Hi all

Hope you had a good weekend, and if not my apologies go out to you

Being new to this whole BES administrator thing and not getting any training as my company aren't willing to pay for it because Blackberries haven't "Proved their worth" as yet, I am having a little problem with "Set password function and lock handheld" function on the BES.

I was under the impression that when I push a "Set password and lock handheld" request through to a device it would change the password that the user needs to log in to the device.

However, this request only seems to be working when the user is already logged in and not when the device is logged out.

Any suggestions why this could be happening would be appreciated.

Cheers
J

I am not sure what you mean by when a device is logged on and logged off? I just sent the "set password and lock handheld" command to my device. My device about a minute later prompted me asking if I would like to accept the wirlessly set password. Try sending it to yourself and let us know what happens.

Also the user doesn't need a password to "log on" to a device. The password is only there for added security. If you want the device to be password protected, you can set this up through an IT policy.

My apologies to clear this up it might be an idea to explain the situation I am in that is generating this problem.

We have had our BES and devices online for 3 months now, and users are being requested to change their passwords.

The users in question are successfully entering their first password and then being asked to enter a new one, god only knows how but they are entering their new password, then successfully verifying the new password, and then some how they are forgetting the new password they set and can not log into their devices.

I am therefore receiving requests to change their password remotely so they can get logged in again, it was my understanding that when I pushed a new password from the BES to the device, that password would take affect after at most 20 minutes and as you say the user receives a message saying the password had been changed.

However, the password I am pushing to the device is for some reason not being set to the new one.

Hope this clears it up.

Cheers
J

I see what you mean now. Thanks for clearing that up. I believe it gives them an option to accept the password you sent them if there is already a password on the device. That is what it prompted me when I sent it to myself.

Is this only happening with one user/device?

Hmmm, if the users have enabled Content Protection then you will not be able to wirelessley reset their password.

Not 100% sure how you can check this when they cannot unlock their devices, but... in the past when I have tried to wirelessly reset a pwd on a content protected BB, nothing happens. No prompts on screen, no messages to user, just nothing at all. Does this sound like what you are experiencing?

Also is this a problem for ALL users or some? Have you been able to wirelessly reset any pwds?

Very good point Jadey, I forgot all about content protection!

I try to forget about it at times too ...

It sounds exactly like the problem I am having and I can confirm that Content Protection is Enabled on all the devices as I have don it in the IT policy, so thank you for this one I am sure it is giong to sort it out.

However, I work in a Government organisation can anybody confirm to me that I can switch off Content Protection and still remain GSI/GSX compliant ?

Cheers
J

No idea about the GSI/GSX compliance, sorry.

One thing to point out - if you stop forcing content protection via policy, it won't immediately help you. Users will still need to disable it on their own devices... and even then the remote password reset won't work until there is nothing left on the device that WAS content protected.
Basically I think that if your users cannot remember those passwords, they're just going to have to get it wrong X times and wait for the BB to wipe. Another point to note, the devices will take a while to wipe with content protection enabled, so tell them to be patient. Once done, enterprise activate the devices again...

lots of info regarding content protection in this thread (and linked threads within it)

Can I prevent Wipe Handheld after multiple failed passwords

Has anyone here tried resetting a password on a content protected BB running 4.2 handheld software? My BF has an 8800 with content protection enabled and he is able to successfully send the reset password command from his BES. I don't want the hassle of testing it on my 8800 to know for sure - I'm too busy this week.

Thanks for that link Jadey, I'll see if that answers a question I just posted in the security thread.

BTW, anyone go through all the password attempts on a BB that has content protection enabled? It is UGH-LEE, takes close to 90 mins to wipe.

It takes that long (or longer) any time you wipe a content protected device - not just by using up the password attempts.

I'll give it a test today on my 8100 (4.2.0.67, platform 2.2.0.39)

Well, didn't expect that! It worked!

Device info:
BlackBerry 8100 v4.2.0.67
Platform 2.2.0.39
Crypto Kernel v3.8.4.28

Content compression Enabled
Content protection Enabled
Content protection strength = Strong
Include Address Book = Yes

I don't know whether it has any effect that I enabled content protection, and then between 5 and 10 mins later reset pwd via BES.
I will turn protection strength up to Strongest (bypassing Stronger), leave the device for a day, and try reset again...

Jadey - I can't duplicate reseting the pwd on a BB w/v4.2 with content protection enabled. Can you verify you;ve done that?

Righteo. Done some more testing today.

From what I can ascertain:

Set Password and Lock Handheld command, sent from BES, DOES work on a content protected device when it is UNLOCKED when it receives the command.

Set Password and Lock Handheld command, sent from BES, DOES NOT work on a content protected device when it is LOCKED when it receives the command.

So not too useful then. That implies that a user who has a locked BB and cannot remember the password still cannot have the password remotely reset.

Gah. Can anyone else do a quick test and verify this as true?

That is pretty much what I was finding :(

I have done some research with regards the GSi/GSx bit and it seems that HMG handhelds "should" have Content protection enabled to ensure RESTRICTED documents are encrypted :(

Oh dear looks like I am back to square one :(

Thanks for all your help on this one Jadey

No problem, good luck with your users...

Thanks for verifying Jadey.