Take the 2-minute tour ×

We just rolled out a Blackberry Express Server, and would like to make sure that all Blackberry devices that our users own are connecting SOLELY through the BES server. We are running Exchange 2010 SP1.

I've read some links that discuss blocking BIS at the firewall level. Before doing that, however, I'd like to individually contact all users with Blackberries and make sure that they have a chance to switch to the BES server. I've sent a company-wide email, but unsurprisingly folks tend to tune these out until they are forced into action.

Is there an easy way to identify the users with Blackberries by searching IIS logs, or perhaps using the Exchange Management Shell? Especially some automated way? I've tried searching for the Blackberry identifier, but it does not appear next to any user name, so it's not as helpful as it could be.

Edit: to clarify, what I'm talking about is the fact that Blackberries can use OWA to download mail to the phone. We do not allow IMAP or POP access through our firewall so that's not a concern--just folks with Blackberries using Blackberry's hack to allow it to connect to Exchange without a BES server. As far as I know, Blackberries are the only popular phones that use this method to download mail.

share|improve this question
add comment

3 Answers

Not sure what you mean by "Blackberry identifier" - BIS spoofs an IE user-agent string for its requests. The best way to find the requests in my experience is looking at the IIS logs for requests coming from the BIS servers (address ranges are here). These requests WILL have usernames in the requests they send, something like https://owa.example.com/exchange/username.

As far as finding all the requests.. it's a pain if you don't have a good means to search the logs. The BIS servers seem to batch the requests for all users on your server into requests coming from a specific server, so once you find one, searching for other requests from that specific IP is a good approach.

As far as blocking, I've found that it's pretty effective to block the BIS ranges directly in the reverse proxy's config so that I can find (from the 403's in the log) which users are attempting to set their phones up with BIS and set them straight.

share|improve this answer
Yes I meant user-agent, just couldn't think of the proper name when i wrote it out. Ah, I was hoping that the user agent would specify Blackberry, since I saw some user agents with Blackberry in the log. I guess those must have been people using the Blackberry browser, not BIS? –  Quinten Mar 16 '11 at 17:12
@Quinten Correct. The best way to identify BIS connections is the source IP address. It will be in one of the ranges in this article. From there you can find all the requests from that IP (it tends to stick to one address), and use the urls they're requesting to figure out which users it's connecting to. –  Shane Madden Mar 16 '11 at 17:27
Darn, unfortunately we have an ISA server. I tried doing a search on all of the IP ranges in that link, but of course all of our OWA external requests go through the ISA server and have a single originating IP. I'll have to figure out how to grab the logs on our ISA server and try from there. Thanks for sending me in the right direction though. –  Quinten Mar 16 '11 at 17:46
add comment

My IIS logs do contain BlackBerry references if someone accesses OWA from it. (Note the BlackBerry9630)

2011-03-16 15:56:29 W3SVC1 GET /owa - 80 - BlackBerry9630/ 301 0 0

I'm confused as to what your exact question is. Are you saying you have people using OWA from their BlackBerry devices, or are they connecting to your Exhange server using IMAP or POP?

share|improve this answer
Blackberry devices can use OWA to download email to the phone. I don't care if they are just using the mobile browser, but if they are downloading messages I only want them to do so through our BES server. What I want is a way to identify the user who is connecting to OWA from a Blackberry. The log entry you show above is just what I'm seeing--but I want to link it to a specific user ID. –  Quinten Mar 16 '11 at 16:04
a BIS request is not issued by the Blackberry itself, but by servers in RIM's infrastructure. The user configures their credentials in a site with their cell phone provider, which utilizes the servers in RIM's BIS environment to spider your OWA with their login and fetch mail, which is passed to the device. –  Shane Madden Mar 16 '11 at 16:23
add comment
up vote 1 down vote accepted

OK, I worked on this for a few more hours, and here's what I found:

1) ISA tracks the client IPs that were missing in the IIS logs, so I was able to find references to the Blackberry Internet Service IP ranges. Unfortunately, all of the USER references are anonymous, as the ISA server doesn't handle authentication--it just passes on the request to the Exchange 2010 box. So, by itself, the ISA logs were useless.

2) Matching up the ISA logs to the IIS logs was looking to be a lot of work, as the only way I could really think to do it would be by matching up timestamps, and time synchronization couldn't be guaranteed.

3) As I scanned the IIS logs again, I noticed several requests using the PROPFIND method, which I was not familiar with. After researching it, I learned this is the Webdav method for accessing OWA. BIS uses Webdav to download OWA messages to the Blackberry, so this is a useful clue.

4) I searched the IIS logs for all queries using the PROPFIND method. These do, in fact, include the user name. It's not guaranteed that these are Blackberry users, but at least it's more useful than a blanket email to limit it to entries using an access method that's predominantly used by BIS. Most (but not all) of the user names that popped up match the user IDs of folks that I know to be using the Blackberry, so pretty good correlation--my guess is that the exceptions are using a Blackberry but just didn't tell us about it.

Someone correct me if my reasoning is wrong! Hopefully this helps someone else with a similar task.

share|improve this answer
PROPFIND is used by other clients, too.. you should be able to filter that down further. If your ISA logs are configured right, you should be able to dig up the PROPFIND requests from those logs, too, then check those for BIS IP addresses. –  Shane Madden Mar 18 '11 at 17:07
@Shane Madden: Good point. In the end this method worked OK because we only have about 10 users who were on this list, so I did not feel badly about contacting them individually to make sure they knew to switch over to our BES server. It turns out that they all had a Blackberry. I was able to search the OWA logs using the Microsoft tool "log parser"--very useful. Here is the query I used: SELECT cs-uri-stem AS URL FROM \\mailserver\c$\inetpub\logs\LogFiles\W3SVC1*.log WHERE cs-method LIKE 'PROPFIND' GROUP BY URL –  Quinten Mar 22 '11 at 19:37
add comment

Your Answer


