Windows Mobile 6.5 Enterprise App Store Deployment

This article examines how enterprise app stores and software distribution portals functioned for corporate deployments of Windows Mobile 6.5. During the late 2000s, enterprises required controlled, secure methods to deliver line-of-business (LOB) applications to ruggedized handhelds and smartphones without relying on consumer-facing marketplaces. The following sections outline the infrastructure, software packaging, client portals, and security protocols that powered private enterprise application delivery on Windows Mobile 6.5.

Infrastructure and Centralized Management Platforms

Corporate app distribution on Windows Mobile 6.5 was driven primarily by centralized Mobile Device Management (MDM) platforms rather than public app stores. Microsoft offered System Center Mobile Device Manager (SCMDM) 2008, which integrated directly with Active Directory and Group Policy. Third-party management suites such as Sybase Afaria, SOTI MobiControl, and early versions of AirWatch were also widely deployed.

These platforms served as the backend repository. IT administrators uploaded application packages, set user- or role-based access controls, and configured target device groups. Instead of browsing a public catalog, devices connected securely to these enterprise servers via Mobile Virtual Private Network (Mobile VPN) connections to retrieve available software.

The Client-Side Enterprise App Catalog

To deliver an "app store" experience to the end user, management platforms installed a native client agent onto the Windows Mobile 6.5 device.

  • Self-Service Portals: The client agent provided a simple, localized graphical interface. Users could view a list of authorized applications, check for version updates, and initiate installations on demand.
  • Push vs. Pull Delivery: Administrators could designate software as optional or mandatory. Mandatory updates were pushed silently in the background over-the-air (OTA) or applied during scheduled synchronization windows, while optional applications remained in the self-service catalog for user-initiated installation.
  • Intranet Portals: Smaller organizations without dedicated MDM servers often utilized internal IIS-hosted web portals. Employees opened Internet Explorer Mobile, navigated to an internal URL, authenticated via Active Directory, and clicked direct links to download application files.

Packaging via CAB Files and Provisioning XML

Applications on Windows Mobile 6.5 were packaged almost exclusively as Cabinet (.cab) files. These files contained:

  1. Compiled Binaries: The executable files and dynamic link libraries (DLLs), typically built with the .NET Compact Framework or native C++.
  2. Setup Instructions: An embedded _setup.xml file that instructed the Windows Mobile OS where to unpack binaries, write registry keys, create shortcuts, and set permissions.
  3. Provisioning XML (wappush/OMA-CP): Enterprise suites often bundled CAB files with Open Mobile Alliance Client Provisioning (OMA-CP) scripts to pre-configure application settings, database connection strings, and server endpoints during installation.

Security, Code Signing, and Execution Policies

Windows Mobile 6.5 enforced a two-tier security model consisting of Unprivileged and Privileged execution levels. Line-of-business applications often required privileged access to interact directly with hardware components, such as barcode scanners, serial interfaces, and local file storage.

To deploy software without triggering user-facing security warnings or outright installation blocks, enterprises implemented Private Key Infrastructure (PKI):

  • Enterprise Root Certificates: Administrators provisioned their internal root Certificate Authority (CA) certificates onto devices during initial staging.
  • Code Signing: All internal CAB packages and binaries were signed using a certificate generated by that internal CA.
  • Policy Enforcement: Through Group Policy or provisioning files, the mobile operating system was configured to trust enterprise-signed applications automatically, allowing silent installations and privileged execution without prompting the end user.

Staging and Distribution Workflows

Deployments were executed either Over-the-Air (OTA) or through physical docking stations:

  • OTA Distribution: Enabled field workers to receive updates cellularly or via Wi-Fi through an encrypted Mobile VPN tunnel connected to the company network.
  • Cradle/ActiveSync Distribution: For ruggedized warehouse and logistics devices, enterprises utilized batch docks connected via USB or Ethernet. Software distribution software detected the ActiveSync or Windows Mobile Device Center (WMDC) connection and deployed bulk updates while devices were charging overnight.