Disable forced remote wipe, while still enforcing PIN unlock code

[PhD]

Hi there,

As the per the subject - is there any way to disable wiping the mobile, while still enforcing the use of a pin number?

We're allowing users to have their mobiles provisioned with our server, and one of the security provisions (as mandated by our CEO) is that the enforcing of PIN's is adhered to.

This is all good, but the feature of a forced local wipe when the pin code is enforced is something that is causing a bit of a stir.

Ive read a few other articles/posts - about setting the max number of pin tries to 0, and/or to something ridiculously huge, and other information saying only valid numbers are between 4 and 16...

Without wanting to "try" a setting of 0 or something larger to "see what happens" is there any way around this? Or does someone actually know what happens if you set it to 0?

I looked for any existing bugs submitted for this but couldnt see one.

Cheers,
PHD

[Dirk]

To which type of device to you refer?
Setting the value to -- in IPCU for iOS 4+ will leave the remote wipe under user control, for instance.

[PhD]

sorry? set the value to --? 0? where....
so, if theres a setting in the iphone config util, what happens then when the pin unlock failed limit is reached - does a provisioned iphone overrule the zimbra settings?

[Dirk]

As per the attached image.
Dont set it at all in zimbra, let the configuration profile do the work.

That said of course, an automatic wipe of the phone after multiple incorrect pin attempts is a good thing, I dont know why you'd want to disable it.

[PhD]

Ah I see, downside is if the user has an android or other smartphone that the policy can be enforced by zimbra. Force pin=good, forced local wipe = bad if you have ever given your phone to a kid for 10 minutes while locked, only to find it wiped when you get it back.. So I guess I can use your method for our iPhone users. But the other phones is still an issue. The Max number of failed attempts needs allowance to be set to 0 in zimbra, or really high

[Dirk]

Good point, I'd suggest not having android phones....... or kids.

Zimbra does support a value of zero for pin attempts end if you enable the enforce policy option it will send that to the device. How the device interprets that value may be up for grabs by each version of the android OS though. I can see it being anything other than 'dont do it' rather than 'do it right away' but I suggest testing it on a few handsets if possible.

[ewilen]

Please consider voting for Bug 50270 - RFE: allow policy to force password without imposing time-based lockout or wipe after N failed PIN inputs

[tobias.dinse]

Hi,

yesterday we integrated a iphone from our customer to zimbra. After that we cant disable the Code. I have installed the Configuration Utility but I cant find anything about disable code. How I can disable that? I cant use the function "disable code" on the Iphone because its grey and cant be used