[RJeffDay]

RUNNING: BES Version 4.1.4 (Bundle 24) working with Lotus Notes.

SUBJECT: User Terminations

When it comes time for an employee with a BB Device to separate from the company, it is standard procedure to place them in the Active Directory ‘Deny Access’ users group. This denies them access to all system resources such as their email and databases. (I know... It's pretty much SOP for all companies)

We have noticed however, that the user can still receive email via their BB device from our Lotus Notes server even though their user ID is in the ‘Deny Access’ folder.

Does anyone know how to resolve this issue or tell me why it happens?

Thank you.

[penguin3107]

You don't wipe the user's handheld when they're terminated?

[RJeffDay]

Originally Posted by penguin3107

You don't wipe the user's handheld when they're terminated?

We are still in the process of developing our procedure because many of these users are using personal devices on our corporate network.

Our consideration is that we do not want to perform a 'wipe and disable' if an individual has a personal device while driving/flying back from a business trip. We're not quite sure what the legal ramifications might be.

That brings up another question: What does a 'Wipe and Disable' actually do to the device? I know it wipes the data, but does it then render the phone useless?

What is the procedure at your company?

[penguin3107]

Originally Posted by RJeffDay

What is the procedure at your company?

We don't allow personal devices to be activated on our BES. No exceptions.

User gets terminated... device gets security wiped.
Once wipe is completed, service on that wireless number is suspended at the carrier level.

Erase & Disable Handheld deletes all user data from the handheld and essentially breaks the connection to BES. It doesn't actually "disable" the device in any way. You're disabling the BES activation.

[jsconyers]

There are a couple of good threads about allowing personal devices on your BES

http://www.blackberryforums.com/bes-...ckberries.html

http://www.blackberryforums.com/bes-...d-devices.html

[TargetIT]

Damn, getting canned in mid-air would suck.

[-EOS-]

Push an empty IT Policy, then Erase Data and Disable Hanheld.

[DavidAdams]

If you just want to stop the device being used until it returns to base why not just set a new password?

[penguin3107]

Originally Posted by DavidAdams

If you just want to stop the device being used until it returns to base why not just set a new password?

Because it's probably not being returned. It's a personally owned device as per the OP.

[DavidAdams]

Originally Posted by penguin3107

Because it's probably not being returned. It's a personally owned device as per the OP.

i was thinking this would stop its use until the owner gets back and can discuss wiping/removing personal stuff first.

[swinter]

Wouldn't removing the user from the Bes work as a solution? They keep their handheld but get nothing from the Bes?

[penguin3107]

Originally Posted by swinter

Wouldn't removing the user from the Bes work as a solution? They keep their handheld but get nothing from the Bes?

But then they also keep the associated IT Policy and whatever company data is already on the device.

[Pinjo]

While you are flexible by allowing them access to your service, you need to review the stipulations of providing them such access. Remember, it is not their right to connect to your company BES. It's a balance of allowing them to be productive on their own "time and dime" (I'm thinking of trademarking this), but protecting the company. You really should look at changing your policy to make users aware of your rights and their rights when connecting to a company BES.

Our policy states that it is their responsibility to backup and maintain their personal data on their device (apps, pictures, email, etc.). We also make them aware of the process if they are to be separated from the company. They sign and understand this policy as a stipulation of connecting to our BES.

[Jadey]

Originally Posted by RJeffDay

it is standard procedure to place them in the Active Directory xxx8216;Deny Accessxxx8217; users group. This denies them access to all system resources such as their email and databases. (I know... It's pretty much SOP for all companies)

We have noticed however, that the user can still receive email via their BB device from our Lotus Notes server even though their user ID is in the xxx8216;Deny Accessxxx8217; folder.

Does anyone know how to resolve this issue or tell me why it happens?

Thank you.

Slightly confused. Access lockout in Domino is in the Domino Directory deny access group section. Do you have your Domino Directory integrated with Active Directory? That might explain why you mention AD for a Domino lockout.

Either way, that is not so important. The reason it doesn't stop mail to BB is because BES does not retrieve user mail using the user's Domino ID. It uses the Server ID of the Domino Server hosting that user's BES. As you are not locking out the server ID (BAD IDEA, do not lock out server ID, will stop BES working for all users on that Domino BES instance) it will continue to run.

All that locking out an individual user notes ID will do is stop THAT particular ID accessing the domino servers. It will not stop a different ID (Domino server) with access to the user mailfile from accessing that mailfile. Thus the BES server will just keep on going.

[juwaack68]

I so wish I was notified of terminations. I usually find out a couple of weeks after the person has left the company. *sigh*

[Jadey]

Originally Posted by RJeffDay

Does anyone know how to resolve this issue

Okey dokey. I am assuming that we CAN'T take the following options:

a) Set password and lock device = would stop user being able to use BB AT ALL until they come back to you. Probably not acceptable if personal device on your BES.

b) Erase data and disable handheld - you have ruled this out

c) Deleting user from BES - personally I see no issue with this. It would stop the corporate email updating etc. When the user is back, backup handheld (delete all BES service books first and/or disable wireless rec to allow proper backup), wipe it preferably with factory reset to shift off policy, restore personal user data.

If you still can't do any of those and need to leave the user on the BES server but not active, then just disable wireless PIM synch of company data (address book, memos, etc) and in user account on BES set redirection > message forwarding > redirect to blackberry device to FALSE for that user and set filters > forward messages to blackberry device to FALSE.

I *think* in that case the user might be able to send corp email from BB, but not receive. You'd still have the task of clearing corp data off of BB when you get it, but in the interim it would stop any NEW corp data ending up on BB.

[TargetIT]

Originally Posted by juwaack68

I so wish I was notified of terminations. I usually find out a couple of weeks after the person has left the company. *sigh*

Can I take a guess at when you find out about new employees too?

[juwaack68]

Wirelessly posted (My blond BlackBerry)

Originally Posted by TargetIT

Can I take a guess at when you find out about new employees too?

Rarely since the Helpdesk does all the new BlackBerry user deployments.

[x14]

Originally Posted by Jadey

a) Set password and lock device = would stop user being able to use BB AT ALL until they come back to you. Probably not acceptable if personal device on your BES.

This option doesn't work too well. If the device is locked it will prompt the user to accept the new password. I haven't found a policy to not prompt the user to accept.

[x14]

Originally Posted by RJeffDay

We have noticed however, that the user can still receive email via their BB device from our Lotus Notes server even though their user ID is in the ‘Deny Access’ folder.

This is because BES has access to the mail file. Best is to either remove the user from BES or disable redirection.