Wiping a Device
4/8/2010
Mobile Operators or System Administrators can clear flash memory from a remote location or based on an established number of failed authenticate attempts.
The following table shows the description of each type of wipe.
| Wipe type | Description |
|---|---|
Local wipe |
Enables a Mobile Operator or System Administrator to implement a local wipe policy that wipes the Windows Mobile device's flash drive when a user fails authentication too many times. Prior to the last authentication attempt allowed, a message is displayed to let the user know that they only have one chance left before the device automatically reboots and reformats the flash drive. When too many failed authentication attempts occur, the user is prompted periodically to enter a pre-defined pass code. |
Remote wipe |
Enables a Mobile Operator or System Administrator to force the Windows Mobile device to reboot and reformat the flash memory. |
Local Wipe
To perform a local wipe, you would use the Password Required Policy (4131) and the DeviceWipeThreshold registry key. As described in the Security Note below, Microsoft recommends that you enforce authentication from the device using SECPOLICY_LASS_DESKTOP_QUICK_CONNECT policy (4146).
The following registry key indicates the number of times an incorrect password can be entered before the device's memory is securely erased.
Registry\HKLM\Comm\Security\Policy\LASSD\DeviceWipeThreshold
| Value:Type | Description |
|---|---|
number:INT |
The number of incorrect password attempts allowed. The value can be 1 through 4294967295 (0xFFFFFFFF). The Manager and Enterprise role can change this registry key. This setting corresponds with a setting available on the Device Security Settings dialog box in Exchange Server 2003 SP2. |
This registry key does not exist by default. If this registry key does not exist, is set to zero (0), or is set to 4294967295 (0xFFFFFFFF), the local wipe feature is turned off.
Note
The Hint that appears for users to remind them of their password, is hard–coded to appear after five incorrect password attempts. Exchange Administrators must take this into consideration, and configure Remote Wipe to occur after users see their Hint.
.gif "Cc842616.security(en-us,MSDN.10).gif") Security Note: |
|---|
| Microsoft recommends that, if a user sets DeviceWipeThreshold to something other than 0 or 0xFFFFFFFF, you should also use the SECPOLICY_LASS_DESKTOP_QUICK_CONNECT policy (4146) to enforce authentication from the device. If authentication is not forced from the device and the user authenticates from the desktop instead, the password attempts made from the desktop will not count against the number of incorrect attempts that will wipe the device. |
To change this registry setting, you must create an XML file that uses the Registry Configuration Service Provider. For more information about how to create the XML, see Changing Registry Settings by Using the Registry Configuration Service Provider.
Remote Wipe
You can wipe the device even when Password Required or DeviceWipeThreshold is not enforced. This is accomplished by using the Exchange Server Configuration Tools directly.