Devicewire Weblog

Enabling RPC over HTTPS on a single Exchange 2003 Server

2008-10-10T20:36:00Z

Enabling RPC over HTTPS on a single Exchange 2003 Server

“What is RPC over HTTPS, and why is enabling it on a single Exchange Server significant?” I hear you cry.

RPC over the HTTP(S) is the technical term for ‘Outlook Anywhere’ – the technology that allows you to access Exchange from an Outlook client via any Internet connection as if you were connected via the local network.

Outlook Anywhere is similar to the Server ActiveSync protocol used by Windows Mobile devices to access Exchange in that it is used to synchronise email, contacts and calendar with the client device, but whereas Server ActiveSync can only synchronise data with a specific user mailbox, Outlook Anywhere allows the user to use the full functionality of their Outlook client remotely – this includes accessing mailboxes other than their own (should they have permission to), public folders, everything they can do when connected locally in the office.

RPC stands for Remote Procedure Call. Whenever you perform an action in Outlook that requires a response from the Exchange server, Outlook sends a remote procedure call to the Exchange server and gets a response back.

What Outlook Anywhere does is to encrypt these remote procedure calls using a digital certificate and then send them to the Exchange server over the Internet, hence RPC over HTTPS.

Exchange 2007 can support Outlook Anywhere in a single-server deployment, but Exchange 2003 requires that Exchange be deployed in a 2-server topology called a ‘front-end’ / ‘back-end’ deployment. This is principally for security reasons: the ‘front-end’ server, because it is Internet-facing, sits in a DMZ environment and receives the encrypted request from the Outlook client. It then decrypts the request and sends it, unencrypted, over the local network to the ‘back-end’ Exchange server exactly as a local Outlook client would do. When the response is received from the back-end Exchange server, it is encrypted and then sent back to the client over the Internet.

It is possible to do all of this without encrypting the information, in which case it would be RPC over HTTP, but this guide assumes that you are using a certificate to encrypt information and I would not recommend not doing so.

It is important to note that Exchange 2007 can also be configured in this way should security be a concern, except that with Exchange 2007 the terminology has changed so that you no longer have ‘front-end’ and ‘back-end’ servers, instead you have different Exchange roles that can be applied in any topology you want – so you have ‘edge servers’ and ‘mailbox servers’ as well as ‘client access servers’ and ‘hub transport servers’.

The ‘role’ of an Exchange 2003 server is specified in the Exchange System Manager. Right click on the Exchange server and select Properties. On the General tab there is an option to specify ‘This is a Front End server’:

In a single-server deployment, if you try to select this option you will receive an error indicating that you cannot set a server as a front-end server if it is the only Exchange server in the organisation:

However, trust me, it IS possible. But it does involve editing the registry on the Exchange server. Because of this I cannot stress enough that you do NOT perform any of what I am about to tell you on your own production (that is to say, LIVE) Exchange environment unless you fully understand the ramifications of any changes you make to your server and have at the very least a full backup of the server that can be restored should anything go wrong. In fact, I would suggest that, if you do want the functionality of Outlook Anywhere and cannot afford either an additional license for a second Exchange server or an upgrade to Exchange 2007, that you pay me to do it for you!

To enable RPC over HTTP on your Exchange server, there are a number of steps you need to follow.

Install RPC over HTTP Proxy Service

You first need to install the RPC over HTTP proxy service. This is a component of the Windows Server operating system and is installed via the Add/Remove Windows Components applet within the Control Panel. It is located under Networking Services:

Configure authentication mechanism to RPC virtual directory within IIS Manager

Now launch the Internet Information Services (IIS) Manager applet. Locate the RPC virtual directory:

Right click on the virtual directory and select Properties.

Click on the Directory Security tab and then on the Edit button in the Authentication and Access Control section:

Untick the option to Enable Anonymous Access.

Tick the option to enable Basic Authentication, a warning message will be displayed click Yes to acknowledge it.

In the Default Domain field, click on the Select button and select the Domain that the Exchange server services:

Click OK.

NOTE – you have now basic authentication access to the Exchange server RPC directory, as mentioned previously this is acceptable if you are using a digital certificate to encrypt client-server communications, if you are not then any password information sent over the Internet could be intercepted.

Configure RPC virtual directory to require SSL communication within IIS Manager

Still within the Directory Security tab, click on the Edit button in the Secure Communications section:

Ensure that the option to Require Secure Channel (SSL) is ticked, as well as the option below it. Normally this option will be selected already if you use SSL with Outlook Web Access.

Configure RPC port access in the Registry

On the Exchange server, click on Start and select Run. Type in ‘regedt32.exe’ and click OK. This will launch Registry Editor.

Browse to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem

Verify that the Rpc/HTTP port is set to 6001 (it will be by default):

Now browse to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeSA\Parameters

Verify that the HTTP Port is set to 6002 (it will be by default)

Also verify that the Rpc/HTTP NPSI Port is set to 6004 (it will be by default)

Now browse to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\RpcProxy

Double click on the ValidPorts entry, the following will be displayed:

Delete the contents of the field (exchange:100-5000), and replace it with the following:

<ServerNETBIOSName>:6001-6002;<ServerFQDN>:6001-6002;<ServerNetBIOSName>:6004;<ServerFQDN>:6004

where <ServerNETBIOSName> is the machine name of the Exchange server itself, and <ServerFQDN> is its external name (ie the name used by Outlook Web Access)

So my server would require the following entry:

exchange:6001-6002;exchange.oa-demo.co.uk:6001-6002;exchange:6004;exchange.oa-demo.co.uk:6004

Exit Registry Editor.

Configure RPC over HTTP Topology in Exchange System Manager

Launch the Exchange System Manager.

Right click on the Exchange Server and select Properties.

Click on the RPC-HTTP tab, the following will be displayed:

Select the option to make the server a Back-End server. An error message will be displayed:

Click OK to acknowledge the error. Click OK again to save the changes to the configuration. A warning message will be displayed warning that the ports have not been configured correctly and be prompted to reconfigure them. Click CANCEL. You will be prompted to reboot the server.

Now reboot the Exchange Server.

Install the SSL certificate on the client PC

Before you can use Outlook to connect to the Exchange server via RCP over HTTPS, you will first need to install the correct SSL certificate onto the client PC to authenticate the certificate used by the Exchange server. This is only necessary if you are using a self-issued certificate. If you are using a root-trusted certificate on the Exchange server then ignore this step.

The certificate that needs to be installed on the client PC is not the certificate used by the RPC virtual directory on the Exchange server, but the root certificate of the Certificate Authority that issued the certificate to the RPC directory.

To locate this certificate, log into the server that has the Certificate Authority service installed on it. This may well be the Exchange server itself, it depends on how your network is deployed.

On the server that is acting as the CA, open the Control Panel and open Internet Options.

Click on the Security tab and the on the Certificates button.

Click on the Trusted Root Certification Authorities tab.

Locate the certificate issued by the CA and export it as a CER file. Copy this file to the client PC.

On the client PC double click the CER file to install it. Select the option to install it to the Trusted Root Certification Authorities folder.

Configure the Outlook Client

NOTE – to use Outlook via RPC over HTTPS you will require Outlook 2003 or later.

Create a new Outlook profile if required.

Select the option to create an Exchange Server account.

In the Server Name field enter the LOCAL address of the Exchange server (ie the machine name, or the NETBIOS name)

Enter your username.

DO NOT CLICK NEXT at this point, click on the More Setting button.

You may receive an error saying that the Exchange server cannot be contacted, click OK. A further window will be displayed asking you to verify the address of the Exchange server, click Cancel.

The More Settings window will now be displayed. Click on the Connection tab:

Tick the option to Connect to Microsoft Exchange using HTTP. Click on the Exchange Proxy Settings button:

Enter the external web address of the Exchange server (ie the address used for Outlook Web Access) in the fields as shown above. In the second text field, the ‘msstd’ is required!

Click OK, OK again, Next and then Finish.

Now launch Microsoft Outlook.

You will be prompted to enter your NT domain login credentials:

Enter your username in the form ‘DOMAIN\Username’

You will now be connected to the Exchange server:

In the immortal words of a popular 80s television show: "I love it when a plan comes together!"

Xobni

2008-10-06T11:15:00Z

No that isn't a typo, this blog post is to tell you about Xobni, a free plug-in to Microsoft Outlook to help you organise your email and keep track of conversations and files, as well as providing statistics on your email usage. It is available for download here:

http://www.xobni.com

Why Xobni? The quicker of you will have noticed that xobni is 'inbox' spelt backwards, and it really is clever. Once installed it adds an extra navigation pane to your Outlook view (Outlook 2003 and 2007 are supported currently), like so:

Each time you select a mail from any of your folders, information will be displayed instantly about the sender of that mail.

Statistics are displayed at the top of the screen indicating how may mails have been sent to and received from that person, and at what hours of the day.

If that person has an account with LinkedIn (http://www.linkedin.com), their profile can be accessed directly from within the Xobni toolbar.

The latest mail threads, or conversations, you have had with that person are displayed in chronological order, and any files that were attached to any of those mails are displayed for easy access.

In short, a work of organisation genius!

Cloud Computing - what's it all about?

2008-10-06T10:33:00Z

“Cloud Computing” is very much the buzz word of the day, but what is it?

The “Cloud” refers to the Internet in general. It is so-called due to the fact that it is typically depicted as a cloud in most network diagrams, like so:

It is depicted as a cloud both to represent the fact that the Internet is, by its very nature, ethereal and ever-changing, but also because for the most part, what happens in the background to make data travel across the Internet between two endpoints is largely irrelevant to most people – you just need to trust that it works!

The Internet can actually be represented as looking like this:

But I digress. Cloud computing refers to the recent trend of moving away from traditional, locally-hosted application and storage servers, to using servers hosted by a third party service provider. These servers are connected to the Internet and as such are available from anywhere in the world. Indeed, you may not know where in the world the servers you access are physically located, and it doesn’t matter. For this reason, the server are said to be “in the cloud”.

Google is a good example of such a service provider. Google Apps is a collection of applications, some of which are purely web-based, some of which require that software be installed on your device to access online services.

The suite can be accessed at http://www.google.com/apps

Currently the suite is comprised of the following ‘cloud-based’ applications:

Google Mail (Gmail) – web-based email, similar to Hotmail but which unlike Hotmail can be accessed via the IMAP email protocol, making it accessible from virtually any email client without the need to install any additional software, but also providing more functionality than the more prevalent POP protocol such as the ability to manage folders and move messages between them.

Google Talk – a free instant messaging and file transfer client, like Windows Messenger or Jabber, but which also includes IP telephony capabilities like Skype.

Google Calendar – an online calendar which can be accessed from your web browser and can also be synchronised from common desktop applications such as iCal on the Mac as well as Microsoft Outlook.

Google Docs – web-based Document, Spreadsheet and Presentation creation service enabling documents to be created and edited and saved online, ready for access anytime simply via a web browser, across virtually platforms, including Windows Mobile.

Google Maps – an online mapping service allowing you to view specific locations or map routes between them.

Google Earth – a software utility that harnesses converged satellite imagery to produce a full 3D zoomable model of the entire planet.

Most of these applications require that you first register for an account with Google before you can use them.

Google Docs

Although Google Earth is possibly my favourite, Google Docs is perhaps the most significant as it provides feature rich, always-on document creation capability from virtually any internet-connected device, completely for free. All you need to do is fire up a web browser login and get creating. Your document is saved securely online on Google’s servers until you next login and edit it. At any point you can save the document to your device, email it, or print it. It is also possible to share the document with other users providing online collaboration in real time.

This is a big deal – Microsoft will charge you thousands of pounds to install Sharepoint, their equivalent server-based product that does the same thing, and it is precisely Microsoft’s hegemony over this market sector that Google are targeting.

Google Gears

Google Docs is a very clever service, but it does require that you have a connection to the Internet to use it. What if you’re stuck somewhere where you don’t have an Internet connection, or are on the move and need to make a quick adjustment to a document before you forget and can’t be arsed to connect to the Internet?

Google Gears is the answer.

Gears, as it is now known as it is not a solely Google-related application, is an open source collaborative effort to develop a framework to provide offline access to online applications.

It is a free plugin to your web browser and can be downloaded from the Google web site.

When Gears is installed, your Google Docs web session has an ‘Offline’ option in the menu bar, which when clicked allows you to ‘add’ the site to the Gears plugin:

Once enabled an icon will be added to your programs folder;

Launching the application will display the same document in your same web browser, but will indicate that you are editing the document offline:

The next time you login when you are connected, the document changes will be synced automatically. Pretty cool eh?

Other companies are re-inventing themselves as “cloud service providers”: Microsoft has long had its Hotmail email platform, now called ‘Windows Live’, and has now launched a hosted Exchange service in the US allowing companies and ‘prosumers’ to enjoy the functionality of an Exchange 2007 server-based mailbox, without the worry of having to install, configure and maintain it. Exchange now supports such a wide range of access methods and client device types that it no longer matters where in the world your mailbox is physically held, if you have a connection to the Internet you can send and receive email.

Apple has recently launched its MobileMe service, and has integrated it into the iPhone, iPod Touch and MacOS X platforms as well as releasing a client for the Windows operating system. MobileMe (http://www.apple.com/mobileme/) provides an online storage area and tools to synchronise mail, contacts, calendar, photos and files with your device.

Nokia have also jumped on the bandwagon and have set up the Ovi service (http://ovi.nokia.com/services/)

The OVI Suite is a free download from the Nokia web site and comprises a number of applications:

· Nokia Music

· Nokia Photos

· Nokia Videos

· Nokia One Touch Access

· Nokia Map Loader

· Nokia Software Updater

· Nokia Home Media Server

The main 'dashboard' of the software is designed as a portal to online services, and as an online storage area, similar to MobileMe, where you can upload your photos, pictures, files, etc.

OVI also has all of the applications that are shipped with the Nokia PC Suite:

· Application Installer

· Content Copier

· PC Sync

The One Touch Access application allows you to establish a connection to the Internet via your connected Nokia phone with a single click.

The Nokia Music application offers similar features to iTunes in that you can manage the music on your PC, transfer it to your Nokia phone and purchase new music from the online Nokia Store:

The Photos and Videos applications allow you to browse the contents of your Nokia phone’s media folders and upload them to your personal storage area in the “Nokia Cloud”.

The Nokia Map Loader application lets you download free map information for the built-in GPS software on the new Nokia E and N series range of devices. The Nokia Software Updater, as its name suggests, checks for firmware updates for your phone, downloads and installs them.

The Nokia Home Media Server allows you to share content on your PC with other users on the same local network who also have the OVI software installed:

Personally, with the cost of storage forever plummeting, and the technology now available to cram 1TB of data onto a 2.5-inch laptop hard drive, I still prefer to store all my data locally, but having it online and available from anywhere in the world from a mobile device is pretty cool.

The big question is whether businesses will see the potential of cloud computing and start to replace the traditional model of having Microsoft Office installed on every PC with one where applications are hosted online and accessed via a web browser.

Eltima SyncMate for Mac OS X

2008-10-05T09:16:00Z

Sync Mate is a utility for Mac OS X that allows you to synchronise your Windows Mobile 5 or 6 device with your Mac.

The free version of the software is available for download here:

http://www.eltima.com/products/syncmate/

The free version allows you to synchronise contacts and calendar with the Mac Address Book and iCal applications, as well as read your SMS messages.

The Expert verison, which you need to purchase, allows you sync awhole lot more, as you can see from the screenshot above. But the real benefit of the free version of the software is that when the PDA is connected to the Mac for the first time, a network adapter is installed within the System Preferences, which allows you to use your Mac's Internet connection from the Windows Mobile device:

The other really cool feature, which to the best of my knowledge is unique, you can also mount the Windows Mobile PDA as a drive, to view the contents of the device and drag and drop files to and from the Mac. Once mounted, the PDA is displayed as a drive:

Which can be controlled via the Finder:

Eltima supports both USB and WiFi connections.

Perlego Device Management

2008-10-04T11:42:00Z

Perlego (www.perlego.com) is a US-based company that offers a complete, hosted, web-based device management solution for Windows Mobile, Symbian and Palm devices – no server hardware is required and there is no setup lead time: you can literally be good to go virtually immediately.

I admit that I had not come across this company myself until recently, and the Perlego web site is an exercise in ‘marketing-eze’ which tells you very little of any use for such a large amount of text and expensive flash animation, but in light of the demise of the Nokia Intellisync platform (http://blog.devicewire.com/blogs/devicewire/archive/2008/09/29/nokia-to-cease-all-development-work-on-intellisync.aspx), I thought it would be wise to examine alternatives - so I thought I’d give you the inside scoop on a potential candidate. Indeed Perlego themselves have been quick to realise an opportunity and at the time of writing there is a banner on their web site advertising a special introductory offer to existing Nokia Intellisync customers.

Read on…

Features

Perlego Device Management comprises three primary components:

· Perlego Backup

· Perlego Update

· Perlego Remote

Perlego Backup does what it says on the tin – it allows the user to backup the contents of their PDA (either all of it, or selective contents) to a secure online storage area, and restore that backup at a later date if required.

Perlego Update allows the administrator to ‘publish’ files to a secure online storage area and allow users access to those files, be they documents, images, applications, or any other file type.

Perlego Remote works silently in the background and allows the administrator to send commands to the client device transparently to the user to perform virtually any change on the client device that you can think of.

I will look at all of these features in more detail.

Infrastructure

The entire Perlego solution is web-based. The client is installed onto the device via the browser on the client itself – the web site sending the correct version of the client software to the device based on the type and version of the browser used.

All administration of the solution is also done via a hosted web interface.

All client-server communications are secured by 128-bit SSL encryption.

All client-server communications are also ‘connection-agnostic’, meaning that the solution can be used over GPRS, 3G, WiFi, or via a tethered connection to a PC.

Licensing

When you sign up for an account with Perlego, your company is set up as a ‘Domain’ on the server. You are given an administrative login to the admin web interface, and a set number of client licenses.

Client licenses are valid for 365 days from the moment the client is installed on the mobile device, after which time they become inactive.

I will look at the admin web interface in a moment, but it is important to note that the principle strength of Perlego (a unique strength to the best of my knowledge), is that your entire mobile device fleet can be up and running with a fully-featured device management solution in the time it takes for you to ring Perlego and be assigned your licenses: there is no hardware setup involved at all. This is an attractive model both to the Perlego and the customer: the customer has no hardware setup, maintenance or backup costs; and Perlego have an ongoing revenue stream based on an annual renewal process.

Client Installation

For the rest of this article, I will focus on using Windows Mobile as the client device type, but the same features are available for Symbian devices also as well as Palm, and I have it on good authority that the roadmap also has the iPhone and the Google Android platform on it.

Installation is very simple, and does not require that the device be connected to a PC. Simply open a browser on the device and connect to http://tryperlego.com

This link is the same one to use on all client devices – the web site detects which browser is being used and displays the appropriate download link accordingly.

The following screen will be displayed:

Click on the link to download the Perlego Mobile Suite, you will be prompted to download and run the installer file:

After a few minutes the software will be installed:

Two icons will be added to the Programs folder:

· Perlego Backup

· Perlego Updates

When running the Perlego software for the first time you will be prompted to enter a license code. It is this license code that identifies the device with your Domain.

This license can either be emailed to the user, or read out to them over the phone. Alternatively, devices can be ‘pre-registered’ on the server provided that you know the IMEI number of the device.

Perlego Backup

Selecting the Perlego Backup icon launches the backup application:

The Backup and Restore service runs independently of and is separate from the Update and Remote services.

Several options can be configured to refine the amount of data that is backed up:

A full backup can be selected, which will copy the entire contents of the device, or alternatively specific applications and folders can be selected:

· Contacts

· Calendar

· My Documents

· SIM address book

He advanced options all the user to exclude specific folders from the full backup, as well as specific file types:

Once all of the options have been configured, the first time you run the Backup application you will be prompted to create an account with the online storage area and enter a username and password of your choice:

If you already have a username and password, you can skip this step and enter your login details.

Selecting the Restore application will prompt you for the same username and password, and will display a list of available backups to choose from.

Backup performed from the same device are incremental, therefore whilst the first backup may take a while and upload a large amount of data to the server, subsequent backups will only upload those files that have been added or modified.

Any backups that are uploaded from a device can be restored to any other device – independent of their type. Therefore, it is possible to backup your contacts from a Windows Mobile device, and then restore those same contacts to a Symbian device should you change device type.

I would classify the Backup option as ‘nice to have’ but also potentially costly: there is no means of restricting how users initiate a backup or a restore operation. If a user was to initiate a full device backup over a 3G connection while roaming the resulting cost incurred could be staggering. The ability to restrict operations to a high-speed connection only will be available in a future release of the software.

Backup can be disabled altogether on the client device via the Perlego Remote feature, which I will look at in a moment.

Perlego Update

The Perlego Update feature allows the administrator to publish files to client devices from the server. Whilst the Backup feature is a separate component that works on a user login basis, both the Perlego Update and Perlego Remote features are configured by the administrator via the web interface.

The web interface is accessed via a web browser using the same link as that used on the client devices to download and install the client – http://tryperlego.com

This link can only be accessed from Internet Explorer, no other browsers are supported for the admin interface (because if you use a different browser, the web site will think that you are accessing it from a client device and get confused).

When accessing this site from IE, you will be prompted for a username and password rather than being displayed the client download link.

The ‘look’ of the web interface can be customised in as much as you can add your company logo in the top right hand corner of the screen and can customise a colour scheme. I have it on good authority that the GUI for the interface is going to be overhauled radically as it is currently a bit austere and far from intuitive, see what you think of this:

Nice isn’t it!

I will go through each of the elements of the admin interface as they apply to the different features available.

Perlego Update requires that ‘Categories’ be created on the server. Each category also requires that an ‘Icon’ be uploaded to the server to represent that category on the client device.

The procedure is as follows.

In the admin interface, expand Content Distribution --> Publish To Catalog --> Icon Groups à New:

The following window will be displayed:

Enter a name for the Icon. Your company domain will be listed automatically.

3 different icon categories exist – these are available in different sizes for the different client types that are supported.

Browse to where you have saved the desired icon file, select the target client device types from the list and click Insert to upload the new icon.

The Icon group will now be listed:

You can now create a Category. This is done within Content Distribution --> Publish To Catalog --> Categories:

Enter a name for the Category as well as a Description. The text that is entered in the Description field is not viewable to the user on the client device, this is to identify the category to the administrator.

The Display Priority field allows you to specify where on the client the Category is displayed. This is only relevant if you have more than one category defined. It is possible to have up to 9999 categories defined!

Select the Icon you defined earlier and associate it with the Category.

Now you need to upload the files to the server that you want to be available in the Category.

This is done within Content Distribution --> Publish To Catalog --> Publish Content:

Select the Category to which the file is to be published. Select the device type.

Enter a name for the Publication. Specify the Display Priority (this works in the same way as the Categories, but defines where within the Category the publication is displayed).

Browse to where the file is saved that you wish to upload.

The Unique File Identifier field is a bit misleading. Unless you enter some text in this field, when the file is downloaded to the client it will be saved with a name of 12345678901234567890.xx (where this is a randomly generated file name). If you want the file to be saved on the client with a specific name, you need to enter this filename in this field.

Any text you enter in the Description field IS viewable to the user on the client device.

Scroll down, the following will be displayed:

You can specify where on the device the file is downloaded to. From the drop-down menu there are a number of pre-defined locations available, such as ‘My Documents’, ‘Program Files’, etc, or you can add a new location which will be created on the client device automatically.

It is also possible to define an installation path. This is largely irrelevant as if you are sending say, a CAB application package to a Windows Mobile device, it is the CAB file that defines where the resulting application is installed to. This path defined here is largely just a temporary installation file location path.

If you want the file that you are sending to the device to be opened once it is successfully downloaded, select ‘Open’ from the Command menu. If the file that you are sending to the client device is an executable, and there are specific parameters that need to be defined when the executable is run, select Add New and enter the correct syntax for those parameters.

Select the Icon that you want the publication to have on the client device.

Select the client device types that you want the publication to be available to.

Scroll down, the following will be displayed:

You can select which languages the package should be available to (based on the language of the operating system installed on the client device).

You can also specify Filters and Families that the publication is a member of – I will look at these in a moment as they add some powerful intelligence to the system that it is important to be aware of.

You can also a specify a date range within the which the package is available for, after which the package will not be.

Specify the delivery options for the publication and click Publish.

Once the file has been uploaded, it will be assigned a unique identifier:

This value is relevant for the Remote feature which I will look at in a moment.

Now let’s see how this looks on the client device.

Running the Perlego Update application on the client device will display the following screen:

Select the option to Check For Updates. The client will contact the server (provided that the device has a connection to the Internet):

The categories that you have defined will be listed, using the icons that you uploaded. Opening the category will list the content that you defined:

Selecting that content will automatically download it and execute it based on the options you defined as the administrator.

Filters

Filters allow the administrator to restrict access to specific content publications based on device criteria.

When the Perlego client software first connects to the server, it will upload certain information about the client device. It is not possible to view or report on this information to view the status of your mobile fleet, but it is possible to add intelligence to the way in which published packages are delivered to that fleet.

These criteria include:

· Build

· Carrier

· CarrierID

· ConnectionType

· DeviceType

· DeviceUID

· IMEI

· IMSI

· Language

· Locale

· OS

· OSVersion

· Processor

· Version

These values can be set to ‘equal’, ‘begin with’ or ‘contain’ the text specified:

For example, if you want to send a hotfix package to Windows Mobile devices that use the Vodafone network, you could specify the 5-digit carrier ID for the Vodafone network in a new Filter and specify that filter in the properties of the Content Publication.

It is important to note that the administrator needs to know what information to put in the Value field – these options are not pre-populated as they are with other solutions.

Domains, Users and Licenses

When your account is created for you by Perlego, your company will be assigned a Domain. It is then possible for you to create sub-domain of your own domain – as many as you like. As the administrator of your domain, you will be able to fully administer any sub-domains of your domain.

It is also possible to create different levels of administrative logins to your domain, or any sub-domains of your domain.

This is ideal for the service reseller model. The only thing you cannot do is generate licenses. Perlego will assign you a set number of licenses, but you can then transfer some or all of these licenses to any sub domain that you have control over.

SMS Messaging

It is possible to send SMS messages to one, or all members of your client device fleet from the server.

These SMS messages are free and can be delivered anywhere in the world. Whilst the cost of this message delivery is borne by Perlego, and messages are not explicitly monitored, if Perlego were to notice a suspiciously large volume of messages from a specific domain and discovered that you were letting everyone know that the new series of Top Gear starts tonight then they would probably take a dim view of that!

Perlego Remote

As the song goes, I have saved the best till last. Perlego Remote is where this solution starts to get more interesting from a DM perspective.

The Perlego Remote component is not visible on the client device, it operates in the background. This component allows the administrator to send and execute commands on the device without user interaction. On a Windows Mobile device, these commands might contain XML provisioning scripts to create and edit registry values – effectively allowing you to control any aspect of the client device that can be controlled via the Registry: which on a Windows Mobile device is pretty much everything.

The Remote feature has its own section in the admin interface:

Commands are created by selecting Command Library --> New:

Enter a name for the command.

Select an Action Type for the command:

A ‘reset’ action type will soft reset the device.

An ‘execute’ action will send a specific file to the device and run it – this is where the unique file identifier field comes into play which we saw earlier and is specified in the Application ID field.

A ‘config’ action will send an XML provisioning script to the device – this is defined in the Parameter field.

Other action types are available but are beyond the scope of this introduction.

The Acknowledgement field allows the administrator to define that the client should communicate to the server that the command has been received successfully.

For example, creating a config command with the following parameters:

<wap-provisioningdoc>

</characteristic>

</characteristic>

</characteristic>

</characteristic>

</characteristic>

</wap-provisioningdoc>

Will configure a Windows Mobile device with Server ActiveSync push email settings:

A sequence of commands can be grouped into a Command Set, to form a powerful script operation.

Once a command or a command library has been created, it can be ‘pushed’ to a device via the Send Command interface:

This will cause an SMS message to be sent to the device or group of devices specified. Again, there is no charge for this SMS message. The message itself is not displayed on the screen of the client device, instead it is received by the remote listener application on the device and actioned accordingly.

It is up to the administrator to know how to format and create the XML provisioning scripts and enter them manually into the web interface.

There are many examples of such scripts on the Microsoft web site:

http://msdn.microsoft.com/en-us/library/ms894922.aspx

You can view the status of issued commands in the Command Queue view, and the Command History view shows what command shave bee issued in the past.

Devices can be Deactivated via the Deactivate Device menu – which causes devices to no longer be able to contact the content server. No information is erased from the device by this procedure – if you wanted to ‘kill’ a device, you would need to issue a hard reset command via an XML provisioning script.

Summary

To summarise then, Perlego is a feature-rich device management solution with no administrative overhead from a setup, maintenance or backup perspective and can be deployed in literally the length of time it takes to acquire licenses, be assigned a login and to publish your content and scripts.

Publishing and creating those scripts is a manual process that requires in-depth knowledge of the operating systems in use on the part of the administrator…but assistance with that side of the solution is available from yours truly :)