A device continues to synchronize even though the AllowNonProvisionableDevices parameter is set to False in Exchange 2007

In Microsoft Exchange Server 2007 Service Pack 1 (SP1), a device may continue to synchronize even after an administrator changes the AllowNonProvisionableDevices parameter that used by the Set-ActiveSyncMailboxPolicy cmdlet from True to False.

This behavior occurs because several new Exchange ActiveSync policy settings are added in Exchange 2007 SP1. Some of these policies are available only with the Microsoft Exchange Server 2007 Enterprise Edition client access license (CAL). The policy settings that are available with the Exchange Enterprise CAL are applied to the device by the synchronizing client that uses the enterprise role. Certain mobile service providers may not want the devices being managed to this extent. Therefore, these mobile providers may lock down the device. This behavior is decided by the CanTransistionManagement parameter on the device. When the CanTransistionManagement parameter is set to False, only the Microsoft Exchange Server 2007 Standard Edition CAL policies can be configured. When the CanTransistionManagement parameter is set to True, all the policies that are available through the Exchange Standard CAL and the Exchange Enterprise CAL can be configured.

When the CanTransistionManagement parameter is set to False on the device, you can also set the AllowNonProvisionableDevices parameter to False on the Exchange 2007 SP1 server to prevent devices that cannot fully apply the policies from synchronizing.

If the AllowNonProvisionableDevices parameter is set to True, the device will be able to synchronize and to obtain a policy key. If an administrator later changes the AllowNonProvisionableDevices parameter from True to False, the device will continue to synchronize. This behavior occurs because the AllowNonProvisionableDevices parameter is not a policy setting that is sent to the device. Additionally, because the device sends a policy key, the device will be able to synchronize.

This behavior is by design.

When an administrator changes the AllowNonProvisionableDevices parameter from True to False, the change will be picked up if one of the following conditions is true:

• The policy is checked at the next policy update interval.
• A change in the policy causes the policy setting to be sent to the client.