A PIN is a numeric string that's used in certain systems, including Unified Messaging systems, so that a user can be authenticated and gain access. A PIN is a passcode that users enter on the telephone to access their Exchange Server mailbox. The strength of the PIN depends on its length, how well it's protected, and how difficult it's to guess.

PINs are most frequently used for automatic teller machines (ATMs). However, they are also used for Unified Messaging systems instead of alphanumeric passwords. In Exchange 2010 Unified Messaging, the PIN is entered over an analog, digital, or mobile telephone and is used to gain access to the user's mailbox that includes e-mail, voice mail, and calendaring information.

In Exchange 2010 Unified Messaging, PIN policies are defined and configured on a UM mailbox policy. Multiple UM mailbox policies can be created depending on your requirements. When you enable a user for Exchange 2010 Unified Messaging, you associate or link the user to an existing UM mailbox policy. The UM PIN policies that are configured on the UM mailbox policy should be based on the security requirements of your organization.

The following are several PIN configuration settings that you can set on a UM mailbox policy in Exchange 2010.

Minimum PIN Length

The Minimum PIN Length setting specifies the minimum number of digits that a mailbox PIN can be. The range is 4 through 24, and the default is 6. If you enter 0, users aren't required to enter a PIN.

Important:
Configuring this setting with zero isn't a recommended practice. By configuring this setting to zero, you greatly decrease the level of security for your network.

If you change the minimum password length to a higher value, existing subscribers are prompted to enter a new PIN that contains the new minimum number of digits before they can continue.

Note:
Increasing this number creates a more secure UM environment. However, setting it too high can result in users forgetting their PIN.

PIN Lifetime

The PIN Lifetime setting controls the time interval, in days, from the date subscribers last changed their PIN to the date they'll be forced to change their PIN again. The range is 0 through 999, and the default is 60 days. If 0 is entered, the PIN won't expire.

Note:
Unified Messaging won't notify users when their PIN is about to expire.

Logon Failures Before PIN Reset

The Logon Failures Before PIN Reset setting specifies the number of sequential unsuccessful logon attempts before the mailbox PIN is automatically reset. To disable this feature, set this setting to unlimited. Otherwise, it must be set to a number lower than the Maximum Logon Attempts setting. The range is 1 through 998, and the default is 5.

Note:
To increase security for UM-enabled users, enter a number that's less than 5.

Maximum Logon Attempts

The Maximum Logon Attempts setting specifies how many PIN entry errors in successive calls subscribers can make before they're locked out of their mailbox. By default, after 5 attempts are made, the PIN is automatically reset. The range is 1 through 999, and the default is 15.

Note:
To increase security, decrease the number of failed attempts. But remember that decreasing it to a number much lower than the default may result in users being locked out unnecessarily. Unified Messaging will generate warning events that can be viewed using Event Viewer if PIN authentication fails for a UM-enabled user or the user is unsuccessful in trying to log on to the system.

Allow Common Patterns

PIN History Count

When planning for UM PINs, you must make sure that you choose the appropriate levels of security for your organization. You must carefully consider the UM PIN requirements and how your PIN security settings meet or exceed your organization's security policy.

Important:
It's a security best practice to implement strong PIN requirements for Unified Messaging users. This can be enforced by creating Unified Messaging PIN policies that require six or more digits for PINs and increases the level of security for your network.

After you set the PIN requirements that meet the security requirements for your organization, you must create and configure a UM mailbox policy to enforce your organizational PIN requirements. For more information about how to create and manage a UM mailbox policy, see Managing UM Mailbox Policies.

Note:
After you create the UM mailbox policy, you must associate the UM-enabled user or users with the appropriate UM mailbox policy. You can perform this task by using the Enable-UMMailbox Exchange Management Shell command. For more information about the Exchange Management Shell command, see the Enable-UMMailbox reference topic.

There are situations in which UM users forget their PIN or are locked out of UM access to their mailbox. In either case, it may be necessary for you to reset a UM-enabled user's PIN. For more information about how to reset a user's PIN, see Reset a Unified Messaging PIN for a UM-Enabled User.