Applies to: Exchange Server 2010 SP3, Exchange Server 2010 SP2
Topic Last Modified: 2009-11-24
Mobile phones can store sensitive corporate data and provide access to many corporate resources. If a device is lost or stolen, that data can be compromised. Through Microsoft Exchange ActiveSync policies, you can add a password requirement to your mobile phones. This requires users to enter a password to access their mobile phones. We recommend that, in addition to requiring a device password, you configure your mobile phones to automatically prompt for a password after a period of inactivity. The combination of a device password and inactivity locking provides more security for your corporate data.
In addition to these features, Microsoft Exchange Server 2010 provides a remote device wipe feature. You can issue a remote device wipe command from the Exchange Management Shell. Users can issue their own remote device wipe commands from the Microsoft Office Outlook Web App user interface.
The remote device wipe feature also includes a confirmation function that writes a time stamp in the sync state data of the user's mailbox. This time stamp is displayed in Outlook Web App and in the user's mobile phone properties dialog box in the Exchange Management Console.
 Important: |
|---|
| In addition to resetting the mobile phone to factory default condition, a remote device wipe also deletes any data on any storage card that's inserted in the mobile phone. If you're performing a remote device wipe on a mobile phone in your possession and want to keep the data on the storage card, remove the storage card before you initiate the remote device wipe. |
 Caution: |
|---|
| After a remote device wipe has occurred, data recovery is very difficult. However, no data removal process leaves a device as free from residual data as when it's new. Recovery of data from a device may still be possible using sophisticated tools. |
Remote Device Wipe vs. Local Device Wipe
Local device wipe is the mechanism by which a mobile phone wipes itself without the request coming from the server. If your organization has implemented Exchange ActiveSync policies that specify a maximum number of password attempts and that maximum is exceeded, the mobile phone performs a local device wipe. The result of a local device wipe is the same as that of a remote device wipe. The device is returned to its factory default condition. When a mobile phone performs a local device wipe, no confirmation is sent to the Exchange server.