Questions[windows-phone-7](server)

I'm currently having the following setup, all servers are Windows 2012 R2:

• Intune subscription
• Web Application Proxy server
• Offline CA
• Issuing CA
• NDES server with SCCM CRP
• SCCM 2012 R2
• Windows Phone 8.1 device

My issue is as follows, I have made a root CA profile and SCEP profile in SCCM, deployed it to Intune user collection. When I try to connect to the NDES server (https://ndes.bla.com) from the Windows Phone 8.1, I can successfully load pages. After I do a Workplace Join on the Windows Phone 8.1 device, at one point, WAP is no longer forwarding requests to the NDES server, they timeout. This results that the device will not get a certifiacte from the NDES server. Any request that I send to the https://ndes.bla.com fails from the WP8.1 or any other browser, other published websites on the WAP server (e.g., https://fs.bla.com) do keep responding. Restarting the Web Application Proxy Service on the WAP server, allows me to access the NDES externally again (including from the device), until I join the Windows Phone 8.1 device again.

The HTTPERR1.log on the WAP server shows entries as follows:

2014-08-14 23:31:10 xxx.xxx.xxx.xxx 56872 yyy.yyy.yyy.yyy 443 HTTP/1.1 GET /certsrv/mscep/mscep.dll/pkiclient.exe?operation=PKIOperation&message=MIJLHAYJKo (truncated, total request 2048 bytes) 2qNaTJX/kpZ - - Client_Reset -

2014-08-14 23:32:10 xxx.xxx.xxx.xxx 56873 yyy.yyy.yyy.yyy 443 HTTP/1.1 GET /certsrv/mscep/mscep.dll/pkiclient.exe?operation=PKIOperation&message=MIJLHAYJK (truncated, total request 2048 bytes) tJQKpRz2qNaTJX/kpZ - - Client_Reset -

2014-08-15 01:29:04 xxx.xxx.xxx.xxx 56953 yyy.yyy.yyy.yyy 443 HTTP/1.1 GET /certsrv/mscep/mscep.dll/pkiclient.exe?operation=GetCACert&message=MDM - - Client_Reset -

But only after I tried to activate the Windows Phone, if I do a manual GET from the phone beforehand it will let me download the files, then again the first two could be truncated in the logs as well...

• Using publicly trusted CA certificates on the WAP server and NDES server.
• Deploying SCEP profile succeeds when clients are in the local network, thus bypassing the WAP server.
• I've added the MaxFieldLength and MaxRequestBytes at 65534 to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters on the WAP server.
• From the internal successfull client certificate deployment, I wish I could see the complete request, so I can try it manually from external connection, any tips on that would be welcome.

I have been asked to set-up a test Exchange Server 2010 machine in order to test the Exchange ActiveSync system as an alternative to our existing Blackberry mobile email solution. We intend on using Windows 7 phones to hook into our Exchange system.

I have installed the server and installed a commercial SSL certificate. I have migrated a single mailbox across to the new server. I can access that mailbox quite happily in OWA and in desktop Outlook , all seems fine from that front.

I have a problem with the Exchange ActiveSync element though.

No matter what settings I use I cannot get the mobile phone to sync with the server.

The error I am getting is:

You'll need a personal certificate to connect to mail.example.co.uk. Error code 85030027

Now, my limited understanding^[1] of our set up is that we should not need personal certificates. The Exchange ActiveSync system is set to use Basic Authentication which should just be a plaintext username/password combination over SSL.

We've never needed to use Exchange ActiveSync before, so I haven't done any further set up other then accept the defaults. The handset is on our own internet wifi network so we should not need to worry about ensuring we can SSL traffic forwarded from the external IP to the internal machine at this point.

For reference I can access the OWA page under SSL and the certificate looks ok. If I manually visit the full path specified as the Exchange ActiveSync URL then I get a username and password popup box which I understand to be normal.

I feel like I'm missing something silly and would really appreciate a point in the right direction.

^[1] We have a fairly basic use for our existing Exchange Server 2003, we do not do anything complicated with it so have never needed to set up external connections or integration with mobiles before. There is probably some piece of 'common' knowledge I am lacking.

As in the title.

We have a WCF service, and a Windows Phone 7 client. One of our customers wants to install the service behind a TMG server.

I know that TMG is an update to the old ISA server and I recall having to install a client on my PC to connect to a site behind the ISA server, but I cannot see anything about in any of my searches.

Is it actually possible to access the service via this gateway? If so can anyone tell me what I need to do? I'm happy to research it if I know what to look for.

EDIT:

Reading further I see that TMG an do cert based Authentication. So if a trusted cert is installed on the device, this can be connected to the user the in AD. This means that TMG will allow the packet through.

Is my understanding correct?