A smartphone user was surprised that her firm’s system administrator could remotely wipe her personal phone. This is because your phone accepts policy control from, for example, Microsoft Exchange Server, if you choose to synchronize your personal smartphone with that server.
A system administrator can do a lot more that a remote wipe if you use something like Exchange ActiveSync to get your email, calendar, and contacts from your company. My day job’s company sys admin came to me yesterday to ask if he could test the new Exchange Server with me and test its policy settings. He knew that I used a bunch of smartphones and we could test a lot between the two of us. As you can see in the photo above, the policy setting on my Droid does not allow not having a PIN or using a gesture to unlock the phone. Only a numeric PIN or alphanumeric password is allowed in this policy setting test.
I also noted a couple of interesting differences among the platforms in the way they responded to being migrated to a new server:
– Windows Phone 7 (HTC HD7): Automatic and transparent. I did not have to make any changes to the phone
– iPhone 4: I had to change the server name and attempt syncing twice before the changes were recognized
– Motorola Droid (Android OS 2.2): I had to re-enter the mail server address and password multiple times before it finally started syncing with the new Exchange Server