BlackBerry® Enterprise Service 10

[thumper999]

Not sure the correct place to ask this question, but a couple of years ago my company installed a daylight savings time patch to our exchange server.  Apparently Microsoft made a security change to one of the hot fixes\service packs that prevent anyone with administrative privaleges from being able to use a Blackberry.  Has anyone else run into this issue and do you know of any fixes that Microsoft may have provided?

[knottyrope]

If you want your BES and handhelds to work correctly for everyone, all of the time, then you need to follow RIM's guidelines and best practices.

It's called the Principle of Least Privilege... and you're not following it.
Principle of least privilege - Wikipedia, the free encyclopedia

Make yourselves normal users, and then create a secondary login with Domain Admin privileges. Only use that secondary login when necessary.

[bbhorrigan]

Why would you ever have a regular user with domain admin privileges? Doesn't seem to be a very good idea. I would suggest you utilize service accounts.

[thumper999]

I am the user, and I am also a domain admin.

[knottyrope]

My name is knottyrope

I am a domain abuser, currently I am on my 7th year of recovery.

Every day I am tempted to elevate my privileges. It has been hard using Run as at times and using a second account can be daunting, but in the end it has been worth it to keep things more secure for my company and fellow employees.

[bbhorrigan]

Hi my name is BBhorrigan, and I was once a domain abuser.

It is a battle you fight one day at a time.

you never really win.

[thumper999]

My problem is that I am an admin for 200 plus Blackberry users and I cannot use one of the devices myself.  I will check with Microsoft.

[knottyrope]

Administration accounts in protected Windows Active Directory groups
http://www.blackberry.com/btsc/KB12309

 snip

It is possible to modify Microsoft Active Directory permissions to allow BlackBerry smartphone users who are members of protected groups to send email messages from their BlackBerry smartphones without creating secondary email accounts using the DSACLS.exe utility. For instructions on modifying the permissions that are associated with the AdminSDHolder Microsoft Active Directory object and have been changed by the recent Microsoft Exchange update, refer to the Microsoft Support Knowledge Base.

Important: This procedure is not recommended by Microsoft or by Research In Motion.

 snip

You have been warned, good luck.