Wednesday, February 13, 2013

Assigning a Throttling Policy to all iOS 6.1 Devices in Exchange 2010

UPDATE 14-Feb-2013: After being linked to from Ars Technica, I felt the need to improve the script. My original version of the script tried to use the UserDisplayName field that is returned from Get-ActiveSyncDevice.  However, that field had a maximum number of characters, and a number of longer user DNs got cut off, which would make the script fail for that user. I figured out a way around it, and the script has been updated.

If you're an Exchange administrator, you have probably heard about the issues caused by Apple's iOS 6.1 on Exchange servers.  It seems that screwy calendar code in iOS 6.1 ends up generating tons of transaction logs in Exchange, and can bring CAS servers to its knees.

As an aside, its rather timely that this has come up just after the new Blackberry 10 came out.  Coincidence??????  Heh.

The temporary workarounds that MS recommends were to either apply a throttling policy to affected users, or block iOS 6.1 devices completely.  Since an all-out block is generally a Bad Thing, throttling policy is the way to go.  However, determining who is using iOS 6.1 and applying a throttling policy to them was not provided.

A company I do work for experienced the exact issue.  Exchange transaction logs were being generated at a prodigious rate.  So, rather than blocking them, we went the throttling route.  First, I created a throttling policy called iOS61 and set the ActiveSync throttling to the lowest recommended values:
New-ThrottlingPolicy -Name iOS61 -EASPercentTimeInCAS 10 -EASPercentTimeInAD 10 -EASPercentTimeInMailboxRPC 10
Then, I created a short Powershell script to apply the policy to any user with a device using iOS 6.1:
$DeviceList = Get-ActiveSyncDevice -ResultSize Unlimited | Where {$_.DeviceOS -match "iOS 6.1"}
foreach ($Device in $DeviceList)
$DeviceDN = $Device.DistinguishedName
Set-Mailbox $MBName -ThrottlingPolicy iOS61
The script will likely throw up some warnings about completing the command but not making any changes.  This happens because users may have more than one device, and the script tries to update the mailbox for every device it finds.  Nothing to be alarmed about.

Quick and dirty, but gets the job done.

Once Apple comes up with a solution, you can remove the throttling policy like this (assumes the users didn't have a throttling policy before this whole debacle):
Get-Mailbox -ResultSize Unlimited | Where {$_.ThrottlingPolicy -eq 'iOS61'} | Set-Mailbox -ThrottlingPolicy $NULL


  1. great tip!

    were you able to correct that "UserDisplayName" problem?

    1. Yes I did. See the updated script in the blog post.


  2. Wouldn't it suffice to use quotation marks for "$Device.UserName" to avoid your issue?

    1. Quotation marks won't work because I found the truncation was actually within the UserDisplayName field being output. I've figured out a way around it, and updated the script.

  3. Hello, great tip but userdisplay name where cut after 64 characters.
    Can you correct this?


    1. Was just corrected on the blog a few minutes ago. I don't use UserDisplayName any longer. Do a refresh.


  4. One-liner: Get-ActiveSyncDevice -Filter { DeviceOS -eq "iOS 6.1" } -ResultSize:Unlimited |% { ([ADSI] ([ADSI] ([ADSI] "GC://$($_.DistinguishedName -replace '\\', '/')").Parent).Parent).distinguishedName[0] } | Select-Object -Unique | Set-Mailbox -ThrottlingPolicy iOS6

  5. Hi,

    How can i found out which accounts are in this policy?
    And how can i test, work this policy with this accounts or not?


  6. This comment has been removed by the author.

  7. Now that 6.1.2 is out, I suggest changing the targeting filter to:
    Where {($_.DeviceOS -match "iOS 6.1") -and ($_.DeviceOS -notmatch "iOS 6.1.2")}