Windows Mobile 6.1.x Upgrades and Build Levels – March 11, 2009

I’ve been compiling a running alphabetical list of which devices now have official supported upgrades available for them since the summer of 2008. This may be useful for many of you as well implementing SCMDM and researching which devices are compatible.

Several links fixed, and several devices purchased with WM 6.1.x builds now listed as reference as well. Interesting to see the slow uptake of devices having the 6.1.4 build finally that has the Internet Explorer Mobile 6 (IE6on6).

Included is the specific OS/AKU build for each device for SCMDM 2008 SP1 support.

MO/OEM OS/AKU Build Number
Alltel:
Alltel HTC PPC8600 WM 6.1 ?
Alltel HTC Touch WM 6.1 ?
Alltel Palm Treo Pro WM 6.1.4 w/AKU 1.4.4 Build 20765.1.4.4?
ASUS:
ASUS PDA Phone P527 WM 6.1 w/AKU 1.0.4 Build 19214.1.0.4
ASUS PDA Phone P750  Patch WM 6.1 ?
ASUS P565 WM 6.1 ?
AT&T:
AT&T Motorola Q9h WM 6.1 w/AKU 1.0.2? Build 19209.1.0.2?
AT&T Tilt WM 6.1 w/AKU 1.0.4 Build 19214.1.0.4
AT&T Pantech C810 Duo WM 6.1 w/AKU 1.1.8 Build 19597.1.1.8
AT&T BlackJack II (SGH-i617) WM 6.1 w/AKU 1.0.1 Build 19208.1.0.1
AT&T Fuze (HTC Touch Pro) WM 6.1 w/AKU 1.2.6 Build 19971.1.2.6
AT&T Epix (SGH-i907) WM 6.1 w/AKU 1.3.2 Build 20276.1.3.2
AT&T LG Incite (CT810) WM 6.1 w/AKU 1.2.8 Build 19974.1.2.8
Bell:
Bell HTC Touch WM 6.1 ?
Fido:
Fido BlackJack (SGH-i616) WM 6.1 w/AKU 1.0.1 Build 19208.1.0.1
HTC:
HTC TyTN II (unlocked) WM 6.1 w/AKU 1.0.3 Build 19212.1.0.3
HTC Touch Diamond (unlocked) WM 6.1.4 w/AKU 1.4.3 Build 20764.1.4.3
HTC Touch Pro (unlocked) WM 6.1.4 w/AKU 1.4.3 Build 20764.1.4.3
HTC Touch Cruise WM 6.1 ?
HTC Touch Dual WM 6.1 ?
HTC Touch HD WM 6.1.4 w/AKU 1.4.0 Build 20757.1.4.0
i-mate:
Ultimate 6150 WM 6.1 w/AKU 1.2.1 Build 19959.1.2.1
Ultimate 8150 WM 6.1 w/AKU 1.2.1 Build 19959.1.2.1
Ultimate 8502 WM 6.1 w/AKU 1.1.2 Build 19585.1.1.2
Ultimate 9502 WM 6.1 w/AKU 1.1.2 Build 19585.1.1.2
JAMA 101 (Pending)
Intermec:
Intermec CN3 WM 6.1 w/AKU 1.1.1 Build 19581.1.1.1
Intermec CK3 WM 6.1 ?
Motorola (Symbol):
Motorola MC55 WM 6.1 w/AKU 1.1.1 Build 19581.1.1.1
Motorola MC70 (BSP 0.01.09.00) WM 6.1 w/AKU 1.1.5 Build 19590.1.1.5
O2:
O2 XDA Stellar (HTC TyTN II) WM 6.1 ?
O2 XDA Orbit 2 (HTC Touch Cruise) WM 6.1 ?
O2 XDA Mantle (HTC P6500) WM 6.1 ?
Orange:
Orange HTC TyTN II WM 6.1 ?
Orange HTC P6500 WM 6.1 ?
Palm:
Palm Treo Pro (unlocked/GSM) WM 6.1 w/AKU 1.0.5 Build 19216.1.0.5
Rogers:
Rogers BlackJack (SGH-i616) WM 6.1 w/AKU 1.0.1 Build 19208.1.0.1
Samsung:
Samsung SCH-i200 WM 6.1 w/AKU 1.0.4 Build 19214.1.0.4
Samsung BlackJack II (SCH-i617) WM 6.1 w/AKU 1.0.1 Build 19208.1.0.1
Samsung SCH-i760 WM 6.1 w/AKU 1.0.0 Build 19202.1.0.0
Samsung Omnia SCH-i900 (non-US) WM 6.1 w/AKU 1.3.1 Build 20270.1.3.1?
Samsung SGH-i780
(IT, NL, Nordic, Singapore, UK only)
WM 6.1 ?
Sprint:
Sprint Motorola Q9c WM 6.1 w/AKU 1.0.2? Build 19209.1.0.2?
Sprint Mogul WM 6.1 w/AKU 1.0.2 Build 19208.1.0.2
Sprint HTC Touch WM 6.1 w/AKU 1.0.1 Build 19208.1.0.1
Sprint Samsung Ace (SPH-i325) WM 6.1 w/AKU 1.0.0 Build 19202.1.0.0?
Sprint HTC Touch Diamond
(Pending)
WM 6.1.4 w/AKU 1.4.3? Build 20764.1.4.3?
Sprint Palm Treo 800w WM 6.1 w/AKU 1.0.5 Build 19216.1.0.5
Sprint Palm Treo Pro WM 6.1.4 w/AKU 1.4.4 Build 20765.1.4.4
Telus:
Telus HTC Touch WM 6.1 ?
Telus HTC S720 WM 6.1 ?
Telus HTC P4000 WM 6.1 ?
Verizon:
Verizon Samsung SCH-i760 WM 6.1 w/AKU 1.0.0 Build 19202.1.0.0
Verizon UStarcom XV6800 WM 6.1 w/AKU 1.0.3 Build 19212.1.0.3
Verizon HTC XV6900 WM 6.1 w/AKU 1.0.3 Build 19212.1.0.3
Verizon Motorola Q9c WM 6.1 w/AKU 1.1? Build 19704.1.1.50
Verizon HTC Touch Pro WM 6.1 w/AKU 1.2.7 Build 19972.1.2.7
Verizon Samsung Omnia (SGH-i910) WM 6.1 w/AKU 1.3.1 Build 20270.1.3.1
Verizon Samsung Saga (SCH-i770) WM 6.1 w/AKU 1.3.2 Build 20276.1.3.2
Vodafone:
Vodafone v1615 WM 6.1 w/AKU 1.0.3 Build 19212.1.0.3

If you know of others, updates or corrections, please let me know!

|\\arco..
mnielsen(at)enterprisemobile.com
http://marco.blogsite.org


Mobile Security Resources

Windows Mobile security best practices are a key component of Enterprise Mobile’s expertise and services, but recently we’ve been much more vocal about it! First off, there’s the excellent WM Application Security White Paper that my colleague Dave Field just published. Here’s a brief synopsis:

This technical paper recommends how enterprises can take advantage of the powerful security features of Windows Mobile to defend against malicious and unsupported application use. Taking a very pragmatic approach, the paper describes how various features work and how to implement them to protect devices based on Windows Mobile 5.0, 6.0 and 6.1.

I highly recommend it for any IT professional who’s interested in Windows Mobile security. Dave has put incredible detail into this paper, making it invaluable for an organization who is currently using (or planning to deploy) Windows Mobile devices and applications.

Next up, there’s an interesting Network World article by John Cox about Mobile browser security that Dave and I are quoted in.  The article focuses on the impact that a new generation of mobile web browsers will have on how enterprise IT organizations handle mobile device security.  John sums up the three key areas that enterprises should focus on:

IT departments, according to experts, need to focus on three areas: assessing the security architecture and features in the mobile browser and the underlying operating system; working with users on smart and safe browsing practices; and creating a solid handheld device management system.

In fact, choosing a mobile platform with a strong and flexible security model in hand with a solid device management system can help you minimize the headaches that users have to endure. With those first two handled, educating users on smart and safe browsing practices is something that is applicable to both traditional desktop web browsers as well as the new crop of full-featured mobile browsers. Read the full article, titled “Mobile browsers bring new security headaches” now for more information.


Picking the Right SSL Server Certicate for Windows Mobile

A lot of Enterprise Software for Mobile devices utilizes SSL for security.  SSL is the de facto choice because it can traverse NATs and routers whereas many VPNs cannot.

So, you’ll need to purchase an SSL certificate for your web server and any Windows Mobile clients should have the root of your SSL certificate in the device’s root certificate store.

The problem comes when the root certificate is not already in the device root certificate store by default.  You can add certificates to the root store (this got a lot easier in Windows Mobile 6.0).  But, this will likely require a user trying to perform the task or the support tech will need to “touch” the device.  And, if the device is cold reset, you have to perform this task all over again.  It is much easier just to use an SSL server certificate from a Public Certificate Authority  that chains to a root certificate that’s already resident on the device.

Unfortunately, Windows Mobile has no root certificate updating service as included in Windows XP and Windows Vista.  With Windows Mobile, you get the root certifcates that were added when the image was built.

If you are using Windows Mobile 5.0 devices, you should not use GoDaddy or Comodo root certificates for the most part.   Here is a table showing which versions of Windows Mobile includes which Public CA certificates:

Windows Mobile Root Certificates

Another consideration is the use of wildcard certificates.  As you probably already know if you are reading this, a wildcard certificate allows the use of a wildcarded DNS name prefix such as “*.acme.com”.  You can use the same SSL certificate for many different web servers that all have assigned DNS names that end in “.acme.com”.  It is important for SSL security that the server’s internet DNS name matches the subj or subj alt name on the certificate.  So, if you wildcard th prefix in the certificate, you can use one cert for a lot of servers.

Windows Mobile started supporting wildcard certificates in Windows Mobile 6.0.  If you have Windows Mobile 5.0 devices, you should take a look at the offering from Digicert.  They allow you to pre-populate the subj alt name of the certificate with a list of server names.  This ends up giving you something approaching wildcard certificate features.  However, you do need to know the internet DNS names of all the web servers you’ll be using.  See more details on the Digicert site. Note that digicert is not shown on the list above because they actually chain back to the Entrust root.

Dave Field, CISSP, MCP
Device Management and Security Architect
Enterprise Mobile, Inc.


Writing custom GPOs for SCMDM 2008

UPDATED: Oct 5, 2008: Updated v1.1 .ADM file with corrections and additional settings.

One of the most powerful things about Microsoft System Center Mobile Device Manager (SCMDM) is the ability to manage all of your Windows Mobile 6.1 or above devices through Active Directory (AD) Group Policy Objects (GPOs). A large percentage of the corporate market is already using GPOs to manage their desktop, notebook and server environments.

The GPO technology was introduced in Windows 2000 Server. Before that there were System Policies in Windows NT 4.0. There is already a fair amount of documentation and knowledge around extending GPOs to your own needs. But here I will go into some aspects more important around making use of SCMDM and supporting Windows Mobile in an enterprise running AD.

In this article I will go through how you can extend your own GPOs to have additional settings not available out of the box in the default Windows Mobile GPO template supplied by Microsoft in SCMDM 2008. I will expect that you already know how to access and use the default SCMDM GPO settings.

Windows Mobile Registry Keys

GPOs work by manipulating how registry keys are changed and written on the client machines. This is no different on Windows Mobile, compared to other Windows platforms at this point in time.

I will save the discussion on where to find and research Windows Mobile registry locations. But will point out that many are bound to specific OS levels, OEM and hardware requirements. So what works on one WM device may not work on another. So I can’t stress enough the aspect of testing such settings before a larger deployment to end-users.

For this article I have asked my colleague, Chris De Herrera, to suggest some registry keys to use:

Improve text rendering performance by increasing the GLYPH Cache to 32k (decimal):

[HKEY_LOCAL_MACHINE\System\GDI\GLYPHCACHE]
“limit”=dword:00008000

Internet Explorer Mobile homepage settings:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs]
“home_0409″=”file://\\windows\\default_0409.htm”
“version_0409″=”file://\\windows\\about_0409.htm”
“blank”=”res://webview.dll/blank.htm”

Configure Communicator Mobile:

[HKEY_CURRENT_USER\Software\Microsoft\Communicator\System Settings]
“ServerInternal”=”sip.yourcompany.com”
“Server”=”sip.yourcompany.com:443″

Furthermore I have also researched the following registry keys which may be helpful in corporate environments:

ClearType Activation:

[HKEY_LOCAL_MACHINE\System\GDI\ClearType][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
“ClearTypeText”=dword:1[HKEY_LOCAL_MACHINE\System\GDI\ClearTypeSettings]
“OffOnRotation”=dword:0

Browser History:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“DaysToKeep”=dword:00001E

Default Search Page:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“Search Page”=http://m.live.com/search/Results.aspx?q=%&mid=8001

Internet Explorer User Agent:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent]
“Default”=”Mozilla/4.0″
“Platform”=”Windows CE”
“Version”=”MSIE 6.0″

Menu Animations:

[HKEY_LOCAL_MACHINE\SYSTEM\GWE\Menu]
“AniType”=dword:0

Windows Animations:

[HKEY_LOCAL_MACHINE\SYSTEM\GWE]
“Animate”=dword:0

Error Reporting:

[HKEY_LOCAL_MACHINE\System\ErrorReporting\DumpSettings]
“DumpEnabled”=dword:0
[HKEY_LOCAL_MACHINE\System\ErrorReporting\UploadSettings]
“DontUpload”=dword:1[HKEY_LOCAL_MACHINE\System\ErrorReporting\UploadSettings]
“ConnectionFlags”=dword:0

Today Screen Text:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Shell\DeviceBeta]
“Today”=”EnterpriseMobile”

Display Time/Date in Taskbar or disable for battery indicator:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Shell]
“TBOpt”=dword:3
“ShowTitleBarClock”=dword:1

Permit Bluetooth and IrDA File Transfer:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Obex]
“IsEnabled”=dword:1

Please be aware that most of these settings require a soft reboot of the device before they become effective. The SCMDM policy agent should prompt you for a reboot of the device when an updated policy is synchronized from the Device Management Server.

Creating .ADM Files

Using the information published about the correct registry key prefix to use for GPOs on Windows Mobile I created my own .ADM file with my sample registry keys listed above and a few other samples currently available.

You can download it here. I have noted in my sample the references used.

Look for a new folder called “Windows Mobile Settings-Extended” in the Computer Configuration section of the Group Policy Object Editor.

The single main trick was to prefix the native Windows Mobile registry keys with the <SOFTWARE\Policies\Microsoft\Windows Mobile Settings\Registry> path.

So the native:
<HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs> became the longer:
<SOFTWARE\Policies\Microsoft\Windows Mobile Settings\Registry\HKLM\Software\Microsoft\Internet Explorer\AboutURLs>.

Note the collapsed HKEY_LOCAL_MACHINE hive into the named HKLM. This also works for the HKEY_CURRENT_USER hive into HKCU.

Further Information on .ADM Files

Please see the reference links below for more details on the syntax used in the example .ADM file. The syntax and commands are not the easiest in the world of IT.

I also found a ADM file editor, called ADM Template Editor from a small company in Australia that may be useful if you are planning to write and manage a large number of custom .ADM/.ADMX files.

Again, please test the policies on the OS platform, level, and hardware you wish to broadly deploy your Windows Mobile settings out to.

Look for more articles soon on useful Windows Mobile registry keys and GPOs!

References:

|\\arco..
mnielsen(at)enterprisemobile.com
http://marco.blogsite.org


The “Save Password” checkbox does not work in Mobile IE

Here is a little issue that I researched this week and I thought I’d share it on the blog.

PROBLEM: When accessing a website that is secured to use an NTLM authenticated password, the “Save Password” option does not work on Windows Mobile Pocket PCs and Smartphones.

Here are detailed steps that outline how to reproduce this problem using a Motorola/Symbol MC70 Pocket PC. Note that the test device was running Windows Mobile 5.0 AKU3. Read the rest of this entry »