ActiveSync Security Policy not working w/ 8.1

[asousa]

Hi All,

Updated to 8.1 last night, my company email no longer works. Keeps failing with the security policy. It worked fine with WP8. Anyone know what policy might have changed in the new OS? I have our IT department looking into it, they haven't been able to find anything yet either. I did a hard reset and everything to eliminate the possibility of just a bad upgrade.

Any one else experiencing this?

Thanks

 

[asousa]

hmmm, no one else is having this issue... odd

 

[Semen Shevchenko]

Hi. I have same problem on wp8.1. Some advices?

 

[catg801]

I have had a similar issue and all the forums say its a EAS policy issue. All the setting i use work fine on Windows 8 phones, iphone 4 and 5 and android.
With this new Nokia Windows 8.1 phone i setup an account and it says Your windows phone doesnt support this server version - well we use Exchange 2007 and all the doco says it should work. The exchange guys have changed my AS account to use the default EAS profile and it didnt resolve the issue. Also tried installing certificates on the phone. Nothing has worked.

 

[hotphil]

Related to the BitLocker issue that caused the rollout to be halted? Does the EAS policy require/enforce it by default?

 

[catg801]

I'm just waiting for them to send through the policies so i can double check them - but I think it does require/enforce it by default.

hotphil you know of any links to the BitLocker issue i can have a look at to try and find a resolution?

 

[hotphil]

Sadly not. There were a few mentions of it on here. But the audience is mainly users rather than system/Exchange admins so were light on the technical details. From what I recall, if 8.1 was installed on a device which had BitLocker enabled then the device just sat there asking for a USB key with the BitLocker key to be inserted. Kinda difficult on most phones. Devices had to be rolled back to 8 using the Nokia recovery tool. So the rollout got canned while MS worked on a fix.
Maybe now the issue is reversed - BitLocker can't be turned on but EAS may be requiring it. I'm off to have a look at some of my Exchange boxes now.

 

[catg801]

DevicEncryptionEnabled is actually set to false. And allownonprovisionabledevices is set to true. A lot of other people on other forums said to allow that. hasnt fixed the issue unfortuantely.

 

[ashram]

I'd say, if your exchange admins are up for some trial and error, start your account with a blank policy, and add/test every policy 1 at a time until you find the one that is causing the issue..... i "used" to be the exchange admin for mobility at a previous job, but haven't don't that in years, so that's all i can think of.

 

[Jason McColl]

The problem would appear to be related to the way that the Windows 8.1 devices see the imbedded SD Card slot on the Nokia phones. Even if there is no SD Card in the slot. There are not many settings that can be modified outside the defaults (see below): (p.s. this is not secure, therefore I would not recommend supplying SD Cards or allowing the use)
AllowNonProvisionableDevices : True
AlphanumericDevicePasswordRequired : True
AttachmentsEnabled : True
DeviceEncryptionEnabled : False
RequireStorageCardEncryption : False
DevicePasswordEnabled : True
PasswordRecoveryEnabled : False
DevicePolicyRefreshInterval : unlimited
AllowSimpleDevicePassword : True
MaxAttachmentSize : unlimited
WSSAccessEnabled : True
UNCAccessEnabled : True
MinDevicePasswordLength : 4
MaxInactivityTimeDeviceLock : 00:30:00
MaxDevicePasswordFailedAttempts : 10
DevicePasswordExpiration : unlimited
DevicePasswordHistory : 10
AllowStorageCard : True
AllowCamera : True
RequireDeviceEncryption : False
AllowUnsignedApplications : True
AllowUnsignedInstallationPackages : True
AllowWiFi : True
AllowTextMessaging : True
AllowPOPIMAPEmail : True
AllowIrDA : True
RequireManualSyncWhenRoaming : False
AllowDesktopSync : True
AllowHTMLEmail : True
RequireSignedSMIMEMessages : False
RequireEncryptedSMIMEMessages : False
AllowSMIMESoftCerts : True
AllowBrowser : True
AllowConsumerEmail : True
AllowRemoteDesktop : True
AllowBluetooth : Allow
MaxCalendarAgeFilter : All
MaxEmailAgeFilter : All
RequireSignedSMIMEAlgorithm : SHA1
RequireEncryptionSMIMEAlgorithm : TripleDES
AllowSMIMEEncryptionAlgorithmNegotiation : AllowAnyAlgorithmNegotiation
MinDevicePasswordComplexCharacters : 1
MaxEmailBodyTruncationSize : unlimited
MaxEmailHTMLBodyTruncationSize : unlimited
UnapprovedInROMApplicationList : {}
ApprovedApplicationList : {}
AllowExternalDeviceManagement : False
MobileOTAUpdateMode : MinorVersionUpdates
AllowMobileOTAUpdate : True
IrmEnabled : True