General access denied error - mdm2008 sp1 software deployment

Všechny reakce

• 17. června 2009 21:34Andreas Helland

   
  

  2

  Přihlásit se a hlasovat
  You are able to install the cab manually on the Samsung without any warnings/prompts? Have you signed it with your own software cert, that you have also deployed to the devices, or is the cab signed with the Microsoft certificate it came with? For instance if the Samsung for some reason has a different list of trusted CAs installed this could be an issue.
  
  I don't know if there are any firmware updates available for the Samsung - some of their devices have been known to have bugs related to SCMDM.
  • Reagovat
  • Citovat

   
• 18. června 2009 1:55Wayne Phillips.MVP, Moderátor

   
  

  2

  Přihlásit se a hlasovat

  Some Device (Especially carrier modified ones) have the security nailed down. While testing this device, use the Security Configuration Manger to manage the device security. It’s included in certain versions of Visual Studio, so check if you have VS installed. Check out the Windows Mobile 5.0 Application Security whitepaper.
  

  
  Cheers Wayne

  Airloom

   

  • Reagovat
  • Citovat

   
• 19. června 2009 9:02Stjani

   
  

  0

  Přihlásit se a hlasovat
  Hi,
  
  when I try to install MDMDeviceStatusViewer manually I get this error  "This program is from an unknown publisher...." So I guess I need either  change security settings on the Mobile og sign the program.
  I tried using  Security Configuration Manager version 1.0.0.0 but I can not get a connection to my Mobile. I can connect it to Active sync 4.5.0 OK.
  I just installed Visio Studio 2008 on my PC but Security Configuration Manager  wanted Visual Studio 2005 so I installed Visual Studio 2005 (team edition for software developers) on my PC.
  I cannot connect to my Mobile using Visual Studio. I have not done any configuration or installed any updates on Visual Studio, and I have not used this product a lot.
  I read the "Step by Step: Understanding Windows Mobile Security Using the Device Security Manager" which was written in februar 2007 and updated 6/4/2009.
  It is the same there I cannot get the Device Emulatur to connect i.e. ActiveSync should start after I "Cradle" but nothing.
  I am doing this on two PC's and get the same on both.
  Any Ideas'
  Thanks
  Stjani.
  • Reagovat
  • Citovat

   
• 19. června 2009 9:25Wayne Phillips.MVP, Moderátor

   
  

  2

  Přihlásit se a hlasovat
  Configure Active Directory Group Policies to deploy the required root certificates to the Software Publisher Certificate (SPC) and Unprivileged Execution Trust Authorities stores on the mobile devices. The SPC store governs cab installation on a Windows Mobile Device. The Unprivileged Execution Trust Authorities store is used by Windows Mobile security to control code execution. If an executable can be chained up to a certificate in this store, it is considered signed and is assigned a trust level based on the device security policies.
  
  Cheers Wayne
  Airloom

  • UpravenýWayne Phillips.MVP, Moderátor24. června 2009 2:04
  •  
  • Reagovat
  • Citovat

   
• 19. června 2009 16:01Stjani

   
  

  0

  Přihlásit se a hlasovat
  OK,
  
  when I use the security configuration manager to check if the cab file is sign I get
  Certificate issued by: Microsoft Code Signin PCA
  Autehntication         : Unsigned
  Permission             : It appers that this file will be prevented from executing on your device.
                               : the certificate that was used to sign this file was not found on the SPC store.
  
  I am running the security manager from the PC which created the cab files.
  I am trying to use security manager to sign the cab files, but no changes.
  thanks,
   Stjani
  
  
  • Reagovat
  • Citovat

   
• 22. června 2009 0:34David Creedy

   
  

  1

  Přihlásit se a hlasovat
  Can you make sure you are doing the following for testing:
  
  1. Sign your cab files with your Internal CA, the one you've used for SCMDM to keep things simple
  2. As Wayne Phillips said above, make sure the Internal CA's certificate is deployed to the device, not just in the Root store, but also the SPC and Unprivileged Execution Trust authorities store.
  
  You can sign your CAB files with your internal CAs certificate when creating the software packages via the Software Deployment console on MDM, just select your .pfx store when you add the cab file.
  
  • Reagovat
  • Citovat

   
• 23. června 2009 9:25Stjani

   
  

  0

  Přihlásit se a hlasovat
  OK,
  
  thanks it is working now. I guess I need to take a look at the HTC mobiles and check if security is ok.
  
  Now I would like to know  if I can  get more info about the mobiles in System Center Mobile Manager Console. The only info I am getting is Device Status and Device History.
  
  Thanks,
  Stjani
  • Reagovat
  • Citovat

   
• 24. června 2009 2:07Wayne Phillips.MVP, Moderátor

   
  

  0

  Přihlásit se a hlasovat
  To make it easy for future user to search to forum, it might be better to open a "extracting more device information" thread.
  
  Cheers
  Wayne

  • Označen jako odpověďStjani 24. června 2009 9:46
  •  
  • Reagovat
  • Citovat