Accessing remote file shares with BES 5

One new feature made possible with the release of version 5 of the BlackBerry device software (when used in conjunction with a BES 5 server), is the ability to access and search remote file systems: both Windows and Samba-based.

To add the file share to the BES, log into the BlackBerry Web Administration Console (remember that if using the BAS' internal authentication mechanism, the default username is 'admin' rather than 'besadmin').

Browse to Servers and Components --> BlackBerry Domain --> Component View --> MDS Connection Service. Click on the File tab and select the option to Edit Component:

Enter a name for the share, this can be anything to identify the share to the administrator, as well as the UNC path to the file share [in the form \\(server)\file_share]
This share must be available to the BES, ideally on the same local network.
Enter the details of a domain user account to be used to access the share. This user account must naturally have permission to access the share.

Click Save All.

Click on the Configuration Sets tab:

Enter a name for the Configuration Set and add the file share created earlier.

Now browse to the specific MDS Connection Service instance you want to assign the component to and click on the Component Configuration Sets tab:

Add the Configuration Set you created earlier and click Save All.

Now click on the Instance Information tab and select the option to Restart Instance.

The file share has now been configured. To access the share from the handheld device, open the Applications folder and select the Files icon:

Select All Documents and enter in the name of the file if you know it, or a partial match to search for:

BES 4.1.x / 5.0 Exchange 2003 pre-requisites

Create a Domain User account called BesAdmin

On the Exchange Server, select Start → Programs → Microsoft Exchange → Active Directory Users and Computers

Browse to the Users container. Right click in the right-hand pane and select New → User

The following window will be displayed:

Enter BesAdmin in the First name and User logon name fields. Click Next. The following window will be displayed:

Enter a password for the account. Ensure that the options User cannot change password and Password never expires ARE TICKED. Click Next. The following window will be displayed:

Ensure that the option to Create an Exchange mailbox is ticked. Click Next and then click Finish.

Assign the BesAdmin user account local administrative rights

Once the BesAdmin user account has been created. On the BES server, right click on the My Computer icon on the desktop and select Manage. Browse to the Groups folder:

Double click the Administrators group.
Click on the Add button.
Set the Look in field to the domain of which the BES server is a member.
Select the BesAdmin user account and click Add.
Click OK and then OK again.

Assign "logon as service" rights on the BES server to the BesAdmin user account

On the BES Server, select Start → Settings → Control Panel.
Double click on the Administrative Tools icon
Double click on the Local Security Policy icon

Browse to Local Policies → User Rights Assignment in the left-hand menu.
In the right-hand pane scroll down and select Log on as service

Double click the entry, the following window will be displayed:

Click Add. The following window will be displayed:

Set the Look in field to the domain in which the BES server resides.
From the list of users select the BesAdmin account and click Add.
Click OK and then OK again.

Delegate administrative control to the BesAdmin user account

On the Exchange server, select Start → Programs → Microsoft Exchange → Exchange System Manager.

Right click on the Organisation name (at the root of the directory in the left-hand pane) and select Properties. The following window will be displayed:

Tick the options to Display routing groups and Display administrative groups. Click OK. If you receive a warning message indicating that the Exchange System Manager needs to be closed and re-opened for the changes to take effect, click OK.

Close the Exchange System Manager and then re-launch it again from the Start menu.

Right click on the first Administrative Group and select Delegate Control, as shown below:

The Administration Delegation Wizard will be displayed:

Click Next. The following window will be displayed:

Click Add. The following window will be displayed:

Set the Look in field to the domain in which the BES server resides. From the list of users select the BesAdmin account and click OK.

Click Next and then click Finish to complete the wizard.

Assign Send as, Receive as and Administer information store rights to the user account

Within the Exchange System Manager, right click on the entry for the Exchange server which the BES is going to communicate with and select Properties, as shown below:

Click on the Security tab. In the list of users select the BesAdmin user account. In the list of permissions, scroll down and tick the options to allow Administer information store, Receive As and Send As.

Click OK.

Now send an email to the BesAdmin user to initialise the mailbox!

Assign Send As rights on the Domain to the BesAdmin user account

On the Exchange Server, launch the Active Directory Users and Computers MMC snap-in:

Open the View menu and select the option to show Advanced Features.

Right click on the Domain root and select Properties. Click on the Security tab:

Click on the Advanced button. Select the option to Add a user:

Enter the alias of the BesAdmin account created earlier and click OK. In the Apply Onto drop-down menu select the option for User Objects:

In the Permissions section select the option to enable Send As:

Install Exchange System Manager on the BES server

Install the Exchange System Manager tool on the BES server from the Exchange CD.
Once installed, ensure that you update the installation so that the same service pack version is applied to the System Manager that is currently running on the Exchange server.

To verify the service pack version that is running on the Exchange server, open Windows Explorer on the Exchange server and browse to the folder where Exchange has been installed. By default this will be C:\Program Files\Exchsvr

Open the “BIN” folder and locate the file “store.exe”. Right click on the file and select Properties.

Click on the Version tab, the service pack version will be displayed in the Comments field as shown below:

Install the correct version of the CDO.DLL file

Windows 2000 Server requires that version 6.0.5770.16 or higher of the cdo.dll file be installed.
This file is installed by default with Service Pack 3 or later, however it has not been registered.

Windows 2003 Server requires that version 6.5.6944.0 or higher of the cdo.dll file be installed. This file is installed by default with Exchange 2003 System Manager, and also by Windows Server 2003 SP1, however it has not been registered.

By default the cdo.dll file will be located in the C:\Program Files\Exchsvr\Bin directory. To check the version of the file, right click on it and select Properties. Click on the Version tab:

Register the CDO.DLL file

The cdo.dll file needs to be registered, otherwise wireless calendar synchronisation will not function correctly between the Blackberry handheld and the server.

To register the file, copy it to the C:\WINNT\System32 directory.

Once the file has been copied, select Start → Run. Enter “cmd” in the dialogue and press OK.

A command prompt will be displayed. Change to the WINNT\System32 by typing cd winnt\system32 and pressing enter.

Type regsvr32 cdo.dll and press enter:

If the file is registered successfully, notification will be displayed as shown below:

Now log off as Administrator and log in to the BES server using the BesAdmin user account.

Launch the Exchange System Manager to finalise the installation and initialise the MAPI connection to Exchange.

You are now ready to begin installation of the BES 4.1.x software.

Adding Users

Launch the Blackberry Manager from the Start Menu.
Select Servers in the left-hand navigation pane. Select your server from the list.

In the bottom pane, select the option to Add Users. The Exchange Global Address List will be displayed:

Select your users and click OK.

Now click on the entry for the server in the left-hand pane:

Click on the Users tab. Select a user.

In the bottom pane, select the Service Access section. Select the option to Generate and Email Activation Password.
The user will receive an email from BesAdmin with their password. They can now use this password to complete the Enterprise Activation wizard on the Blackberry handheld.

BES 4.1.x / 5.0 Exchange 2007 pre-requisites

Create a Domain User account called BesAdmin

On the Exchange Server, select Start → Programs → Microsoft Exchange → Active Directory Users and Computers

Browse to the Users container. Right click in the right-hand pane and select New → User

The following window will be displayed:

Enter BesAdmin in the First name and User logon name fields. Click Next. The following window will be displayed:

Enter a password for the account. Ensure that the options User cannot change password and Password never expires ARE TICKED. Click Next. The following window will be displayed:

Click Finish.

Create an Exchange Mailbox for the BesAdmin User

On the Exchange Server, launch the Exchange Management Console.
Select Recipient Configuration → Mailbox and then New Mailbox:

The following window will be displayed:

Select User Mailbox and click Next. The following window will be displayed:

Select Existing User and then click Browse. Select the BesAdmin user. Click OK and then click Next. The following window will be displayed:

Click Next.
Click New and then Finish.

Assign the BesAdmin user account local administrative rights

Once the BesAdmin user account has been created. On the BES server, right click on the My Computer icon on the desktop and select Manage. Browse to the Groups folder:

Double click the Administrators group.
Click on the Add button.
Set the Look in field to the domain of which the BES server is a member.
Select the BesAdmin user account and click Add.
Click OK and then OK again.

Assign "logon as service" rights on the BES server to the BesAdmin user account

On the BES Server, select Start → Settings → Control Panel.
Double click on the Administrative Tools icon
Double click on the Local Security Policy icon

Browse to Local Policies → User Rights Assignment in the left-hand menu.
In the right-hand pane scroll down and select Log on as service

Double click the entry, the following window will be displayed:

Click Add. The following window will be displayed:

Set the Look in field to the domain in which the BES server resides.
From the list of users select the BesAdmin account and click Add.
Click OK and then OK again.

Assign Send as, Receive as and Administer information store rights to the BesAdminuser account

Unlike previous versions of Exchange. This needs to be done at the command line via the Exchange Management Shell.

Launch the command interface and enter the following command:

get-mailboxserver (servername) | add-adpermission –user (service account)-accessrights GenericRead, 
GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin

Where (servername) should be replaced with the name of the Exchange Server, and (service account) should be replaced with the Alias name of the BesAdmin user account (so ‘BesAdmin’ in this case)

If you are successful, you should see the following:

To verify the permissions of an existing account, type:

get-mailboxserver (servername) | getADpermission -user (service account) | Format-List

Now send an email to the BesAdmin user to initialise the mailbox!

Assign Send As rights on the Domain to the BesAdmin user account

On the Exchange Server, launch the Active Directory Users and Computers MMC snap-in:

Open the View menu and select the option to show Advanced Features.

Right click on the Domain root and select Properties. Click on the Security tab:

Click on the Advanced button. Select the option to Add a user:

Enter the alias of the BesAdmin account created earlier and click OK. In the Apply Onto drop-down menu select the option for User Objects:

In the Permissions section select the option to enable Send As:

Install Microsoft Exchange Server MAPI Client and Collaboration Data Objects 1.2.1

Download the MAPI and CDO files from the Microsoft web site:

http://www.microsoft.com/downloads/details.aspx?FamilyID=E17E7F31-079A-4...

Once downloaded, run the EXE file and specify a location for the files to be extracted to. Once extracted, run the file named ‘ExchangeMapiCdo.MSI’. The following window will be displayed:

Click Next.
The License Agreement screen will be displayed. Read the terms and conditions and click Next if you agree.
Click Finish.

Now log off as Administrator and log in to the BES server using the BesAdmin user account.

You are now ready to begin installation of the BES 4.1.x software.

Adding Users

Launch the Blackberry Manager from the Start Menu.
Select Servers in the left-hand navigation pane. Select your server from the list.

In the bottom pane, select the option to Add Users. The Exchange Global Address List will be displayed:

Select your users and click OK.

Now click on the entry for the server in the left-hand pane:

Click on the Users tab. Select a user.

In the bottom pane, select the Service Access section. Select the option to Generate and Email Activation Password.
The user will receive an email from BesAdmin with their password. They can now use this password to complete the Enterprise Activation wizard on the Blackberry handheld.

BES 4.1.x Lotus Domino pre-requisites

Create a domino user called BesAdmin

Log into the Domino Administrator:

Register a new user account for the BesAdmin user:

Add the BesAdmin user to the LocalDomainServers Group

Browse to the Groups view in the Domino Administrator:

Double click the LocalDomainServers group:

Drop down the Members menu:

Select the domain directory and add the BesAdmin user to the group:

Click OK.
Save the changes to the group.

Stop the Domino Server

On the Domino server, browse to Start → Programs → Administrative Tools → Services. Locate the Lotus Domino Server service. Double click the entry to display the properties for the service.
Set the Startup Type to Manual:

Reboot the Domino server.

Create a local administrator account on the Domino server

Right click on the icon for My Computer and select Manage.
The Computer Management console will be displayed. Browse to Local Users and Groups → Users.

Create a new user account with a name of BesAdmin.
Set the password to never expire.

Browse to Local Users and Groups → Groups:

Open the Administrators Group and add the BesAdmin user account to the group.

Log off and then log back in as the new BesAdmin user on the Domino server.

You are now ready to install the BES software.

Add Users to the BES

Launch the Blackberry Manager from Start → Programs → Blackberry Enterprise Server → Blackberry Manager:

Browse to the Server entry from the left-hand navigation pane and select the Users tab:

Select the option to Add User. The Domino directory will be displayed:

Select the target user account and click Add then OK. The user will now be listed in the Blackberry Manager:

Set Activation Password

Right click on the entry for the user and select the option to Set Activation Password:

Enter a suitable password, ideally this should be 6 characters long and contain lower-case letters only:

Click OK.

The user is now ready to perform an Enterprise Activation on the handheld.

Perform Enterprise Activation

On the Blackberry handheld, from the main menu select Options → Advanced Options → Enterprise Activation.

In the Email field, the user should enter their full email address.
In the Password field, the user should enter the activation password set by the administrator (NOTE – this is NOT the user’s NT domain or Domino password, but the BES Activation Password that was set earlier).

If the user sees the option to enter an Activation Server Address, this field is only required if the handheld is being activated over WiFi via the local network. If the handheld is being activated via a cellular connection (GPRS or 3G) then leave this option blank.

Press the menu button and select the option to Activate.

After a few moments the handheld will display ‘Encryption Verified’ and then ‘Waiting for services’. This means that the connection to the BES was successful and mailbox data is now being downloaded to the device. This process can take up to 20 minutes to complete depending on the amount of data held in the user’s mailbox.

On the Domino Server itself, in the Domino Server Console, the activation process can be viewed in real time:

The activation process is now complete.

Repeat the above process for additional users as required.

BES 5 Enterprise Activation

Adding new users to BES 5 is now even easier than in previous versions. Once the user has been added to the BES server by the administrator and assigned an activation password, the user will then be able to activate their handheld in a number of ways:

• Over the cellular network using the Enterprise Activation feature on the handheld device
• Over a local WiFi network using the Enterprise Activation feature on the handheld device by specifying the IP address of the activation server
• Via the BlackBerry Web Desktop by connecting the handheld to their local PC via USB

This article assumes that the BES server has been installed correctly already. For detailed instructions on how to prepare the Microsoft Exchange environment for a BES deployment read these articles:

Exchange 2003
Exchange 2007 / 2010

For instructions on how to install the BES 5 software itself view this post:

http://blog.brightpointuk.co.uk/installing-blackberry-enterprise-server-...

Activating over the cellular network

Once an enterprise activation password has been assigned to the user, the Enterprise Activation feature on the handheld can be located under Options --> Advanced Options --> Enterprise Activation.
In here the user simply need enter their full email address, including domain, and the activation password assigned by the administrator.

For detailed information on how the Activation Process works, read this article:

http://blog.brightpointuk.co.uk/how-does-bes-wireless-activation-process...

Activating over the WiFi network

For those devices that have WiFi capability, provided that the local wireless network can route to the BES server, devices can be activated by completing the Enterprise Activation wizard as above, but with the additional step of completing the Activation Server Address, which needs to contain the IP address of the BES server.

NOTE - this feature needs to be enabled on the BES manually as it is not enabled by default. If the BES server has been deployed in a multiple-box deployment, it is the IP address of the BES Router component that needs to be entered on the handheld device, and the Router needs to be configured to be able to relay SMTP traffic to the Exchange Server. To do this, on the BES server open the BlackBerry Server Configuration utility from the Start Menu. Click on the WiFi OTA Activation tab:

Complete the details of the Exchange server as required.

Also note, to accept activation requests on Server 2008, the built-in firewall will need to be configured to accept incoming requests on TCP port 4101.

Activating via the BlackBerry Web Desktop

Users can browse to the Web Desktop URL (https://(bes_server)/webdesktop) from their Windows PC running IE6 or later:

When logging in for the first time they will be prompted to install the "RIMWebComponents", this will install the required USB drivers and device manager software onto the PC. Administrative rights will be required for this.

Once installed, the user will be able to login using the domain credentials:

The user can now connect their handheld device to the PC via the USB connection. The device manager software will detect the device automatically. The user will be prompted to enter their activation password within the browser.
If the feature has been enabled on the BES by the administrator, users can even set their own activation passwords and enable their own devices, without the IT department getting involved at all (provided that their user account has been added to the BES):

Once activated, the device will be listed in the properties of the user account:

Clicking on the device entry will display detailed information about that device:

and provide a list of tasks that can be performed on that device, including the ability to perform a 'remote kill':

BES 5.0 Web Desktop Manager

The Web Desktop Manager component was first released as a free update to BES 4.0 SP6 or later (http://blog.brightpointuk.co.uk/blackberry-web-desktop-manager)

Now the tool has been incorporated into BES 5.0 and enables users to manage their devices directly from the PC web browser (only Internet Explorer 6 or later is supported currently)

The tool is accessed by browsing to https://(BES_Server)/webdesktop:

From this interface users can, provided that the administrator has enabled the feature on the BES itself, edit their default signature as well as message re-direction settings.
Email filters can be created, defining what mails get delivered to the handheld device:

Available filter criteria include:

Which mailbox folders that are synchronised to the handheld device can be defined:

The Contacts that are synchronised to the handheld can be defined, including subfolders of the main Contacts folder:

The contents of the user's handheld device can be backed up to the user's PC via the tool:

Automatic, schedule-based, backups can also be configured:

Should a user be issued with a new device, they can simply connect that device to their PC, once logged into the tool, and switch their account details to the new device automatically:

BES 5.0.1 Exchange 2010 pre-requisites

Ensure that Exchange 2010 Update Rollup 1 is installed on the Exchange 2010 server. This package is available here - http://www.microsoft.com/downloads/details.aspx?FamilyID=371add31-d7a0-4...

Create a domain user account called BesAdmin

On the Exchange server, in the Active Directory Users and Computers console, create a domain user called "BesAdmin" and assign it an Exchange mailbox. Set the user account password to never expire.

Send an email to the BesAdmin user to initialise the Exchange mailbox.

Assign the BesAdmin user local administrative rights

On the server that is to host the BES, make the BesAdmin domain user a member of the local administrator group. NOTE - the BES server will first need to have been added to the Domain if not done already.
To do this, on the BES Express server, right click on the icon for My Computer and select Manage. Browse to Local Users and Groups --> Groups --> Administrators and add the BesAdmin user:

Assign the BesAdmin user "log on as a service" rights

On the BES server, also assign the BesAdmin domain user account "log on as a service" rights. To do this, select Administrative Tools --> Local Security Policy --> User Rights Assignment --> Log on as a service and add the BesAdmin user:

Assign "Receive As" and "Administer Information Store" rights to the BesAdmin user

On the Exchange server, launch the Exchange PowerShell and issue the following command:

Get-MailboxDatabase | Add-ADPermission -User "BesAdmin" -AccessRights
 ExtendedRight -ExtendedRights Receive-As, ms-Exch-Store-Admin

Assign Exchange View-Only Administrator rights to the BesAdmin user

Still within the Exchange PowerShell, now issue the following command:

Add -RoleGroupMember "View-Only Organization Management" -Member "BesAdmin"

Assign "Send As" rights on the domain to the BesAdmin user

Within the Active Directory Users and Computers console, open the View menu and select the option to display Advanced Features.

Right click on the domain and select Properties. Click on the Security tab:

Click on the Advanced button:

Click on Add and type in the name of the BesAdmin user:

Select the option to Apply Onto User Objects.
Scroll down to the bottom and tick the option to enable Send As rights:

For good measure, also enable Send As rights on the Exchange server itself within the Exchange PowerShell. Launch the console and issue the following command:

Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights
Send-As -User "BesAdmin" -Identity "CN=Users,DC=domain,DC=com"

(where "domain" and "com" should be substituted for your specific domain details, eg: DC=brightpoint,DC=co,DC=uk and so on)

To force all of the above changes to take effect on the domain, it may be worth running a group policy update. On the Exchange server click Start --> Run and issue the command "gpupdate /force"

Turn off Exchange 2010 Client Throttling

Exchange 2010 uses client throttling by default to protect the Exchange server from excessive user demands. RIM recommend turning off this feature as it can have an adverse affect on the performance of the BES solution. This is done within the Exchange PowerShell console.
Launch the console and issue the following command to get the "Identity" of the default throttling policy"

Get-ThrottlingPolicy | Where-Object {$_.IsDefault -eq "True"} | FL Identity

the Identity will be displayed:

Now issue the following command:

Set-ThrottlingPolicy -RCAMaxConcurrency $null

You will be prompted to enter the Identity to apply the policy to, enter the result returned above:

Increase the maximum number of connections to the Exchange Address Book Service

On the Exchange Server (or specifically the Client Access Server in a multi-box deployment), browse to C:\Program Files\Microsoft\Exchange Server\V14\Bin and locate the file "microsoft.exchange.addressbook.service.exe.config" and open it in NotePad:

Locate the line "MaxSessionsPerUser":

Increase the value to 100000. Save the file then restart the Address Book Service:

Install the Exchange MAPI CDO 1.2.1 package

The Microsoft Exchange MAPI CDO 1.2.1 package must be installed to provide the BesAdmin user a MAPI connection to Exchange mailboxes as well as access to calendaring information. This package is available for download from our FTP site HERE (Exchange 2010 only).

Run the installer and accept the license agreement:

Now you're ready to install the BES software.

BlackBerry Enterprise Transporter Tool

The BES Transporter Tool is a free utility from RIM that is designed to enable the administrator to easily migrate users from one BES server to another, or from one BlackBerry Domain to another, ideal for administrators who intend to run their existing BES 4 installation alongside an upgraded BES 5 server for a period of time before then decommissioning the older server.

The installation is simply a matter of running the MSI file and following the on-screen prompts. An icon will be added to the Start Menu automatically. Launching the application displays the following screen:

The first step in using the tool is to create a new configuration document. Click on the New button, enter a name for the new document and click Save. Now the rest of the fields will no longer be greyed out.

Now you need to specify the source and target BlackBerry database instances. Click on the Configure button:

In the SQL Server field enter the name of the server holding the BES SQL database.
In the Label field enter the name of the SQL instance running on that server.
In the Database field, enter the name of the BES database, normally BESMgmt by default.
Verify that a connection can be established to the database using the specified authentication details.
Click OK. Now complete the same details for the target BES database.

Now you can select the users that you want to migrate. Click on the Details button. Click on the Find Users button to view the users available on the source BES. Select the users as required.
Click Close.

Click the Preview button to view a report of the intended operation. Be sure to read and understand any errors that are returned.
Provided that no errors are reported, click the Migrate button to begin the operation. Your user accounts will now be migrated.

For details on how to install the BES 5.0 software read this article - http://blog.brightpointuk.co.uk/installing-blackberry-enterprise-server-...

BlackBerry Web Desktop Manager

The Blackberry Web Desktop Manager is a free download from the Blackberry web site and is a bolt-on to the Blackberry Enterprise Server enabling users to manage their handhelds via a web interface without the administrator needing to get involved.

Version 4.0 SP6 or later of the BES software is required, but it can also be used with the BES Express and Blackberry Professional Software versions. It has actually been available for a while now, but somehow slipped under my radar.

NOTE - the Web Desktop feature is built into BES 5.0, read this article for details on this version - http://blog.brightpointuk.co.uk/bes-50-web-desktop-manager

The installation process is straightforward and installs two additional services to the BES Server:

• Blackberry Administrative Service - AS
• Blackberry Administrative Service - NCC

The installation process does require that you configure an LDAP authentication source for connecting to the Exchange Server, but detailed information is included in the accompanying PDF installation guide.

Once installed, users can access the web interface by browsing to:

https://(BES_Server_Name)/webdesktop/login

NOTE - Internet Explorer 5.5 or later is required, Firefox is not supported. For users to access this web interface externally, the BES will need to be assigned a public IP address and port 443 opened on the firewall. The Administration Services can be installed on a machine other than the BES if external access directly to the BES itself is not permitted.

The initial web interface prompts the user to log in using their Active Directory domain credentials:

logging in for the first time, the browser will require that some ActiveX controls are installed, select the option to install them.

Once logged in, the following screen will be displayed:

The web interface allows users to activate and deactivate their own handhelds, setting their own activation passwords.

Users can also install, update or remove applications on the handheld.

Email filters can be applied, governing what mails are pushed to the handheld.

The entire data held on the device can also be backed up to the server and restored at a later date by the user via the web interface, or an automatic scheduled backup can be configured.

Finally, users can also edit the default signature via the web interface, rather than having to do it on the device.

This web interface approach is a precursor to the release of BES 5 which will provide full administrator access to the Blackberry Server via a web interface rather than via a WIN32 console application, and also removes the need for users to install the Blackberry Desktop Software on their PCs which is a major plus for network administrators.

Deploying applications wirelessly with BES 5.0

Although not a new feature to version 5.0 of the BlackBerry Enterprise Server solution, the procedure is slightly different now that the product is administered through a web browser using the BlackBerry Administration Service (BAS).

To deploy an application to a handheld device over the air, the procedure is as follows.

Create a shared application repository

Create a shared folder on the BES itself or somewhere on the LAN that the BES has access to.
Assign the BESAdmin user full read and write access to the share:

Add the repository to the BAS

Launch the BlackBerry Administration Service within a web browser and log in.
Browse to Servers and Components --> Component View --> BlackBerry Administration Service

Add the folder's UNC share path within the Software Management section and set the deployment to be managed by the BAS:

Be sure to click on the Save All entry to apply the changes.

Publish an application to the repository

ZIP up the component files of the application you wish to deploy and copy and paste the ZIP file to the shared directory you created earlier.

Within the BlackBerry Administration Service, browse to BlackBerry Solution Management --> Software --> Applications --> Add or update applications:

Browse to the ZIP file you created earlier and click Next, the package will be read and details imported:

Select the option to Publish the application.

Create a Software Configuration

Within the BAS, browse to BlackBerry Solution Management --> Software --> Create A Software Configuration:

Enter a name for the configuration and Save it.
Edit the Configuration and click on the Applications tab.
Click on the option to Add applications to software configuration
Click on the Search option to display a list of available packages:

Select the target package and click on the option to Add to software configuration

Select the deployment method (either wired, if being deployed using the Desktop Web Manager across the LAN, or wireless if being deployed over the air) and whether the package is optional or required.

Select the option to Save All.

Assign the Software Configuration to a user or a group

Open the properties of a user account or group, and click on the Software Configuration tab:

Add the software configuration to the user account and click Save All.

The package will now be deployed to the user's device.

NOTE - it is also possible for users to install applications themselves locally using the BlackBerry Web Desktop Manager if permitted by the administrator.

How does the BES Wireless Activation process work?

What is it?

In a nutshell, the Enterprise Activation feature of the Blackberry Enterprise Server links a specific Blackberry handheld to a user account on the BES: it is the equivalent of connecting a handheld to the BES server via a USB or RS232 cable. Once activated, the contents of that user’s mailbox are wirelessly synchronised to the handheld. The beauty of the feature is that the Blackberry doesn’t need to be physically connected to the BES before it can be used. In fact, it doesn’t even need to ever set foot on the company premises – it can be activated wirelessly over the cellular network, in theory from anywhere in the world!

Before I describe how this process works, it is first necessary to explain how the end-to-end Blackberry solution works.
Research In Motion, the company that develops the Blackberry solution, has deployed in different parts of the globe, elements of hardware accessible to each mobile network operator that offers Blackberry service: the RIM Relay. This device acts as a proxy server, proxying requests from the handheld devices and the BES servers deployed throughout the world. It is this proxy-based architecture that is the reason why the BES server itself does not require a public IP address, unlike other remote email solutions, but it does also mean that you are dependent upon a third-party’s hardware for your messaging solution to operate.
Each Blackberry handheld device has a unique identifying number assigned to it – its PIN number. When the handheld registers on the cellular network, it sends this PIN number to the RIM Relay so that the Relay ‘knows’ that the device is available and ready to send and receive data. The BES server also has a unique identifier: the SRP key entered during the installation process. Provided that the BES has a connection to the Internet, when the Blackberry services are started, the server also registers with the Relay.

What does the process involve?

Before a handheld can be activated wirelessly, the administrator of the BES first needs to add the user to the BES and then assign an activation password to the user via the Blackberry Manager on the BES itself:

The Administrator selects the entry for the user account, and then clicks on the option to Generate and Email Activation Password within the Service Access task.

This causes an email to be sent to the target user, from the BESAdmin user account, containing the activation password. A typical email would look something like this:

The user now has all they need to activate the handheld.

On Blackberry handheld devices, if you open the Options menu and then select Advanced Options, in this menu you will see an option for Enterprise Activation.
If you select this option, depending on which version of the handheld software you are running, you will see either two or three fields:

• Email
• Password
• Activation Server

The Activation Server field does not need to be completed if the device is being activated via a cellular connection, I will look at this option later.

The user needs to enter their full email address, and their activation password that they were emailed by the BESAdmin user. NOTE – it is important that the user does not get confused and use their NT domain password; it must be the Blackberry enterprise activation password. Also note, if the password contains capital letters, the password IS case-sensitive.

Once the Email and Password fields have been completed, press the jogwheel and select Activate from the menu.
If the phone element of the handheld is currently turned off, you will be prompted to enable it, and the activation process will then proceed.

How does it work?

On the handheld device, when the option to Activate is selected, the handheld examines the email address that has been entered in the Email field. It identifies the domain (the text after the @ sign in the email address), and performs an MX-lookup on that domain, using DNS, to locate the mail server for that domain. Once located, it then sends an email to the email address containing specific text in the subject and body of the message. A typical email might look something like this:

When a user is added to the BES server, the BESAdmin user account monitors the user’s mailbox from that moment on, looking for changes that need to be mirrored on the handheld device.
When this email from the handheld is delivered to the mailbox, the BES detects it, and knows from the text in the subject and body fields that it is a command message, and acts on it accordingly, linking the PIN number of the handheld to that user account. This information is then updated to the Relay so that it ‘knows’ that the PIN of the handheld is linked to the SRP key of the BES server, and that data should be relayed between the two whenever both are online and authenticated. Once this process has completed, the email is then automatically deleted from the user’s mailbox.
This process usually occurs so quickly that the user never actually sees the email arrive or disappear again.
The contents of the user’s mailbox is then synchronised to the handheld. The length of time this process can take will vary depending on the amount of data that is held in the user’s mailbox, but 10 minutes is a normal figure.

What might cause this process to fail?

Mobile Network Operator

The handheld device itself will clearly need to be registered on the cellular network: the user should see the signal strength indicated on the screen, and should also see the type of service indicated: ideally the user should see GPRS or EDGE on the handheld. If the user is out of coverage then the process will fail.

The SIM in the handheld will also need to be enabled for the Blackberry service with the network operator: it is not sufficient to be merely enabled for GPRS or 3G service. If the user receives an error on the handheld along the lines of ‘service connection not available’, despite indicating GPRS service, then the SIM is not enabled correctly for Blackberry service.

DNS

For the enterprise activation process to succeed, the handheld must be able to resolve the MX record for the domain from the email address entered.
MX records are Mail eXchange records, they are the email equivalent of DNS entries for web sites that map, say ‘wwww.bbc.co.uk’ to ‘212.58.253.67’.
The DNS entries for your domain must be configured correctly.
To be honest, this is unlikely to be the cause of the problem as, if your DNS entries were not configured correctly, it is likely that you would not be receiving ANY email, not just emails from Blackberry handhelds. But this worth taking into consideration when troubleshooting the activation process in case your email delivery architecture has anything ‘funny’ in it.

Spam filters & anti-virus software

The activation confirmation email generated from the handheld needs to arrive in the end user’s mailbox, for it to be picked up by the BES server.
If the mail is identified as being spam by a filtering system and ‘quarantined’ the process will fail. Ideally the RIM Relay will need to be added as a ‘safe sender’ to the whitelist. How this is done depends on the filtering system in place – adding the entire domain ‘blackberry.net’ as a safe sender would be one solution.
If the mail does arrive in the user’s mailbox, but has been altered in some way, the process will fail. The text contained in the subject and body of the message is specifically intended for the BES server, therefore if an anti-virus system prefixes the word [SCANNED] to the subject of a message, this will cause the BES to not recognise the mail correctly as being a command message and will ignore it, causing the process to fail.

User permissions

If the command email is not able to be read by the BESAdmin user, then the process will fail. This is normally indicated by the fact that the command email appears in the user’s mailbox, but then never disappears again.
The BESAdmin user needs to be a ‘View-Only Exchange Administrator’, and needs ‘Send As’, ‘Receive As’ and ‘Administer Information Store’ rights on the Exchange Server to be able to properly send and receive emails from user mailboxes to the remote handhelds.

Outlook or desktop email client configuration

If the user's desktop email client is configured to download mails from the user's Exchange mailbox and then remove them - either via POP or to a local PST file, then this can cause the process to fail as the BES won't be able to retrieve the mail if it has already been removed from the user's mailbox.

User error, or ‘ the MD Factor’

Network Administrators out there – if you have verified all of the above and are still at a loss to explain why the process isn’t working, don’t be afraid to suggest that your user is a numpty!

So what is the Activation Server?

I mentioned above that on newer handheld devices, the Enterprise Activation wizard allows for the entry of an activation server address. This field is not required if the device is being activated over a cellular connection, as the device locates the address of the BES by sending the command email to the domain’s mail server for the BES to detect and act on.
The Activation Server field is designed to be used if the handheld is being activated locally via a WiFi connection – provided that activations via WiFi are permitted on the BES itself. This can be configured within the Blackberry Manager.

Installing BlackBerry Enterprise Server 5.0 for Microsoft Exchange

BES 5.0.0 has landed. The administration of this version of the software is radically different from previous versions - the BlackBerry Manager MMC snap-in component having been replaced by a web-based administration service. In this post I will run through the installation procedure which should be relevant to those both familiar with the solution and those accessing it for the first time.
Due to the number of screenshots I shall tackle the installation process only in this post, watch this space for further posts on how to handle routine administrative tasks.

Preparing the Microsoft Exchange environment

I have detailed the procedure for preparing a Microsoft Exchange environment in separate articles:

Exchange 2003
Exchange 2007 / 2010

The steps to run through are as follows:

• Create a domain user account and mailbox for the BesAdmin user account
• Assign the BesAdmin user account local admin rights on the BES server
• Assign the BesAdmin user account "log on as a service" rights on the BES server
• Assign Send As, Receive As and Administer Information Store rights to the BesAdmin user account on the Exchange server
• Assign Send As rights on the Domain to the BesAdmin user account
• Install Microsoft Exchange Server MAPI Client and Collaboration Data Objects 1.2.1 on the BES server

Installing the BES 5.0 software

In this post I shall be installing all BES components on the same server. Read the Deployment Guide for details on all deployment scenarios. I shall be using Server 2008 64-bit in this example.

Extract the contents of the self-extracting EXE installation package. Browse to the folder where the contents have been extracted to and run the setup.exe file:

Verify that you have followed the above article and configured the correct permissions on the BesAdmin user account. Click Continue Installation

Select your Country/Region, read the license agreement and select the option to Agree if you accept the terms and conditions. Click Next:

If this is a new installation rather than an upgrade, select the option to create a new database (watch this space for instructions on the procedure for upgrading an existing installation):

Select the components of the BES solution that you wish to install on this server. In this post I shall be installing all BES services on the same server. Click Next:

The BES installation package will install an instance of the Apache web server as well as several Java packages. Read the license agreement and select the option to Agree if you accept the terms and conditions. Click Next:

The installation wizard will determine that all pre-requisite components are present and indicate what corrective action needs to be taken:

Click Next. You will be prompted to specify the database server to use. If you have a separate Microsoft SQL Server available, select that option and complete the required details. In this post I will be installing the database locally on the BES server itself:

Click Next. Enter the password for the BesAdmin account and enter a name for the BES server itself:

Click Next:

Click Install:

The required components and program files will be copied to the local machine. This may take a few minutes. Once complete you will be prompted to reboot the server:

Click Yes. Once rebooted, the installation procedure will resume automatically:

Click Next. You will be prompted to create the BES Management database:

Click Yes. This may take a few minutes. Click OK once complete:

You will be given the option of specifying which TCP port the database service should access the database on:

Click Next. Enter the CAL (Client Access License) and SRP details:

Click Next. The MAPI component will now be invoked and will prompt for the details of the Exchange server to be accessed:

Complete the fields as required and verify that the Check Name function can resolve both the server and mailbox. Click OK:

Enter a name for the Mobile Data Service application pool as well as passwords for the default admin and publisher user account roles. Click Next:

You will be prompted to create the required database. Click Yes.

Click OK once complete.

You will be prompted to verify that the MDIS service has bee configured, consult the accompanying documentation for more information if required. Click OK.

If you selected the option to install the Monitoring Service you will be prompted to enter the database server details. Click Next:

You will be prompted to create the required database, click Yes:

Click OK when complete:

If you selected the option earlier, you will be prompted to specify your instant messaging environment. Make the appropriate selection and click Next:

Enter the details of the BlackBerry Administration Service web pool and enter the password for the SSL certificate for the admin web site. Click Next:

You will be prompted to enter details of the LDAP account used to access the Exchange Global Address List. Use the BesAdmin domain user account unless required otherwise. Click Next:

Enter the default password for the admin account that should be used to access the web administration web site. Click Next:

The installation wizard is now complete. Click the option to Start Services and verify that all services start successfully. Click Next:

Details of the web admin tool and the web desktop tool will be displayed, make a note of these addresses. Click Close.

The installation is now complete. The web-based admin tool can be accessed from the Start menu:

Launch the BlackBerry Administration Service:

Set the "login using" field to the BlackBerry Administration Service. Enter "admin" as the user name and the password you specified earlier:

You will be prompted to install an ActiveX component, select the option to install:

And again when prompted select the option to Install:

Once complete, you will be prompted to restart the BES server again. Select Yes.

Once rebooted, launch the Admin Tool again and log in using the same credentials as before, remembering to set the "Login using" field to the BlackBerry Administration Service. The BES Admin tool interface will be displayed:

NOTE - on my fully patched Server 2008 installation, which includes IE8, the Admin tool did not display until I enabled the Compatibility View mode.

You can now finalise your BES configuration and add users as required. Watch this space for more information on how to add users and perform routine admin tasks.

Firewall Rules

NOTE - on Server 2008 you will need to configure the built-in firewall to allow connections to the Apache web server instance on port 443 from all desired hosts before they will be able to access either the Administrator or Web Desktop tools.

Outbound SMTP access on TCP port 25 will need to be enabled between the BES and the Exchange server for activation and administrator mails to be delivered successfully.

If the SQL Server being used is external to the BES, SQL access on port 1433 will need to be configured (or the static port specified during the installation process).

Outbound access on TCP port 3101 to the BES Relay will need to be enabled.

Adding Users

To add users to the BES 5 server, log into the Administration Web Tool.
Browse to User --> Create A User:

To search for available users click on the Search link:

Select the target user and click Continue:

Select the BES server that the user should be added to and click Continue:

Enter the Activation Password for the user and click Create User:

An email will now be sent to the user containing the Activation Password:

The user will now be able to activate their handheld in a number of ways:

• Over the cellular network using the Enterprise Activation feature on the handheld device
• Over a local WiFi network using the Enterprise Activation feature on the handheld device by specifying the IP address of the activation server
• Via the BlackBerry Web Desktop by connecting the handheld to their local PC via USB

Activating over the cellular network

Once an enterprise activation password has been assigned to the user, the Enterprise Activation feature on the handheld can be located under Options --> Advanced Options --> Enterprise Activation.
In here the user simply need enter their full email address, including domain, and the activation password assigned by the administrator.

For detailed information on how the Activation Process works, read this article:

http://blog.brightpointuk.co.uk/how-does-bes-wireless-activation-process...

Activating over the WiFi network

For those devices that have WiFi capability, provided that the local wireless network can route to the BES server, devices can be activated by completing the Enterprise Activation wizard as above, but with the additional step of completing the Activation Server Address, which needs to contain the IP address of the BES server.

NOTE - this feature needs to be enabled on the BES manually as it is not enabled by default. If the BES server has been deployed in a multiple-box deployment, it is the IP address of the BES Router component that needs to be entered on the handheld device, and the Router needs to be configured to be able to relay SMTP traffic to the Exchange Server. To do this, on the BES server open the BlackBerry Server Configuration utility from the Start Menu. Click on the WiFi OTA Activation tab:

Complete the details of the Exchange server as required.

Also note, to accept activation requests on Server 2008, the built-in firewall will need to be configured to accept incoming requests on TCP port 4101.

Activating via the BlackBerry Web Desktop

Users can browse to the Web Desktop URL (https://(bes_server)/webdesktop) from their Windows PC running IE6 or later:

When logging in for the first time they will be prompted to install the "RIMWebComponents", this will install the required USB drivers and device manager software onto the PC. Administrative rights will be required for this.

Once installed, the user will be able to login using the domain credentials:

The user can now connect their handheld device to the PC via the USB connection. The device manager software will detect the device automatically. The user will be prompted to enter their activation password within the browser.
If the feature has been enabled on the BES by the administrator, users can even set their own activation passwords and enable their own devices, without the IT department getting involved at all (provided that their user account has been added to the BES):

Once activated, the device will be listed in the properties of the user account:

Clicking on the device entry will display detailed information about that device:

and provide a list of tasks that can be performed on that device, including the ability to perform a 'remote kill':

New Features in BES 5.0

BES 5.0 is finally here and the Brightpoint GB Tech Blog have installed it in their test lab. In this post I shall run through some of the new features you can expect to find in this release. The solution has been re-engineered considerably 'under the hood', with support for Windows Server 2008 included and all server administration now being web-based. Major changes have been made the individual component services that make up the BES solution allowing for a wide range of deployment topologies as well as fault-tolerance, making it an attractive solution for both the Enterprise and SMB markets.

Server Features

Web-based Administration

The first and most apparent change in this release of the software is how the solution is administered. The MMC-based BlackBerry Manager application has been replaced with a web-based admin tool which enables the BlackBerry domain, user accounts, devices and device features to be managed from any PC with access to the BES.
The Mobile Data Service (MDS) and the Software Configuration areas are also managed via this web-based tool.
The Admin tool is accessed by browsing to https://(server)/webconsole/app/
The MDS Admin tool is accessed at https://(server)/mdsisconsole/app/
Internet Explorer 6 or later is required to access the tool.
Separate administrative logins to the web-based tool with varying permission levels can be configured.

NOTE - on my fully patched Server 2008 installation, which includes IE8, the Admin tool did not display until I enabled the Compatibility View mode.

BlackBerry Web Desktop Manager

The Web Desktop Manager has been available as an optional download for BES 4.1.x, which I posted about here (http://blog.brightpointuk.co.uk/node/95). This feature is now built into the BES 5.0 release and enables users to manage their BlackBerry devices from a web browser. This tool removes the need for the BlackBerry Desktop software to be installed on users' PCs and allows users to activate and deactivate their own handhelds, set their own activation passwords as well as install, update or remove applications on the handheld. Email filters can be applied, governing what mails are pushed to the handheld.
The entire contents of the device can also be backed up to the server and restored at a later date by the user via the web interface, or an automatic scheduled backup can be configured.
Finally, users can also edit the default signature via the web interface, rather than having to do it on the device.
The above features can be restricted by the administrator if desired, or made available or on a per-user or per-group basis.
The Web Desktop is accessed by browsing to https://(server)/webdesktop
Internet Explorer 6 or later is required to access the tool.
When logging into the Web Desktop Manager for the first time, the web site will prompt users to download and install a client application which contains the required handheld USB drivers and the BlackBerry Device Manager application which is used to install applications and certificates onto handhelds. Local administrative rights on the PC will be required to install this component.
Alternatively, the component is available in an MSI package, "RIMWebComponents.msi" that can be installed onto client PCs separately or via Active Directory Group Policy.

BlackBerry Enterprise Server High Availability

This is a new deployment scenario supported by BES 5.0 which provides for 2 BES servers to be deployed in a clustered environment with the BlackBerry database replicated between both servers, meaning that no single point of failure exists in the solution. When running the solution in an Active / Passive cluster, failover can be configured to occur automatically based on pre-defined thresholds which are continually monitored by the BlackBerry Monitoring Server (see below).

Support for Microsoft Windows Server 2008

BES 5.0 can now be installed on Windows Server 2008, both 32-bit and 64-bit versions.

Support for Microsoft SQL Server 2005 Express Edition

BES 5.0 now uses Microsoft SQL Server 2005 Express Edition as its default database back-end rather than the older Microsoft SQL Server Desktop Engine (MSDE). SQL Server 2005 Express Edition will be installed automatically during the BES installation unless you specify an alternate database server manually.

BlackBerry Monitoring Service

The Monitoring Service records up to 57 weeks worth of performance information on specific individual BES components as well as the connection status of the solution which can be reported on by the administrator. Thresholds and alerts can also be configured.

Support for IBM Lotus Domino 8.5 and Lotus Notes 8.5

BES 5.0 now supports the latest versions of both Lotus Domino and Lotus Notes. Lotus Notes Links are also supported. In Lotus Notes, users can include document links, view links or database links (also known as application links) in their email messages. Any links received in email messages on the BlackBerry handheld can be viewed in the BlackBerry handheld browser. Users may be prompted to enter the username and password if the target document is stored in a secure area.

Handheld Features

(When using device software v5.0 in conjunction with BES 5.0)

• Calendar
  • Ability to forward calendar appointments and view attachments saved to meeting invitations
  • Pop-up reminders containing conference call information will enable users to dial the number directly from the reminder
• Contacts
  • Ability to view subfolders of the personal Contacts folder
  • Ability to specify which subfolders of the Contacts folder should be synchronised to the device via the Web Desktop Manager
  • Ability to view contacts within Public Folders
  • Ability to specify which Public Folder contact lists are synchronised to the device via the Web Desktop Manager
• Browser
  • Support for Google Gears
  • Support for in-line video streaming
• Miscellaneous
  • Support for email follow-up flags
  • Support for the .wma audio file format
  • Ability to add, remove, move and rename personal folders
  • Improvements to BlackBerry Maps performance
  • Ability to set default download folder, wallpaper and icon layout from 'Homescreen Preferences'
  • Access the Application Switcher by pressing and holding the Menu key

RIM add BlackBerry support for Exchange 2010 to BES 5

RIM have officially added support for Exchange 2010 to BlackBerry Enterprise Server 5. Following hot on the heels of SP1 for BES 5 (http://blog.brightpointuk.co.uk/service-pack-1-bes-5-released), both RIM and Microsoft have released updates for BES 5 and Exchange 2010 to enable compatibility.
The pre-prequisites are therefore:

• BES 5.0.1 MR1 (ie BES 5 with Service Pack 1 and Maintenance Release 1)
• Rollup Update 1 for Exchange 2010 - http://www.microsoft.com/downloads/details.aspx?FamilyID=371add31-d7a0-4...
• Microsoft MAPI CDO 1.2.1 - http://www.microsoft.com/downloads/details.aspx?familyid=e17e7f31-079a-4...

For detailed information on how to configure Exchange 2007 / 2010 for a BES deployment, read this article - http://blog.brightpointuk.co.uk/bes-41x-50-exchange-2007-pre-requisites

The Exchange 2010 area of the BlackBerry web site can be found here - http://na.blackberry.com/eng/services/server/exchange/2010support.jsp

Setting up BlackBerry Enterprise Server for access to Office Communicator Server

The BlackBerry Enterprise Server (BES) product supports both OCS 2005 and 2007 versions, but uses the Communicator Web Access (CWA) component of the solution, so this feature needs to be installed on the OCS server itself.

Verify that the CWA web site can be accessed from the browser on the BES server, ensuring that DNS is correctly configured and installing any SSL certificates if required:

And verify that a sample user account is able to log in via the browser:

The CWA web site itself should be enabled for Forms-based authentication: which is the default configuration, as well as Integrated Windows Authentication:

Run the BES installation wizard. Whether this is a clean install, or you're adding the instant messaging functionality to an existing installation, the first screen will prompt you to select your Instant Messaging platform:

NOTE - if this is an existing installation, you should run the installer as the same user account that was used to first install the solution originally (ie the BesAdmin account).

Select the appropriate version of OCS. Run through the rest of the installation steps - for detailed information on how to install the BES solution from scratch, visit the BlackBerry section of the blog (http://blog.brightpointuk.co.uk/blackberry). Even on an existing installation you will be prompted to run through all installation steps and reboot the server.
Following a reboot the installation will resume and you will be prompted to enter in the address of the Communicator Web Access server:

Enter in the server address minus the /cwa suffix, so if your CWA login address is https://ocsweb.domain.com/cwa just enter 'ocsweb.domain.com'

Specify whether the server is accessed via HTTP or HTTPS and enter the port number if not using the standard 80 or 443 ports.

Complete the installation. When finished, within the list of BlackBerry services will be one named 'BlackBerry Collaboration Service', ensure that it has started successfully:

Setting up BlackBerry Smartphone devices

The BES is now configured. In order to use the BlackBerry device, you will first need to ensure that the BlackBerry Instant Messaging (BBIM) service book is present on the device.
To do this, on the device itself browse to Menu --> Options --> Advanced Options --> Service Books and ensure that BBIM is listed. If not, it may be necessary to re-send services books from the BES within the BlackBerry Manager.

Next, the OCS client software itself will need to be installed onto the handheld. One way of doing this is to use the BlackBerry Desktop Manager application.
The OCS client software can be downloaded from the BlackBerry web site - http://na.blackberry.com/eng/support/downloads/im.jsp

Download the file to your PC and extract the contents. The BlackBerry Desktop Manager software can be downloaded from the BlackBerry web site here - https://www.blackberry.com/Downloads/entry.do?code=A8BAA56554F96369AB93E...

Once installed, connect the BlackBerry to your PC and launch the Desktop Manager application. If prompted to select an Outlook profile, simply press Cancel. The following window will be displayed:

Click on the Application Loader and select the option to Add/Remove Applications.
The wizard will read details from the device about installed software, this process may take a few minutes. When prompted, click on the option to Browse and navigate to where you saved the extracted OCS client:

Select the OfficeCommunicator2007.alx file and click Open.
Tick the option to Install ‘Enterprise Messenger’ and click Next. The software will then be installed onto the device. When complete you can disconnect the device from the PC.

On the device itself, in the main menu should now be a folder called ‘Instant Messaging’:

Within this folder will be an icon for Enterprise Messenger:

Tap the icon to launch the OCS client:

You can now sign in using your domain username and password. If you have any contacts saved to your address book already, they will be displayed together with their status:

Once logged in, your status will also be updated:

You are now connected to the OCS server from your BlackBerry.

Troubleshooting BlackBerry Enterprise Server synchronisation issues

In this article I shall look at what to check when your BlackBerry users are unable to either receive mail, send mail, or both.
This article will only examine how to troubleshoot BES when deployed against an Exchange server rather than Domino or Groupwise.

Regardless of which version of the BES software you are running, the way in which it access Exchange is essentially the same - a system account is granted read and write access to user's mailboxes and manages their mailbox on their behalf. In the event of a problem, the specific troubleshooting steps will vary depending on the version of Exchange you are running, but the basic elements to verify are common to all:

• Number of users affected
• Device network connectivity
• User mailbox status
• Message filters
• BES server services
• BES server network connectivity
• BesAdmin Exchange permissions
• Event Viewer
• Log files

This article also assumes that users have already successfully activated their devices and have been able to both send and receive mail before, and have only now started experiencing problems. For details on how to troubleshoot the Enterprise Activation procedure, view this article - http://blog.brightpointuk.co.uk/how-does-bes-wireless-activation-process...

This article is not intended as an exhaustive troubleshooting guide. Should all of the steps outlined in this article appear to be passed by your BES deployment, and yet you continue to experience difficulty, then detailed examination of the BES log files and use of the BES Resource Kit may be required to isolate and rectify the cause of the problem. Brightpoint's technical support staff are fully-versed in all aspects of the BES solution and able to provide expert support.

BlackBerry Architecture

When troubleshooting BES issues, it is important to understand how the end-to-end BlackBerry architecture works and the components involved.

RIM deploy and maintain what is referred to as the BlackBerry Infrastructure (BBI). BES servers are assigned unique SRP IDs, which are used to authenticate against and register with the BBI using the Server Router Protocol (SRP). Connections are initiated from the BES to the BBI on a single TCP port, number 3101. This is the reason why BES servers are not required to be "Internet-facing" and do not require public IP addresses.
Client devices also register with the BBI, using unique PIN numbers. Messages sent from the BES are encrypted and then routed over the Internet to the BBI, including the target device's PIN number in the header information. Similarly, messages sent from handhelds are encrypted and sent to the BBI using the BES server's unique SRP key in the header.

Typically, the ability to receive email but not send is either due to Active Directory permission issues, or an exception to the Exchange mailbox size limit policy. If mail is being received then it is relatively safe to assume that both client device and BES are operating correctly. If mail is not being received (or sent), then a sensible troubleshooting procedure would include the following.

NOTE - the same troubleshooting procedure applies to the BlackBerry Professional Software (BPS).

Number of users affected

If only one user is reporting problems, then it is advisable to verify the status of the client device and that specific user's Exchange mailbox before you worry about the server. If all users, or an administratively-significant number of users are reporting problems then the server status should be examined. As the administrator, if you have a device yourself, is yours working?

Device Network Connectivity

If you believe the issue to be unique to a specific user, then verify that the device itself is correctly configured.

Is the cellular element of the device enabled? By default when powering on devices all networks are disabled. If the device has been used in a location that requires cellular devices be deactivated, has the user remembered to reactive the radio?

Can the device be used to make voice calls (if voice is enabled on the SIM and the IT policy allows use of the phone)? If the user receives a recorded message indicating that a call to customer services is required....then a call to customer services may be required to rectify an account issue.
Is the device registered with the cellular operator and indicating a packet data connection (either "GPRS", "EDGE" or "3G")? If not, the user may not be in a suitable coverage area or the operator may be experiencing a localised network fault.
Does the user definitely have the BES subscription on the SIM they are using in the BlackBerry device?

To force a device to register with the BlackBerry Infrastructure, select Menu --> Options --> Advanced Options --> Host Routing Table --> Menu --> Register Now

In many cases, simply removing the battery from the device and reinserting it after a couple of seconds may resolve the issue.

You can verify that the device is correctly registered on both the cellular network and with the BlackBerry infrastructure by sending a PIN message from the device to itself: within the Inbox on the device select the option to Compose PIN and send a message to yourself. This will cause a message to be sent from the device back to itself via the BlackBerry Infrastructure independently from the Exchange server.

New to version 5.0 of the device handheld software is a mobile network diagnostic test utility. Should you want to perform more detailed diagnostics, select the Options icon from the main menu. Select the Mobile Network menu entry:

The following screen will be displayed:

Press the menu button and select the entry for Diagnostics Test. The following window will be displayed:

Press the menu button and select the Run option:

Verify that all tests are completed successfully:

• BlackBerry Registration
• Connected to BlackBerry
• BlackBerry PIN-PIN

User Mailbox Status

If the user's device appears to be operating correctly, can the user access their mailbox via Outlook or Outlook Web Access? If the user's account has been disabled for any reason the administrator will need to ascertain why and whether the account can be reactivated.
If the user has exceeded their Exchange mailbox size limit, the ability to receive new mail may have been disabled and the user will need to free up some space in their mailbox before any new mails will be delivered.

Message Filters

If a user is receiving some email messages but not all, or is not receiving any messages but troubleshooting so far indicates that everything appears to be functioning correctly, verify what messages filters have been applied to the user's account: it may simply be the case that the user has inadvertently applied a rule that prohibits certain or all mails from being forwarded to their BlackBerry device:

BES services

Should more than one user have reported problems, and your own device not be receiving mail, verify the status the BES. Ensure that all required BlackBerry services are running and check the Application log in the Event Viewer for any warning or critical error messages.
Restarting the BlackBerry Controller service will cause all BlackBerry services to be refreshed.

BES network connectivity

If no messages are being received by handhelds, either email or PIN messages, verify that the BES is connected to the BlackBerry Infrastructure. You can verify whether the BES or BPS server is successfully connected to the SRP infrastructure by launching the BlackBerry Server Configuration utility from the Start menu and selecting the BlackBerry Router tab:

Click the Test Network Connection button and verify that the test is successful. Should the test fail verify that the server has outbound Internet access on TCP port 3101 on any firewalls between the BES and the outside world.

Alternatively you can run the bbsrptest.exe utility at the command line. On the BES server open a command prompt and navigate to the directory where the BES software has been installed to - c:\Program Files\Research In Motion\BlackBerry Enterprise Server\Utility by default.
Run the following command:

bbsrptest.exe

If the test is successful the following will be displayed:

Alternatively, if you have a BlackBerry Technical Support subscription, you can view the status of a specific BES SRP key and re-enable it should it have been disabled for any reason:

Verify whether the company Internet feed may be congested or have insufficient bandwidth to accommodate the volume of traffic being generated using SNMP monitoring tools such as MRTG (http://blog.brightpointuk.co.uk/mrtg)

Should the SRP connectivity test be successful, you can also verify end-to-end connectivity between the BES and the handheld by sending the user a PIN message from the BES:

BesAdmin Exchange permissions

Should PIN messages be delivered end-to-end successfully, then this would indicate that both BES and devices are operating correctly. Should Exchange emails not be being delivered, then the permissions of the BesAdmin account (or the user account used to install the BES server) should be verified. This step is essential when troubleshooting issues whereby emails are being received by users, but no emails are able to be sent.

In any Exchange BES installation, the BesAdmin will need the following rights in order to be able to both send and receive emails successfully:

• Exchange View Only Administer privileges
• "Send As", "Receive As" and "Administer Information Store" privileges on the Exchange server
• "Send As" permissions on User Objects on the Active Directory domain

The steps to verify that these permissions have been correctly applied are as follows:

Exchange 2003

Delegate administrative control to the BesAdmin user account

On the Exchange server, select Start → Programs → Microsoft Exchange → Exchange System Manager.

Right click on the Organisation name (at the root of the directory in the left-hand pane) and select Properties. The following window will be displayed:

Tick the options to Display routing groups and Display administrative groups. Click OK. If you receive a warning message indicating that the Exchange System Manager needs to be closed and re-opened for the changes to take effect, click OK.

Close the Exchange System Manager and then re-launch it again from the Start menu.

Right click on the first Administrative Group and select Delegate Control, as shown below:

The Administration Delegation Wizard will be displayed:

Click Next. The following window will be displayed:

Click Add. The following window will be displayed:

Set the Look in field to the domain in which the BES server resides. From the list of users select the BesAdmin account and click OK.

Click Next and then click Finish to complete the wizard.

Assign Send as, Receive as and Administer information store rights to the BesAdmin user account

Within the Exchange System Manager, right click on the entry for the Exchange server which the BES is going to communicate with and select Properties, as shown below:

Click on the Security tab. In the list of users select the BesAdmin user account. In the list of permissions, scroll down and tick the options to allow Administer information store, Receive As and Send As.

Click OK.

For full details on how to prepare Exchange 2003 for a BES installation, read this article - http://blog.brightpointuk.co.uk/bes-41x-50-exchange-2003-pre-requisites

Exchange 2007

Assign Send as, Receive as and Administer information store rights to the BesAdminuser account

Unlike previous versions of Exchange. This needs to be done at the command line via the Exchange Management Shell.

Launch the command interface and enter the following command:

get-mailboxserver (servername) | add-adpermission –user (service account)-accessrights GenericRead, 
GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin

Where (servername) should be replaced with the name of the Exchange Server, and (service account) should be replaced with the Alias name of the BesAdmin user account (so ‘BesAdmin’ in this case)

If you are successful, you should see the following:

To verify the permissions of an existing account, type:

get-mailboxserver (servername) | getADpermission -user (service account) | Format-List

For full details on how to prepare Exchange 2007 for a BES installation, read this article - http://blog.brightpointuk.co.uk/bes-41x-50-exchange-2007-pre-requisites

Exchange 2010

Assign "Receive As" and "Administer Information Store" rights to the BesAdmin user

On the Exchange server, launch the Exchange PowerShell and issue the following command:

Get-MailboxDatabase | Add-ADPermission -User "BesAdmin" -AccessRights
 ExtendedRight -ExtendedRights Receive-As, ms-Exch-Store-Admin

Assign Exchange View-Only Administrator rights to the BesAdmin user

Still within the Exchange PowerShell, now issue the following command:

Add -RoleGroupMember "View-Only Organization Management" -Member "BesAdmin"

Assign "Send As" rights to the BesAdmin user

This is done on the Exchange server itself within the Exchange PowerShell. Launch the console and issue the following command:

Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights
Send-As -User "BesAdmin" -Identity "CN=Users,DC=domain,DC=com"

(where "domain" and "com" should be substituted for your specific domain details, eg: DC=brightpoint,DC=co,DC=uk and so on)

To force all of the above changes to take effect on the domain, it may be worth running a group policy update. On the Exchange server click Start --> Run and issue the command "gpupdate /force"

Turn off Exchange 2010 Client Throttling

Exchange 2010 uses client throttling by default to protect the Exchange server from excessive user demands. RIM recommend turning off this feature as it can have an adverse affect on the performance of the BES solution. This is done within the Exchange PowerShell console.
Launch the console and issue the following command to get the "Identity" of the default throttling policy"

Get-ThrottlingPolicy | Where-Object {$_.IsDefault -eq "True"} | FL Identity

the Identity will be displayed:

Now issue the following command:

Set-ThrottlingPolicy -RCAMaxConcurrency $null

You will be prompted to enter the Identity to apply the policy to, enter the result returned above:

Increase the maximum number of connections to the Exchange Address Book Service

On the Exchange Server (or specifically the Client Access Server in a multi-box deployment), browse to C:\Program Files\Microsoft\Exchange Server\V14\Bin and locate the file "microsoft.exchange.addressbook.service.exe.config" and open it in NotePad:

Locate the line "MaxSessionsPerUser":

Increase the value to 100000. Save the file then restart the Address Book Service:

For full details on how to prepare an Exchange 2010 environment for a BES installation, read this article - http://blog.brightpointuk.co.uk/bes-501-exchange-2010-pre-requisites

All versions of Exchange

Assign Send As rights on Domain User Objects to the BesAdmin user account

On the Exchange Server, launch the Active Directory Users and Computers MMC snap-in:

Open the View menu and select the option to show Advanced Features.

Right click on the Domain root and select Properties. Click on the Security tab:

Click on the Advanced button. Select the option to Add a user:

Enter the alias of the BesAdmin account created earlier and click OK. In the Apply Onto drop-down menu select the option for User Objects:

In the Permissions section select the option to enable Send As:

Calendar Issues

Should email messages be sent and received successfully between the BES and handheld devices, but calendar appointments not be synchronised, a common step missed when installing the BES solution is to register the CDO.dll file on the BES server.
This only applies to versions of Exchange prior to 2007. When installing BES against Exchange 2003 and earlier, usual practice is to install the Exchange System Manager on the BES server. This installs the required MAPI components, but does not install the files required for calendaring.
The CDO.dll file needs to be located on the Exchange server, copied to the System32 directory on the BES server and registered:

By default the cdo.dll file will be located in the C:\Program Files\Exchsvr\Bin directory. To check the version of the file, right click on it and select Properties. Click on the Version tab:

The cdo.dll file needs to be registered, otherwise wireless calendar synchronisation will not function correctly between the Blackberry handheld and the server. To register the file, copy it to the C:\WINNT\System32 directory.

Once the file has been copied, select Start → Run. Enter “cmd” in the dialogue and press OK.

A command prompt will be displayed. Change to the WINNT\System32 by typing cd winnt\system32 and pressing enter.

Type regsvr32 cdo.dll and press enter:

If the file is registered successfully, notification will be displayed as shown below:

This procedure is not required for BES installations against versions of Exchange later than 2003 as the MAPI CDO package is used rather than the Exchange System Manager.

Troubleshooting BesAdmin user account permissions

The commonest cause of problems when troubleshooting issues with a BES installation is that the correct permissions have not been assigned to the BesAdmin user on the domain and the Exchange server as detailed above.
Included with the BES 5 software is a utility called "IEMSTEST" which can verify the BesAdmin user's access to specific user mailboxes.

The utility lives in the C:\Program Files\Research In Motion\BlackBerry Enterprise Server\Utility folder and needs to be run at the command line:

Select the BlackBerryServer MAPI profile when prompted:

Select the user account you wish to query:

The permissions will be tested:

As you can see from the above screenshot this test has indicated that the BesAdmin account does not have Send As rights on my James Liddiard user account. Once I verify my permissions, re-running the test indicates that all test have passed successfully:

General Troubleshooting

Should you be unsure as to whether the server running the BES server meets the requirements of the software, or has all the components necessary for integration with Exchange, you can run the BlackBerry System Requirements Tool, part of the BlackBerry Enterprise Server Resource Kit:

This information will be required by Technical Support should you wish to escalate an issue.
The BlackBerry Enterprise Server Resource Kit (BRK) can be downloaded free of charge from the BlackBerry web site.

Activating BlackBerries remotely via BlackBerry Web Desktop with BES Express

The BES Express 5.0.1 product includes the same BlackBerry Web Desktop feature included with the full BES product, enabling users to manage their own handhelds, backup and restore data as well as configure message filters.
So what? Whilst the BES Express product does enable client devices to enjoy push email and PIM data synchronisation functionality on a BIS (BlackBerry Internet Service) tariff, unless you have the more expensive BES (BlackBerry Enterprise Server) tariff, it is not possible to activate devices wirelessly using the Enterprise Activation feature. (http://blog.brightpointuk.co.uk/how-does-bes-wireless-activation-process...).

This means that whilst it isn't possible for users to be remotely activated against a BES Express deployment over the air if they are on the cheaper BIS tariff, they can activate their devices remotely via their web browser by connecting their BlackBerry device to their PC via the supplied USB cable.

System Requirements

The BlackBerry Web Desktop is a web application hosted on the BES Express server itself by default, depending on the options you selected during the installation.
By default, any device can be activated by a user using the Web Desktop "wireline" activation feature. This behaviour is configured within the properties of the Administration Service component:

In order to access the site externally, TCP port 3443 must be open to the BES Express server, or the server hosting the BlackBerry Administration Service, on all firewalls between it and the Internet. If an alternate port was specified during the installation of the BES Express software, this port must be opened instead.

Client Access

The Web Desktop is accessed via https://(bes_express_server):3443/webdesktop/login

As with the Administration Service, it can be accessed either via Active Directory or BlackBerry authentication mechanisms.

The web site itself is only accessible from Internet Explorer 6 or later, as Microsoft ActiveX components are required to enable device connectivity. When logging in for the first time, you will be prompted to install this component:

In order for the installation to be successful, the Web Desktop address should be added to the Trusted Sites security zone within the Internet Explorer options:

If the device communication components were not successfully installed you will receive notification that further setup is still required:

Add the site to the Trusted Sites and refresh the browser window, you will then be prompted to install the component:

This component can be optionally installed on all PCs in a domain automatically via Group Policy if desired, read the Administrator Guide for more information, available in the File Library and the FTP site.

If Active Directory authentication is enabled, any AD users can theoretically access the site, but if not added to the BES as a user, they will not be able to access any BES-related functionality:

Once the device components have been installed, provided that the user is enabled for BlackBerry service, they will be prompted to connect their device to their PC:

Once connected, the new hardware will be detected automatically:

The device will then be associated with the user automatically:

And the PIN number will be displayed:

If a BlackBerry handheld is already associated with the user account, the option of switching to their new device will be given:

The activation process is now complete.

For more information on the functionality available in the Web Desktop application, read this article - http://blog.brightpointuk.co.uk/bes-50-web-desktop-manager

Announcing BlackBerry Enterprise Server Express!

At the GSM Mobile World Congress in Barcelona RIM have announced an all-new flavour of BES Express (aka BlackBerry Professional Software).

Until now BPS has offered a streamlined version of the full BlackBerry Enterprise Server product, free to download and install for a single user, with additional user licenses (CALs) needing to be purchased, up to a maximum of 30 users (beyond which you'd need to upgrade to a full BES).

BPS is also yet to be upgraded to offer the features supported by handsets running version 5.0 of the device software.

BPS also required that users have the BES service enabled on their SIM card.

All that has now changed.

BES Express is now* still free to download....but all CALs are FREE....and there is NO LIMIT on how many CALs you may have.

The big news is that BES Express will work on the BIS tariff (BlackBerry Internet Service) - meaning that companies can now enjoy Exchange-based push email delivery on BlackBerry handhelds for approximately £5-£8 per user per month rather than the £25 a BES tariff requires...the cost of which may have been a barrier to adopting a BlackBerry solution previously.

This is a logical decision when you consider that Microsoft's Exchange ActiveSync protocol is effectively free (and can be used on Windows Mobile, Symbian, iPhone and Android devices), and to use BlackBerry with Exchange...you need to have an Exchange Server anyway.

With BPS, RIM provided a solution for the SoHo market, but there was no proportional upgrade from the 30-user business to, say, the 50-user business: once you reached the BPS cap of 30 users, to have 31 users you had no choice but to upgrade to a full BES - but not everyone needs the sheer wealth of features full BES offers in terms of device management and integration with third-party back-end Line Of Business (LOB) services, etc. BES Express addresses this gap in the market.

BES Express can be installed directly onto an Exchange or SBS server. RIM state a recommended maximum of 75 users on an Exchange-based BES Express installation before you start to consider using dedicated hardware. I will be providing setup guides very shortly.

* I say "now": BES Express won't be available for download until 1st March.

So the upshot of all this is that BlackBerry functionality is now effectively a free bolt-on to Exchange. There are some caveats however...

• The software will only work with Exchange 2003 or later (no Exchange 2000 support, and no support for Domino or Groupwise)
• There will be no over the air enterprise activation functionality (when used with the BIS tariff on client devices)
• There will be no instant messaging integration with OCS or Lotus SameTime (you’ll need full BES for this)
• The IT policy will be a limited set of 35 features (not the 450 policies available in full BES)
• BES Express cannot be installed in a High Availability deployment
• BES Express will not feature the MDS Integration Service, so it will not be possible to integrate with third party back-end systems (you can’t do this with BPS either, you need full BES)
• The BlackBerry Monitoring Service will not be available
• The web administration service will have 6 pre-defined administrative roles, which cannot be customised

The main news to take away is that the software will be free, client licenses will be free and unlimited, and it can be installed directly onto the Exchange server – so it is effectively a free add-on to Exchange that provides support for BlackBerry client devices (provided you have a BIS tariff on your SIM).

The bad news is that users of Exchange 2000 now have no mobility solution from RIM, and will have to upgrade their Exchange installation.

You can read more on the BlackBerry web site - http://na.blackberry.com/eng/services/business/server/express/

RIM have also released a comparison chart detailing the features available in all versions of the BES product- http://na.blackberry.com/eng/services/business/server/express/Comparison...

BlackBerry Enterprise Server Express Edition IT Policies

IT Policies

The following IT policies are available in the BlackBerry Enterprise Server Express edition:

Common
• Password required
• Minimum password length
• User can disable password
• Maximum security timeout
• Maximum password age
• User can change timeout
• Password pattern checks
• Allow SMS
• Allow MMS

Password
• Set password timeout
• Set maximum password attempts
• Suppress password echo
• Maximum password history
• Forbidden passwords

Email Messaging
• Maximum native attachment size
• Maximum native total attachment size
• Allow auto attachment download
• Disable rich content email
• Disable manual download of external images
• Confirm external image download

Security
• Disallow third party application downloads
• Force lock when holstered
• Content protection strength
• Disable IP Modem
• Disable external memory
• External file system encryption level
• Require password pattern
• Encryption of on-board device memory media files

S/MIME Application
• S/MIME force encrypted messages
• S/MIME allowed content ciphers

Bluetooth
• Disable Bluetooth

VoIP
• SIP User ID
• SIP User password
• SIP User display name

VPN
• VPN Username
• VPN User password

WiFi
• Disable WiFi

Camera
• Disable photo camera
• Disable video camera

Wireless software upgrades
• Disallow patch download over roaming WAN
• Allow web-based software loading
• Cryptographic services backup

Installing BlackBerry Enterprise Server Express for Exchange 2003

The BlackBerry Enterprise Server Express Edition offers businesses the ability to enable their staff to use BlackBerry devices to receive push-based email from an existing Microsoft Exchange installation - both standalone Exchange servers and the Microsoft Small Business Server product.
A free download from the BlackBerry web site, the solution is not limited to any set number of users and requires only that users have a BlackBerry data tariff on their SIM card with their network operator.
A 10,000 user CAL is supplied with the download by default:

Features

BES Express is based on the full BES 5.0.1 MR1 product code, and as such offers much (but not all) of the same functionality:

• Web-based administration
• 6 pre-defined administrative roles
• BlackBerry Web Desktop
• Over 35 IT policies for device management (see below), including device wipe
• HTML email support
• Flag emails for follow-up
• Mail folder management
• Remote email search
• Set out of office status and message
• Forward calendar appointments
• Open attachments in calendar appointments
• Free / Busy lookup
• Remote file access
• Support for audio (AWE, WAV, MP3, WMA) files

The following features are NOT available in BES Express:

• Cradle-less enterprise activation (when used with the BIS tariff on client devices)
• Ability to define multiple administrative roles
• BlackBerry Monitoring Service
• BlackBerry Enterprise Transporter Tool
• High Availability deployment options
• Support for BlackBerry Mobile Voice System (MVS)
• Support for enterprise instant messaging and social networking integration

At the time of writing, BES Express is only available in English.
BES Express is not compatible with Lotus Domino or Novell Groupwise installations.

System Requirements

Operating System

• Windows Server 2003 SP2 (32-bit or 64-bit)
• Windows Server 2003 R2 SP2 (32-bit or 4-bit)
• Windows Server 2008 SP2 (32-bit or 64-bit)
• Windows Small Business Server 2003
• Windows Small Business Server 2008

Microsoft Exchange Messaging Server

• Microsoft Exchange 2003 SP2
• Microsoft Exchange 2007 SP1
• Microsoft Exchange 2010 including Update Rollup 1

Microsoft Exchange System Tools

• (Exchange 2003) Microsoft Exchange 2003 SP2 System Manager or MAPI client and CDO 1.2.1 version 6.5.8039.0 or later
• (Exchange 2007) MAPI client and CDO 1.2.1 version 6.5.8067.0 or later
• (Exchange 2010) MAPI client and CDO 1.2.1 version 6.5.8146.0 or later

The following hotfix is required on the Microsoft Exchange 2003 server to provide Unicode support for calendars (ie Simplified Chinese and Japanese language characters) - http://support.microsoft.com/?kbid=913643
If using Exchange 2003, the following update is also required on the BES server to resolve a known issue with certain Chinese language characters - http://support.microsoft.com/?kbid=923537

Hardware

(Up to 200 users)
• Single processor, 2.0GHz Intel Xeon (2 processors recommended)
• 2GB memory
• 2 HDDs, RAID 1

  (Up to 500 users)

• Two processors, 2.0GHz Intel Xeon
• 2GB memory
• 2 HDDs, RAID 1

  (Up to 1000 users)

• Two processors, 2.0GHz Intel Xeon
• 3GB memory
• 2 HDDs, RAID 1

Database

Any of the following database management systems are supported:

• MSDE 2000 SP3
• Microsoft SQL Server 2005 SP3 (32-bit or 64-bit)
• Microsoft SQL Server 2005 Express Edition SP3
• Microsoft SQL Server 2008 SP1 (32-bit or 64-bit)
• Microsoft SQL Server 2008 Express Edition SP1 (32-bit or 64-bit)

If using a database system earlier than SQL 2005 SP3, the following hotfix should be installed on the database server - http://support.microsoft.com/?kbid=960082

Miscellaneous

In order to provide support for audio attachments, Windows Media Player 9 or later is required on the BES.

Internet Explorer 6 or later is required to access the web administration console.

Firewall

The BES requires outbound-initiated, bi-directional access to the Internet on TCP port 3101 as well as access to DNS.

RIM recommend operating up to a maximum of 75 users if the BES Express software is being installed directly onto the Exchange server itself. On a standalone server, BES Express can support up to 2,000 users. Multiple BES Express servers can be deployed in the same BlackBerry domain.

Preparing an Exchange 2003 environment

NOTE - this article assumes an Exchange 2003 installation, visit the BES Express section for articles on installing the solution against Exchange 2007 or 2010 (http://blog.brightpointuk.co.uk/blackberry-enterprise-server-express)

If installing the BES Express software on the Exchange server itself, the Exchange server should NOT itself also be a domain controller. This does not apply to the Small Business Server 2003 product, but if a dedicated server is available as an option, this should be considered for scalability.

Create a domain user account called BesAdmin

On the Exchange server, in the Active Directory Users and Computers console, create a domain user called "BesAdmin" and assign it an Exchange mailbox. Set the user account password to never expire.

Send an email to the BesAdmin user to initialise the Exchange mailbox.

Assign the BesAdmin user local administrative rights

On the server that is to host the BES Express, make the BesAdmin domain user a member of the local administrator group. NOTE - the BES Express server will first need to have been added to the Domain if not done already.
To do this, on the BES Express server, right click on the icon for My Computer and select Manage. Browse to Local Users and Groups --> Groups --> Administrators and add the BesAdmin user:

Assign the BesAdmin user "log on as a service" rights

On the BES Express server, also assign the BesAdmin domain user account "log on as a service" rights. To do this, select Administrative Tools --> Local Security Policy --> User Rights Assignment --> Log on as a service and add the BesAdmin user:

Assign Exchange View-Only Administrator rights to the BesAdmin user

On the Exchange server, make the BesAdmin user an Exchange View-Only administrator. Launch the Exchange System Manager and browse to Administrative Groups. Right click on the Administrative Group that the BesAdmin user is to have access to and select Delegate Control:

If you don't see the Administrative Groups displayed, right click on the Domain and select properties. Select the option to display Administrative Groups:

Close the Exchange System Manager and re-launch it. Add the BesAdmin user as an Exchange View-Only Administrator in the Delegate Control wizard:

Assign "Send As", "Receive As" and "Administer Information Store" rights to the BesAdmin user

Within the Exchange System Manager, right click on the entry for the Exchange server and select Properties. Click on the Security tab.
Add the BesAdmin user and tick the options to allow "Send As", "Receive As" and "Administer Information Store" rights to the user:

Assign "Send As" rights on the domain to the BesAdmin user

Within the Active Directory Users and Computers console, open the View menu and select the option to display Advanced Features.

Right click on the domain and select Properties. Click on the Security tab:

Click on the Advanced button:

Click on Add and type in the name of the BesAdmin user:

Select the option to Apply Onto User Objects.
Scroll down to the bottom and tick the option to enable Send As rights:

To force all of the above changes to take effect on the domain, it may be worth running a group policy update. On the Exchange server click Start --> Run and issue the command "gpupdate /force"

Install the Exchange MAPI CDO 1.2.1 package / Exchange System Manager

NOTE this step is only required if the BES Express software is being installed onto a server other than the Exchange server. If the Exchange server itself is being used to host the BES Express software, then all of the required MAPI components are already present.
If installing BES Express on a separate server, then a form of MAPI is required to enable Exchange connectivity. There are two choices when installing BES Express for use with Exchange 2003: the Exchange Management Tools (the Exchange System Manager) can be installed from the Exchange 2003 installation media and then brought up to the same service pack level as the Exchange 2003 server; or alternatively the Microsoft Exchange MAPI CDO 1.2.1 package can be installed for a 'lighter-weight' installation.
In this article I shall use the MAPI CDO package - this is available for download from our FTP site HERE (Exchange 2003 / 2007).

Run the installer and accept the license agreement:

Now you're ready to install the BES Express software.

NOTE - if you do choose to install the Exchange System Manager on the BES Express server then there are further configuration steps required.
The Exchange System Manager does not include the CDO.dll system file required for calendar access, this file must be copied to the BES Express server from the Exchange server.
By default this file will be located on the Exchange server in the "C:\Program Files\Exchsvr\Bin" directory. Copy the file to the "C:\Windows\System32" directory on the BES Express server.

Once copied across, register the CDL.dll file by launching the command prompt. Change to the C:\Windows\System32 directory and issue the following command:

regsvr32 cdo.dll

If successful, the following window will be displayed:

Installing the BlackBerry Enterprise Server Express software

LOG INTO THE BES EXPRESS SERVER AS THE BESADMIN USER!

Launch the BES Express installer, you will be prompted to confirm that you are indeed logged in as the correct user:

Click Continue Installation:

Choose your country and read the license agreement. Select the option to accept if you agree to the terms and conditions:

Select the option to Create a BlackBerry Configuration Database:

Select the option to install a BlackBerry Enterprise Server:

Verify that all pre-requisite checks are completed successfully, paying attention to any warnings or failures:

In this article I am allowing the BES Express installer to install a local copy of SQL Server Express, if you intend to use a dedicated SQL Server, select this option and enter the details of the server address:

Enter the password for the BesAdmin account and enter in a name for the BES Express server: this name can be a 'friendly' one and is used to identify it in the Web Administration interface:

If you are warned that the server does not have sufficient free disk space available, free up some space before continuing:

A summary of the installation options will be displayed:

Click Install, the required components will now be installed, this process may take a while. When complete you will be prompted to reboot the server:

Click Yes. Once rebooted, log back in as the BesAdmin user. The installation will resume automatically:

Enter a name for the Configuration Database - this should ideally be left at the default unless specifically required. Click Next:

You will be prompted to create the database, click Yes:

When created, click OK:

Enter in the 10,000-user CAL, SRP key and SRP authentification key you were supplied along with the BES Express download. Verify connectivity to the RIM Relay on TCP port 3101. Click Next:

The MAPI connection settings will now be required, enter in the name of the Exchange server as well as the BesAdmin user account mailbox. Click OK:

Enter in the name you wish to use for the Administration web site. Again this should be left at the default if you are unsure as to what this means. Any name you choose should be resolvable via DNS if not using the default option.
Enter in a password for the SSL certificate - this is generated automatically by the installer and assigned to the Apache-based administration web site (the site does not run within IIS). The certificate is generated based on the name entered.
By default the administration web site runs on port 3443 - this can be altered if desired but again leave this value at the default unless specifically required. Click Next:

Enter in the details of the BesAdmin user account again and click Next:

Specify whether you wish access to the administration web site to be authenticated based on Active Directory credentials, or whether you want to use the built-in BlackBerry Administration Service authentication. If you select the second option, enter in a password for the default admin account.

NOTE - if you select BlackBerry Administration Service authentication, the default admin username is "ADMIN", NOT "BESADMIN".

Click Next:

Select the option to Start Services and verify that all services start successfully:

Click Next:

You will be reminded what the address is to access the administration web site. Click Finish.

The software is now installed and ready to use. To access the web administration site, a link will have been added to the Programs folder on the Start menu:

Selecting the link will launch the default browser on the server (which needs to be Internet Explorer 6 or later):

Log in ether as the BesAdmin user (using Windows authentication) or as the Admin user (using BlackBerry authentication):

Add the web site to the Trusted Sites group in the Internet Explorer security options area:

And add the web site certificate to the trusted certificate authority folder:

Adding Users

In the Administration web site, select the option to Create a user:

Selecting Search will display a list of all available users:

Tick the user(s) you want to add and click Continue:

Select the BES Server the users should be added to (you'll only have one option) and click Next. The users will now be added to the BES Server.

To associate a device to a user, the BlackBerry handheld itself can be connected directly to the BES Express server via USB. In the Administration web site browse to Devices --> Attached Devices --> Overview:

When the device is connected, its PIN details will be displayed:

Select the option to Assign current device to a user. Select the user you want to associate the device with:

The device will now be associated to the user and will automatically activate itself and begin to download user mailbox data.

Troubleshooting

If you encounter any problems adding or activating users, first verify that all BlackBerry services have started and are running correctly:

Exchange Permissions

The commonest cause of problems when troubleshooting issues with a BES installation is that the correct permissions have not been assigned to the BesAdmin user on the domain and the Exchange server as detailed above.
Included with the BES Express software is a utility called "IEMSTEST" which can verify the BesAdmin user's access to specific user mailboxes.

The utility lives in the C:\Program Files\Research In Motion\BlackBerry Enterprise Server\Utility folder and needs to be run at the command line:

Select the BlackBerryServer MAPI profile when prompted:

Select the user account you wish to query:

The permissions will be tested:

As you can see from the above screenshot this test has indicated that the BesAdmin account does not have Send As rights on my James Liddiard user account. Once I verify my permissions, re-running the test indicates that all test have passed successfully:

Installing BlackBerry Enterprise Server Express for Exchange 2007

The BlackBerry Enterprise Server Express Edition offers businesses the ability to enable their staff to use BlackBerry devices to receive push-based email from an existing Microsoft Exchange installation - both standalone Exchange servers and the Microsoft Small Business Server product.
A free download from the BlackBerry web site, the solution is not limited to any set number of users and requires only that users have a BlackBerry data tariff on their SIM card with their network operator.
A 10,000 user CAL is supplied with the download by default:

Features

BES Express is based on the full BES 5.0.1 MR1 product code, and as such offers much (but not all) of the same functionality:

• Web-based administration
• 6 pre-defined administrative roles
• BlackBerry Web Desktop
• Over 35 IT policies for device management (see below), including device wipe
• HTML email support
• Flag emails for follow-up
• Mail folder management
• Remote email search
• Set out of office status and message
• Forward calendar appointments
• Open attachments in calendar appointments
• Free / Busy lookup
• Remote file access
• Support for audio (AWE, WAV, MP3, WMA) files

The following features are NOT available in BES Express:

• Cradle-less enterprise activation (when used with the BIS tariff on client devices)
• Ability to define multiple administrative roles
• BlackBerry Monitoring Service
• BlackBerry Enterprise Transporter Tool
• High Availability deployment options
• Support for BlackBerry Mobile Voice System (MVS)
• Support for enterprise instant messaging and social networking integration

At the time of writing, BES Express is only available in English.
BES Express is not compatible with Lotus Domino or Novell Groupwise installations.

System Requirements

Operating System

• Windows Server 2003 SP2 (32-bit or 64-bit)
• Windows Server 2003 R2 SP2 (32-bit or 4-bit)
• Windows Server 2008 SP2 (32-bit or 64-bit)
• Windows Small Business Server 2003
• Windows Small Business Server 2008

Microsoft Exchange Messaging Server

• Microsoft Exchange 2003 SP2
• Microsoft Exchange 2007 SP1
• Microsoft Exchange 2010 including Update Rollup 1

Microsoft Exchange System Tools

• (Exchange 2003) Microsoft Exchange 2003 SP2 System Manager or MAPI client and CDO 1.2.1 version 6.5.8039.0 or later
• (Exchange 2007) MAPI client and CDO 1.2.1 version 6.5.8067.0 or later
• (Exchange 2010) MAPI client and CDO 1.2.1 version 6.5.8146.0 or later

Hardware

(Up to 200 users)
• Single processor, 2.0GHz Intel Xeon (2 processors recommended)
• 2GB memory
• 2 HDDs, RAID 1

  (Up to 500 users)

• Two processors, 2.0GHz Intel Xeon
• 2GB memory
• 2 HDDs, RAID 1

  (Up to 1000 users)

• Two processors, 2.0GHz Intel Xeon
• 3GB memory
• 2 HDDs, RAID 1

Database

Any of the following database management systems are supported:

• MSDE 2000 SP3
• Microsoft SQL Server 2005 SP3 (32-bit or 64-bit)
• Microsoft SQL Server 2005 Express Edition SP3
• Microsoft SQL Server 2008 SP1 (32-bit or 64-bit)
• Microsoft SQL Server 2008 Express Edition SP1 (32-bit or 64-bit)

If using a database system earlier than SQL 2005 SP3, the following hotfix should be installed on the database server - http://support.microsoft.com/?kbid=960082

Miscellaneous

In order to provide support for audio attachments, Windows Media Player 9 or later is required on the BES.

Internet Explorer 6 or later is required to access the web administration console.

Firewall

The BES requires outbound-initiated, bi-directional access to the Internet on TCP port 3101 as well as access to DNS.

RIM recommend operating up to a maximum of 75 users if the BES Express software is being installed directly onto the Exchange server itself. On a standalone server, BES Express can support up to 2,000 users. Multiple BES Express servers can be deployed in the same BlackBerry domain.

Preparing an Exchange 2007 environment

NOTE - this article assumes an Exchange 2007 installation. Visit the BES Express section of the blog for articles on installing the solution against Exchange 2003 or 2010.

If installing the BES Express software on the Exchange server itself, the Exchange server should NOT itself also be a domain controller. This does not apply to the Small Business Server 2008 product, but if a dedicated server is available as an option, this should be considered for scalability.

Create a domain user account called BesAdmin

On the Exchange server, in the Active Directory Users and Computers console, create a domain user called "BesAdmin" and assign it an Exchange mailbox. Set the user account password to never expire.

Send an email to the BesAdmin user to initialise the Exchange mailbox.

Assign the BesAdmin user local administrative rights

On the server that is to host the BES Express, make the BesAdmin domain user a member of the local administrator group. NOTE - the BES Express server will first need to have been added to the Domain if not done already.
To do this, on the BES Express server, right click on the icon for My Computer and select Manage. Browse to Local Users and Groups --> Groups --> Administrators and add the BesAdmin user:

Assign the BesAdmin user "log on as a service" rights

On the BES Express server, also assign the BesAdmin domain user account "log on as a service" rights. To do this, select Administrative Tools --> Local Security Policy --> User Rights Assignment --> Log on as a service and add the BesAdmin user:

Assign Exchange View-Only Administrator rights to the BesAdmin user

On the Exchange server, launch the Exchange PowerShell and issue the following command:

add-exchangeadministrator "BesAdmin" -role ViewOnlyAdmin

Assign "Receive As" and "Administer Information Store" rights to the BesAdmin user

Within the Exchange Powershell, now issue the following command:

get-mailboxserver "exchange.domain.com" | add-adpermission -user "BesAdmin"
 -accessrights ExtendedRight -extendedrights Receive-As, ms-Exch-Store-Admin

Assign "Send As" rights on the domain to the BesAdmin user

Within the Active Directory Users and Computers console, open the View menu and select the option to display Advanced Features.

Right click on the domain and select Properties. Click on the Security tab:

Click on the Advanced button:

Click on Add and type in the name of the BesAdmin user:

Select the option to Apply Onto User Objects.
Scroll down to the bottom and tick the option to enable Send As rights:

To force all of the above changes to take effect on the domain, it may be worth running a group policy update. On the Exchange server click Start --> Run and issue the command "gpupdate /force"

Install the Exchange MAPI CDO 1.2.1 package

The Microsoft Exchange MAPI CDO 1.2.1 package must be installed to provide the BesAdmin user a MAPI connection to Exchange mailboxes as well as access to calendaring information. This package is available for download from our FTP site HERE (Exchange 2003 / 2007).

Run the installer and accept the license agreement:

Now you're ready to install the BES Express software.

Installing the BlackBerry Enterprise Server Express software

LOG INTO THE BES EXPRESS SERVER AS THE BESADMIN USER!

Launch the BES Express installer, you will be prompted to confirm that you are indeed logged in as the correct user:

Click Continue Installation:

Choose your country and read the license agreement. Select the option to accept if you agree to the terms and conditions:

Select the option to Create a BlackBerry Configuration Database:

Select the option to install a BlackBerry Enterprise Server:

Verify that all pre-requisite checks are completed successfully, paying attention to any warnings or failures:

In this article I am allowing the BES Express installer to install a local copy of SQL Server Express, if you intend to use a dedicated SQL Server, select this option and enter the details of the server address:

Enter the password for the BesAdmin account and enter in a name for the BES Express server: this name can be a 'friendly' one and is used to identify it in the Web Administration interface:

If you are warned that the server does not have sufficient free disk space available, free up some space before continuing:

A summary of the installation options will be displayed:

Click Install, the required components will now be installed, this process may take a while. When complete you will be prompted to reboot the server:

Click Yes. Once rebooted, log back in as the BesAdmin user. The installation will resume automatically:

Enter a name for the Configuration Database - this should ideally be left at the default unless specifically required. Click Next:

You will be prompted to create the database, click Yes:

When created, click OK:

Enter in the 10,000-user CAL, SRP key and SRP authentification key you were supplied along with the BES Express download. Verify connectivity to the RIM Relay on TCP port 3101. Click Next:

The MAPI connection settings will now be required, enter in the name of the Exchange server as well as the BesAdmin user account mailbox. Click OK:

Enter in the name you wish to use for the Administration web site. Again this should be left at the default if you are unsure as to what this means. Any name you choose should be resolvable via DNS if not using the default option.
Enter in a password for the SSL certificate - this is generated automatically by the installer and assigned to the Apache-based administration web site (the site does not run within IIS). The certificate is generated based on the name entered.
By default the administration web site runs on port 3443 - this can be altered if desired but again leave this value at the default unless specifically required. Click Next:

Enter in the details of the BesAdmin user account again and click Next:

Specify whether you wish access to the administration web site to be authenticated based on Active Directory credentials, or whether you want to use the built-in BlackBerry Administration Service authentication. If you select the second option, enter in a password for the default admin account.

NOTE - if you select BlackBerry Administration Service authentication, the default admin username is "ADMIN", NOT "BESADMIN".

Click Next:

Select the option to Start Services and verify that all services start successfully:

Click Next:

You will be reminded what the address is to access the administration web site. Click Finish.

The software is now installed and ready to use. To access the web administration site, a link will have been added to the Programs folder on the Start menu:

Selecting the link will launch the default browser on the server (which needs to be Internet Explorer 6 or later):

Log in ether as the BesAdmin user (using Windows authentication) or as the Admin user (using BlackBerry authentication):

Add the web site to the Trusted Sites group in the Internet Explorer security options area:

And add the web site certificate to the trusted certificate authority folder:

Adding Users

In the Administration web site, select the option to Create a user:

Selecting Search will display a list of all available users:

Tick the user(s) you want to add and click Continue:

Select the BES Server the users should be added to (you'll only have one option) and click Next. The users will now be added to the BES Server.

To associate a device to a user, the BlackBerry handheld itself can be connected directly to the BES Express server via USB. In the Administration web site browse to Devices --> Attached Devices --> Overview:

When the device is connected, its PIN details will be displayed:

Select the option to Assign current device to a user. Select the user you want to associate the device with:

The device will now be associated to the user and will automatically activate itself and begin to download user mailbox data.

Troubleshooting

If you encounter any problems adding or activating users, first verify that all BlackBerry services have started and are running correctly:

Exchange Permissions

The commonest cause of problems when troubleshooting issues with a BES installation is that the correct permissions have not been assigned to the BesAdmin user on the domain and the Exchange server as detailed above.
Included with the BES Express software is a utility called "IEMSTEST" which can verify the BesAdmin user's access to specific user mailboxes.

The utility lives in the C:\Program Files\Research In Motion\BlackBerry Enterprise Server\Utility folder and needs to be run at the command line:

Select the BlackBerryServer MAPI profile when prompted:

Select the user account you wish to query:

The permissions will be tested:

As you can see from the above screenshot this test has indicated that the BesAdmin account does not have Send As rights on my James Liddiard user account. Once I verify my permissions, re-running the test indicates that all test have passed successfully:

Installing BlackBerry Enterprise Server Express for Exchange 2010

The BlackBerry Enterprise Server Express Edition offers businesses the ability to enable their staff to use BlackBerry devices to receive push-based email from an existing Microsoft Exchange installation - both standalone Exchange servers and the Microsoft Small Business Server product.
A free download from the BlackBerry web site, the solution is not limited to any set number of users and requires only that users have a BlackBerry data tariff on their SIM card with their network operator.
A 10,000 user CAL is supplied with the download by default:

Features

BES Express is based on the BES 5.0.1 MR1 code, and as such offers much (but not all) of the same functionality:

• Web-based administration
• 6 pre-defined administrative roles
• BlackBerry Web Desktop
• Over 35 IT policies for device management (see below), including device wipe
• HTML email support
• Flag emails for follow-up
• Mail folder management
• Remote email search
• Set out of office status and message
• Forward calendar appointments
• Open attachments in calendar appointments
• Free / Busy lookup
• Remote file access
• Support for audio (AWE, WAV, MP3, WMA) files

The following features are NOT available in BES Express:

• Cradle-less enterprise activation (when used with the BIS tariff on client devices)
• Ability to define multiple administrative roles
• BlackBerry Monitoring Service
• BlackBerry Enterprise Transporter Tool
• High Availability deployment options
• Support for BlackBerry Mobile Voice System (MVS)
• Support for enterprise instant messaging and social networking integration

At the time of writing, BES Express is only available in English.
BES Express is not compatible with Lotus Domino or Novell Groupwise installations.

System Requirements

Operating System

• Windows Server 2003 SP2 (32-bit or 64-bit)
• Windows Server 2003 R2 SP2 (32-bit or 4-bit)
• Windows Server 2008 SP2 (32-bit or 64-bit)
• Windows Small Business Server 2003
• Windows Small Business Server 2008

Microsoft Exchange Messaging Server

• Microsoft Exchange 2003 SP2
• Microsoft Exchange 2007 SP1
• Microsoft Exchange 2010 including Update Rollup 1

Microsoft Exchange System Tools

• (Exchange 2003) Microsoft Exchange 2003 SP2 System Manager or MAPI client and CDO 1.2.1 version 6.5.8039.0 or later
• (Exchange 2007) MAPI client and CDO 1.2.1 version 6.5.8067.0 or later
• (Exchange 2010) MAPI client and CDO 1.2.1 version 6.5.8146.0 or later

Hardware

(Up to 200 users)
• Single processor, 2.0GHz Intel Xeon (2 processors recommended)
• 2GB memory
• 2 HDDs, RAID 1

  (Up to 500 users)

• Two processors, 2.0GHz Intel Xeon
• 2GB memory
• 2 HDDs, RAID 1

  (Up to 1000 users)

• Two processors, 2.0GHz Intel Xeon
• 3GB memory
• 2 HDDs, RAID 1

Database

Any of the following database management systems are supported:

• MSDE 2000 SP3
• Microsoft SQL Server 2005 SP3 (32-bit or 64-bit)
• Microsoft SQL Server 2005 Express Edition SP3
• Microsoft SQL Server 2008 SP1 (32-bit or 64-bit)
• Microsoft SQL Server 2008 Express Edition SP1 (32-bit or 64-bit)

If using a database system earlier than SQL 2005 SP3, the following hotfix should be installed on the database server - http://support.microsoft.com/?kbid=960082

Miscellaneous

In order to provide support for audio attachments, Windows Media Player 9 or later is required on the BES.

Internet Explorer 6 or later is required to access the web administration console.

Firewall

The BES requires outbound-initiated, bi-directional access to the Internet on TCP port 3101 as well as access to DNS.

RIM recommend operating up to a maximum of 75 users if the BES Express software is being installed directly onto the Exchange server itself. On a standalone server, BES Express can support up to 2,000 users. Multiple BES Express servers can be deployed in the same BlackBerry domain.

Preparing an Exchange 2010 environment

NOTE - this article assumes an Exchange 2010 installation only. Visit the BES Express section of the blog for details on installing the solution against Exchange 2003 or 2007.

Ensure that Exchange 2010 Update Rollup 1 is installed on the Exchange 2010 server. This package is available here - http://www.microsoft.com/downloads/details.aspx?FamilyID=371add31-d7a0-4...

If installing the BES Express software on the Exchange server itself, the Exchange server should NOT itself also be a domain controller.

Create a domain user account called BesAdmin

On the Exchange server, in the Active Directory Users and Computers console, create a domain user called "BesAdmin" and assign it an Exchange mailbox. Set the user account password to never expire.

Send an email to the BesAdmin user to initialise the Exchange mailbox.

Assign the BesAdmin user local administrative rights

On the server that is to host the BES Express, make the BesAdmin domain user a member of the local administrator group. NOTE - the BES Express server will first need to have been added to the Domain if not done already.
To do this, on the BES Express server, right click on the icon for My Computer and select Manage. Browse to Local Users and Groups --> Groups --> Administrators and add the BesAdmin user:

Assign the BesAdmin user "log on as a service" rights

On the BES Express server, also assign the BesAdmin domain user account "log on as a service" rights. To do this, select Administrative Tools --> Local Security Policy --> User Rights Assignment --> Log on as a service and add the BesAdmin user:

Assign "Receive As" and "Administer Information Store" rights to the BesAdmin user

On the Exchange server, launch the Exchange PowerShell and issue the following command:

Get-MailboxDatabase | Add-ADPermission -User "BesAdmin" -AccessRights
 ExtendedRight -ExtendedRights Receive-As, ms-Exch-Store-Admin

Assign Exchange View-Only Administrator rights to the BesAdmin user

Still within the Exchange PowerShell, now issue the following command:

Add -RoleGroupMember "View-Only Organization Management" -Member "BesAdmin"

Assign "Send As" rights on the domain to the BesAdmin user

Within the Active Directory Users and Computers console, open the View menu and select the option to display Advanced Features.

Right click on the domain and select Properties. Click on the Security tab:

Click on the Advanced button:

Click on Add and type in the name of the BesAdmin user:

Select the option to Apply Onto User Objects.
Scroll down to the bottom and tick the option to enable Send As rights:

For good measure, also enable Send As rights on the Exchange server itself within the Exchange PowerShell. Launch the console and issue the following command:

Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights
Send-As -User "BesAdmin" -Identity "CN=Users,DC=domain,DC=com"

(where "domain" and "com" should be substituted for your specific domain details, eg: DC=brightpoint,DC=co,DC=uk and so on)

To force all of the above changes to take effect on the domain, it may be worth running a group policy update. On the Exchange server click Start --> Run and issue the command "gpupdate /force"

Turn off Exchange 2010 Client Throttling

Exchange 2010 uses client throttling by default to protect the Exchange server from excessive user demands. RIM recommend turning off this feature as it can have an adverse affect on the performance of the BES solution. This is done within the Exchange PowerShell console.
Launch the console and issue the following command to get the "Identity" of the default throttling policy"

Get-ThrottlingPolicy | Where-Object {$_.IsDefault -eq "True"} | FL Identity

the Identity will be displayed:

Now issue the following command:

Set-ThrottlingPolicy -RCAMaxConcurrency $null

You will be prompted to enter the Identity to apply the policy to, enter the result returned above:

Increase the maximum number of connections to the Exchange Address Book Service

On the Exchange Server (or specifically the Client Access Server in a multi-box deployment), browse to C:\Program Files\Microsoft\Exchange Server\V14\Bin and locate the file "microsoft.exchange.addressbook.service.exe.config" and open it in NotePad:

Locate the line "MaxSessionsPerUser":

Increase the value to 100000. Save the file then restart the Address Book Service:

Install the Exchange MAPI CDO 1.2.1 package

The Microsoft Exchange MAPI CDO 1.2.1 package must be installed to provide the BesAdmin user a MAPI connection to Exchange mailboxes as well as access to calendaring information. This package is available for download from our FTP site HERE (Exchange 2010 only).

Run the installer and accept the license agreement:

Now you're ready to install the BES Express software.

Installing the BlackBerry Enterprise Server Express software

LOG INTO THE BES EXPRESS SERVER AS THE BESADMIN USER!

Launch the BES Express installer, you will be prompted to confirm that you are indeed logged in as the correct user:

Click Continue Installation:

Choose your country and read the license agreement. Select the option to accept if you agree to the terms and conditions:

Select the option to Create a BlackBerry Configuration Database:

Select the option to install a BlackBerry Enterprise Server:

Verify that all pre-requisite checks are completed successfully, paying attention to any warnings or failures:

In this article I am allowing the BES Express installer to install a local copy of SQL Server Express, if you intend to use a dedicated SQL Server, select this option and enter the details of the server address:

Enter the password for the BesAdmin account and enter in a name for the BES Express server: this name can be a 'friendly' one and is used to identify it in the Web Administration interface:

If you are warned that the server does not have sufficient free disk space available, free up some space before continuing:

A summary of the installation options will be displayed:

Click Install, the required components will now be installed, this process may take a while. When complete you will be prompted to reboot the server:

Click Yes. Once rebooted, log back in as the BesAdmin user. The installation will resume automatically:

Enter a name for the Configuration Database - this should ideally be left at the default unless specifically required. Click Next:

You will be prompted to create the database, click Yes:

When created, click OK:

Enter in the 10,000-user CAL, SRP key and SRP authentification key you were supplied along with the BES Express download. Verify connectivity to the RIM Relay on TCP port 3101. Click Next:

The MAPI connection settings will now be required, enter in the name of the Exchange server as well as the BesAdmin user account mailbox. Click OK:

Enter in the name you wish to use for the Administration web site. Again this should be left at the default if you are unsure as to what this means. Any name you choose should be resolvable via DNS if not using the default option.
Enter in a password for the SSL certificate - this is generated automatically by the installer and assigned to the Apache-based administration web site (the site does not run within IIS). The certificate is generated based on the name entered.
By default the administration web site runs on port 3443 - this can be altered if desired but again leave this value at the default unless specifically required. Click Next:

Enter in the details of the BesAdmin user account again and click Next:

Specify whether you wish access to the administration web site to be authenticated based on Active Directory credentials, or whether you want to use the built-in BlackBerry Administration Service authentication. If you select the second option, enter in a password for the default admin account.

NOTE - if you select BlackBerry Administration Service authentication, the default admin username is "ADMIN", NOT "BESADMIN".

Click Next:

Select the option to Start Services and verify that all services start successfully:

Click Next:

You will be reminded what the address is to access the administration web site. Click Finish.

The software is now installed and ready to use. To access the web administration site, a link will have been added to the Programs folder on the Start menu:

Selecting the link will launch the default browser on the server (which needs to be Internet Explorer 6 or later):

Log in ether as the BesAdmin user (using Windows authentication) or as the Admin user (using BlackBerry authentication):

Add the web site to the Trusted Sites group in the Internet Explorer security options area:

And add the web site certificate to the trusted certificate authority folder:

Adding Users

In the Administration web site, select the option to Create a user:

Selecting Search will display a list of all available users:

Tick the user(s) you want to add and click Continue:

Select the BES Server the users should be added to (you'll only have one option) and click Next. The users will now be added to the BES Server.

To associate a device to a user, the BlackBerry handheld itself can be connected directly to the BES Express server via USB. In the Administration web site browse to Devices --> Attached Devices --> Overview:

When the device is connected, its PIN details will be displayed:

Select the option to Assign current device to a user. Select the user you want to associate the device with:

The device will now be associated to the user and will automatically activate itself and begin to download user mailbox data.

Troubleshooting

If you encounter any problems adding or activating users, first verify that all BlackBerry services have started and are running correctly:

Exchange Permissions

The commonest cause of problems when troubleshooting issues with a BES installation is that the correct permissions have not been assigned to the BesAdmin user on the domain and the Exchange server as detailed above.
Included with the BES Express software is a utility called "IEMSTEST" which can verify the BesAdmin user's access to specific user mailboxes.

The utility lives in the C:\Program Files\Research In Motion\BlackBerry Enterprise Server\Utility folder and needs to be run at the command line:

Select the BlackBerryServer MAPI profile when prompted:

Select the user account you wish to query:

The permissions will be tested:

As you can see from the above screenshot this test has indicated that the BesAdmin account does not have Send As rights on my James Liddiard user account. Once I verify my permissions, re-running the test indicates that all test have passed successfully:

Setting up a new BlackBerry Internet Service (BIS) account

The BlackBerry Internet Service (BIS) is RIM's consumer-oriented platform which provides push-based email delivery from your own POP or IMAP-based account to your handheld, without the need for your own BlackBerry server deployed somewhere. It does not offer the device management functionality of the corporate product, the BlackBerry Enterprise Server (BES), but then you don't necessarily need it as a consumer.

In order to use the BIS service you will obviously need a BlackBerry device, and also have the BIS tariff enabled on your SIM card by your mobile operator.

In this article I am using Vodafone as the network operator, but the instructions are common to all operators that offer BIS. Al operators that do, will have a web site hosted by RIM accessible by users. To activate your new account, browse to the operator's BIS Portal. In the case of Vodafone UK, the site is accessible here - https://bis.eu.blackberry.com/html?brand=vodauk

Select the option to create a new account:

Read the terms and conditions and select the option to agree if you accept:

Enter the PIN number and IMEI number of your BlackBerry handheld. This information can be found on your device by browsing to Options --> Status.

Enter your desired username and password to access the BIS Portal in the future:

Enter in the email address of the account you wish to activate, as well as the password for that email account.

The setup wizard will now attempt to determine the correct connection settings to use automatically based on the email address entered. This process may work for commonly-used email accounts such as Hotmail or Gmail. If the wizard is not able to determine the settings to use the following will be displayed:

Select the option to enter the settings manually:

Select the type of email account you wish to configure. Personal email accounts would be POP or IMAP-based accounts along the lines of a Hotmail or a GoogleMail account. It may also apply to work accounts that only support POP or IMAP access, such as a Domino-based account (I appreciate that Domino does provide webmail access, but not for the purposes of this service it doesn't).

Selecting the option to set up a work account will present the following options:

If you have an Exchange server deployed that is configured to provide Outlook Web Access (or webmail - access to email via a web browser), select this option:

Enter in the webmail address of your Exchange server, the address you enter to access your email via your web browser. This is normally of the form:

Exchange 2003 - http(s)://mail.mydomain.com/exchange
Exchange 2007 - http(s)://mail.mydomain/owa

Complete your email address, username and password information. Your username and password will be the same details you use to log into your Windows PC. Your username will need to be in the form 'domain\username'. The domain to enter will be the contents of the 'Log Into' field when you log into your Windows PC.

Your mailbox name will usually be the same as your username. Provided that all the information has been entered correctly, and the Exchange server is accessible, the following will be displayed:

Your account has now been added successfully. In the Settings section you can adjust your default signature as well as whether or not to synchronise deleted items - ie when you delete an item on your device whether or not it gets deleted from the Exchange server.

Should you have selected the option to set up a personal email account, you will need to complete the following information:

The email server address will be the POP or IMAP server provided by your email service. If your account is already configured on your PC in OUtlook or Outlook Express you can retrieve the settings from here.

Filters can also be applied to incoming messages, specifying whether mails containing certain text, from certain senders or sent to certain recipients get forwarded to the handheld or not, or get sent flagged as urgent:

You can also change your password to access the BIS Portal:

In the event that the service stops responding, or you need to hard reset your device, it may be necessary to re-send the configuration details to the handheld. This can be done within the Help menu:

Click on the option to Send Service Books

This process may take up to 30 minutes to complete.

Synchronise your BlackBerry handheld with Microsoft Outlook

Whilst a BlackBerry handheld activated with a corporate BES server will receive contact and calendar data over the air from either an Exchange or a Domino server, devices used with the BlackBerry Internet Service (BIS) can only receive emails over the air, and must synchronise contact and calendar information locally with your PC via the BlackBerry Desktop Manager software, available for download free from the BlackBerry web site- http://na.blackberry.com/eng/services/desktop/

Once installed, launch the Desktop Manager and connect your BlackBerry handheld to your PC via the supplied USB cable. Windows will detect the new hardware automatically. Within the Desktop Manager application, select the Synchronise option:

The following window will be displayed:

Tick the option to Synchronise Organizer Data. In the left-hand navigation menu, select the option to Configure --> Synchronisation:

Click on the Synchronisation button:

Select the folders which you want to sync to the handheld. Selecting the Calendar folder will prompt you to specify the desktop application you want to synchronise with:

Select Microsoft Outlook and click Next:

Select the direction of synchronisation you want and click Next:

If you have more than one Outlook profile configured (be it Mum, Dad, James or Home, Work, Project) select the desired profile. If desired select a date range for calendar entry synchronisation. Click Next:

Click Finish. Repeat the same procedure for the Address Book and other PIM data folders:

Clicking on the Advanced options will allow you to specify specific Outlook folders if you have multiple configured and will also allow you to map specific Outlook contact fields to those on the handheld, should you want the Outlook 'Home' number to map to the 'Carphone' number on the handheld, for example:

Once you have configured synchronisation options, if you receive the following error message:

This would indicate that the handheld is configured for wireless synchronisation rather than desktop synchronisation. To adjust this, on the handheld itself open the Address Book application.
Press the menu button and select Options:

Select the Desktop Contacts List:

Set Wireless Synchronisation to No.

Do the same for the Calendar application:

You will now need to re-enable Address Book and Calendar synchronisation within the BlackBerryDesktop Manager application.
Initiating a synchronisation now will complete successfully: