Yep, so think very carefully before enabling it via policy. Also I tell my users not to enable it, else if they forget their passwords it is their life they're going to make harder...
This is an interesting thread
http://www.blackberryforums.com/bes-...necessary.html
http://www.blackberryforums.com/bes-...ow-remove.html
http://www.blackberryforums.com/bes-...rotection.html