[prdaley]

Hi everyone,

I can't seem to find a satisfactory answer to this in BES documentation or in the forums. Yes, there are a lot of threads about removing IT policies, but they're mostly from the user perspective. What I'm looking for is the best method to revert a device back to a pre-BES activation state. The problem in my environment is that all of the devices we support are personal devices so wiping them out is something I don't particularly like to do if I can help it. I have to believe there is a way via BES to target a specific user and remove any IT policies associated with BES or otherwise undo the BES activation.

Thanks,

[penguin3107]

Originally Posted by prdaley

I have to believe there is a way via BES to target a specific user and remove any IT policies associated with BES or otherwise undo the BES activation.

There really isn't.
From the BES side, wiping the device is the best way.

Have the user do a backup.
Wipe.
Restore data after wipe.

Afterthought...
It's not exactly clean, but you could try sending a Default IT Policy, then simply remove their BES account after it's applied.

[hdawg]

What versions of BES and what handheld operating systems do you have on your devices?

If you're at BES 4.1 SP4 and have HH OS 4.2.2 or greater ... you can use the IT Policy setting:

Security policy group > Remote Wipe Reset to Factory Defaults

which will remove the IT Policy of a device when you wipe it from the BES. That said, this kind of wipe is actually much faster than a device initiated wipe which doesn't even remove IT Policy.

[prdaley]

We're on 4.1.4.32

We actually already use the Default Policy with no modifications since we're basically just providing personal devices a pathway to e-mail, calendar, and contacts and nothing more.

Thanks for the replies. I'd still probably prefer to not wipe out personal devices on a regular basis so I guess I'll just be leaving the Default Policy in place. I still find it incredible that you can't send a command from BES to just do nothing more than nullify the current policy in place.

[buluks]

i don't know where is wrong. i try using policy bin file and from BES but in status IT policy not remove.

[skyman84]

Yeah,
There is no way. best you can do is remove their accont from the BES if you want the leave them with their data.
However if you do that, and depending on where your company is located, you can get into seriouse trouble allowing them to leave the company with company information still on their device (be it emails or addresses).
The only way to "reset" a device to pre activation settings, is to do a full wipe using jloader, other wise just a std wipe will still leave your IT policy on the device.
I know you've got a blank polcy, but it's still a policy.

[besadmin23]

Guys, isn't prdaley just asking to remove the IT policy?? This is easy, albeit a little sneaky. Just make an IT policy that is blank. No specific settings at all. Then apply the policy, confirm it was delivered, then just remove the user from the BES. No need to wipe... A blank IT policy IS setting the device back to default for all intense and purpose related to what prdaley is asking for sure. And yes, they will still see Blank IT Policy or whatever you name it in the policy area but effectively, the device is clean again. I do this all the time. This said, prdaley, make sure your company doesn't mind if the emails or contacts remain on the device. The user won't be able to respond to the messages, at least not with their now old company address but this should certainly work.

[penguin3107]

Originally Posted by besadmin23

Just make an IT policy that is blank. No specific settings at all. Then apply the policy, confirm it was delivered, then just remove the user from the BES. No need to wipe.

I suggested this a month and a half ago, when the thread was started.
And seriously... what's with all the follow-up posts on old threads?
It's getting a bit tiresome.

You obviously have good info. Stick to current threads and stop repeating what other users have already said.

[besadmin23]

what you said a month ago was to push the Default IT Policy. Many admins may modify their Default IT Policy. I was adding a bit more clarity for the folks that may not have pieced it all together in their heads.

I'll also reply to any thread where I think I can add value. If the info hasn't been stated I will reply. None of the threads were more than 10-12 days since latest post.

And dont think that just because you said it one way that everyone in the forum will know exactly what you meant. Sometimes a description in laymen's terms is more effective.

Feel free in the future to correct me technically if I am wrong but never socially again please.

I am ONLY doing this to help others as I have gotten so much from this forum in the past. Seriously, that attitude was pretty stinky.

I would like to be on the same side as you since you obviously know what you are doing as well. Quite frankly, I'm just shocked at your response.

[besadmin23]

Just noticed something in 5.0. Check out the IT policy listed under security sectioned called "Remote Wipe Reset to Factory Defaults". The description says that if set to true, it will permanently delete the stored IT policy and 3rd party if the admin sends the Erade Data and Disable Handheld IT Admin command over the air... I just tried and while all data is gone, there is NO it policy left on the device. So the Blank IT policy rule won't be needed any longer if the user is ok with you wiping the device.

[hdawg]

... and you tried this on a HH with an IT Policy that didn't have the setting in place already?

[penguin3107]

Originally Posted by besadmin23

Just noticed something in 5.0. Check out the IT policy listed under security sectioned called "Remote Wipe Reset to Factory Defaults". The description says that if set to true, it will permanently delete the stored IT policy and 3rd party if the admin sends the Erade Data and Disable Handheld IT Admin command over the air... I just tried and while all data is gone, there is NO it policy left on the device. So the Blank IT policy rule won't be needed any longer if the user is ok with you wiping the device.

This requires at least HH OS 4.2.2 and also doesn't meet the OP's requirements based on this statement:
"The problem in my environment is that all of the devices we support are personal devices so wiping them out is something I don't particularly like to do if I can help it."

The original goal is to not wipe the device.