In preparation for enabling the default Quarantine action of new ActiveSync devices I white-listed all existing devices by adding them to the AllowedActiveSyncDeviceID attribute of each users respective mailbox.
After I enabled the quarantine and set the administrative email several quarantine approval emails were sent to the admin email specified for devices on the allowed list for the mailbox. However it doesn't appear that users were actually quarantined.
If I run the following command I get devices returned as being quarantined:
Get-ActiveSyncDevice | where-object {$_.DeviceAccessstate -contains "quarantined"}
If I run THIS command which should be querying the same attribute but using the -Filter I get no results:
Get-ActiveSyncDevice -Filter "DeviceAccessState -eq 'quarantined'" -ResultSize Unlimited. If I use this same command filtering for "Allowed" it returns all devices that have been allowed.
On top of this I have several users who have had all their devices added to the ActiveSyncAllowedDeviceID attribute on their mailbox but if I look at their mailbox through ECP one or more of those allowed devices are still marked as Quarantined and it won't let me allow them - it just sits there with "Allow Device - Pending". Yet it doesn't appear they are actually quarantined as I've had no reports of them unable to access their mailbox on their device.
Can anyone suggest why those two commands are returning different results when they are querying the same attribute?
And also, why some devices are still appearing as quarantined through ECP even though they don't seem to be through PowerShell nor will they allow me to allow them through ECP?
Thanks