that you saw in step# 11 above.

CONCLUSION: By default, the “Save Password” option exposed in the Mobile IE authentication dialog does not save the password for NTLM authentication cases.

WHY DOES THIS HAPPEN?: Underlying Mobile IE is the use of the Windows Internet API (wininet) which is a set of core code inherited from desktop windows. You may have noticed that in order to cache NTLM with desktop IE, you need to configure the website to be an “intranet” zone website. Furthermore, you have to set your security settings to use user authentication logon settings to use automatic logon only for intranet zone” or “Automatic Logon for user name and password”. Once the user of desktop IE has entered and saved their password for the “intranet” website one time, they no longer need to enter it on subsequent use. Mobile IE encounters the same problem as desktop IE, but in Windows Mobile IE, there is no configuration UI to allow the user to make these changes.

SOLUTION: You can add the website to the list of intranet sites by hacking the registry on the device. To configure http://www.yoursite.com/ and https://www.yoursite.com/ as “intranet” websites and therefore eligible for NTLM password caching:

1. Add the registry key: HKLM\Software\Microsoft\Windows\CurrentVersion\Internet settings\ZoneMap\domains\yoursite.com\www
2. Under this new key add 2 values: “http” and “https”
3. Set each of the 2 values to “1″

NOTES:

• The website domain name prefix (eg, “www”) is configured as a sub-key of the domain name (eg, “yoursite.com”).
• You need to configure each URI scheme (http, https, ftp, etc.) that may be used for the website. Each different URI scheme will require a separate instance of the cached password
• By setting value=”1″ for the URI scheme, you are configuring that full URI as a site in the “intranet” zone. Here is the value associated with all zones: 0 My Computer, 1 Local Intranet Zone, 2 Trusted sites Zone, 3 Internet Zone, 4 Restricted Sites Zone.
• For a full discussion of all security zone registry settings see KB 182569 – Internet Explorer security zones registry entries for advanced users
• There are a number of registry editors for Windows Mobile devices that you can download and use. However, you can use WAP Provisioning XML to query and write to the registry via the registry configuration service provider. You can use a tool such as rapiconfig to implement WAP provisioning XML on Windows Mobile devices. The rapiconfig tool is available in the Windows Mobile Software Development Kits.

Dave Field, CISSP, MCP
Device Managment and Security Architect
Enterprise Mobile, Inc.