VPN keeps re-locking phone (certificate requirements)

mantispid · #1 (**permalink**) 10-08-2009, 10:36 AM

Does anyone know of a registry tweak to prevent a phone (TP2 in my case) from being re-locked? I have to use SDA-Unlocker whenever I re-establish my company VPN connection. It's quite annoying to have to do this simply to use apps like google maps. The corporate security types have gone way overboard here. The folks using blackberries don't have to deal with this sort of crap.

I somehow prevented it from being re-locked before I had to do a hard reset yesterday. I can't seem to remember exactly what I did, though. I've used the SDA-Unlocker.exe program, clearsecurity.cab file, and the HTC Application unlock.exe program... and none of 'em will stick if I re-connect to the corporate VPN. Ugh!

Ok, a with a little bit of sleuthing I've found that it is the Exchange server re-establishing various security settings in the registry. I need to figure out a way to prevent this from happening. Is there some sort of registry tweak that will deny MS Exchange access to the security policies in the registry?

mantispid · #2 (**permalink**) 10-08-2009, 04:05 PM

There needs to be some sort of app that will block Exhange security policy pushes. Or perhaps some sort of app that blocks registry edits of specific keys...

I've tried Zenyee's StayUnlock, but that only prevents the Exchange Server from re-establishing the lock system. I need something that will prevent the server from doing a lockout of unsigned apps (and their installation as well).

...or even just a simple digitally signed registry editor that can import a registry key or two with a single click.

*sigh*

**shaggylive** · #3 (**permalink**) 10-08-2009, 04:15 PM

there are a few out there. the only one off the top my head would be AutoLock (CSDevCtrl) it's a lock app that works with the built in lock. includes an option to reset that timeout.
http://forum.xda-developers.com/showthread.php?t=386451

btw, I don't use the exchange lock, but I do use this for my everyday phone lock app, tons of options and lightweight.

mantispid · #4 (**permalink**) 10-08-2009, 04:34 PM

Just to be clear, I'm not really concerned with the password lock that is enforced by Exchange. I just want to be able to run 3rd party apps. The exchange server keeps setting the registry key that prevents unsigned apps from running or being installed.

If there is an app that will prevent this, I'll be golden. The unlocker apps are nice, but my security key is a simple pin and isn't too onerous.

**shaggylive** · #5 (**permalink**) 10-08-2009, 04:37 PM

my bad, I didn't fully read. keep looking there might be something out there, otherwise chalk it up to good m$ security, and and ask your admins for more rights.

Mutiny32 · #6 (**permalink**) 10-08-2009, 05:04 PM

Ask your Active Directory admin to lax up on the GPO for Windows Mobile devices.

mantispid · #7 (**permalink**) 10-08-2009, 07:49 PM

I wish it were that simple. These folks absolutely do not budge on their security policies. I can't even install programs or drivers on my company laptop.

**shaggylive** · #8 (**permalink**) 10-08-2009, 07:52 PM

is it their phone or yours?

mantispid · #9 (**permalink**) 10-09-2009, 09:18 AM

It's theirs. I can't really complain all that much. Still, I hate having to carry two phones because one is so gimped out.

Mutiny32 · #10 (**permalink**) 10-09-2009, 04:50 PM

Quote:

Originally Posted by mantispid

It's theirs. I can't really complain all that much. Still, I hate having to carry two phones because one is so gimped out.

Give it back to them and tell them you'd like it back when you are able to use it other than a potential IED or paperweight.

I'm a CISSP and the admins are NOT doing their jobs correctly. Security is supposed to be transparent as possible without hindering business functionality or breaking the law. And it's hindering business functionality.