Installation Guide

BlackBerry Enterprise Server for Microsoft Exchange Version 4.1 Service Pack 5

SWD-280223-0212011833-001

Contents
1 Planning a BlackBerry Enterprise Server installation ................................................................................................ Installing all BlackBerry Enterprise Server components on one computer........................................................................ Installing the BlackBerry Attachment Service ....................................................................................................................... Installing the BlackBerry Collaboration Service .................................................................................................................... Installing the BlackBerry Manager .......................................................................................................................................... Installing the BlackBerry MDS Connection Service .............................................................................................................. Installing the BlackBerry MDS Integration Service .............................................................................................................. Installing the BlackBerry Router .............................................................................................................................................. Installing the Hosted BlackBerry Enterprise Server .............................................................................................................. 5 5 5 5 6 6 6 7 7 9 9 11 12 13 14 14 15 17

2 System requirements.......................................................................................................................................................... System requirements: BlackBerry Enterprise Server ............................................................................................................ System requirements: BlackBerry Attachment Service ........................................................................................................ System requirements: BlackBerry Manager ........................................................................................................................... System requirements: BlackBerry MDS Connection Service ............................................................................................... System requirements: BlackBerry MDS Integration Service ............................................................................................... System requirements: BlackBerry Router ............................................................................................................................... Supported environments............................................................................................................................................................ Unsupported environments....................................................................................................................................................... 3 Configuring a Microsoft Exchange 5.5, Microsoft Exchange 2000, or Microsoft Exchange 2003 messaging environment......................................................................................................................................................................... Create a Microsoft Windows account and mailbox ............................................................................................................... Configure permissions for the Microsoft Windows account................................................................................................. Configuring Microsoft Exchange permissions for the Microsoft Windows account......................................................... Configure Microsoft Exchange Version 5.5 permissions for the Microsoft Windows account.................................... Configure Microsoft Exchange 2000 or 2003 permissions for the Microsoft Windows account............................... Identify and resolve any Microsoft Exchange known issues for wireless calendar synchronization............................. 4 Configuring a Microsoft Exchange 2007 messaging environment.......................................................................... Create a Microsoft Exchange 2007 account and mailbox ................................................................................................... Configure Microsoft Windows permissions for the Microsoft Exchange 2007 account................................................... Configure Microsoft Exchange 2007 permissions for the Microsoft Exchange account ................................................ Enable BlackBerry device users to send messages in a Microsoft Exchange 2007 environment...................................

19 19 19 20 20 20 20 23 23 23 23 24

5 Setting up the database connection............................................................................................................................... Specifying permissions when connecting to the BlackBerry Configuration Database using Microsoft Windows authentication.............................................................................................................................................................................. Specifying MSDE 2000 permissions for the Microsoft Windows account..................................................................... Assign Microsoft SQL Server permissions to the Microsoft Windows account.............................................................. Configuring authentication to the BlackBerry MDS Integration Service database.......................................................... 6 Installing the BlackBerry Enterprise Server software................................................................................................. Applications installed with the BlackBerry Enterprise Server components....................................................................... Prerequisites: Installing the BlackBerry Enterprise Server .................................................................................................. Install the BlackBerry Enterprise Server software.................................................................................................................. Test the BlackBerry Enterprise Server installation................................................................................................................. Install the BlackBerry database notification system ............................................................................................................. 7 Post-installation tasks....................................................................................................................................................... Configure support for Unicode text in calendars on BlackBerry devices in a Microsoft Exchange 2003 environment ........................................................................................................................................................................................................ Connecting to a BlackBerry Attachment Service .................................................................................................................. Connect the BlackBerry MDS Connection Service to a BlackBerry Attachment Service ............................................ Connect the BlackBerry Messaging Agent to a BlackBerry Attachment Service ......................................................... Connect a remote BlackBerry Attachment Service to the BlackBerry Messaging Agent ........................................... Authenticating the BlackBerry MDS Integration Service to the BlackBerry Manager and web services...................... Allow the BlackBerry MDS Integration Service to communicate with the BlackBerry Manager ............................... Allow client authentication between the BlackBerry MDS Integration Service and web services............................. Configuring how users search for email addresses in a Hosted BlackBerry Enterprise Server environment............... Configure how users search for email addresses in a Hosted BlackBerry Enterprise Server environment.............. Configure the Hosted BlackBerry Enterprise Server to search for email addresses using LDAP............................... Configure the Hosted BlackBerry Enterprise Server to search for email addresses using a custom LDAP field .................................................................................................................................................................................................... Add or remove a BlackBerry Enterprise Server component.................................................................................................. 8 Creating and managing administrators......................................................................................................................... Administrative roles.................................................................................................................................................................... Creating a BlackBerry Enterprise Server administrator in a Microsoft SQL Server environment................................... Assign an administrative role to a new or existing Microsoft SQL Server database account..................................... Configure the BlackBerry Manager to use database authentication in a Microsoft SQL Server environment............

25 25 25 25 26 27 27 27 28 28 29 31 31 31 31 32 32 33 33 34 34 35 35 35 36 37 37 38 39 39

Assign a BlackBerry Enterprise Server administrator to a different administrative role................................................. Delete an administrator from a BlackBerry Enterprise Server ............................................................................................ 9 Removing the BlackBerry Enterprise Server software................................................................................................ Remove the BlackBerry Enterprise Server software............................................................................................................... Delete registry entries from your computer............................................................................................................................ Removing the BlackBerry database notification system....................................................................................................... Remove the BlackBerry database notification system from one BlackBerry Configuration Database .................... Remove the BlackBerry database notification system from all BlackBerry Configuration Database instances...... 10 Troubleshooting the BlackBerry Enterprise Server installation process................................................................. A third-party tool did not install successfully and the BlackBerry Enterprise Server setup application closed ......... Failed to write License Key to the Database........................................................................................................................... Previous version detected but no database available............................................................................................................ The BlackBerry Collaboration Service does not connect to Microsoft Office Live Communications Server 2005 ........................................................................................................................................................................................................ The setup application did not prompt you to change or confirm the MAPI profile.......................................................... The setup application prompts you for access to the installation media for Microsoft .NET Framework Version 1.1 ........................................................................................................................................................................................................ 11 Glossary................................................................................................................................................................................ 12 Legal notice..........................................................................................................................................................................

40 40 41 41 41 42 42 42 43 43 43 43 44 44 44 47 49

Installation Guide

Planning a BlackBerry Enterprise Server installation

Installation Guide

Planning a BlackBerry Enterprise Server installation

Planning a BlackBerry Enterprise Server installation

You can install all BlackBerry Enterprise Server components on one computer, or you can install specific components on separate computers. Consider any impacts on system resources before you decide where to install a component. Consider installing all components on one computer if you do not plan to activate many BlackBerry devices, if you have determined that the computer can handle the traffic volume for the BlackBerry Enterprise Server components, or if you do not mind that the computer has direct access to the wireless network. For performance information, see BlackBerry Enterprise Server Performance Benchmarking.

Installing all BlackBerry Enterprise Server components on one computer

If you want to set up an evaluation or complete a simple installation of the BlackBerry Enterprise Server for a small number of users, you can install all the BlackBerry Enterprise Server components on the same computer. During the installation process, you can choose to install all BlackBerry Enterprise Server components, including the BlackBerry MDS Integration Service, on the same computer. The BlackBerry MDS Integration Service is only required if you want to use enterprise applications on BlackBerry devices.

Installing the BlackBerry Attachment Service

The BlackBerry Attachment Service converts supported attachments into a format that users can view on their BlackBerry devices. The BlackBerry Attachment Service might use increased system resources when it processes numerous conversion requests at the same time. If you want to increase the number of conversion requests that can occur concurrently without impacting message delivery, you can install the BlackBerry Attachment Service on a separate computer. You can connect multiple instances of the BlackBerry Enterprise Server to a single BlackBerry Attachment Service. If you install the BlackBerry Attachment Service on a separate computer, you install the BlackBerry Attachment Service and the BlackBerry Controller. The BlackBerry Controller monitors the BlackBerry Attachment Service and restarts it if it stops responding.

Installing the BlackBerry Collaboration Service

The BlackBerry Collaboration Service provides an encrypted connection between your organization's instant messaging server and the enterprise instant messaging application on the BlackBerry device. If you want to help maximize the number of available sockets so that the BlackBerry Collaboration Service can respond to more requests, you can install the BlackBerry Collaboration Service by itself on a separate computer.

Installation Guide

Installing the BlackBerry Manager

If you install the BlackBerry Collaboration Service on a separate computer, you install the BlackBerry Collaboration Service and the BlackBerry Controller. The BlackBerry Controller monitors the BlackBerry Collaboration Service and restarts it if it stops responding. You can connect multiple instances of the BlackBerry Enterprise Server to a single BlackBerry Collaboration Service. A different BlackBerry Collaboration Service exists for each instant messaging environment. For example, a BlackBerry Collaboration Service exists for Windows Messenger, and a different BlackBerry Collaboration Service exists for IBM Lotus Sametime. You can install only one BlackBerry Collaboration Service in your environment. Users can use only one type of enterprise instant messaging application on their BlackBerry devices.

Installing the BlackBerry Manager

The BlackBerry Manager allows administrators to manage a BlackBerry Domain. A BlackBerry Domain consists of single BlackBerry Configuration Database and all BlackBerry Enterprise Server instances that use it. You can install the BlackBerry Manager with other BlackBerry Enterprise Server components or by itself on administrator computers. Install the BlackBerry Manager on administrator computers if you have many administrators or if administrators cannot access the BlackBerry Enterprise Server computers.

Installing the BlackBerry MDS Connection Service

The BlackBerry MDS Connection Service provides users with access to online content and applications on the corporate intranet or the Internet. The BlackBerry MDS Connection Service might use increased system resources when it processes content requests. If you want to minimize the impact on message delivery, you can install the BlackBerry MDS Connection Service by itself on a separate computer. You can connect multiple instances of the BlackBerry Enterprise Server to a single BlackBerry MDS Connection Service. If you install the BlackBerry MDS Connection Service on a separate computer, you install the BlackBerry MDS Connection Service and the BlackBerry Controller. The BlackBerry Controller monitors the BlackBerry MDS Connection Service and restarts it if it stops responding.

Installing the BlackBerry MDS Integration Service

The BlackBerry MDS Integration Service provide connectivity between the BlackBerry MDS Runtime Application on BlackBerry devices and enterprise applications. The BlackBerry MDS Integration Service might use increased system resources when it processes content requests. If you want to minimize the impact on message delivery, you can install the BlackBerry MDS Integration Service by itself on a separate computer.

Installation Guide

Installing the BlackBerry Router

You can connect multiple instances of the BlackBerry Enterprise Server to a single BlackBerry MDS Integration Service. If you install the BlackBerry MDS Integration Service on a separate computer, you install the BlackBerry MDS Integration Service and the BlackBerry Controller. The BlackBerry Controller monitors the BlackBerry MDS Integration Service and restarts it if it stops responding. The BlackBerry MDS Integration Service requires the BlackBerry MDS Application Repository, which the setup application installs on your database server during the installation process. Each BlackBerry MDS Integration Service instance supports one BlackBerry MDS Application Repository.

Installing the BlackBerry Router

The BlackBerry Router connects to the wireless network and routes data to and from BlackBerry devices. You can install the BlackBerry Router with other BlackBerry Enterprise Server components or by itself on a separate computer. Install the BlackBerry Router on a separate computer if you want to set it up in the DMZ, or to install several standby instances of the BlackBerry Router as failover components in case your primary BlackBerry Router becomes unavailable. You can connect multiple instances of the BlackBerry Enterprise Server to a single BlackBerry Router. If you install the BlackBerry Router on a separate computer, you install the BlackBerry Router and the BlackBerry Controller. The BlackBerry Controller monitors the BlackBerry Router and restarts it if it stops responding.

Installing the Hosted BlackBerry Enterprise Server

The Hosted BlackBerry Enterprise Server allows you to make the BlackBerry Enterprise Server available to other organizations (for example, small or medium-sized businesses). When you configure the Hosted BlackBerry Enterprise Server in your corporate environment, one or multiple organizations can subscribe to your service. If you want to install the Hosted BlackBerry Enterprise Server, the installation process and requirements are identical to those for the BlackBerry Enterprise Server. The Hosted BlackBerry Enterprise Server includes all of the components of the BlackBerry Enterprise Server, but it uses a different licensing model. Depending on how you configure your hosted environment, you might require additional configurations after the installation.

Installation Guide

System requirements

Installation Guide

System requirements

System requirements

For information about calculating hardware requirements, visit www.blackberry.com/go/serverdocs to see the BlackBerry Enterprise Server Capacity Calculator and BlackBerry Enterprise Server Performance Benchmarking.

System requirements: BlackBerry Enterprise Server

Item operating system Requirement Any of the following operating systems: Microsoft Windows 2000 SP4 (Server edition or Advanced Server edition) Microsoft Windows Server 2003 or later Microsoft Windows Server 2003 (64-bit) Microsoft Windows Small Business Server 2003 (Standard edition or Premium edition) Any of the following messaging servers installed physically close to where you plan to install the BlackBerry Enterprise Server: Microsoft Exchange Version 5.5 Microsoft Exchange 2000 Microsoft Exchange 2003 or later Microsoft Exchange 2007 Microsoft Exchange mixed environment (any combination of Microsoft Exchange Version 5.5, Microsoft Exchange 2000, Microsoft Exchange 2003, and Microsoft Exchange 2007) Microsoft Solution for Hosted Messaging and Collaboration version 3.5 Any of the following messaging server system tools installed on the BlackBerry Enterprise Server computer: Microsoft Exchange Version 5.5 Administrator Microsoft Exchange 2000 System Manager Microsoft Exchange 2003 System Manager Microsoft Exchange Server MAPI client and CDO 1.2.1 to support Microsoft Exchange 2007, either Microsoft Exchange Server MAPI client and CDO 1.2.1 or Microsoft Exchange 2003 SP2 System Tools

messaging server

messaging server system tools

Installation Guide

System requirements: BlackBerry Enterprise Server

Item Microsoft Exchange Organization of the messaging server system tools version of the CDO library Unicode support for calendars

Requirement the same Microsoft Exchange Organization as the messaging server The latest version that is supported by the latest version of Microsoft Exchange in your environment To support Microsoft Exchange 2003, the following Microsoft hotfixes installed: 913643 on your messaging server 923537 on the computer that hosts the BlackBerry Enterprise Server To support Microsoft Exchange 2007, the Internet Service Manager component of Microsoft Internet Information Services Any of the following database management systems: MSDE 2000 Microsoft SQL Server 2000 SP4 Microsoft SQL Server 2005 or later (Professional edition, Enterprise edition, or Express edition) Microsoft SQL Server 2005 (64-bit) To support Microsoft SQL Server, the following conditions on the database server: collation setting set to default case-insensitive BlackBerry Configuration Database collation setting set to default caseinsensitive named pipes and TCP/IP network protocols turned on Any of the following data access components on the computers that host the BlackBerry Enterprise Server or the BlackBerry Configuration Database: MDAC Version 2.8 with Security Patch MS04-003 (Version 2000.85.1025.00) MDAC Version 2.8.2 (Version 2000.86.1830.00), included with Microsoft Windows Server 2003 SP1 A database server with the following conditions: host for the BlackBerry Configuration Database support for mixed-mode authentication To support languages other than English, localized version of Microsoft .NET Framework Version 1.1 SP1 Any of the following instant messaging servers:

Internet Service Manager database management system

collation setting

remote database conditions data access components

database conditions for the BlackBerry MDS Integration Service Microsoft .NET Framework instant messaging server

10

Installation Guide

System requirements: BlackBerry Attachment Service

Item

Requirement IBM Lotus Sametime Version 3.0 Community Server IBM Lotus Sametime Version 3.1 Community Server IBM Lotus Sametime Version 6.5.1 Community Server (Version 6.5.1 or later required to support dormant mode) IBM Lotus Sametime Version 7.0 Community Server IBM Lotus Sametime Version 7.5 Community Server Microsoft Office Live Communications Server 2005 (SP1 is required to support Microsoft Office Communicator and dormant mode) Novell GroupWise Messenger server Version 1.0.2 or later Novell GroupWise Messenger server Version 2.0 or later

web browser

Microsoft Internet Explorer with the following settings: Java or JavaScript turned on language preferences configured to display encoded web pages To support audio attachments, Windows Media Player Version 9 or later A high-speed, switched connection between the BlackBerry Enterprise Server and the messaging servers A firewall or proxy with the following conditions: support for the BlackBerry Enterprise Server to initiate an outgoing, twoway TCP/IP connection to an external server on port 3101 support for the resolution of Internet addresses using DNS transparency of the proxy server for proxy firewalls

media player network proximity firewall

System requirements: BlackBerry Attachment Service

The following system requirements apply when installing the BlackBerry Attachment Service on a computer separate from the BlackBerry Enterprise Server. Item operating system Requirement Any of the following operating systems: Microsoft Windows 2000 SP4 (Server edition or Advanced Server edition) Microsoft Windows Server 2003 SP1

11

Installation Guide

System requirements: BlackBerry Manager

Item media player web browser

Requirement Microsoft Windows XP Professional SP2 To support audio attachments, Windows Media Player Version 9 or later Microsoft Internet Explorer with the following settings: Java or JavaScript turned on language preferences configured to display encoded web pages

System requirements: BlackBerry Manager

The following system requirements apply when installing the BlackBerry Manager on a computer separate from the BlackBerry Enterprise Server. Item operating system Requirement Any of the following operating systems: Microsoft Windows 2000 SP4 (Server edition, Advanced Server edition, or Professional edition) Microsoft Windows Server 2003 SP1 Microsoft Windows XP Professional SP2 Microsoft Windows Small Business Server 2003 (Standard edition or Premium edition) Any of the following messaging server system tools: Microsoft Exchange Version 5.5 Administrator Microsoft Exchange 2000 System Manager Microsoft Exchange 2003 System Manager Microsoft Exchange Server MAPI client and CDO 1.2.1 for Microsoft Exchange 2007, either Microsoft Exchange Server MAPI client and CDO 1.2.1 or Microsoft Exchange 2003 SP2 System Tools

messaging server system tools

Microsoft Exchange Organization of the same Microsoft Exchange Organization as the messaging server the messaging server system tools version of the messaging server system the same version as the messaging server tools version of the CDO library the latest version that is supported by the latest version of Microsoft Exchange in your environment

12

Installation Guide

System requirements: BlackBerry MDS Connection Service

Item Internet Service Manager Microsoft .NET Framework web browser

Requirement To support Microsoft Exchange 2007, the Internet Service Manager component of Microsoft Internet Information Services installed To support languages other than English, localized version of Microsoft .NET Framework Version 1.1 SP1 Microsoft Internet Explorer with the following settings: Java or JavaScript turned on language preferences set to display encoded web pages Any of the following data access components: MDAC Version 2.8 with Security Patch MS04-003 (Version 2000.85.1025.00) MDAC Version 2.8 SP2 (Version 2000.86.1830.00) To support BlackBerry device implementation, printer and file sharing turned on To support BlackBerry device implementation that uses a hub, a USB driver that supports USB 1.1-compliant hubs

data access components

printer and file sharing USB hub

System requirements: BlackBerry MDS Connection Service

The following system requirements apply when installing the BlackBerry MDS Connection Service on a computer separate from the BlackBerry Enterprise Server. Item operating system Requirement Any of the following operating systems: Microsoft Windows 2000 SP4 (Server edition, Advanced Server edition, or Professional edition) Microsoft Windows Server 2003 SP1 Microsoft Windows XP Professional SP2 Microsoft Windows Small Business Server 2003 (Standard edition or Premium edition) To support BlackBerry Enterprise Server Version 3.5 and BlackBerry Enterprise Server Version 3.6, any of the following applications: Microsoft Exchange Version 5.5 Administrator Microsoft Exchange 2000 System Manager

messaging server application

13

Installation Guide

System requirements: BlackBerry MDS Integration Service

Item

Requirement Microsoft Exchange 2003 System Manager Microsoft Exchange Server MAPI client and CDO 1.2.1 for Microsoft Exchange 2007, either Microsoft Exchange Server MAPI client and CDO 1.2.1 or Microsoft Exchange 2003 SP2 System Tools

RSA Authentication Agent

To support enhanced network authentication, RSA Authentication Agent Version 5.0 for Microsoft Windows

System requirements: BlackBerry MDS Integration Service

The following system requirements apply when installing the BlackBerry MDS Integration Service on a computer separate from the BlackBerry Enterprise Server. Item operating system Requirement Any of the following operating systems: Microsoft Windows 2000 SP4 (Server edition or Advanced Server edition) Microsoft Windows Server 2003 SP1 Microsoft Windows XP Professional SP2 A database server that is the the host for the BlackBerry Configuration Database.

database conditions

System requirements: BlackBerry Router

The following system requirements apply when installing the BlackBerry Router on a computer separate from the BlackBerry Enterprise Server. Item operating system Requirement Any of the following operating systems: Microsoft Windows 2000 SP4 (Server edition or Advanced Server edition) Microsoft Windows Server 2003 SP1 Microsoft Windows XP Professional SP2

14

Installation Guide

Supported environments

Item firewall

Requirement A firewall or proxy firewall with the following conditions: support for the BlackBerry Router to initiate an outgoing, two-way TCP/IP connection to an external server on port 3101 support for the resolution of Internet addresses using DNS transparency of the proxy server for proxy firewalls

Supported environments
Item virtual environment Description The BlackBerry Enterprise Server and its components support the following virtual environments: VMware ESX Server Version 2.5.2 or later VMware ESX Server Version 3.0.1 The BlackBerry Collaboration Service supports Windows Messenger if MSMQ Version 3.0 is installed. If installed separately from Microsoft Windows Server 2003, the default Microsoft Active Directory Integration and Triggers subcomponents must be cleared, and only the Common subcomponent must be selected. The BlackBerry Collaboration Service supports Windows Messenger with TLS if one of the following certificates is installed on the computer that hosts the BlackBerry Collaboration Service: if your instant messaging server is Microsoft Office Live Communications Server 2005, an MTLS certificate if your instant messaging server is Microsoft Office Live Communications Server 2005 SP1, a server authentication certificate for the computer account The BlackBerry Collaboration Service supports IBM Lotus Sametime when you add the IP address of the computer that hosts the BlackBerry Collaboration Service to the CommunityConnectivity document on the IBM Lotus Sametime server.

Windows Messenger

Windows Messenger with TLS

IBM Lotus Sametime

15

Installation Guide

Supported environments

Item Novell GroupWise Messenger

Description The BlackBerry Collaboration Service supports Novell GroupWise Messenger when SSL authentication is turned on for the Novell GroupWise Messenger agents on the computer that hosts the BlackBerry Collaboration Service. The BlackBerry Collaboration Service supports Microsoft Office Communicator when MTLS and HTTPS certificates for communication with the Microsoft Office Live Communications Server are installed on the Microsoft Office Communicator Web Access server. The BlackBerry Collaboration Service supports Microsoft Office Communicator with TLS if one of the following certificates is installed on the computer that hosts the BlackBerry Collaboration Service: if your instant messaging server is Microsoft Office Live Communications Server 2005, an MTLS certificate if your instant messaging server is Microsoft Office Live Communications Server 2005 SP1, a server authentication certificate for the computer account The BlackBerry Collaboration Service supports Microsoft Office Communicator and AJAX Service with the following conditions: the following Microsoft hotfixes from www.microsoft.com/support installed: 911996 on your Microsoft Office Live Communications Server 915066 on your Microsoft Office Communicator server a virtual server installed on your Microsoft Office Communicator server, with the following conditions: all unassigned IP addresses forms-based authentication only support for an HTTPS browser connection an ISAPI filter for the cwaauth.dll file and the ajax.dll file

Microsoft Office Communicator

Microsoft Office Communicator with TLS

Microsoft Office Communicator and AJAX Service

enhanced network authentication SNMP monitoring remote access

The BlackBerry Enterprise Server and its components support RSA Authentication Agent Version 5.0 for Microsoft Windows. The BlackBerry Enterprise Server and its components support the SNMP service. The BlackBerry Enterprise Server and its components support remote access using any of the following applications:

16

Installation Guide

Unsupported environments

Item

Description Terminal Services for use with Microsoft Windows Server 2000, installed using Remote Administration mode Microsoft Remote Desktop Connection for use with Microsoft Windows Server 2003

Unsupported environments
Item DMZ Description

The BlackBerry Enterprise Server and its components, with the exception of the BlackBerry Router, do not support installation in a DMZ. messaging server The BlackBerry Enterprise Server and its components do not support the installation of the messaging server on the same computer. email application The BlackBerry Enterprise Server and its components do not support the installation of email applications on the same computer. Microsoft SQL Server 2005 Express The BlackBerry MDS Integration Service databases do not support the database Microsoft SQL Server 2005 Express database.

17

Installation Guide

Configuring a Microsoft Exchange 5.5, Microsoft Exchange 2000, or Microsoft Exchange 2003 messaging environment

18

Installation Guide

Configuring a Microsoft Exchange 5.5, Microsoft Exchange 2000, or Microsoft Exchange 2003 messaging environment

Configuring a Microsoft Exchange 5.5, Microsoft Exchange 2000, or Microsoft Exchange 2003 messaging environment
Create a Microsoft Windows account and mailbox

You must create and configure a Microsoft Windows account and mailbox in the Microsoft Active Directory service for the BlackBerry Enterprise Server and the BlackBerry Manager so that they can authenticate to the Microsoft Exchange messaging server. You might not be able to see the Microsoft Windows account to verify that it has been created. For more information about the Send As permission and the BlackBerry Enterprise Server, visit www.blackberry.com to read KB04707. For more information about how to assign the Send As permission for multiple user accounts, visit www.support.microsoft.com to read article 912918. 1. 2. On any computer within the Microsoft Windows domain, on the taskbar, click Start > Programs > Microsoft Exchange > Active Directory Users and Computers. Create an account with the following attributes: Name: BESAdmin User location: create a Microsoft Exchange mailbox Group membership: Domain User Assign this account the Send As permission for all user accounts in the User container of the Active Directory domain. Send a test message to activate the new mailbox.

3. 4.

Configure permissions for the Microsoft Windows account

On each computer that you want to install the BlackBerry Enterprise Server components on, you must configure the permissions of the Microsoft Windows account that you plan to use to install the BlackBerry Enterprise Server components. 1. On the taskbar, click Start > Programs > Administrative Tools > Local Security Policy. 2. Configure the following permissions for the Microsoft Windows account: log on locally with local permissions (if not assigned by default) log on as a service 3. 4. On the taskbar, click Start > Programs > Administrative Tools > Computer Management. Add the Microsoft Windows account to the local administrators group.

19

Installation Guide

Configuring Microsoft Exchange permissions for the Microsoft Windows account

Configuring Microsoft Exchange permissions for the Microsoft Windows account

Configure Microsoft Exchange Version 5.5 permissions for the Microsoft Windows account
On each computer that you plan to install the BlackBerry Enterprise Server or the BlackBerry Manager on, you must configure the Microsoft Exchange permissions of the Microsoft Windows account that you plan to use to complete the installation. Without the proper permissions, the BlackBerry Enterprise Server cannot function. > Using Microsoft Exchange Version 5.5 Administrator, in both the Site and Configuration containers, add the Service Account Admin permission to the Microsoft Windows account.

Configure Microsoft Exchange 2000 or 2003 permissions for the Microsoft Windows account
On each computer that you plan to install the BlackBerry Enterprise Server or the BlackBerry Manager on, you must configure the Microsoft Exchange permissions of the Microsoft Windows account that you plan to use to complete the installation. Without the proper permissions, the BlackBerry Enterprise Server cannot function. 1. 2. Using Microsoft Exchange 2000 or 2003 System Manager, configure the Exchange View Only Administrator permission with the minimum access level of Administrative Groups. At the server level, configure the following permissions: Send As Receive As Administer Information Store

Identify and resolve any Microsoft Exchange known issues for wireless calendar synchronization
You must read the Microsoft Exchange known issues that might impact your messaging environment and install the hotfixes for them. If your messaging environment includes multiple messaging servers, resolve the known issues that apply to the latest version of the Microsoft Exchange software in your environment. Without the proper fixes installed, the BlackBerry Enterprise Server cannot function. 1. To determine which of the following Microsoft articles apply to your environment, visit www.support.microsoft.com: Microsoft Exchange tool Microsoft Exchange Version 5.5 Administrator Microsoft article 312273 818709

20

Installation Guide

Identify and resolve any Microsoft Exchange known issues for wireless calendar synchronization

Microsoft Exchange tool Microsoft Exchange 2000 System Manager Microsoft Exchange 2003 System Manager 2. 3.

Microsoft article 314606 824960 823343 894470

Verify that your environment meets the requirements described in the applicable known issues. Download and install the hotfixes for the known issues on the computers on which you plan to install the BlackBerry Enterprise Server and the BlackBerry Manager.

21

Installation Guide

Configuring a Microsoft Exchange 2007 messaging environment

22

Installation Guide

Configuring a Microsoft Exchange 2007 messaging environment

Configuring a Microsoft Exchange 2007 messaging environment

Create a Microsoft Exchange 2007 account and mailbox

Before you begin: You must configure Microsoft Exchange 2007 to support earlier versions of Microsoft Outlook by creating the public folder database. For more information about supporting earlier versions of Microsoft Outlook, visit www.microsoft.com/support to read article 555851 and visit technet.microsoft.com to read articles 123694 and 124270. 1. 2. 3. Log in to the Microsoft Exchange computer as an administrator with the permission to create an account. Open the Microsoft Exchange Management Console. Create a new Microsoft Exchange account named BESAdmin.

Configure Microsoft Windows permissions for the Microsoft Exchange 2007 account
On each computer that you plan to install the BlackBerry Enterprise Server or the BlackBerry Manager on, you must configure the Local Security Policy permissions for the Microsoft Exchange account that you plan to use to complete the installation. Without the proper permissions, the BlackBerry Enterprise Server cannot function. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Right-click My Computer. Click Manage. In the left pane, expand Local Users and Groups. Navigate to the Groups folder. In the right pane, double-click Administrators. Click Add. In the Enter the object names to select field, type BESAdmin. Click OK. Click Apply. Click OK.

Configure Microsoft Exchange 2007 permissions for the Microsoft Exchange account
1. On a computer that hosts the Microsoft Exchange Management Shell, open the Microsoft Exchange Management Shell.

23

Installation Guide

Enable BlackBerry device users to send messages in a Microsoft Exchange 2007 environment

2.

Perform one of the following actions: If you are performing the command locally on the Microsoft Exchange 2007 server, type: addexchangeadministrator "BESAdmin" role ViewOnlyAdmin If you are performing the command from another computer, type: get-mailboxserver "<messaging_server_name>" | add-exchangeadministrator "BESAdmin" role ViewOnlyAdmin Type the following command: get-mailboxserver "<messaging_server_name> " | add-adpermission user "BESAdmin" accessrights ExtendedRight extendedrights Send-As, Receive-As, ms-Exch-Store-Admin

3.

Enable BlackBerry device users to send messages in a Microsoft Exchange 2007 environment
1. On any computer within your domain, on the taskbar, click Start > Administrative Tools > Active Directory Users and Computers. 2. In the View menu, click Advanced Features. 3. Right-click the domain root. 4. Click Properties. 5. On the Security tab, click Advanced. 6. Click Add. 7. Type BESAdmin. 8. Click Check Name. 9. Click OK. 10. In the Apply Onto drop-down list, click User Objects. 11. In the Allow column, select the Send As check box. 12. Click Apply. 13. Click OK.

24

Installation Guide

Setting up the database connection

Setting up the database connection

The BlackBerry Enterprise Server can connect to the BlackBerry Configuration Database on the Microsoft SQL Server using Microsoft Windows authentication or database authentication. If you use Microsoft Windows authentication, the BlackBerry Manager logs in to the BlackBerry Configuration Database using the Microsoft Windows account that you used to complete the installation. If you use database authentication with Microsoft SQL Server, the BlackBerry Manager authenticates to the database using the database credentials that the administrator provides.

Specifying permissions when connecting to the BlackBerry Configuration Database using Microsoft Windows authentication
During the BlackBerry Enterprise Server installation process, if you choose to connect to the BlackBerry Configuration Database using Microsoft Windows authentication, the Microsoft Windows account that you use must have permissions on the database server. The type of permissions depends on the BlackBerry Enterprise Server setup option that you choose, and on whether you create the BlackBerry Configuration Database on the same computer as the BlackBerry Enterprise Server or on another database server.

Specifying MSDE 2000 permissions for the Microsoft Windows account

If you install MSDE 2000 during the BlackBerry Enterprise Server installation process, you do not need to specify additional permissions. When you select Microsoft Windows authentication during the BlackBerry Enterprise Server installation process, the setup application automatically assigns the required permissions to the Microsoft Windows account that you are using to complete the installation.

Assign Microsoft SQL Server permissions to the Microsoft Windows account

> Peform one of the following actions: If you create the BlackBerry Configuration Database on the same computer as the BlackBerry Enterprise Server, or if you install the BlackBerry MDS Integration Service, assign the system administrator permission to the Microsoft Windows account that you are using to complete the installation. If you create the BlackBerry Configuration Database on another computer, assign server administrator and database creator permissions to the Microsoft Windows account that you are using to complete the installation. If you are using Microsoft SQL Server 2005, assign the system administrator permission, or each of the following roles: SQLAgentUserRole, SQLAgentReaderRole, and SQLAgentOperatorRole.

25

Installation Guide

Configuring authentication to the BlackBerry MDS Integration Service database

Configuring authentication to the BlackBerry MDS Integration Service database

If you install the BlackBerry MDS Integration Service on a Microsoft SQL Server, the setup application uses the same uthentication method and account that you specified for the BlackBerry Configuration Database. The account requires the same permissions for the BlackBerry MDS Integration Service database as it requires for the BlackBerry Configuration Database.

26

Installation Guide

Installing the BlackBerry Enterprise Server software

Installing the BlackBerry Enterprise Server software

Applications installed with the BlackBerry Enterprise Server components
Item J2SE Runtime Environment JRE Microsoft XML Parser Version 5.0 update 9 1.6 4.0 SP2 Components with which this item is installed All BlackBerry MDS Connection Service BlackBerry Collaboration Service BlackBerry Messaging Agent BlackBerry Attachment Service BlackBerry Manager BlackBerry Router BlackBerry Messaging Agent BlackBerry Manager BlackBerry Collaboration Service

Microsoft .NET Framework

1.1 or 1.1 SP1

MSDE database

2000

BlackBerry Enterprise Server

Prerequisites: Installing the BlackBerry Enterprise Server

Item credentials from the BlackBerry Enterprise Server installation media Requirement CAL key SRP identifier SRP key SRP host computer name and port number of the instant messaging server (use the virtual server name and port number where the AJAX Service is installed, if applicable) computer name and port number of the proxy server (optional)

installation credentials from your environment

allowed lists for anti-virus and antispam software applications

Add the blackberry.net domain to the allowed lists in the anti-virus and antispam software applications that the messaging server or gateway uses.

27

Installation Guide

Install the BlackBerry Enterprise Server software

Install the BlackBerry Enterprise Server software

The installation process includes a restart of the computer. If you use a .pac file to configure the connection to the proxy server, you can specify that file after you complete the installation process. 1. 2. 3. 4. 5. 6. Log in to the computer using the BESAdmin account that you created. In the BlackBerry Enterprise Server installation media, double-click setup.exe. Complete the instructions on the screen. When prompted to restart the computer, click Yes. Log in to the computer using the same account that you used in Step 1 to start the setup application. Complete the instructions on the screen.

After you finish: Complete the following actions: If you installed the BlackBerry Collaboration Service, download the BlackBerry Instant Messaging Connector from www. blackberry.com/support/downloads and install it. If you installed MSDE 2000, update the sa account password. For more information, visit www.support.microsoft.com to read article 32233. If you configured the BlackBerry Configuration Database on a Microsoft SQL Server during installation, ensure the BlackBerry Configuration Database collation setting is set to default case-insensitive.

Test the BlackBerry Enterprise Server installation

1. 2. In the Microsoft Windows Services, verify that the BlackBerry Enterprise Server services are running. In the Microsoft Windows Event Viewer and in the log files that are located in <drive>:Program Files\Research In Motion \Blackberry Enterprise Server\Logs, check for error messages. For troubleshooting information, visit www.blackberry.com/support. In the BlackBerry Manager, add a test user account. If you added a test user successfully, the connection from the BlackBerry Enterprise Server to the BlackBerry Configuration Database and the messaging server is open. If you installed the BlackBerry MDS Connection Service, browse to http://<BES_host>:8080. If the status page appears, the BlackBerry MDS Connection Service is running successfully.

3.

4.

28

Installation Guide

Install the BlackBerry database notification system

Install the BlackBerry database notification system

The BlackBerry database notification system helps to reduce the number of database queries that the BlackBerry Enterprise Server makes to the BlackBerry Configuration Database. If you create the BlackBerry Configuration Database on the same computer as the BlackBerry Enterprise Server, the BlackBerry database notification system installs automatically. If you create the BlackBerry Configuration Database on a database server that is installed on a separate computer, you can install the BlackBerry database notification system manually after you complete the BlackBerry Enterprise Server installation. Before you begin: You must have the system administrator role on the database server. 1. 2. 3. 4. 5. 6. 7. 8. On the database server, open the BlackBerry Enterprise Server installation media. In the Tools\DBNS folder, copy RimEsp.dll to C:\Program Files\Microsoft SQL Server\MSSQL\Binn. Open the Microsoft SQL Query Analyzer. Using the console, navigate to Database\DBInstallScripts\SQLServer\4.1 on the BlackBerry Enterprise Server installation media. Open NotifyInstall.sql and change <_DATABASENAME_> to the name of your BlackBerry Configuration Database. For example, BesMgmt. Run the script. Confirm that the Microsoft SQL Query Analyzer displays the message Function dbo.xp_RIMxxxx registered. To set up additional BlackBerry Configuration Database instances in your environment, repeat steps 1 through 7.

29

Installation Guide

Post-installation tasks

30

Installation Guide

Post-installation tasks

Post-installation tasks
Configure support for Unicode text in calendars on BlackBerry devices in a Microsoft Exchange 2003 environment

Before you begin: You must have installed the hotfixes for wireless calendar synchronization for Microsoft Exchange 2003. 1. 2. 3. 4. 5. On the BlackBerry Enterprise Server, open the Registry Editor. In the left pane, navigate to HKEY_LOCAL_MACHINE\software\Research In Motion\BlackBerry Enterprise Server \Agents. Create a DWORD value named SetLocaleIDs. Set the value to 1. In the Microsoft Windows Services, restart the BlackBerry Messaging Agent.

Connecting to a BlackBerry Attachment Service

Complete the following tasks if you have installed the BlackBerry Attachment Service on a computer separate from the BlackBerry Enterprise Server. These tasks ensure that other BlackBerry Enterprise Server components can connect to the BlackBerry Attachment Service.

Connect the BlackBerry MDS Connection Service to a BlackBerry Attachment Service

Complete the following task if you have not installed the BlackBerry Attachment Service on the same computer as the BlackBerry MDS Connection Service. 1. On the computer that hosts the BlackBerry MDS Connection Service, navigate to C:\Program Files\Research In Motion \BlackBerry Enterprise Server\MDS\Servers\Instance\config. 2. In a text editor, open rimpublic.property. 3. Type the following lines at the end of the file: Attachment.Server.host=<attachment_server_hostname> Attachment.Server.port.asp=1900 4. 5. 6. 7. Attachment.Server.port.rqp=2000 Save and close the file. In the Microsoft Windows Services, restart the BlackBerry MDS Connection Service. To connect another BlackBerry MDS Connection Service to the BlackBerry Attachment Service, complete steps 1 through 5. On the computer that hosts the BlackBerry Attachment Service, open the Registry Editor.

31

Installation Guide

Connecting to a BlackBerry Attachment Service

8. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Research In Motion\BBAttachServer\BBAttachBESExtension. 9. Change AllowRemoteServices to 1. 10. In the Microsoft Windows Services, restart the BlackBerry Attachment Service.

Connect the BlackBerry Messaging Agent to a BlackBerry Attachment Service

Complete the following task if you have not installed the BlackBerry Attachment Service on the same computer as the BlackBerry Enterprise Server. 1. On the computer that hosts the BlackBerry Enterprise Server, on the taskbar, click Start > Programs > BlackBerry Enterprise Server > BlackBerry Server Configuration. 2. On the Attachment Server tab, in the Configuration Option drop-down list, click Connector Configuration. 3. In the Server field, type the name or IP address of the computer that hosts the BlackBerry Attachment Service. 4. In the Server Submit Port field, type the TCP/IP port number (between 1024 and 65,535) that the attachment connector uses to send the requests for attachment data to the BlackBerry Attachment Service. 5. In the Server Result Port field, type the TCP/IP port number (between 1024 and 65,535) that the BlackBerry Enterprise Server uses to query and retrieve the converted data from the BlackBerry Attachment Service. 6. In the Polling Time(s) (seconds) field, type the interval (between 10 and 300 seconds) that the BlackBerry Enterprise Server uses between querying the BlackBerry Attachment Service for when the conversion of large attachments is complete and the attachment is available for delivery. 7. Click OK. 8. In the Microsoft Windows Services, restart the BlackBerry Dispatcher.

Connect a remote BlackBerry Attachment Service to the BlackBerry Messaging Agent

Complete the following task if you have not installed the BlackBerry Attachment Service on the same computer as the BlackBerry Enterprise Server. Before you begin: Open the BlackBerry Configuration Panel on the BlackBerry Enterprise Server and record the port information for the Server Submit Port and the Server Result Port that the BlackBerry Enterprise Server uses. 1. 2. 3. 4. 5. On the computer that hosts the BlackBerry Attachment Service, on the taskbar, click Start > Programs > BlackBerry Enterprise Server > BlackBerry Server Configuration. On the Attachment Server tab, in the Configuration Option drop-down list, click Attachment Server. In the Submit Port field, type the same port number that you typed in the Server Submit Port field on the BlackBerry Enterprise Server. In the Result Port field, type the same port number that you typed in the Server Result Port field on the BlackBerry Enterprise Server. In the Configuration Port field, type the TCP/IP port number (between 1024 and 65,535) that the administrative console should use.

32

Installation Guide

Authenticating the BlackBerry MDS Integration Service to the BlackBerry Manager and web services

6. 7.

Click OK. In the Microsoft Windows Services, restart the BlackBerry Attachment Service.

Authenticating the BlackBerry MDS Integration Service to the BlackBerry Manager and web services
After you install the BlackBerry MDS Integration Service, you must install a digital certificate for the BlackBerry MDS Integration Service in the key store on the same computer. This certificate allows server-authenticated communication between the BlackBerry MDS Integration Service and the BlackBerry Manager. You can install a self-signed certificate for the BlackBerry MDS Integration Service, or you can obtain a signed root certificate from a certificate authority and install it in the key store using the Java keytool. You can replace the self-signed certificate with a signed root certificate at any time, but it is recommended that you install the certificate that you want to use immediately after you install the BlackBerry MDS Integration Service, and before you allow authentication with the BlackBerry Manager or web services using that certificate. You can also export the BlackBerry MDS Integration Service certificate to allow client authentication with external web services. For more information about using the Java keytool, visit java.sun.com/javase/6/docs/technotes/tools/windows/ keytool.html.

Allow the BlackBerry MDS Integration Service to communicate with the BlackBerry Manager
When the BlackBerry Manager connects to the BlackBerry MDS Integration Service for the first time after installation, the BlackBerry Manager prompts you to view and install the BlackBerry MDS Integration Service self-signed certificate. This certificate allows server-authenticated communication between the BlackBerry MDS Integration Service and the BlackBerry Manager. Before you begin: Perform this task immediately after you install the BlackBerry MDS Integration Service. 1. 2. 3. 4. 5. 6. In the BlackBerry Manager, in the left pane, click a BlackBerry MDS Integration Service. In the certificate installation dialog box, click View Certificate. Review the certificate information. Click Install Certificate. Complete the instructions on the screen. Accept the default settings. When prompted, click Cancel.

33

Installation Guide

Configuring how users search for email addresses in a Hosted BlackBerry Enterprise Server environment

Allow client authentication between the BlackBerry MDS Integration Service and web services
The BlackBerry MDS Integration Service self-signed certificate enables client authentication between the BlackBerry MDS Integration Service and web services hosts. If the BlackBerry MDS Runtime Applications in your environment use HTTPS to communicate with web servers to receive data and updates, export the BlackBerry MDS Integration Service certificate to the web services hosts. This allows BlackBerry MDS Runtime Applications that use web services to authenticate with and access web services. Before you begin: Contact your organization's BlackBerry MDS Runtime Application developers for information about the web services that the BlackBerry MDS Runtime Applications in your environment use. If you replaced the BlackBerry MDS Integration Service self-signed certificate with a root certificate from a certificate authority, web services must trust the root certificate authority to authenticate with the BlackBerry MDS Integration Service. 1. 2. 3. Using Microsoft Internet Explorer, export the BlackBerry MDS Integration Service self-signed certificate from the trusted root certificate authorities area of the computer's key store. Send the BlackBerry MDS Integration Service self-signed certificate to the web services servers that the BlackBerry MDS Runtime Applications use. Verify that the certificate is installed in the trusted key store of the web services servers.

After you finish: If you have multiple BlackBerry MDS Integration Service servers installed, export the certificate for each BlackBerry MDS Integration Service. Allow BlackBerry MDS Runtime Applications to access web services using HTTPS.

Configuring how users search for email addresses in a Hosted BlackBerry Enterprise Server environment
If you host a BlackBerry Enterprise Server and multiple organizations subscribe to your hosted service, you must customize the address lookup feature so that BlackBerry device users can access their organizations contact list and download the information to their BlackBerry devices. By customizing how users search for email addresses, you can restrict the BlackBerry device users from accessing the contact information of another organization that subscribes to your hosted service. You must make sure that the organization name for each user is listed accurately and consistently in the contact list. For example, if the organization name appears as an acronym in some entries but in full in others, the address lookup results might be inaccurate. If a user tries to look up contact information for a user whose organization name is not specified, no address lookup results appear. When users try to look up contact information, they need to type the entire email address.

34

Installation Guide

Configuring how users search for email addresses in a Hosted BlackBerry Enterprise Server environment

If you do not want to use the address lookup feature, you can configure the BlackBerry Enterprise Server to look up user addresses using LDAP. With LDAP, users can perform more comprehensive searches for addresses in the GAL. The BlackBerry Enterprise Server does not search for a users organization name in the GAL. Instead, it uses an LDAP field as a filter for retrieving users with a specific organization name. You can select an existing LDAP field or you can create a custom field.

Configure how users search for email addresses in a Hosted BlackBerry Enterprise Server environment
1. 2. 3. 4. 5. 6. On the BlackBerry Enterprise Server, open the Registry Editor. In the left pane, navigate to HKEY_LOCAL_MACHINE\Software\Research In Motion\BlackBerry Enterprise Server \Agents. Verify that the DWORD value for AllowAddressLookup is 1. Create a DWORD value named HostedServer. Set the value to 1. In the Microsoft Windows Services, restart the BlackBerry Controller.

Configure the Hosted BlackBerry Enterprise Server to search for email addresses using LDAP
1. 2. 3. 4. 5. 6. 7. On the BlackBerry Enterprise Server, open the Registry Editor. In the left pane, navigate to HKEY_LOCAL_MACHINE\Software\Research In Motion\BlackBerry Enterprise Server \Agents. Create a DWORD value named LDAPSearch. Set the value to 1. Create a DWORD value named LDAPALPSearch. Set the value to 1. In the Microsoft Windows Services, restart the BlackBerry Controller.

Configure the Hosted BlackBerry Enterprise Server to search for email addresses using a custom LDAP field
1. 2. 3. 4. 5. On the BlackBerry Enterprise Server, open the Registry Editor. In the left pane, navigate to HKEY_LOCAL_MACHINE\Software\Research In Motion\BlackBerry Enterprise Server \Agents. Create a string value named LDAPCompanyField. Set the value to a string that represents the LDAP field that you want to use as the company name field. In the Microsoft Windows Services, restart the BlackBerry Controller.

35

Installation Guide

Add or remove a BlackBerry Enterprise Server component

Add or remove a BlackBerry Enterprise Server component

Complete this task if you want to add or remove a BlackBerry Enterprise Server component from a computer that also hosts other BlackBerry Enterprise Server components. CAUTION: Before removing the existing BlackBerry Enterprise Server installation, move active user accounts to another BlackBerry Enterprise Server. 1. Perform one of the following actions to add a component: remove the existing installation and reinstall the BlackBerry Enterprise Server with the component if supported, install the component on a separate computer 2. Perform one of the following actions to remove a component: turn off the service and set its Startup type to Manual remove the existing installation and reinstall the BlackBerry Enterprise Server without the component

36

Installation Guide

Creating and managing administrators

Creating and managing administrators

Administrative roles

The BlackBerry Enterprise Server uses predefined roles, which correspond to common administrative roles in organizations, to control who can perform specific tasks and limit who can access sensitive data in your organization. You assign each BlackBerry Enterprise Server administrator to an administrative role. If you already manage your organization using Microsoft Windows groups, assign those groups to the administrative roles so that you can manage role membership through the group. When an administrator starts the BlackBerry Manager, the BlackBerry Manager checks the authentication credentials, determines the administrative role, and displays a list of the tasks that the administrator can perform. Role security administrator (rim_db_admin_security) Description These administrators can perform all tasks. They are the only administrators who can manage role membership and change sensitive security properties, such as licenses and encryption keys. The administrator account that you created during the installation process is assigned the security administrator role automatically. These administrators can perform all tasks that relate to user accounts, services, instances of the BlackBerry Enterprise Server, and global application data. These administrators cannot view role membership, licenses, or encryption keys. These administrators can perform all tasks that relate to user accounts and BlackBerry device management, including: supporting new user accounts implementing BlackBerry devices managing software configurations managing the installation and behavior of third-party applications on BlackBerry devices

enterprise administrator (rim_db_admin_enterprise)

device administrator (rim_db_admin_handheld)

37

Installation Guide

Creating a BlackBerry Enterprise Server administrator in a Microsoft SQL Server environment

Role senior help desk administrator (rim_db_admin_sr_helpdesk)

Description These administrators can perform all tasks that relate to user account management, including: adding, moving, and deleting user accounts updating and sending IT policies to BlackBerry devices sending IT administration commands to BlackBerry devices These administrators can perform tasks that relate to user account management, including: creating and sending passwords for activating BlackBerry devices over the wireless network resending service books or IT policies These administrators cannot add, move, or delete user accounts or send certain IT administration commands. These administrators can view all tasks and properties that relate to their role, but they cannot perform the tasks or change the properties. Use this view-only role when training new administrators.

junior help desk administrator (rim_db_admin_jr_helpdesk)

auditor (rim_db_admin_audit_<role>)

Creating a BlackBerry Enterprise Server administrator in a Microsoft SQL Server environment

BlackBerry Enterprise Server administrators are database users who can access the BlackBerry Configuration Database using the BlackBerry Manager. This access is restricted to the administrative roles that the BlackBerry Enterprise Server administrators are assigned to. Only administrators who are assigned to the security administrator role can create other BlackBerry Enterprise Server administrators accounts. When creating administrator accounts, perform one of the following tasks: assign a BlackBerry administrative role to an existing database account create a new database account and assign it an administrative role

38

Installation Guide

Configure the BlackBerry Manager to use database authentication in a Microsoft SQL Server environment

Assign an administrative role to a new or existing Microsoft SQL Server database account
Note: Do not assign an administrative role using the Microsoft SQL Server consoles or assign more than one administrative role to an administrator. The BlackBerry Configuration Database uses the most restrictive settings to determine which tasks the BlackBerry Manager displays, so an administrator who is assigned both enterprise and junior help desk roles sees only the tasks for the junior help desk role. Before you begin: Verify that you have the system administrator role on the database server. If you are assigning an administrator to the security or enterprise administrative role, verify that the administrator has administrative permission on the Microsoft Exchange messaging server. If you are creating a new database account and and want to use Microsoft Windows authentication, verify that the Microsoft Windows user or group account already exists. 1. 2. 3. In the BlackBerry Manager, in the left pane, click BlackBerry Domain. On the Role Administration tab, click a role. Complete one of the following actions: To add an administrative role to an existing Microsoft SQL Server database account, click List Administrators. To create a new Microsoft SQL Server database account and assign it to an administrative role, click Add Administrators. Complete one of the following actions: To add an administrative role to an existing administrator account, click the administrator account that you want to add the role to. To create a database account only and add an administrative role to the account, type a user name. To create a database account for an existing Microsoft Windows user or group and add an administrative role to the account, type a user name preceded by a domain name (for example, DOMAIN\username). If prompted, type and confirm a password. Click OK.

4.

5. 6.

Configure the BlackBerry Manager to use database authentication in a Microsoft SQL Server environment
During the installation process, if you choose to connect to the BlackBerry Configuration Database using Microsoft Windows authentication, the BlackBerry Manager uses Microsoft Windows authentication automatically. If you create database accounts for your administrators, you must change the type of authentication that the BlackBerry Manager uses. 1. In the BlackBerry Manager, on the Tools menu, click Options. 2. Click Database. 3. In the Authentication drop-down list, click Database Authentication.

39

Installation Guide

Assign a BlackBerry Enterprise Server administrator to a different administrative role

4. 5.

Click OK. Restart the BlackBerry Manager.

Assign a BlackBerry Enterprise Server administrator to a different administrative role

As organizational changes occur, you might need to move an administrator to a different administrative role. 1. In the BlackBerry Manager, in the left pane, click BlackBerry Domain. 2. On the Role Administration tab, click the role that the administrator is assigned to. 3. Click List Administrators. 4. Remove the administrator from the list. 5. Click the role that you want to assign the administrator to. 6. Click the administrator. 7. Click OK. The database permissions change immediately. After you finish: Instruct the administrator to restart the BlackBerry Manager.

Delete an administrator from a BlackBerry Enterprise Server

1. 2. 3. 4. 5. In the BlackBerry Manager, in the left pane, click BlackBerry Domain. On the Role Administration tab, click the role that the administrator is assigned to. Click Remove Administrators. In the drop-down list, click the administrator. Click OK.

After you finish: Optionally, you can delete the database account associated with that administrator from the database.

40

Installation Guide

Removing the BlackBerry Enterprise Server software

Removing the BlackBerry Enterprise Server software

Remove the BlackBerry Enterprise Server software
Use this task to remove the BlackBerry Enterprise Server or a BlackBerry Enterprise Server component that you have installed on a separate computer. 1. On the taskbar, click Start > Settings > Control Panel > Add/Remove Programs. 2. Click BlackBerry Enterprise Server. 3. Click Remove. 4. Click Yes.

After you finish: Optionally, you can delete remaining log files and remove the JRE software and the Java Web Start software from the computer.

Delete registry entries from your computer

1. 2. On the computer that you removed the BlackBerry Enterprise Server software from, open the Registry Editor. Delete the following registry keys: Location HKEY_LOCAL_MACHINE\SOFTWARE HKEY_LOCAL_MACHINE\System\CurrentControlSet \Services HKEY_LOCAL_MACHINE\System\ControlSet001 \Services HKEY_LOCAL_MACHINE\System\ControlSet00n \Services HKEY_CURRENT_USER\Software HKEY_CURRENT_USER\Software\Microsoft\Windows NT\ CurrentVersion\Windows Messaging SubSystem \Profiles HKEY_USERS\.DEFAULT\Software HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft \Windows\CurrentVersion\App Paths KEY Research In Motion BBAttachServer and any keys starting with BES or BlackBerry BBAttachServer and any keys starting with BES or BlackBerry BBAttachServer and any keys starting with BES or BlackBerry Research In Motion any keys named BlackBerryServer, BlackBerry Manager, or listed as the name of your BlackBerry Enterprise Server Research In Motion BESManmmc.dll

41

Installation Guide

Removing the BlackBerry database notification system

Location HKEY_CLASSES_ROOT\Installer\Products

KEY any key in which the ProductName is BlackBerry Enterprise Server

Removing the BlackBerry database notification system

You must remove the BlackBerry database notification system manually if you installed it manually. You can choose to remove the BlackBerry database notification system for one or all instances of the BlackBerry Configuration Database.

Remove the BlackBerry database notification system from one BlackBerry Configuration Database
1. 2. 3. 4. 5. 6. Open the Microsoft SQL Query Analyzer. Using the console, navigate to <drive>:\Database\DBInstallScripts\SQLServer\4.1 in the BlackBerry Enterprise Server installation media. Open NotifyUnInstall.sql. Delete all commands after --- delete notification stored procedures and -- delete notification tables. Run the script. Perform one of the following actions: Restart the Microsoft SQL Server. In Windows Explorer, navigate to C:\Program Files\Microsoft SQL Server\MSSQL\Binn. Rename RimEsp.dll (for example, to RimEspXXX.tmp) .

Remove the BlackBerry database notification system from all BlackBerry Configuration Database instances
1. 2. 3. 4. 5. 6. Open the Microsoft SQL Query Analyzer. Using the console, navigate to <drive>:\Database\DBInstallScripts\SQLServer\4.1 in the BlackBerry Enterprise Server installation media. Open NotifyUnInstall.sql. Run the script. Using Windows Explorer, navigate to C:\Program Files\Microsoft SQL Server\MSSQL\Binn. Delete RimEsp.dll.

42

Installation Guide

Troubleshooting the BlackBerry Enterprise Server installation process

Troubleshooting the BlackBerry Enterprise Server installation process

A third-party tool did not install successfully and the BlackBerry Enterprise Server setup application closed
Possible solution 1. 2. 3. 4. In the BlackBerry Enterprise Server installation media, open the Tools folder. Double-click the setup application file for the tool that you want to install. Complete the instructions on the screen. Restart the BlackBerry Enterprise Server setup application.

10

Failed to write License Key to the Database

This message appears when you try to add the CAL key. Possible solution After you restart the computer during the BlackBerry Enterprise Server installation process, you must log in using the same Microsoft Windows account that you used to start the installation process. 1. 2. 3. 4. Close the setup application. Log out of the computer. Log in to the computer. Restart the setup application.

Previous version detected but no database available

This message appears when you start the setup application and the setup application stops responding. Possible solution The registry keys that identify your BlackBerry Configuration Database must exist in the Microsoft Windows Registry. 1. 2. 3. On the computer on which you plan to upgrade the BlackBerry Enterprise Server, open the Registry Editor. In the left pane, navigate to HKEY_LOCAL_MACHINE\Research In Motion\BlackBerry Enterprise Server\Database. Create the following case-sensitive string values (if they do not exist): DatabaseName: Type the name of the BlackBerry Configuration Database. DatabaseServerMachineName: Type the computer name of the database server.

43

Installation Guide

The BlackBerry Collaboration Service does not connect to Microsoft Office Live Communications Server 2005

4.

Restart the setup application.

The BlackBerry Collaboration Service does not connect to Microsoft Office Live Communications Server 2005
Possible solution If your instant messaging environment supports Windows Messenger with TLS, you must configure authentication. 1. 2. 3. 4. Download the trial edition of Microsoft Office Communicator 2005 from www.microsoft.com/downloads. Install Microsoft Office Communicator 2005 on the computer that hosts the BlackBerry Collaboration Service. Connect to Microsoft Office Live Communications Server 2005 using Microsoft Office Communicator 2005. If a connection does not open, verify that you installed or imported the certificates required for authentication.

The setup application did not prompt you to change or confirm the MAPI profile
Possible solution Create and change the MAPI profile manually. 1. 2. 3. 4. 5. 6. 7. In the BlackBerry Enterprise Server installation media, open the Tools folder. Double-click Fixmapisvc.exe. Verify that mapisvc.inf is installed at C:\winnt\system32\ or C:\windows\system32\. On the taskbar, click Start > BlackBerry Enterprise Server > Edit MAPI Profile. Type the Microsoft Exchange server name. Click the Microsoft Windows account that is associated with the MAPI profile. Click OK.

The setup application prompts you for access to the installation media for Microsoft .NET Framework Version 1.1
When the BlackBerry Enterprise Server setup application installs Microsoft .NET Framework Version 1.1 SP1 on a computer that hosts a previously installed version of Microsoft .NET Framework Version 1.1, it prompts you for access to the installation media for Microsoft .NET Framework Version 1.1. Possible solution You can access the netfx.msi file that is included with the BlackBerry Enterprise Server installation media. 1. In the BlackBerry Enterprise Server installation media, open the Tools folder.

44

Installation Guide

The setup application prompts you for access to the installation media for Microsoft .NET Framework Version 1.1

2. 3.

Double-click netfx.msi. Complete the instructions on the screen.

45

Installation Guide

Glossary

46

Installation Guide

Glossary

Glossary
AJAX Asynchronous JavaScript and XML

11

BlackBerry Domain A BlackBerry Domain consists of the BlackBerry Configuration Database with its users and any BlackBerry Enterprise Server instances that connect to it. BlackBerry MDS BlackBerry Mobile Data System CAL A client access license (CAL) limits how many users you can add to the BlackBerry Enterprise Server. CDO Collaboration Data Object DMZ A demilitarized zone (DMZ) is a neutral subnetwork outside of an organization's firewall. It exists between the trusted LAN of the organization and the untrusted external wireless network and public Internet. DNS Domain Name System GAL Global Address List HTTPS Hypertext Transfer Protocol over Secure Sockets Layer ISAPI Internet Server Application Programming Interface J2SE Java 2 Platform, Standard Edition JRE Java Runtime Environment LAN local area network

47

Installation Guide

Glossary

LDAP Lightweight Directory Access Protocol MAPI Messaging Application Programming Interface MDAC Microsoft Data Access Components messaging server A messaging server sends and processes messages and provides collaboration services, such as updating and communicating calendar and address book information. MMC Microsoft Management Console MSDE Microsoft SQL Server Desktop Engine MSMQ Microsoft Message Queuing MTLS Mutual Transport Layer Security SNMP Simple Network Management Protocol SQL Structured Query Language SRP Server Routing Protocol SSL Secure Sockets Layer TLS Transport Layer Security XML Extensible Markup Language

48

Installation Guide

Legal notice

Legal notice

12

2008 Research In Motion Limited. All rights reserved. BlackBerry, RIM, Research In Motion, SureType and related trademarks, names, and logos are the property of Research In Motion Limited and are registered and/or used as trademarks in the U.S., Canada, and countries around the world. IBM, Lotus, and Sametime are trademarks of International Business Machines Corporation. Microsoft, Active Directory, Internet Explorer, Outlook, SQL Server, Windows, Windows Media, and Windows Server are trademarks of Microsoft Corporation. Novell and GroupWise are trademarks of Novell, Inc. RSA is a trademark of RSA Security. Java, JavaScript, JRE, and are trademarks of Sun Microsystems, Inc. VMware is a trademark of VMware, Inc. All other brands, product names, company names, trademarks, and service marks are the properties of their respective owners. The BlackBerry smartphone and other devices and/or associated software are protected by copyright, international treaties, and various patents, including one or more of the following U.S. patents: 6,278,442; 6,271,605; 6,219,694; 6,075,470; 6,073,318; D445,428; D433,460; D416,256. Other patents are registered or pending in the U.S. and in various countries around the world. Visit www.rim.com/patents for a list of RIM (as hereinafter defined) patents. This documentation including all documentation incorporated by reference herein such as documentation provided or made available at www.blackberry.com/go/docs is provided or made accessible "AS IS" and "AS AVAILABLE" and without condition, endorsement, guarantee, representation, or warranty of any kind by Research In Motion Limited and its affiliated companies ("RIM") and RIM assumes no responsibility for any typographical, technical, or other inaccuracies, errors, or omissions in this documentation. In order to protect RIM proprietary and confidential information and/or trade secrets, this documentation may describe some aspects of RIM technology in generalized terms. RIM reserves the right to periodically change information that is contained in this documentation; however, RIM makes no commitment to provide any such changes, updates, enhancements, or other additions to this documentation to you in a timely manner or at all. This document might contain references to third-party sources of information, hardware or software, products or services and/or third-party web sites (collectively the "Third-Party Information"). RIM does not control, and is not responsible for, any Third-Party Information, including, without limitation the content, accuracy, copyright compliance, compatibility, performance, trustworthiness, legality, decency, links, or any other aspect of Third-Party Information. The inclusion of ThirdParty Information in this document does not imply endorsement by RIM of the Third-Party Information or the third party in any way. Installation and use of Third-Party Information with RIM's products and services may require one or more patent, trademark, or copyright licenses in order to avoid infringement of the intellectual property rights of others. Any dealings with Third-Party Information, including, without limitation, compliance with applicable licenses and terms and conditions, are solely between you and the third party. You are solely responsible for determining whether such third-party licenses are required and are responsible for acquiring any such licenses relating to Third-Party Information. To the extent that such intellectual property licenses may be required, RIM expressly recommends that you do not install or use Third-Party Information until all such applicable licenses have been acquired by you or on your behalf. Your use of Third-Party Information shall be governed by and subject to you agreeing to the terms of the Third-Party Information licenses. Any Third-Party

49

Installation Guide

Legal notice

Information that is provided with RIM's products and services is provided "as is". RIM makes no representation, warranty or guarantee whatsoever in relation to the Third-Party Information and RIM assumes no liability whatsoever in relation to the Third-Party Information even if RIM has been advised of the possibility of such damages or can anticipate such damages. This documentation might contain references to third-party sources of information, hardware or software, products or services including components and content such as content protected by copyright and/or third-party web sites (collectively the "Third Party Products and Services"). RIM does not control, and is not responsible for, any Third Party Products and Services including, without limitation the content, accuracy, copyright compliance, compatibility, performance, trustworthiness, legality, decency, links, or any other aspect of Third Party Products and Services. The inclusion of a reference to Third Party Products and Services in this documentation does not imply endorsement by RIM of the Third Party Products and Services or the third party in any way. EXCEPT TO THE EXTENT SPECIFICALLY PROHIBITED BY APPLICABLE LAW IN YOUR JURISDICTION, ALL CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS, OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, ANY CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS OR WARRANTIES OF DURABILITY, FITNESS FOR A PARTICULAR PURPOSE OR USE, MERCHANTABILITY, MERCHANTABLE QUALITY, NON-INFRINGEMENT, SATISFACTORY QUALITY, OR TITLE, OR ARISING FROM A STATUTE OR CUSTOM OR A COURSE OF DEALING OR USAGE OF TRADE, OR RELATED TO THE DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NON-PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN, ARE HEREBY EXCLUDED. YOU MAY ALSO HAVE OTHER RIGHTS THAT VARY BY STATE OR PROVINCE. SOME JURISDICTIONS MAY NOT ALLOW THE EXCLUSION OR LIMITATION OF IMPLIED WARRANTIES AND CONDITIONS. TO THE EXTENT PERMITTED BY LAW, ANY IMPLIED WARRANTIES OR CONDITIONS RELATING TO THE DOCUMENTATION TO THE EXTENT THEY CANNOT BE EXCLUDED AS SET OUT ABOVE, BUT CAN BE LIMITED, ARE HEREBY LIMITED TO NINETY (90) DAYS FROM THE DATE YOU FIRST ACQUIRED THE DOCUMENTATION OR THE ITEM THAT IS THE SUBJECT OF THE CLAIM. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, IN NO EVENT SHALL RIM BE LIABLE FOR ANY TYPE OF DAMAGES RELATED TO THIS DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NONPERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN INCLUDING WITHOUT LIMITATION ANY OF THE FOLLOWING DAMAGES: DIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, INDIRECT, SPECIAL, PUNITIVE, OR AGGRAVATED DAMAGES, DAMAGES FOR LOSS OF PROFITS OR REVENUES, FAILURE TO REALIZE ANY EXPECTED SAVINGS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, LOSS OF BUSINESS OPPORTUNITY, OR CORRUPTION OR LOSS OF DATA, FAILURES TO TRANSMIT OR RECEIVE ANY DATA, PROBLEMS ASSOCIATED WITH ANY APPLICATIONS USED IN CONJUNCTION WITH RIM PRODUCTS OR SERVICES, DOWNTIME COSTS, LOSS OF THE USE OF RIM PRODUCTS OR SERVICES OR ANY PORTION THEREOF OR OF ANY AIRTIME SERVICES, COST OF SUBSTITUTE GOODS, COSTS OF COVER, FACILITIES OR SERVICES, COST OF CAPITAL, OR OTHER SIMILAR PECUNIARY LOSSES, WHETHER OR NOT SUCH DAMAGES WERE FORESEEN OR UNFORESEEN, AND EVEN IF RIM HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, RIM SHALL HAVE NO OTHER OBLIGATION, DUTY, OR LIABILITY WHATSOEVER IN CONTRACT, TORT, OR OTHERWISE TO YOU INCLUDING ANY LIABILITY FOR NEGLIGENCE OR STRICT LIABILITY. THE LIMITATIONS, EXCLUSIONS, AND DISCLAIMERS HEREIN SHALL APPLY: (A) IRRESPECTIVE OF THE NATURE OF THE CAUSE OF ACTION, DEMAND, OR ACTION BY YOU INCLUDING BUT NOT LIMITED TO BREACH OF CONTRACT, NEGLIGENCE, TORT, STRICT LIABILITY OR ANY OTHER LEGAL THEORY AND SHALL SURVIVE A FUNDAMENTAL BREACH OR BREACHES OR THE FAILURE OF THE ESSENTIAL PURPOSE OF THIS AGREEMENT OR OF ANY REMEDY CONTAINED

50

Installation Guide

Legal notice

HEREIN; AND (B) TO RIM AND ITS AFFILIATED COMPANIES, THEIR SUCCESSORS, ASSIGNS, AGENTS, SUPPLIERS (INCLUDING AIRTIME SERVICE PROVIDERS), AUTHORIZED RIM DISTRIBUTORS (ALSO INCLUDING AIRTIME SERVICE PROVIDERS) AND THEIR RESPECTIVE DIRECTORS, EMPLOYEES, AND INDEPENDENT CONTRACTORS. IN ADDITION TO THE LIMITATIONS AND EXCLUSIONS SET OUT ABOVE, IN NO EVENT SHALL ANY DIRECTOR, EMPLOYEE, AGENT, DISTRIBUTOR, SUPPLIER, INDEPENDENT CONTRACTOR OF RIM OR ANY AFFILIATES OF RIM HAVE ANY LIABILITY ARISING FROM OR RELATED TO THE DOCUMENTATION. Prior to subscribing for, installing, or using any Third Party Products and Services, it is your responsibility to ensure that your airtime service provider has agreed to support all of their features. Installation or use of Third Party Products and Services with RIM's products and services may require one or more patent, trademark, copyright, or other licenses in order to avoid infringement or violation of third party rights. You are solely responsible for determining whether to use Third Party Products and Services and if any third party licenses are required to do so. If required you are responsible for acquiring them. You should not install or use Third Party Products and Services until all necessary licenses have been acquired. Any Third Party Products and Services that are provided with RIM's products and services are provided as a convenience to you and are provided "AS IS" with no express or implied conditions, endorsements, guarantees, representations, or warranties of any kind by RIM and RIM assumes no liability whatsoever, in relation thereto. Your use of Third Party Products and Services shall be governed by and subject to you agreeing to the terms of separate licenses and other agreements applicable thereto with third parties, except to the extent expressly covered by a license or other agreement with RIM. The terms of use of any RIM product or service are set out in a separate license or other agreement with RIM applicable thereto. NOTHING IN THIS DOCUMENTATION IS INTENDED TO SUPERSEDE ANY EXPRESS WRITTEN AGREEMENTS OR WARRANTIES PROVIDED BY RIM FOR PORTIONS OF ANY RIM PRODUCT OR SERVICE OTHER THAN THIS DOCUMENTATION. Certain features outlined in this documentation require a minimum version of BlackBerry Enterprise Server Software, BlackBerry Desktop Software, and/or BlackBerry Device Software and may require additional development or Third Party Products and Services for access to corporate applications. This product includes software developed by the Apache Software Foundation (www.apache.org/) and/or licensed pursuant to Apache License, Version 2.0 (www.apache.org/licenses/). For more information, see the NOTICE.txt file included with the software. Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Research In Motion Limited 295 Phillip Street Waterloo, ON N2L 3W8 Canada Research In Motion UK Limited 200 Bath Road Slough, Berkshire SL1 3XE United Kingdom Published in Canada

51