Applies to: Exchange Server 2013

Topic Last Modified: 2012-07-11

Use the Set-ActiveSyncVirtualDirectory cmdlet to configure the Microsoft Exchange ActiveSync settings on a specified virtual directory.

For information about the parameter sets in the Syntax section below, see Syntax.

Syntax


Set-ActiveSyncVirtualDirectory -Identity <VirtualDirectoryIdParameter> [-ActiveSyncServer <String>] [-BadItemReportingEnabled <$true \| $false>] [-BasicAuthEnabled <$true \| $false>] [-ClientCertAuth <Ignore \| Accepted \| Required>] [-CompressionEnabled <$true \| $false>] [-Confirm [<SwitchParameter>]] [-DomainController <Fqdn>] [-ExtendedProtectionFlags <MultiValuedProperty>] [-ExtendedProtectionSPNList <MultiValuedProperty>] [-ExtendedProtectionTokenChecking <None \| Allow \| Require>] [-ExternalAuthenticationMethods <MultiValuedProperty>] [-ExternalUrl <Uri>] [-InstallIsapiFilter <$true \| $false>] [-InternalAuthenticationMethods <MultiValuedProperty>] [-InternalUrl <Uri>] [-MobileClientCertificateAuthorityURL <String>] [-MobileClientCertificateProvisioningEnabled <$true \| $false>] [-MobileClientCertTemplateName <String>] [-Name <String>] [-RemoteDocumentsActionForUnknownServers <Allow \| Block>] [-RemoteDocumentsAllowedServers <MultiValuedProperty>] [-RemoteDocumentsBlockedServers <MultiValuedProperty>] [-RemoteDocumentsInternalDomainSuffixList <MultiValuedProperty>] [-SendWatsonReport <$true \| $false>] [-WhatIf [<SwitchParameter>]] [-WindowsAuthEnabled <$true \| $false>]

Set-ActiveSyncVirtualDirectory -Identity
<VirtualDirectoryIdParameter> [-ActiveSyncServer
<String>] [-BadItemReportingEnabled <$true | $false>]
[-BasicAuthEnabled <$true | $false>] [-ClientCertAuth
<Ignore | Accepted | Required>] [-CompressionEnabled
<$true | $false>] [-Confirm [<SwitchParameter>]]
[-DomainController <Fqdn>] [-ExtendedProtectionFlags
<MultiValuedProperty>] [-ExtendedProtectionSPNList
<MultiValuedProperty>] [-ExtendedProtectionTokenChecking
<None | Allow | Require>] [-ExternalAuthenticationMethods
<MultiValuedProperty>] [-ExternalUrl <Uri>]
[-InstallIsapiFilter <$true | $false>]
[-InternalAuthenticationMethods <MultiValuedProperty>]
[-InternalUrl <Uri>] [-MobileClientCertificateAuthorityURL
<String>] [-MobileClientCertificateProvisioningEnabled
<$true | $false>] [-MobileClientCertTemplateName
<String>] [-Name <String>]
[-RemoteDocumentsActionForUnknownServers <Allow | Block>]
[-RemoteDocumentsAllowedServers <MultiValuedProperty>]
[-RemoteDocumentsBlockedServers <MultiValuedProperty>]
[-RemoteDocumentsInternalDomainSuffixList
<MultiValuedProperty>] [-SendWatsonReport <$true |
$false>] [-WhatIf [<SwitchParameter>]]
[-WindowsAuthEnabled <$true | $false>]

Examples

EXAMPLE 1

This example disables Basic authentication on the default Exchange ActiveSync virtual directory on the server Contoso.

	Copy Code
Set-ActiveSyncVirtualDirectory -Identity "contoso\Microsoft-Server-ActiveSync" -BasicAuthEnabled:$false

EXAMPLE 2

This example enables bad item reporting and turns on the option to send Watson reports for errors on the server Contoso.

	Copy Code
Set-ActiveSyncVirtualDirectory -Identity "contoso\Microsoft-Server-ActiveSync" -BadItemReportingEnabled:$true -SendWatsonReport:$true

EXAMPLE 3

This example configures the external URL on the default Exchange ActiveSync virtual directory on the server Contoso.

	Copy Code
Set-ActiveSyncVirtualDirectory -Identity "contoso\Microsoft-Server-ActiveSync" -ExternalUrl "http://contoso.com/mail"

Detailed Description

The Set-ActiveSyncVirtualDirectory cmdlet configures a variety of settings on the virtual directory used for Exchange ActiveSync including security, authentication, and internal and external URL settings.

You need to be assigned permissions before you can run this cmdlet. Although all parameters for this cmdlet are listed in this topic, you may not have access to some parameters if they're not included in the permissions assigned to you. To see what permissions you need, see the "Exchange ActiveSync virtual directory settings" entry in the Clients and Mobile Devices Permissions topic.

Parameters

Parameter Required Type Description

Identity

Required

Microsoft.Exchange.Configuration.Tasks.VirtualDirectoryIdParameter

The Identity parameter uniquely identifies the Exchange ActiveSync virtual directory to be configured. This value must be website\Microsoft-Server-ActiveSync.

ActiveSyncServer

Optional

System.String

The ActiveSyncServer parameter specifies the URL of the Client Access server. This value is in the following format: https://servername/Microsoft-Server-ActiveSync.

BadItemReportingEnabled

Optional

System.Boolean

The BadItemReportingEnabled parameter specifies whether items that can't be synchronized should be reported to the user. If set to $true, the user receives a notification when an item can't be synchronized to the mobile phone.

BasicAuthEnabled

Optional

System.Boolean

The BasicAuthEnabled parameter enables or disables Basic authentication. The default setting is $true.

ClientCertAuth

Optional

Microsoft.Exchange.Data.Directory.SystemConfiguration.ClientCertAuthTypes

The ClientCertAuth parameter specifies the status of client certificate authentication. By default, client certificate authentication is disabled. The default setting is Ignore.

CompressionEnabled

Optional

System.Boolean

The CompressionEnabled parameter is a Boolean value that identifies the compression applied to the specified Exchange ActiveSync virtual directory. The default setting is $true.

Confirm

Optional

System.Management.Automation.SwitchParameter

The Confirm switch causes the command to pause processing and requires you to acknowledge what the command will do before processing continues. You don't have to specify a value with the Confirm switch.

DomainController

Optional

Microsoft.Exchange.Data.Fqdn

The DomainController parameter specifies the fully qualified domain name (FQDN) of the domain controller that writes this configuration change to Active Directory.

ExtendedProtectionFlags

Optional

Microsoft.Exchange.Data.MultiValuedProperty

The ExtendedProtectionFlags parameter is used to customize the options you use if you're using Extended Protection for Authentication. The possible values are:

None Default setting.
Proxy Specifies that a proxy is terminating the SSL channel. A Service Principal Name (SPN) must be registered in the ExtendedProtectionSPNList parameter if proxy mode is configured.
ProxyCoHosting Specifies that both HTTP and HTTPS traffic may be accessing the Client Access server and that a proxy is located between at least some of the clients and the Client Access server.
AllowDotlessSPN Specifies whether you want to support valid SPNs that aren't in the fully qualified domain name (FQDN) format, for example ContosoMail. You specify valid SPNs with the ExtendedProtectionSPNList parameter. This option makes extended protection less secure because dotless certificates aren't unique, so it isn't possible to ensure that the client-to-proxy connection was established over a secure channel.
NoServiceNameCheck Specifies that the SPN list won't be checked to validate a channel binding token. This option makes Extended Protection for Authentication less secure. We generally don't recommend this setting.

ExtendedProtectionSPNList

Optional

Microsoft.Exchange.Data.MultiValuedProperty

The ExtendedProtectionSPNList parameter specifies a list of valid Service Principal Names (SPNs) if you're using Extended Protection for Authentication on the specified virtual directory.

The possible values are:

Null This is the default value.
Single SPN or comma delimited list of valid SPNs By default, you must specify the fully qualified domain name (FQDN) (for example mail.contoso.com) for each SPN. If you want to add an SPN that's not an FQDN (for example, ContosoMail), you must also use the ExtendedProtectionTokenChecking parameter with the AllowDotlessSPN value. You specify the domain in SPN format. The SPN format is <protocol>/<FQDN>. For example, a valid entry could be HTTP/mail.contoso.com.

ExtendedProtectionTokenChecking

Optional

Microsoft.Exchange.Data.Directory.SystemConfiguration.ExtendedProtectionTokenCheckingMode

The ExtendedProtectionTokenChecking parameter defines how you want to use Extended Protection for Authentication on the specified Exchange virtual directory. Extended Protection for Authentication isn't enabled by default. The available settings are:

None Extended Protection for Authentication won't be used. Connections between the client and Exchange won't use Extended Protection for Authentication on this virtual directory. This is the default setting.
Allow Extended Protection for Authentication will be used for connections between the client and Exchange on this virtual directory if both the client and server support Extended Protection for Authentication. Connections that don't support Extended Protection for Authentication on the client and server will work, but may not be as secure as a connection using Extended Protection for Authentication.

Note:
If you have a proxy server between the client and the Client Access server that's configured to terminate the client-to-proxy SSL channel, you must also configure one or more Service Principal Names (SPNs) by using the ExtendedProtectionSPNList parameter.

Require Extended Protection for Authentication will be used for all connections between clients and Exchange servers for this virtual directory. If either the client or server doesn't support Extended Protection for Authentication, the connection between the client and server will fail. If you set this option, you must also set a value for the ExtendedProtectionSPNList parameter.

Note:
If you have a proxy server between the client and the Client Access server that's configured to terminate the client-to-proxy SSL channel, you must also configure one or more SPNs using the parameter ExtendedProtectionSPNList.

ExternalAuthenticationMethods

Optional

Microsoft.Exchange.Data.MultiValuedProperty

The ExternalAuthenticationMethods parameter specifies the authentication methods supported by the server that contains the virtual directory when access is requested from outside the network firewall. If this parameter isn't set, all authentication methods can be used.

ExternalUrl

Optional

System.Uri

The ExternalUrl parameter specifies the URL used to connect to the virtual directory from outside the network firewall.

InstallIsapiFilter

Optional

System.Boolean

The InstallIsapiFilter parameter specifies whether the Internet Server API (ISAPI) filter is installed.

InternalAuthenticationMethods

Optional

Microsoft.Exchange.Data.MultiValuedProperty

The InternalAuthenticationMethods parameter specifies the authentication methods supported by the server that contains the virtual directory when access is requested from inside the network firewall. If this parameter isn't set, all authentication methods can be used.

InternalUrl

Optional

System.Uri

The InternalUrl parameter is used for the Client Access server HTTP Proxy feature. If it's set, the Client Access server receiving the incoming client connections proxies the requests to this URL. This can be an Internet-facing FQDN URL or an internal host name.

MobileClientCertificateAuthorityURL

Optional

System.String

The MobileClientCertificateAuthorityURL parameter specifies the URL for the certification authority (CA) used by the mobile phone.

MobileClientCertificateProvisioningEnabled

Optional

System.Boolean

The MobileClientCertificateProvisioningEnabled parameter specifies whether the Autodiscover service returns the Certificate Services server URL in the XML file.

MobileClientCertTemplateName

Optional

System.String

The MobileClientCertTemplateName parameter specifies the template name for the client certificate.

Name

Optional

System.String

The Name parameter specifies the name of the Exchange ActiveSync virtual directory.

RemoteDocumentsActionForUnknownServers

Optional

Microsoft.Exchange.Data.Directory.SystemConfiguration.RemoteDocumentsActions

The RemoteDocumentsActionForUnknownServers parameter specifies the action that occurs when a Microsoft Windows SharePoint Services or Microsoft Windows file share request comes in via Exchange ActiveSync. When a request arrives, Exchange ActiveSync looks for the requested host name in the Allow and Block lists. If the host name isn't found in either list, the action specified in this parameter, either Block or Allow, is performed.

RemoteDocumentsAllowedServers

Optional

Microsoft.Exchange.Data.MultiValuedProperty

The RemoteDocumentsAllowedServers parameter is a multivalued property that lists all the allowed servers for remote document access.

RemoteDocumentsBlockedServers

Optional

Microsoft.Exchange.Data.MultiValuedProperty

The RemoteDocumentsBlockedServers parameter is a multivalued property that lists all the blocked servers for remote document access.

RemoteDocumentsInternalDomainSuffixList

Optional

Microsoft.Exchange.Data.MultiValuedProperty

The RemoteDocumentsInternalDomainSuffixList parameter is used in organizations that don't run Windows Internet Name Service (WINS) in their network. In these environments, you can specify one or more FQDNs that Exchange ActiveSync treats as internal when a request for remote file access is received.

SendWatsonReport

Optional

System.Boolean

The SendWatsonReport parameter specifies whether a Watson report is sent for errors and events.

WhatIf

Optional

System.Management.Automation.SwitchParameter

The WhatIf switch instructs the command to simulate the actions that it would take on the object. By using the WhatIf switch, you can view what changes would occur without having to apply any of those changes. You don't have to specify a value with the WhatIf switch.

WindowsAuthEnabled

Optional

System.Boolean

The WindowsAuthEnabled parameter specifies whether Integrated Windows authentication is enabled. The default value is $false.

Input Types

To see the input types that this cmdlet accepts, see Cmdlet Input and Output Types. If the Input Type field for a cmdlet is blank, the cmdlet doesn’t accept input data.

Return Types

To see the return types, which are also known as output types, that this cmdlet accepts, see Cmdlet Input and Output Types. If the Output Type field is blank, the cmdlet doesn’t return data.