Hi All,
I am the security administrator of a company. I have a server administrator working with me in the environment.
We come into a situation that we wish to enable Activesync, while disabling device wipe completely (i.e. even the server administrator cannot wipe.) We run Exchange 2010.
The reasons for us:
1) To minimize the attack surface. For example, if someone develop a virus
targeting on Exchange (Client Access Role) administrators. The virus runs
scripts to wipe all active devices in the domain when the administrators logon
to Exchange Management Console.
2) To balance security and usability – because of the some devices ownership are
the employees themselves.
3) To increase user confidence on using our email service.
4) We shall only need, according to company policy, selective wipe (can be done be
a third party MDM/MAM solution).
We did a tough documentation search and lab tests in our testing environment, no luck yet.
If you have a solution on this, please kindly share.
If this is really not possible, counter controls and measures suggestions are welcomed. For example,
a) Adding two-factor authentication to the device wipe feature of administrator(s).
b) Need more than one administrator to activate the device wipe feature for a specific device.
Any suggestions are welcome! Thank you.
William Lee CISA CISM CISSP
Hong Kong