11 Mobile Security Notification Server

This chapter describes troubleshooting tips for the Mobile Security Notification Server.

If notifications are not being sent to clients, verify the following:

The Exchange configuration matches the version of Exchange.
The permission of the proxy account to act on behalf of users is configured in exchange. This permission is different for Exchange 2007 than for Exchange 2010.

Details for the two versions are described in the following sections:

Section 11.1, "Exchange Impersonation on Exchange 2007"
Section 11.2, "Exchange Impersonation on Exchange 2010"

11.1 Exchange Impersonation on Exchange 2007

Exchange 2007 requires two rights to be able to get Exchange Impersonation working:

*ms-Exch-EPI-Impersonation: This right is applied to the Client Access Server and grants the Service Account permission to function as an Exchange Impersonation account on that CAS.
oms-Exch-EPI-May-Impersonate: This right is applied on either a user-by-user basis for each of the users that require impersonation to be enabled, or it can be applied on a mailbox database.

For example, Joe Client is a user with a device, and EWS Proxy is the account used to impersonate the user for notification. To add these rights:

Add-ADPermission 
      -Identity (Get-ExchangeServer 
      -IdentityYOUR_   CAS).DistinguishedName
      -User (Get-User -Identity "EWS Proxy").Identity
      -extendedRight ms-Exch-EPI-Impersonation

   Add-ADPermission 
      -Identity (Get-User -Identity "Joe Client").DistinguishedName
      -User (Get-User -Identity "EWS Proxy").Identity
      -extendedRight ms-Exch-EPI-May-Impersonate

11.2 Exchange Impersonation on Exchange 2010

Exchange 2010 requires the rights to be able to get Exchange Impersonation working:

The AD users are placed in a group (for example; Notification Users), and the service account has the Management scope of the AD group that exchange is recognized. For example:
```
New-ManagementScope -Name:"ExchImpersonationScope" -RecipientRestrictionFilter {memberofgroup -eq "CN=BNS Users,OU=QA,DC=bitzermobile,DC=com"}
```

Define Assign Role:

New-ManagementRoleAssignment -Name:"ExchImpersonationRole" -Role:ApplicationImpersonation -User:"ewsproxy@example.com" -CustomRecipientWriteScope:"ExchImpersonationScope

If you receive this message:

microsoft.exchange.webservices.data.ServiceVersionException: Method SubscribeToPushNotificationsOnAllFolders is only valid for Exchange Server version Exchange2010 or later

This means that an incorrect exchange version was selected when installing Mobile Security Notification Server.

If there are no errors it may be caused by Apple Push Notification server, as it does not guarantee for delivery. Verify your Apple credentials provided are valid.