2.15 Set 'Allow unmanaged devices' to 'False'

Information

This setting determines whether Exchange allow devices that do not accept security policy updates from the Exchange server to use ActiveSync.

Rationale:

Unmanaged devices are more likely to not comply with an organization's security policies and to be infected by malicious software.

Solution

To implement the recommended state, execute the following PowerShell cmdlet:

Set-MobileDeviceMailboxPolicy -Identity default -AllowNonProvisionableDevices $false

See Also

https://workbench.cisecurity.org/files/1512

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-19

Plugin: Windows

Control ID: 65065a0575dc4fbd074cf9990756f5825c45a017ba8c2c2152ec2b144482302c