Creating a BlackBerry Enterprise Server administrator in a Microsoft SQL Server environment... Assign an administrative role to a new or existing Microsoft SQL Server database account.. Configure the BlackBerry Manager to use database authentication in a Microsoft SQL Server environment. Assign a BlackBerry Enterprise Server administrator to a different administrative role... Delete an administrator account from a BlackBerry Enterprise Server... 10 Removing the BlackBerry Enterprise Server software.... Remove the BlackBerry Enterprise Server software.... Delete registry entries from your computer.... Removing the BlackBerry database notification system... Remove the BlackBerry database notification system from a BlackBerry Configuration Database.. Remove the BlackBerry database notification system from all BlackBerry Configuration Database instances. 11 Troubleshooting the BlackBerry Enterprise Server installation process.... A third-party tool did not install and the BlackBerry Enterprise Server setup application closed.. Failed to write License Key to the Database..... Previous version detected but no database available.... The BlackBerry Collaboration Service does not connect to Microsoft Office Live Communications Server 2005. The setup application did not prompt you to change or confirm the MAPI profile... The setup application prompts you for access to the installation media for Microsoft.NET Framework version 1.1.. 12 Glossary....... 13 Legal notice......
Planning a BlackBerry Enterprise Server installation
You can install all BlackBerry Enterprise Server components on one computer, or you can install specific components on separate computers. Consider any impacts on system resources before you decide where to install a component. Consider installing all components on one computer if you do not plan to activate many BlackBerry devices, if you have determined that the computer can handle the traffic volume for the BlackBerry Enterprise Server components, or if you do not mind that the computer has direct access to the wireless network. For performance information, see BlackBerry Enterprise Server Performance Benchmarking.
Installing all BlackBerry Enterprise Server components on one computer

The BlackBerry Router connects to the wireless network and routes data to and from BlackBerry devices. You can install the BlackBerry Router with other BlackBerry Enterprise Server components or by itself on a separate computer. Install the BlackBerry Router on a separate computer if you want to set it up in the DMZ, or to install several standby instances of the BlackBerry Router as failover components in case your primary BlackBerry Router becomes unavailable. You can connect multiple instances of the BlackBerry Enterprise Server to a single BlackBerry Router. If you install the BlackBerry Router on a separate computer, you install the BlackBerry Router and the BlackBerry Controller. The BlackBerry Controller monitors the BlackBerry Router and restarts it if it stops responding.
Configuring the Hosted BlackBerry services
The Hosted BlackBerry services permits you to make the BlackBerry Enterprise Server available to other organizations (for example, small or medium-sized businesses). When you use the Hosted BlackBerry services in your organization's environment, one or more organizations can subscribe to your organization's BlackBerry Enterprise Server. To configure Hosted BlackBerry services, you must use a different licensing model for the BlackBerry Enterprise Server. Depending on how you want to configure the Hosted BlackBerry services, you might need to change how the BlackBerry Enterprise Server searches for contacts.

System requirements

For information about calculating hardware requirements, visit www.blackberry.com/go/serverdocs to see the BlackBerry Enterprise Server Capacity Calculator and BlackBerry Enterprise Server Performance Benchmarking Guide.
System requirements: BlackBerry Enterprise Server
Item operating system Requirement Any of the following operating systems: Windows 2000 SP4 Server or Advanced Server Windows Server 2003 or later Windows Server 2003 or later (64-bit) Windows Server 2003 R2 SP2 Windows Server 2003 R2 SP2 (64-bit) Windows Small Business Server 2003 Standard or Premium Any of the following messaging servers installed physically close to where you plan to install the BlackBerry Enterprise Server: Microsoft Exchange version 5.5 Microsoft Exchange 2000 Microsoft Exchange 2003 or later Microsoft Exchange 2007 Microsoft Exchange mixed environment (any combination of Microsoft Exchange version 5.5, Microsoft Exchange 2000, Microsoft Exchange 2003, and Microsoft Exchange 2007) Microsoft Solution for Hosted Messaging and Collaboration version 3.5 Any of the following system tools for the messaging server installed on the computer that hosts the BlackBerry Enterprise Server: Microsoft Exchange version 5.5 Administrator Microsoft Exchange 2000 System Manager Microsoft Exchange 2003 System Manager Microsoft Exchange Server MAPI client and CDO 1.2.1

The following system requirements apply when installing the BlackBerry MDS Connection Service on a computer separate from the BlackBerry Enterprise Server. Item operating system Requirement Any of the following operating systems: Windows 2000 SP4 (Server, Advanced Server, or Professional) Windows Server 2003 or later Windows Server 2003 or later (64-bit) Windows Server 2003 R2 SP2 Windows Server 2003 R2 SP2 (64-bit)
System requirements: BlackBerry MDS Integration Service
Item messaging server application
Requirement Windows Small Business Server 2003 (Standard edition or Premium edition) To support BlackBerry Enterprise Server Version 3.5 and BlackBerry Enterprise Server Version 3.6, any of the following applications: Microsoft Exchange version 5.5 Administrator Microsoft Exchange 2000 System Manager Microsoft Exchange 2003 System Manager Microsoft Exchange Server MAPI client and CDO 1.2.1 for Microsoft Exchange 2007, either Microsoft Exchange Server MAPI client and CDO 1.2.1 or Microsoft Exchange 2003 SP2 System Tools To support enhanced network authentication, RSA Authentication Agent version 5.0 for Windows

RSA Authentication Agent

The following system requirements apply when installing the BlackBerry MDS Integration Service on a computer separate from the BlackBerry Enterprise Server. Item operating system Requirement Any of the following operating systems: Windows 2000 SP4 (Server or Advanced Server ) Windows Server 2003 or later Windows Server 2003 or later (64-bit) Windows Server 2003 R2 SP2 Windows Server 2003 R2 SP2 (64-bit) A database server that is the host for the BlackBerry Configuration Database.

database conditions

System requirements: BlackBerry Router
The following system requirements apply when installing the BlackBerry Router on a computer separate from the BlackBerry Enterprise Server.
System requirements for optional environments and features

Item operating system

Requirement Any of the following operating systems: Windows 2000 SP4 (Server or Advanced Server) Windows Server 2003 or later Windows Server 2003 or later (64-bit) Windows Server 2003 R2 SP2 Windows Server 2003 R2 SP2 (64-bit) A firewall or proxy firewall with the following conditions: support for the BlackBerry Router to initiate an outgoing, two-way TCP/IP connection to an external server on port 3101 support for the resolution of Internet addresses using DNS transparency of the proxy server for proxy firewalls

firewall

Item virtual environment Description The BlackBerry Enterprise Server and the BlackBerry Enterprise Server components support the following virtual environments: VMware ESX Server version 2.5.2 or later VMware ESX Server version 3.0.1 VMware ESX Server version 3.5 The BlackBerry Collaboration Service supports Windows Messenger if MSMQ version 3.0 is installed. If you installed the BlackBerry Collaboration Service on a computer that is separate from the computer that hosts Windows Server 2003, you must clear the default Microsoft Active Directory Integration and Triggers subcomponents and select the Common subcomponent only. The BlackBerry Collaboration Service supports Windows Messenger with TLS if one of the following certificates is installed on the computer that hosts the BlackBerry Collaboration Service: if your organization's instant messaging server is Microsoft Office Live Communications Server 2005, an MTLS certificate

Microsoft Exchange tool Microsoft Exchange Version 5.5 Administrator Microsoft Exchange 2000 System Manager Microsoft Exchange 2003 System Manager 2. 3.
Microsoft article 823343 894470
Verify that your environment meets the requirements described in the applicable known issues. Download and install the hotfixes for the known issues on the computers on which you plan to install the BlackBerry Enterprise Server and the BlackBerry Manager.
Configuring a Microsoft Exchange 2007 messaging environment
Create a Microsoft Exchange 2007 account and mailbox
Before you begin: You must configure Microsoft Exchange 2007 to support earlier versions of Microsoft Outlook by creating the public folder database. For more information about supporting earlier versions of Microsoft Outlook, visit http:// support.microsoft.com to read article 555851 and visit technet.microsoft.com to read articles 123694, 124270, 397221, and 691120. You must be an administrator with permission to create an account. 1. 2. 3. On the computer that hosts Microsoft Exchange, log in as an administrator with permission to create an account. Open the Microsoft Exchange Management Console. Create a Microsoft Exchange account that is named BESAdmin.
After you finish: To permit checks for meeting participant availability for BlackBerry Device Software version 4.5 or later, configure the Schedule+ free and busy information for the system public folder. For more information, visit http:// technet.microsoft.com to read articles 629523 and 691129.
Configure Microsoft Windows permissions for the Microsoft Exchange 2007 account
On each computer that you plan to install the BlackBerry Enterprise Server or the BlackBerry Manager on, you must configure the Local Security Policy permissions for the Microsoft Exchange account that you plan to use to complete the installation. Without the proper permissions, the BlackBerry Enterprise Server cannot function. 1. 2. 3. 4. 5. 6. 7. 8. Right-click My Computer. Click Manage. In the left pane, expand Local Users and Groups. Navigate to the Groups folder. In the right pane, double-click Administrators. Click Add. In the Enter the object names to select field, type BESAdmin. Click OK.
Configure Microsoft Exchange 2007 permissions for the Microsoft Exchange account
9. Click Apply. 10. Click OK.
1. 2. On a computer that hosts the Microsoft Exchange Management Shell, open the Microsoft Exchange Management Shell. Perform one of the following actions: If you want to execute the command on the Microsoft Exchange 2007 server, type add-exchangeadministrator "BESAdmin" role ViewOnlyAdmin. If you want to execute the command from another computer, type get-mailboxserver "<messaging_server_name>" | add-exchangeadministrator "BESAdmin" role ViewOnlyAdmin. Type the following command: get-mailboxserver "<messaging_server_name>" | add-adpermission user "BESAdmin" accessrights ExtendedRight extendedrights Send-As, Receive-As, ms-Exch-Store-Admin.

Enable BlackBerry device users to send email messages in a Microsoft Exchange 2007 environment
On any computer in the Windows domain, on the taskbar, click Start > Administrative Tools > Active Directory Users and Computers. 2. On the View menu, click Advanced Features. 3. Right-click the domain root. Click Properties. 4. On the Security tab, click Advanced. 5. Click Add. 6. Type the name of the Microsoft Exchange account that you created (for example, BESAdmin). 7. Click Check Names. 8. Click OK. 9. In the Apply drop-down list, click User Objects. 10. In the Allow column, select the Send As check box. 11. Click Apply. 12. Click OK. 1.
Setting up the database connection
The BlackBerry Enterprise Server can connect to the BlackBerry Configuration Database on the Microsoft SQL Server using Microsoft Windows authentication or database authentication. If you use Microsoft Windows authentication, the BlackBerry Manager logs in to the BlackBerry Configuration Database using the Microsoft Windows account that you used to complete the installation. If you use database authentication with Microsoft SQL Server, the BlackBerry Manager authenticates to the database using the database credentials that the administrator provides.
Specifying permissions when connecting to the BlackBerry Configuration Database using Microsoft Windows authentication
During the BlackBerry Enterprise Server installation process, if you choose to connect to the BlackBerry Configuration Database using Microsoft Windows authentication, the Microsoft Windows account that you use must have permissions on the database server. The type of permissions depends on the BlackBerry Enterprise Server setup option that you choose, and on whether you create the BlackBerry Configuration Database on the same computer as the BlackBerry Enterprise Server or on another database server.
Specifying MSDE 2000 permissions for the Microsoft Windows account
If you install MSDE 2000 during the BlackBerry Enterprise Server installation process, you do not need to specify additional permissions. When you select Microsoft Windows authentication during the BlackBerry Enterprise Server installation process, the setup application automatically assigns the required permissions to the Microsoft Windows account that you are using to complete the installation.
Assign Microsoft SQL Server permissions to the Windows account
Perform one of the following actions: If you create the BlackBerry Configuration Database on the same computer as the BlackBerry Enterprise Server, or if you install the BlackBerry MDS Integration Service, assign the system administrator permission to the Windows account that you are using to complete the installation. If you create the BlackBerry Configuration Database on another computer, assign server administrator and database creator permissions to the Windows account that you are using to complete the installation process. If you are using Microsoft SQL Server 2005, assign the system administrator permission to each of the following roles: SQLAgentUserRole, SQLAgentReaderRole, and SQLAgentOperatorRole.

Configuring authentication to the BlackBerry MDS Integration Service database
If you install the BlackBerry MDS Integration Service on a Microsoft SQL Server, the setup application uses the same authentication method and account that you specified for the BlackBerry Configuration Database. The account requires the same permissions for the BlackBerry MDS Integration Service database as it requires for the BlackBerry Configuration Database.
Persistent socket connections for the BlackBerry Collaboration Service
Instant messaging environment Microsoft Office Live Communications Server 2005 or Microsoft Office Communications Server 2007, and TLS communication protocol Microsoft Office Live Communications Server 2005 or Microsoft Office Communications Server 2007, and TCP communication protocol Microsoft Office Live Communications Server 2005 or Microsoft Office Communications Server 2007, and HTTPS communication protocol IBM Lotus Sametime BlackBerry Collaboration Service requirements
one persistent socket connection for each instant messaging session three persistent socket connections for each instant messaging session one persistent socket connection and multiple sequential socket connections for each instant messaging session three persistent socket connections to create one TCP connection; all instant messaging sessions use that TCP connection one persistent socket connection for each instant messaging session
Installing the BlackBerry Enterprise Server software
Applications installed with the BlackBerry Enterprise Server components
Item J2SE Runtime Environment JRE Microsoft XML Parser Version 5.0 update 9 1.6 4.0 SP2 Components with which this item is installed All BlackBerry MDS Connection Service BlackBerry Collaboration Service BlackBerry Messaging Agent BlackBerry Attachment Service BlackBerry Manager BlackBerry Router BlackBerry Messaging Agent BlackBerry Manager BlackBerry Collaboration Service

Microsoft.NET Framework

1.1 or 1.1 SP1

MSDE database

BlackBerry Enterprise Server
Prerequisites: Installing the BlackBerry Enterprise Server
Item credentials from the BlackBerry Enterprise Server installation media Requirement CAL key SRP identifier SRP key SRP host computer name and port number of the instant messaging server (use the virtual server name and port number where the AJAX Service is installed, if applicable) computer name and port number of the proxy server (optional)

9. Change AllowRemoteServices to 1. 10. In the Microsoft Windows Services, restart the BlackBerry Attachment Service.
Connect the BlackBerry Collaboration Service to a remote BlackBerry Attachment Service
Users can use the BlackBerry Client for IBM Lotus Sametime to send files to the contacts in their contact lists. To optimize files for viewing on BlackBerry devices, the BlackBerry Collaboration Service must be able to connect to the BlackBerry Attachment Service. If you have not installed the BlackBerry Attachment Service on the same computer as the BlackBerry Collaboration Service, you must connect the BlackBerry Collaboration Service to the BlackBerry Attachment Service. 1. On the computer that hosts the BlackBerry Collaboration Service, navigate to C:\Program Files\Research In Motion \BlackBerry Enterprise Server\BBIM\Servers\<servername>\config. 2. In a text editor, open the rimpublic.property file. 3. At the end of the file, type the following lines: Attachment.Server.host=<attachmentserverhostname> Attachment.Server.port.asp=1900

4. 5. 6. 7.

Attachment.Server.port.rqp=2000 Save and close the file. In the Windows Services, restart the BlackBerry Collaboration Service. To connect another BlackBerry Collaboration Service to the BlackBerry Attachment Service, complete steps 1 through 5. On the computer that hosts the BlackBerry Attachment Service, in the Registry Editor, perform one of the following actions: If you are running a 32-bit version of Windows, navigate to HKEY_LOCAL_MACHINE\Software\Research In Motion \BBAttachServer\BBAttachBESExtension. If you are running a 64-bit version of Windows, navigate to HKEY_LOCAL_MACHINE\Software\WOW6432Node \Research In Motion\BBAttachServer\BBAttachBESExtension. Change AllowRemoteServices to 1. In the Microsoft Windows Services, restart the BlackBerry Attachment Service.
Connect the BlackBerry Messaging Agent to a BlackBerry Attachment Service
Complete the following task if you have not installed the BlackBerry Attachment Service on the same computer as the BlackBerry Enterprise Server. 1. On the computer that hosts the BlackBerry Enterprise Server, on the taskbar, click Start > Programs > BlackBerry Enterprise Server > BlackBerry Server Configuration. 2. On the Attachment Server tab, in the Configuration Option drop-down list, click Connector Configuration. 3. In the Server field, type the name or IP address of the computer that hosts the BlackBerry Attachment Service. 4. In the Server Submit Port field, type the TCP/IP port number (between 1024 and 65,535) that the attachment connector uses to send the requests for attachment data to the BlackBerry Attachment Service. 5. In the Server Result Port field, type the TCP/IP port number (between 1024 and 65,535) that the BlackBerry Enterprise Server uses to query and retrieve the converted data from the BlackBerry Attachment Service. 6. In the Polling Time(s) (seconds) field, type the interval (between 10 and 300 seconds) that the BlackBerry Enterprise Server uses between querying the BlackBerry Attachment Service for when the conversion of large attachments is complete and the attachment is available for delivery. 7. Click OK. 8. In the Microsoft Windows Services, restart the BlackBerry Dispatcher.

Connect a remote BlackBerry Attachment Service to the BlackBerry Messaging Agent
Complete the following task if you have not installed the BlackBerry Attachment Service on the same computer as the BlackBerry Enterprise Server. Before you begin: Open the BlackBerry Configuration Panel on the BlackBerry Enterprise Server and record the port information for the Server Submit Port and the Server Result Port that the BlackBerry Enterprise Server uses.
Verify that the BlackBerry Collaboration Service can connect to Microsoft Office Communications Server 2007 or Microsoft Office Live Communications Server 2005

1. 2. 3. 4. 5. 6. 7.

On the computer that hosts the BlackBerry Attachment Service, on the taskbar, click Start > Programs > BlackBerry Enterprise Server > BlackBerry Server Configuration. On the Attachment Server tab, in the Configuration Option drop-down list, click Attachment Server. In the Submit Port field, type the same port number that you typed in the Server Submit Port field on the BlackBerry Enterprise Server. In the Result Port field, type the same port number that you typed in the Server Result Port field on the BlackBerry Enterprise Server. In the Configuration Port field, type the TCP/IP port number (between 1024 and 65,535) that the administrative console should use. Click OK. In the Microsoft Windows Services, restart the BlackBerry Attachment Service.
After you install the BlackBerry Enterprise Server with the BlackBerry Collaboration Service, you can verify that the BlackBerry Collaboration Service can connect to your organization's instant messaging server. 1. Browse to the Microsoft Office Communicator Web Access web client using a web address in the following format: <protocol>://<cwahostcomputername>.< domainname>:<portnumber>. (For example, https://server01.test.rim.com:444) Use the same host name, transport protocol, and port number that you specified for the instant messaging server when you installed the BlackBerry Collaboration Service. The port number might be optional if your organization's instant messaging server uses port 80 or port 443. 2. Log in to the Microsoft Office Communicator Web Access web client. If you log in to the Microsoft Office Communicator Web Access web client successfully, the BlackBerry Collaboration Service can connect to your organization's instant messaging server.
Authenticating the BlackBerry MDS Integration Service to the BlackBerry Manager and web services
After you install the BlackBerry MDS Integration Service, you must install a digital certificate for the BlackBerry MDS Integration Service in the key store on the same computer. This certificate allows server-authenticated communication between the BlackBerry MDS Integration Service and the BlackBerry Manager.
You can install a self-signed certificate for the BlackBerry MDS Integration Service, or you can get a signed root certificate from a certificate authority and install it in the key store using the Java keytool. You can replace the self-signed certificate with a signed root certificate at any time, but you should install the certificate that you want to use immediately after you install the BlackBerry MDS Integration Service and before you allow authentication with the BlackBerry Manager or web services using that certificate. You can also export the certificate for the BlackBerry MDS Integration Service to allow client authentication with external web services. For more information about using the Java keytool, visit java.sun.com/javase/6/docs/technotes/tools/windows/keytool.html.

Allow the BlackBerry MDS Integration Service to communicate with the BlackBerry Manager
When the BlackBerry Manager connects to the BlackBerry MDS Integration Service for the first time after installation, the BlackBerry Manager prompts you to view and install the BlackBerry MDS Integration Service self-signed certificate. This certificate allows server-authenticated communication between the BlackBerry MDS Integration Service and the BlackBerry Manager. Before you begin: Perform this task immediately after you install the BlackBerry MDS Integration Service. 1. 2. 3. 4. 5. 6. In the BlackBerry Manager, in the left pane, click a BlackBerry MDS Integration Service. In the certificate installation dialog box, click View Certificate. Review the certificate information. Click Install Certificate. Complete the instructions on the screen. Accept the default settings. When prompted, click Cancel.
Allow client authentication between the BlackBerry MDS Integration Service and web services
The self-signed certificate for the BlackBerry MDS Integration Service allows client authentication between the BlackBerry MDS Integration Service and web services hosts. If the BlackBerry MDS Runtime Applications in your organization's environment use HTTPS to communicate with web servers to receive application data and application updates, you must export the certificate for the BlackBerry MDS Integration Service to the web services hosts. This allows BlackBerry MDS Runtime Applications that use web services to authenticate to the web services and access them. Before you begin: Contact your organization's application developers for information about the web services that the BlackBerry MDS Runtime Applications in your environment use. If you replaced the self-signed certificate for the BlackBerry MDS Integration Service with a signed root certificate from a certificate authority, the web services must trust the root certificate authority to authenticate to the BlackBerry MDS Integration Service.
Configuring a Hosted BlackBerry services environment

1. 2. 3.

Using Microsoft Internet Explorer, export the self-signed certificate for the BlackBerry MDS Integration Service from the trusted root certificate authorities area of the computer's key store. Send the self-signed certificate to the web services servers that the BlackBerry MDS Runtime Applications use. Verify that the certificate is installed in the trusted key store of the web services servers.

BBAttachServer and any keys starting with BES or BlackBerry BBAttachServer and any keys starting with BES or BlackBerry BBAttachServer and any keys starting with BES or BlackBerry Research In Motion any keys named BlackBerryServer, BlackBerry Manager, or listed as the name of your BlackBerry Enterprise Server Research In Motion
Removing the BlackBerry database notification system
Location HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft \Windows\CurrentVersion\App Paths HKEY_CLASSES_ROOT\Installer\Products
KEY BESManmmc.dll any key in which the ProductName is BlackBerry Enterprise Server
You must remove the BlackBerry database notification system manually if you installed it manually. You can remove the BlackBerry database notification system from one BlackBerry Configuration Database instance or all BlackBerry Configuration Database instances.
Remove the BlackBerry database notification system from a BlackBerry Configuration Database
1. 2. 3. 4. 5. 6. Open the Microsoft SQL Server Management Studio. Using the console, navigate to Database\DBInstallScripts\SQLServer\5.0 in the BlackBerry Enterprise Server installation files. Open the NotifyUnInstall.sql file. Delete all commands after --- delete notification stored procedures and -- delete notification tables. Run the script. Perform one of the following actions: Restart Microsoft SQL Server. In Windows Explorer, navigate to C:\Program Files\Microsoft SQL Server\MSSQL\Binn. Rename the RimEsp.dll file (for example, RimEspXXX.tmp).
Remove the BlackBerry database notification system from all BlackBerry Configuration Database instances
1. 2. 3. 4. 5. Open the Microsoft SQL Server Management Studio. Using the console, navigate to Database\DBInstallScripts\SQLServer\5.0 in the BlackBerry Enterprise Server installation files. Open the NotifyUnInstall.sql file. Run the script. Using Windows Explorer, navigate to <drive>:\Program Files\Microsoft SQL Server\MSSQL\Binn.
Delete the RimEsp.dll file.
Troubleshooting the BlackBerry Enterprise Server installation process
A third-party tool did not install and the BlackBerry Enterprise Server setup application closed

Possible solution

1. 2. 3. 4. On the BlackBerry Enterprise Server installation media, open the Tools folder. Double-click the setup application file for the tool that you want to install. Complete the instructions on the screen. Restart the BlackBerry Enterprise Server setup application.
Failed to write License Key to the Database
This error message appears when you try to add the BlackBerry Client Access License key during the installation process.
After you restart the computer during the BlackBerry Enterprise Server installation process, you must log in using the same Windows account that you used to start the installation process. 1. 2. 3. 4. Close the setup application. Log out of the computer. Log in to the computer. Restart the setup application.

Previous version detected but no database available
This message appears when you start the setup application and the setup application stops responding.
The registry keys that identify your BlackBerry Configuration Database must exist in the Microsoft Windows Registry. 1. 2. 3. On the computer on which you plan to upgrade the BlackBerry Enterprise Server, open the Registry Editor. In the left pane, navigate to HKEY_LOCAL_MACHINE\Research In Motion\BlackBerry Enterprise Server\Database. Create the following case-sensitive string values (if they do not exist):
The BlackBerry Collaboration Service does not connect to Microsoft Office Live Communications Server 2005
DatabaseName: Type the name of the BlackBerry Configuration Database. DatabaseServerMachineName: Type the computer name of the database server. Restart the setup application.
If the instant messaging in your organization's environment supports Windows Messenger with TLS, you must configure authentication. 1. 2. 3. 4. Download the trial edition of Microsoft Office Communicator 2005 from www.microsoft.com/downloads. Install Microsoft Office Communicator 2005 on the computer that hosts the BlackBerry Collaboration Service. Connect to Microsoft Office Live Communications Server 2005 using Microsoft Office Communicator 2005. If a connection does not open, verify that you installed or imported the certificates that are required for authentication.
The setup application did not prompt you to change or confirm the MAPI profile
Create and change the MAPI profile manually. 1. 2. 3. 4. 5. 6. 7. On the BlackBerry Enterprise Server installation media, open the Tools folder. Double-click the Fixmapisvc.exe file. Verify that mapisvc.inf is installed in C:\winnt\system32\ or C:\windows\system32\. On the taskbar, click Start > BlackBerry Enterprise Server > Edit MAPI Profile. Type the Microsoft Exchange server name. Click the Windows account that is associated with the MAPI profile. Click OK.
The setup application prompts you for access to the installation media for Microsoft.NET Framework version 1.1
When the BlackBerry Enterprise Server setup application installs Microsoft.NET Framework version 1.1 SP1 on a computer that hosts a previously installed version of Microsoft.NET Framework version 1.1, it prompts you for access to the installation media for Microsoft.NET Framework version 1.1.
You can access the netfx.msi file that is included with the BlackBerry Enterprise Server installation media. 1. 2. 3. On the BlackBerry Enterprise Server installation media, open the Tools folder. Double-click the netfx.msi file. Complete the instructions on the screen.

without limitation the content, accuracy, copyright compliance, compatibility, performance, trustworthiness, legality, decency, links, or any other aspect of Third Party Products and Services. The inclusion of a reference to Third Party Products and Services in this documentation does not imply endorsement by RIM of the Third Party Products and Services or the third party in any way. EXCEPT TO THE EXTENT SPECIFICALLY PROHIBITED BY APPLICABLE LAW IN YOUR JURISDICTION, ALL CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS, OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, ANY CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS OR WARRANTIES OF DURABILITY, FITNESS FOR A PARTICULAR PURPOSE OR USE, MERCHANTABILITY, MERCHANTABLE QUALITY, NONINFRINGEMENT, SATISFACTORY QUALITY, OR TITLE, OR ARISING FROM A STATUTE OR CUSTOM OR A COURSE OF DEALING OR USAGE OF TRADE, OR RELATED TO THE DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NON-PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN, ARE HEREBY EXCLUDED. YOU MAY ALSO HAVE OTHER RIGHTS THAT VARY BY STATE OR PROVINCE. SOME JURISDICTIONS MAY NOT ALLOW THE EXCLUSION OR LIMITATION OF IMPLIED WARRANTIES AND CONDITIONS. TO THE EXTENT PERMITTED BY LAW, ANY IMPLIED WARRANTIES OR CONDITIONS RELATING TO THE DOCUMENTATION TO THE EXTENT THEY CANNOT BE EXCLUDED AS SET OUT ABOVE, BUT CAN BE LIMITED, ARE HEREBY LIMITED TO NINETY (90) DAYS FROM THE DATE YOU FIRST ACQUIRED THE DOCUMENTATION OR THE ITEM THAT IS THE SUBJECT OF THE CLAIM. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, IN NO EVENT SHALL RIM BE LIABLE FOR ANY TYPE OF DAMAGES RELATED TO THIS DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NONPERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN INCLUDING WITHOUT LIMITATION ANY OF THE FOLLOWING DAMAGES: DIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, INDIRECT, SPECIAL, PUNITIVE, OR AGGRAVATED DAMAGES, DAMAGES FOR LOSS OF PROFITS OR REVENUES, FAILURE TO REALIZE ANY EXPECTED SAVINGS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, LOSS OF BUSINESS OPPORTUNITY, OR CORRUPTION OR LOSS OF DATA, FAILURES TO TRANSMIT OR RECEIVE ANY DATA, PROBLEMS ASSOCIATED WITH ANY APPLICATIONS USED IN CONJUNCTION WITH RIM PRODUCTS OR SERVICES, DOWNTIME COSTS, LOSS OF THE USE OF RIM PRODUCTS OR SERVICES OR ANY PORTION THEREOF OR OF ANY AIRTIME SERVICES, COST OF SUBSTITUTE GOODS, COSTS OF COVER, FACILITIES OR SERVICES, COST OF CAPITAL, OR OTHER SIMILAR PECUNIARY LOSSES, WHETHER OR NOT SUCH DAMAGES WERE FORESEEN OR UNFORESEEN, AND EVEN IF RIM HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, RIM SHALL HAVE NO OTHER OBLIGATION, DUTY, OR LIABILITY WHATSOEVER IN CONTRACT, TORT, OR OTHERWISE TO YOU INCLUDING ANY LIABILITY FOR NEGLIGENCE OR STRICT LIABILITY. THE LIMITATIONS, EXCLUSIONS, AND DISCLAIMERS HEREIN SHALL APPLY: (A) IRRESPECTIVE OF THE NATURE OF THE CAUSE OF ACTION, DEMAND, OR ACTION BY YOU INCLUDING BUT NOT LIMITED TO BREACH OF CONTRACT, NEGLIGENCE, TORT, STRICT LIABILITY OR ANY OTHER LEGAL THEORY AND SHALL SURVIVE A FUNDAMENTAL BREACH OR BREACHES OR THE FAILURE OF THE ESSENTIAL PURPOSE OF THIS AGREEMENT OR OF ANY REMEDY CONTAINED HEREIN; AND (B) TO RIM AND ITS AFFILIATED COMPANIES, THEIR SUCCESSORS, ASSIGNS, AGENTS, SUPPLIERS (INCLUDING AIRTIME SERVICE PROVIDERS), AUTHORIZED RIM DISTRIBUTORS (ALSO INCLUDING AIRTIME SERVICE PROVIDERS) AND THEIR RESPECTIVE DIRECTORS, EMPLOYEES, AND INDEPENDENT CONTRACTORS. IN ADDITION TO THE LIMITATIONS AND EXCLUSIONS SET OUT ABOVE, IN NO EVENT SHALL ANY DIRECTOR, EMPLOYEE, AGENT, DISTRIBUTOR, SUPPLIER, INDEPENDENT CONTRACTOR OF RIM OR ANY AFFILIATES OF RIM HAVE ANY LIABILITY ARISING FROM OR RELATED TO THE DOCUMENTATION.

Prior to subscribing for, installing, or using any Third Party Products and Services, it is your responsibility to ensure that your airtime service provider has agreed to support all of their features. Some airtime service providers might not offer Internet browsing functionality with a subscription to the BlackBerry Internet Service. Check with your service provider for availability, roaming arrangements, service plans and features. Installation or use of Third Party Products and Services with RIM's products and services may require one or more patent, trademark, copyright, or other licenses in order to avoid infringement or violation of third party rights. You are solely responsible for determining whether to use Third Party Products and Services and if any third party licenses are required to do so. If required you are responsible for acquiring them. You should not install or use Third Party Products and Services until all necessary licenses have been acquired. Any Third Party Products and Services that are provided with RIM's products and services are provided as a convenience to you and are provided "AS IS" with no express or implied conditions, endorsements, guarantees, representations, or warranties of any kind by RIM and RIM assumes no liability whatsoever, in relation thereto. Your use of Third Party Products and Services shall be governed by and subject to you agreeing to the terms of separate licenses and other agreements applicable thereto with third parties, except to the extent expressly covered by a license or other agreement with RIM. Certain features outlined in this documentation require a minimum version of BlackBerry Enterprise Server, BlackBerry Desktop Software, and/or BlackBerry Device Software. The terms of use of any RIM product or service are set out in a separate license or other agreement with RIM applicable thereto. NOTHING IN THIS DOCUMENTATION IS INTENDED TO SUPERSEDE ANY EXPRESS WRITTEN AGREEMENTS OR WARRANTIES PROVIDED BY RIM FOR PORTIONS OF ANY RIM PRODUCT OR SERVICE OTHER THAN THIS DOCUMENTATION. Certain features outlined in this documentation might require additional development or Third Party Products and Services for access to corporate applications. This product contains a modified version of HTML Tidy. Copyright 1998-2003 World Wide Web Consortium (Massachusetts Institute of Technology, European Research Consortium for Informatics and Mathematics, Keio University). All Rights Reserved. This product includes software developed by the Apache Software Foundation (www.apache.org/) and/or is licensed pursuant to one of the licenses listed at (www.apache.org/licenses/). For more information, see the NOTICE.txt file included with the software. Research In Motion Limited 295 Phillip Street Waterloo, ON N2L 3W8 Canada Research In Motion UK Limited Centrum House 36 Station Road Egham, Surrey TW20 9LF United Kingdom Published in Canada

Placing the BlackBerry Enterprise Server for Microsoft Exchange in a demilitarized zone
Originally posted: June 2002
Affected software versions
BlackBerry Enterprise Server version 2.0 for Microsoft Exchange BlackBerry Enterprise Server version 2.1 for Microsoft Exchange BlackBerry Enterprise Server version 3.5 for Microsoft Exchange

Summary

Some organizations support the placement of Internet-facing servers in demilitarized zones. However, Research In Motion (RIM) recommends against placing a BlackBerry Enterprise Server in a demilitarized zone, and does not support this configuration. This document explains how placing a BlackBerry Enterprise Server in a demilitarized zone can reduce the security level of the zone and can impact BlackBerry Enterprise Server features.
Connecting to the SRP host
Note: The Server Relay Protocol (SRP host) is srp.xx.blackberry.net, where xx is a variable that represents na for a BlackBerry Enterprise Server in North America and eu for a BlackBerry Enterprise Server in Europe. When you start the BlackBerry Enterprise Server service, it makes a persistent Transmission Control Protocol (TCP) connection to the SRP host using one of two methods.
Placing the BlackBerry Enterprise Server behind the firewall
A secure connection requires authentication from both sides of the connection: the BlackBerry Enterprise Server service and the SRP host. The method in which the BlackBerry Enterprise Server is placed behind the firewall is illustrated below (figure 1).
Internet Firewall BlackBerry Enterprise Server Wireless Network
Figure 1: BlackBerry Enterprise Server behind a firewall In this method, the firewall must be configured so that the BlackBerry Enterprise Server can initiate a TCP connection through the firewall to the SRP host. The connection type is outbound-initiated only; no host can initiate an inbound connection to your BlackBerry Enterprise Server. Note: When you configure the firewall to enable the connection to the SRP host, RIM recommends that you do not limit the connection to a specific IP address because RIM might add to the SRP host additional IP addresses that provide additional redundancy or fail-over protection.
2002 Research In Motion Limited

www.blackberry.net

Page 1 of 5
Placing the BlackBerry Enterprise Server in a demilitarized zone
The second connection method involves installing the BlackBerry Enterprise Server in a demilitarized zone. This method is illustrated below (figure 2).
Figure 2: BlackBerry Enterprise Server in a demilitarized zone Because the BlackBerry Enterprise Server requires a MAPI connection to each Microsoft Exchange Server that hosts mailboxes for BlackBerry users, this method requires extensive configuration changes. You must reconfigure the firewall and each Microsoft Exchange Server. Because the BlackBerry Enterprise Server connects to each mailbox server using MAPI, the configuration is identical to the configuration that enables Microsoft Outlook users to connect to their Microsoft Exchange Servers through the firewall. You must complete the following changes: Microsoft Exchange Server Configure the Microsoft Exchange Server so that it uses static ports. Firewall Open static ports to enable the BlackBerry Enterprise Server to connect through the firewall to each Microsoft Exchange Server on the static ports. Open the network authentication ports (such as Kerberos) to enable the BlackBerry Enterprise Server to authenticate to a domain controller. If you use the first connection method, you have to open only one TCP connection. If you use the second connection method, you must open multiple ports, both TCP and User Datagram Protocol (UDP). If you use the second connection method, the proximity of the BlackBerry Enterprise Server to the mail servers to which it is connecting might affect the stability of the BlackBerry Enterprise Server. MAPI is not a TCP application and performs better with a direct connection to the destination host. Note: The versions of the BlackBerry Enterprise Server that are discussed in this document do not require a connection to a Global Catalog Server for remote address lookups.

Page 2 of 5

Placing the BlackBerry Enterprise Server for Microsoft Exchange in a demilitarized zone Mobile Data Service
If you place the BlackBerry Enterprise Server inside the firewall, features that are available in BlackBerry Enterprise Server version 3.5 for Microsoft Exchange, such as Mobile Data Service (MDS), are supported. MDS creates a conduit between the BlackBerry handheld and your intranet and other corporate data. If the BlackBerry Enterprise Server on which Mobile Data Service is installed is located outside your firewall, you cannot access intranet data unless you open the firewall further to enable access to internal data sources such as the corporate intranet or customer relationship management (CRM) application databases.

Mail Server Firewall Data BlackBerry Enterprise Server/ Mobile Data Service

Internet

Figure 3: Mobile Data Service enables connectivity to intranet data
Alternatives to placing the BlackBerry Enterprise Server in a demilitarized zone
If strict corporate policy prohibits direct communication between internal servers and Internet hosts, two alternative methods are available. RIM supports both alternative configurations.

Using a proxy server

This connection method uses a proxy server that is located in the demilitarized zone. In this configuration, the BlackBerry Enterprise Server connects to your proxy server only. The proxy server then communicates with the wireless network over the Internet as illustrated below (figure 4).
Mail Server Firewall Data BlackBerry Enterprise Server / Mobile Data Service Proxy Server
Figure 4: BlackBerry Enterprise Server connects directly to the proxy server Using a proxy server has the following security characteristics: The proxy server can be configured to enable only the BlackBerry Enterprise Server to make port 3101 requests. The firewall can be configured to enable only the BlackBerry Enterprise Server to connect through port 3101, which prevents all internal servers from communicating to the Internet through port 3101.

Page 3 of 5

Note: The proxy server that is selected must support a transparent proxy. The BlackBerry Enterprise Server does not know how to use a proxy; it requires the appearance of a direct connection to the SRP host. Several proxy servers enable this configuration (for example, Microsoft ISA server and Microsoft Proxy Sever). Each server requires the installation of an agent on the client (the BlackBerry Enterprise Server) that gives the appearance of a direct connection.
Using port forwarding (IP port translation)
This connection method uses port forwarding at the firewall. In this configuration, the BlackBerry Enterprise Server is configured to connect to <firewall.yourdomain>.com instead of the SRP host. The firewall must be configured to forward port 3101 requests to the SRP host.

Mail Server Data

Port 3189 Firewall BlackBerry Enterprise Server / Mobile Data Server

Port 3101

Figure 5: BlackBerry Enterprise Server connected to the firewall
Firewall and proxy configuration
Because many firewalls and proxy solutions exist, RIM does not support any specific firewall or proxy solution. Configuration of proxy servers and firewalls are the responsibility of each individual organization. This document only provides the information that is required to implement a solution. For assistance with the configuration your firewall or proxy, contact your solution vendor.

Conclusion

When you install the BlackBerry Enterprise Server for Microsoft Exchange, RIM recommends that you place the server inside your corporate firewall, as close as possible to the mail server that it services (for example, on the same switch). Placing the BlackBerry Enterprise Server outside the firewall reduces the overall security of your demilitarized zone. If strict corporate policy prohibits direct communication between internal servers and Internet hosts, two alternative methods are available: using a proxy server or Port Address Translation (PAT). RIM supports both alternative configurations.

Page 4 of 5

Placing the BlackBerry Enterprise Server for Microsoft Exchange in a demilitarized zone Appendix A: Relevant Microsoft Q articles
XADM: No Way to Configure Port for UDP New Mail Notification Packets (Q264035)
You can configure a Microsoft Exchange Server computer so that is uses specific TCP ports for the information store, directory, and System Attendant. This configuration enables access to the Microsoft Exchange Server through a firewall, router, or other device that blocks certain TCP or UDP ports. You cannot configure the ports that are used when the Microsoft Exchange Server sends a client a new mail notification packet. In a situation in which UDP traffic from the Microsoft Exchange Server to the client is blocked, clients might not receive new mail notification.
XADM: Setting TCP/IP Ports for Exchange and Outlook Client Connections Through a Firewall (Q155831)
This article explains how to enable the Microsoft Exchange Client so that it connects to the Microsoft Exchange Server over an existing connection to the Internet and through a firewall. To enable this connection, you must verify that the ports that are assigned to these connections are static. This requires that you add entries to the registry.
XCLN: Exchange 2000 Static Port Mappings (Q270836)
This article explains how to enable Microsoft Exchange down-level MAPI clients computers (either Microsoft Exchange client computers or client computers that are using Microsoft Outlook in Corporate or Workgroup mode on the Microsoft Exchange 2000 Server) so that they connect to the Microsoft Exchange 2000 Server over an existing connection to the Internet through a firewall.
XCLN: How MAPI Clients Access Active Directory (Q256976)
In Microsoft Exchange Server 4.0, 5.0, and 5.5, the directory service is on the server to which MAPI clients log in and look up addresses in the Global Address List. In Microsoft Exchange 2000, the directory service integrates with the Microsoft Windows 2000 operating system (Active Directory). As a result, the directory service might or might not be located on the Microsoft Exchange 2000 Server. In this environment, a MAPI client accesses the directory and logs in mailboxes differently than previous versions of the Microsoft Exchange Server. This article explains how each version of Microsoft Outlook and Microsoft Exchange Client accesses the Active Directory.
Part number: TAE-00038-001
2002 Research In Motion Limited. All rights reserved. The BlackBerry and RIM families of related marks, images and symbols are the exclusive properties of Research In Motion Limited. RIM, Research In Motion, 'Always On, Always Connected', the envelope in motion symbol and the BlackBerry logo are registered with the U.S. Patent and Trademark Office and may be pending or registered in other countries. All other brands, product names, company names, trademarks and service marks are the properties of their respective owners. The handheld and/or associated software are protected by copyright, international treaties and various patents, including one or more of the following U.S. patents: 6,278,442; 6,271,605; 6,219,694; 6,075,470; 6,073,318; D,445,428; D,433,460; D,416,256. Other patents are registered or pending in various countries around the world. Please visit www.rim.net/patents.shtml for a current listing of applicable patents.

RESEARCH IN MOTION LIMITED (RIM) ON BEHALF OF ITSELF AND ITS AFFILIATES MAKES NO REPRESENTATIONS ABOUT THE SUITABILITY OF THE INFORMATION OR GRAPHICS CONTAINED IN THIS ADVISORY FOR ANY PURPOSE. THE CONTENT CONTAINED IN THIS DOCUMENT, INCLUDING RELATED GRAPHICS, ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. RIM HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS WITH REGARD TO THIS INFORMATION, INCLUDING ALL IMPLIED WARRANTIES AND CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT SHALL RIM BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF INFORMATION CONTAINED HEREIN. THIS DOCUMENT, INCLUDING ANY GRAPHICS CONTINED WITHIN THE DOCUMENT, MAY CONTAIN TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. UPDATES ARE PERIODICALLY MADE TO THE INFORMATION HEREIN AND RIM MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S) AND/OR THE PROGRAM(S) DESCRIBED HEREIN AT ANY TIME.

Page 5 of 5