Re: ActiveSync 4.2 installation with locked-down account

There are three issues here.

1) Elevated privileges needed for installs. ActiveSync needs installed at a
privilege which allows the installing of device drivers, QFE's and component
registrations.

2) "..admin just to *run* activesync". I'm not logged in as an admin when I
run ActiveSync, what issues are you experiencing?

3) "..GPO's to configure ActiveSync 4.2" There are some configurations
which can be access through the registry GPO. What features are you looking
for?

--
Carl Wolz [MSFT]
This Posting is provided "AS IS" with no warranties, and confers no rights.



"SchulieBug" <> wrote in message
news: ups.com...
>I don't know if Microsoft looks into public newsgroups, but i hope this
> one will draw thair attention! I've got two big problems with
> ActiveSync 4.2:
>
> 1) Installation with elevated privileges. I was excited to see
> Activesync 4 came as an MSI just to have my hopes crushed when I did my
> first distribution tests. The MSI complains that it needs to be
> installed as an administrator. For those of us managing large
> organizations, this isn't an option. Why did we want to centrally
> manage software, install with elevated privileges, and keep the end
> users from needing admin privs? Since many sysadmins have repackaged
> 3.8 and have seen it work, it shouldn't be necessary for the user to be
> an admin just to *run* activesync. Microsoft needs to start thinking
> about security and running under "minimum required privileges" when
> writing these peices of code.
>
> 2) I want to be able to use GPO's to configure ActiveSync 4.2. Almost
> anything else can be configured and locked down with GPO's, why not
> ActiveSync
>
> Kind regards,
>
>
> Jan Schulenburg
>

Hi,
The issue about the installation is that ActiveSync must install a new
network interface and create registry settings. The registry alone requires
Administrator access to create the keys.

With Vista this should change due to the focus on User Account Control.


--
Chris De Herrera
http://www.pocketpcfaq.com
http://www.tabletpctalk.com
http://www.pocketpctalk.com
http://www.mobilitytalk.com

ActiveSync 4.x Troubleshooting Guide -
http://www.pocketpcfaq.com/faqs/acti...shoot-as4x.htm


"SchulieBug" <> wrote in message
news: ups.com...
> Carl,
>
> Mainly the first and last issues are important to me. If it is
> installed correct it will run for every user, i will trust on that.
>
> First issue: it should be possible for me to install ActiveSync in a
> locked-down user environment, can't think how MS missed this!
>
> Third issue: i didn't know there was an adm for ActiveSync already? I
> will try to look it up or could someone post is here (or a link)?
>
> Kind regards,
>
> Jan Schulenburg
>

They're already working on the next version and, since this is the only
serious complaint about this problem, I agree that it's unlikely to get any
attention for AS4.2. Maybe the final release of AS4.5 will be set up
differently. You might try sending an e-mail to astell <at> microsoft.com
and tell them what you've found. I'm not positive that account still
exists, but it went directly to the team during the AS4.x beta cycles.

Paul T.

"SchulieBug" <> wrote in message
news: oups.com...
> Chris,
>
> I don't get it.. When installing an MSI wilth elevated provileges, the
> installation is run with admin rights, so it should be possible to
> create a new network interface or to add/modify/delete registry
> settings!
>
> All of our packages are native of re-captured MSI's, all of them run
> fine. Even Adobe Acrobat Reader 7.x comes with an MSI which can be run
> with elevated privileges!
>
> My 2 cents: someone didn't think ActiveSync was ever to be used in a
> professional environment, so why create a proper MSI? PDA owners are
> always local administrators or so?
>
> Please Microsoft: deliver a proper ActiveSync MSI which can be used in
> a locked-down environment and which installs fine using elevated
> privileges!!
>
>
> Maybe i'm a cinical, but somehow i don't think Microsoft will react on
> this
>

>> The mail address is still active. <<

Are you saying that because the mail didn't bounce or did you get a
response (automated/manual?)

Beverly Howard [MS MVP-Mobile Devices]

Unless they've changed it, it is read by real people. I wouldn't expect a
sudden response with "It's in there. Download the latest version from the
Web.", but it's more likely to be addressed if they have a customer
complaint than if they don't.

Paul T.

"SchulieBug" <> wrote in message
news: ups.com...
>I did get an automatic response from the ActiveSync Development Team
> mailbox. I think i can say that the mailbox still exist, however, it
> doesn't say anything about it is being read by real, living, homo
> sapiens
>

Thanks... just trying to stay updated on the address' status.

Beverly Howard [MS MVP-Mobile Devices]

>> more than 2000 employees... Most of our users <<

Sorry for my pessimistic, negative viewpoint, but, it appears that user
needs are not high on this priority list, so the only options for us is
to make do with the scraps which are offered and hope that someone
succeeds with a better third party application.

Beverly Howard [MS-MVP Mobile Devices]

If you have issues deploying ActiveSync, you really need to open a support
call. They have engineers who can assist you. I'll send you more information
on how to do it.


--
Carl Wolz [MSFT]
This Posting is provided "AS IS" with no warranties, and confers no rights.



"SchulieBug" <> wrote in message
news: oups.com...
> Hi guys & girls,
>
> Till now still no response of the MS development team for ActiveSync.
> Don't think they think it's a problem in the real world, as they are
> all local admin on their own development machines
>