Tethering Moto Q 9H with AT&T – Windows Mobile Forums

The key bits of information, for those of you who know what you’re doing and just need the codes:

• Extra initialization commands (in modem properties): at+cgdcont=1,”IP”,”isp.cingular”
• Dial up number: *99***3#

So we drove out to the one Apple store in Massachusetts that allegedly had iPhones in stock, but by the time we got there (20 minutes before the store opened) there were already so many people in line that the sales clerks told us we had no chance of getting one that day.

Just as well.

There was an AT&T Wireless retail store in the same mall, but they didn’t have any iPhones either. And we needed to get something fast to replace my wife’s phone, even if it was just on a temporary basis until we could get the iPhone. So we drove all of three minutes to the nearest AT&T retail store. There I was able to get my hands on a demo unit, so I was finally able to see that … I hated it.

There is no question that the iPhone is pretty. Downright beautiful, to be honest. But usable? Not for me.

The on-screen keyboard was cute, in a way. I liked the little click it made when you hit a key, and I liked the way the key you were typing popped up from under your finger so you could see what key you had just hit. The problem was that quite often the key I hit was NOT the key I intended to hit. So if I wanted to type “No, I didn’t get an iPhone,” what I actually typed might resemble what you see in the title of this post. I could tell that composing e-mail on that thing was going to be really frustrating.

There were other drawbacks to the iPhone:

• The Safari browser does indeed render web pages just like a regular browser. You can see the whole page at once. And it’s really, really, really small. So you have to use the two-fingered “un-pinch” motion to zoom in on what you want to see, and then scroll around to find what you’re actually looking for. Yuck.
• Although it may be technically capable of acting like a modem so you can use it to connect your laptop to the Internet, AT&T and/or Apple won’t allow that, at least not right now.
• Scrolling around the screen using finger wipes instead of keys is hip and fun and all that, but pretty imprecise. I hated flipping right by the icons I was trying to find and then having to go back.
• Apple has clearly put a lot of energy into making the iPhone an awesome device for listening to music and watching video. But you know what? I don’t really need to listen to music or watch video on my PDA-phone. What I really need to do is make phone calls, read and write e-mail, and find stuff on the web.

So we said no to the iPhone, and both of us got the Motorola Q9h, a.k.a Motorola Q Global. I could describe it, but you might as well watch one of the reviews on YouTube, like this one.

So far, a little more than 24 hours after purchase, I’m quite pleased with it. The keyboard rivals any BlackBerry I’ve used, and having the keyboard always available is a big upgrade for me compared to the slide-out keyboard on my XV6700.

The Q is not without its own problems. Connection to the AT&T 3G network seems a bit spotty, with frequent switches over to the slower Edge network. And AT&T has still not released an upgrade from Windows Mobile 6.0 to WM 6.1, to the frustration of many Q users. But I don’t regret passing on the iPhone for a minute.

Unexpected difficulty: I tried to follow the excellent instructions for installing a public 3rd-party SSL certificate on IIS on SBS 2003 at the Official SBS Blog. But in step 5 of those instructions, you are told to “select a Host Header value for this Web site that does not conflict with existing sites.” In the example they provide, they set the Host Header equal to the FQDN of the server: mail.contoso.com. In my case, though, the Host Header “mail.myclient.com” did conflict with an existing site — the one with the expired SSL certificate. So I got an error message when I tried to create the site (step 6).

Solution: The name of the temporary web site and its Host Header value do not need to match the FQDN of the server. I ended up creating a web site called Temp Cert Request with a Host Header of tempcertrequest.myclient.com. I used that web site to generate the CSR request, making sure to put mail.myclient.com in as the common name in the wizard (step 11). I used “2008 mail.myclient.com” as the Friendly Name (step 9) just to make sure I knew which certificate was which.

Thanks to Andy Harper and David Houston for assuring me that I didn’t need to worry about matching Host Header with FQDN.

Here was the scenario:

• Server: SBS 2003 Standard SP1, Exchange 2003 SP2
• Don and Jorge have WM5 phones
• Don had absolutely no problem synchronizing his phone with Exchange.
• Jorge cannot sync either over the air or while cabled to a laptop. We had tried with three different WM5 devices (Treo 700w, Motorola Q, XV6700) over the air and while cradled from two completely separate remote locations. We had tried using both ActiveSync 4.5 on XP and the Mobile Device Center on Vista.
• Server is using a GoDaddy SSL certificate. SSL settings on the server had been triple-checked, and as noted above Don could sync without difficulty (on two different devices, no less).
• Jorge was able to get to log into OWA and see his mail from the WM5 device.
• David – a domain admin account being used for test purposes – was unable to sync from one of the same devices successfully synched for Don.
• Mabel – another (non-domain-admin) account also used for test purposes  – was also unable to sync from that device.

The error on the server when trying to sync was:

Log: Application
Type: Error
Event: 3005
Time: Oct 2 2007 5:44PM
Source: Server ActiveSync
Category: None
Username: jorge
Computer: SERVER
Description: Unexpected Exchange mailbox Server error: Server: [server.internaldomain.com] User: [jorge@externaldomain.com] HTTP status code: [409]. Verify that the Exchange mailbox Server is working correctly.

The error on the device when trying to sync was:

Your account in Microsoft Exchange Server does not have permission to synchronize with your current settings. Contact your Exchange Server administrator. Support code: 0×85010004.

I checked Jorge’s Exchange Features in Active Directory and all are enabled. Jorge is in the same AD OU and same security groups as Don.

Unfortunately, these error messages are rather non-specific. I went through dozens of pages found via Google searches. Most suggested that the problem was related to SSL certificates, host headers, firewall settings, and other issues that turned out not to be the cause.

Fortunately, I am a Microsoft Small Business Specialist, and that entitles me to free support from Microsoft engineers in Shanghai through a managed newsgroup. I posted my problem there, and got this thorough troubleshooting checklist:

Step one:
Please install the hotfix below to see if it helps:
Error message when you try to synchronize a Windows Mobile 5.0-based device in Exchange Server 2003: “0×85010004″
http://support.microsoft.com/kb/919864/en-us
 
Step two:
This issue can be caused if you have a Firewall and not allowed a rule on the Firewall for Microsoft-Server-ActiveSync. So I would like to check if you have run the CEICW Wizard. Please open Server Management console, navigate to ‘To Do List’ and click ‘Connect to the internet’ in the right panel. The wizard can help us configure the networking settings for a SBS server. It automatically creates the ISA rules for internet access and site publishing. It’s strongly recommended to use the wizard to configure the SBS server. More info:
825763 How to configure Internet access in Windows Small Business Server
2003
http://support.microsoft.com/?id=825763
XCSI/PRE/E2K3/Unable to synchronize with Exchange server using Active Sync
http://support.microsoft.com/default.aspx?scid=kb;EN-US;924216

Step three:
Please checked the properties of Microsoft-Server-ActiveSync, is the
Directory Security properties for IP Address and Domain Name Restrictions
configured as ” DENIED ACCESS”? To check it:
1. Open IIS.
2. Expand Web Sites -> Default Web Site.
3. Open the Properties page of Microsoft-Server-ActiveSync.
4. In Directory Security tab, click Edit under “IP address and domain name
restrictions”.
5. Make sure that you configured as Granted access.

Step four:
Please check the following IIS settings:

For Exchange/Exchange-oma virtual directory:
1. Open IIS Manager
2. Open properties of virtual directory Exchange/Exchange-oma
3. Select Directory Security tab
4. Select Edit in Authentication and access control box. Make sure the authentication setting as below:
Authentication Methods
Enabled Basic authentication
Enabled Integrated Windows authentication
Disabled anonymous access

For OMA virtual directory and Microsoft-Server-ActiveSync virtual directory:
1. Open IIS Manager
2. Open properties of OMA virtual directory and Microsoft-Server-ActiveSync virtual directory respectively.
3. Select Directory Security tab
4. Select Edit in Authentication and access control box. Make sure the
authentication setting as below:
Authentication Methods
Uncheck Enable anonymous access
Uncheck Integrated Windows authentication
Check Basic authentication

Of all the items that were listed here, the only ones that were off on my server were that the hotfix had not been installed and that anonymous access on Exchange-oma was not disabled. I made both of these changes, and I am 99% sure that it was the Exchange-oma change that finally solved the problem.

I recently laid hands on an iPhone for the first time a couple weeks ago. It is beautiful and fun to play with. But I said the same thing about my first digital watch about 30 years ago.

I’m a little concerned, though, about the part that says this new technology will use Outlook Web Access as the synchronization tool. BlackBerries can do that, too, but all you get is mail. No calendar, no contacts, no tasks. You can sync those items with a BlackBerry, but only through a USB cable, not over the mobile network.

Memo to business owners’ spouses: stay clear of the iPhone aisle. 

• Smartphones for global travel
• First crop of Windows Mobile 6 phones
• Mobile phones recommended for small business

“Cannot play back the audio stream: the audio format is not supported.”

A fuller explanation of this problem, along with a couple suggested solutions, is in this Windows Mobile blog. Unfortunately, the link to a recommended third-party product (http://tcpmp.corecodec.org) seems to be dead. According to this forum, the software is now available here. Someone else in the same forum suggested VLC, but the Pocket PC version doesn’t seem to be ready.

There is a Palm knowledgebase article on this as well, but it basically throws up its hands.

MotionApps makes a product called mVoiceMail that purports to solve this problem, but it has a minimum quantity of 10 licenses and doesn’t seem to support my PPC 6700 anyway.

TCPMP seems to be the way to go. I have my doubts about downloading from a Hungarian web site named after a Star Trek character, but I will try it anyway. Can’t do it right now — I’ll let you know how I make out.

You wouldn’t think this would be so much of a challenge, but the steps are actually hidden pretty well. The answer was posted at Experts Exchange. Scroll all the way to the very bottom, past the ads and links. (Or pay to join Experts Exchange so you can skip all that stuff in the future.)

Storage memory is critically low. If you do not increase storage memory, you may not be able to start some programs. Use File Explorer to delete files you no longer need, or move some files to a storage card.

Don’t let this happen to you. When it does, your Pocket PC starts to behave like a machine trying to run Windows XP on 64 MB RAM.

The synchronization had created hundreds of duplicates in my new Exchange mailbox, too. I went through and deleted them on my laptop, but my phone was now too overwhelmed to sync the deletions. It didn’t have enough memory to free up more memory. And isn’t that ironic? Yeah, I really do think.

I solved the problem by moving everything I could from the built-in storage memory, which is limited to 40 MB on my XV 6700, to the 2 GB storage card. That only freed up a megabyte or two, but it was enough to get the sync started again, which freed up still more space.

If I’d let it run long enough, it might have gotten back to where it had been earlier in the week. But between this and the problems I’d had getting it to cradle-sync with Vista, I figured this was a good time to try something I’d never dared before: the remote wipe. One of the big selling points of Windows Mobile 5 is that you can erase all the sensitive data from that phone you left in the taxi back in Cleveland. Generally I don’t have the luxury of being able to cripple my equipment just for the sake of research, but my phone was doing me no good in its present state, so why not run a little test?

I didn’t get very far at first. My own server denied me access to the internal web site that runs the wiping process. Fortunately, a little Googling led me to this discussion on Experts Exchange, which further led to this blog entry by my buddy Vlad.

After I clicked “wipe,” I got a message on the phone:

Exchange Server sbs.schrag.net must enforce security policies on your device to continue synchronizing. Do you want to continue?

The choices were OK or Cancel. I don’t know about you, but if a message like that popped up on a machine from which I was illicitly trying to extract sensitive information, I would probably click Cancel. As it happened, I didn’t even have to. By the time I finished transcribing the message and writing the little joke earlier in this paragraph, the message had gone away and the phone had not been wiped. All my contacts, tasks, and calendar entries would still have been available to anyone who picked up the phone, as long as they started fiddling with it before it went into password-protect mode. (All my e-mail had been deleted from the phone as part of the contact duplication fiasco, but I don’t think that was designed as a security measure.)

Meanwhile, back at the admin website on my server, it looked like I was all set:

Microsoft doesn’t make very clear what you’re supposed to see in that Status column. This article explains the steps an administrator has to take to wipe a device, but is silent about what feedback is provided to the administrator. The Microsoft guide on using Windows Mobile 5 with SBS 2003 is even less detailed. This independent and more helpful article, actually lists the sequence of wipe statuses you can expect to see. But it doesn’t say that user action is required to allow the wipe to proceed.

This little security loophole does not seem to be widely publicized, although I am not the first to mention it. In fact, after I’d spent nearly an hour researching and writing all this up, I Googled a slightly different set of search terms and stumbled upon Chris Rue’s complete and much more thorough documentation of this same problem, which he wrote up last August. Had I found that article earlier on in the process, you would not be reading this, but now that I’ve stayed up until 4 in the morning working on it, I’m gonna publish, damn it! 

Anyway, I initiated another sync and this time said OK to the security policy message. It woiked!

Now onto the next step: rebuilding my Pocket PC. But that’s a story for another blog.