Provisioning Windows Mobile phones

Similar to the previous post regarding provisioning iPhones for Exchange servers, the same can be done with Windows Mobile (though I don’t yet know how this will changes with Windows 7 Mobile).  I haven’t found a nice utility to do this, so your relegated to hand coding a .xml file, but it’s no biggie.

If your situation is similar to mine, you have many remote users with mobile phones.  There are times when they need to replace the phone while traveling or something else happens that requires resetting up the phone to connect to your mail server.  We require our self-signed certificate to be installed on the phone, coupled with needing to know all the settings it can be frustrating to help setup a phone, over a phone.

To create a provisioning file, open up your favorite text editor, I like NotePad++.  I started the document out with providing information to provision the certificate:

<wap-provisioningdoc>

<characteristic type="CertificateStore">

<characteristic type="ROOT">

<characteristic type="<certhash>">

<parm name="EncodedCertificate" value="<base64encodedcert>"/>

</characteristic>

</characteristic>

</characteristic>

</wap-provisioningdoc>

There are a few steps that need to be performed in order to get the certificate into the right form:

1. In Windows, open the root certificate
2. Choose the Details tab
3. Find Thumbprint in the Field column and select the text in the box
4. Replace <certhash> with the copied thumbprint in the .xml document, delete the white spaces
5. Close the certificate dialog boxes and open the certificate in a text editor.
6. Remove the BEGIN CERTIFICATE and END CERTIFICATE lines as well as the line breaks so it is one big string
7. Copy the text and replace the <base64encodedcert> with the text.

Next is to setup the Exchange server settings.  You will add the following above the </wap-provisioningdoc> but after the last </characteristic> from the certificate settings.

<characteristic type="Sync">

<characteristic type="Connection">

<parm name="Domain" value="<domain goes here>"/>

<parm name="Password" value="1234"/>

<parm name="SavePassword" value="1"/>

<parm name="Server" value="<mail server goes here>"/>

<parm name="User" value="USERNAME"/>

<parm name="URI" value="Microsoft-Server-ActiveSync"/>

</characteristic>

<characteristic type="Mail">

<parm name="Enabled" value="1"/>

</characteristic>

<characteristic type="Calendar">

<parm name="Enabled" value="1"/>

</characteristic>

<characteristic type="Contacts">

<parm name="Enabled" value="1"/>

</characteristic>

</characteristic>

You can simply fill in the blanks at this point.  I found that Password and User are required but you can put bogus info in there.  When the user installs the file, it will ask for their name and password, so don’t worry about that right now.  When all is said and done you should have a file similar to this (with your own values of course):

<wap-provisioningdoc>

<characteristic type="CertificateStore">

<characteristic type="ROOT">

<characteristic type="<certhash>">

<parm name="EncodedCertificate" value="<base64encodedcert>"/>

</characteristic>

</characteristic>

</characteristic>

<characteristic type="Sync">

<characteristic type="Connection">

<parm name="Domain" value="<domain goes here>"/>

<parm name="Password" value="1234"/>

<parm name="SavePassword" value="1"/>

<parm name="Server" value="<mail server goes here>"/>

<parm name="User" value="USERNAME"/>

<parm name="URI" value="Microsoft-Server-ActiveSync"/>

</characteristic>

<characteristic type="Mail">

<parm name="Enabled" value="1"/>

</characteristic>

<characteristic type="Calendar">

<parm name="Enabled" value="1"/>

</characteristic>

<characteristic type="Contacts">

<parm name="Enabled" value="1"/>

</characteristic>

</characteristic>

</wap-provisioningdoc>

Save the file as “_setup.xml” and your one step away from being able to deploy all of this!  The last step is to turn _setup.xml into a .cab file that can be installed on phones.  Open a command prompt and cd to the location of the _setup.xml file.  Type the following command to create a .cab file name mail.cab (name it whatever you want):

makecab /D COMPRESS=OFF _setup.xml mail.cab

The choice is yours as to how you want to deploy it.  You can put a link to it on a website, sync it with activesync and install it, etc.

When the user installs the .cab file they will be warned that the file is not signed, which is ok for the purposes of this document.  After the installation and the user click’s “OK” to close the window, ActiveSync should open on the phone prompting them for their name and password.  All the other settings are prepopulated including the certificate.

Keep in mind, there is a lot you can do with these provisioning files.  Lots of information is available on the web, Microsoft maintains a list of references that can be used in one of these files at http://msdn.microsoft.com/en-us/library/bb737536.aspx and also provides a strong overview of provisioning at http://msdn.microsoft.com/en-us/library/bb737289.aspx