Managing Windows Mobile 6.5 with System Center MDM

Microsoft System Center Mobile Device Manager (SCMDM) 2008 was an enterprise mobility management solution designed to bring Windows Mobile 6.1 and 6.5 devices under centralized corporate IT governance. By integrating directly with existing Active Directory, Public Key Infrastructure (PKI), and Group Policy architectures, SCMDM treated Windows Mobile smartphones similarly to domain-joined Windows PCs. This article explains how SCMDM delivered security, device configuration, network connectivity, and application distribution to enterprise Windows Mobile 6.5 fleets.

Enrollment and Device Identity

Management began with an over-the-air enrollment process that established mutual trust between the enterprise and the Windows Mobile 6.5 device. IT administrators generated a one-time enrollment password in the SCMDM console and provided it to the end user alongside their corporate Active Directory credentials.

During the enrollment wizard on Windows Mobile 6.5, the device communicated with the SCMDM Enrollment Server via SSL. The server authenticated the user against Active Directory and initiated an automated certificate request to the corporate Active Directory Certificate Services (AD CS). The device was then provisioned with a machine certificate, establishing a unique, cryptographically verified identity inside Active Directory.

Group Policy Enforcement

Unlike consumer-grade Exchange ActiveSync (EAS) policies that only enforced basic PIN requirements, SCMDM extended traditional Active Directory Group Policy Objects (GPOs) directly to Windows Mobile 6.5 devices. SCMDM introduced hundreds of granular mobile-specific GPO settings, allowing administrators to:

  • Enforce strong password complexity and lock-out thresholds.
  • Require hardware-based or file-level storage encryption on both internal memory and external microSD cards.
  • Disable device hardware features, such as integrated cameras, Bluetooth, Wi-Fi, infrared ports, and USB mass storage modes.
  • Restrict third-party application execution by requiring cryptographic code-signing from trusted corporate authorities.

Once GPOs were updated in Active Directory, SCMDM compiled the settings and pushed them to the managed devices automatically.

Mobile VPN and Secure Intranet Access

SCMDM included a dedicated Gateway Server role placed inside the corporate DMZ to handle network security. Windows Mobile 6.5 contained an embedded, standards-based IPsec Mobile VPN client that worked natively with this gateway.

Once enrolled, the mobile device could establish an encrypted, authenticated IPsec tunnel to the SCMDM Gateway Server using its machine certificate. This Mobile VPN supported persistent session traversal, meaning mobile workers stayed connected when transitioning between cellular networks and Wi-Fi access points without dropping sessions. It provided secure, direct access to on-premises resources—such as SharePoint portals, intranet web applications, and internal Line of Business (LOB) servers—without exposing those servers directly to the public internet.

Over-the-Air Software Distribution and Asset Inventory

SCMDM provided centralized software lifecycle management for Windows Mobile 6.5 fleets. Administrators packaged applications into native .cab installers and published them through the SCMDM Software Distribution Console or through integration with System Center Configuration Manager (SCCM).

The management infrastructure allowed administrators to:

  • Target software deployments to specific Active Directory security groups or device collections.
  • Designate installations as mandatory (pushed silently over-the-air without user intervention) or optional (available for download via a mobile self-service catalog).
  • Collect hardware and software inventories, reporting back operating system versions, installed software packages, and device specifications.

Remote Management and Security Lifecycle

Throughout the device lifecycle, administrators maintained complete remote command capabilities over the Windows Mobile 6.5 fleet. If a device was lost, stolen, or the employee left the company, administrators could execute an over-the-air remote wipe command that returned the device to its factory state and destroyed local encryption keys. Additionally, the device's Active Directory object and associated machine certificate could be immediately revoked, permanently severing access to the corporate network and internal applications.