# Device shows:
"Account could not be verified. Please check your settings."
"Permission to sync not established"
"Your device is not allowed to sync"

# iOS specific:
"Cannot Verify Account"
"The mail server is not responding"

# Android specific:
"Unable to open connection to server"
"Authentication failed"

# In Exchange logs:
"DeviceAccessState: Quarantined"
"DeviceAccessState: Blocked"
"ActiveSync: Access denied for device"

# Check user's device access
$user = "john.doe@domain.com"
Get-ActiveSyncDeviceStatistics -Mailbox $user | Select-Object DeviceId, DeviceType, DeviceAccessState, DeviceAccessStateReason

# Check organization-wide settings
Get-ActiveSyncOrganizationSettings | Select-Object DefaultAccessLevel, UserMailInsert

# Check user's CAS mailbox settings
Get-CASMailbox -Identity $user | Select-Object ActiveSyncEnabled, ActiveSyncAllowedDeviceIDs, ActiveSyncBlockedDeviceIDs

# Verify ActiveSync is enabled
$user = "john.doe@domain.com"
$cas = Get-CASMailbox -Identity $user

Write-Host "ActiveSync Enabled: $($cas.ActiveSyncEnabled)"
Write-Host "Allowed Devices: $($cas.ActiveSyncAllowedDeviceIDs -join ', ')"-join ', ')"
Write-Host "Blocked Devices: $($cas.ActiveSyncBlockedDeviceIDs -join ', ')"-join ', ')"
Write-Host "Device Policy: $($cas.ActiveSyncMailboxPolicy)"

# Get device details
$user = "john.doe@domain.com"
Get-ActiveSyncDeviceStatistics -Mailbox $user | Format-Table DeviceId, DeviceType, DeviceModel, DeviceAccessState, DeviceAccessStateReason, FirstSyncTime, LastSuccessSync -AutoSize

# Check for quarantined devices specifically
Get-ActiveSyncDeviceStatistics -Mailbox $user | Where-Object { $_.DeviceAccessState -eq "Quarantined" }

# Check default access level
Get-ActiveSyncOrganizationSettings | Format-List DefaultAccessLevel, AdminMailRecipients, UserMailInsert

# Default levels:
# - Allow = All devices allowed by default
# - Block = All devices blocked by default
# - Quarantine = New devices quarantined for approval

# Check device access rules
Get-ActiveSyncDeviceAccessRule | Format-Table Name, AccessLevel, Characteristic, QueryString

# Get the device ID
$user = "john.doe@domain.com"
$devices = Get-ActiveSyncDeviceStatistics -Mailbox $user
$devices | Format-Table DeviceId, DeviceType, DeviceAccessState

# Allow specific device
$deviceId = "AppleDQ7xxxxx"  # Replace with actual device ID
Set-CASMailbox -Identity $user -ActiveSyncAllowedDeviceIDs @{Add=$deviceId}

# Verify
Get-CASMailbox -Identity $user | Select-Object ActiveSyncAllowedDeviceIDs

Write-Host "Device approved. User should retry sync on device."

# If ActiveSync is disabled
$user = "john.doe@domain.com"
Set-CASMailbox -Identity $user -ActiveSyncEnabled $true

# Verify
Get-CASMailbox -Identity $user | Select-Object DisplayName, ActiveSyncEnabled

# Check current settings
Get-ActiveSyncOrganizationSettings | Format-List

# Option 1: Allow all devices by default (least secure)
Set-ActiveSyncOrganizationSettings -DefaultAccessLevel Allow

# Option 2: Quarantine new devices for approval (balanced)
Set-ActiveSyncOrganizationSettings -DefaultAccessLevel Quarantine -AdminMailRecipients admin@domain.com -UserMailInsert "Your device is pending approval. Please contact IT."

# Option 3: Block all by default, whitelist specific (most secure)
Set-ActiveSyncOrganizationSettings -DefaultAccessLevel Block

# After setting Quarantine or Block, approve devices individually
# Or create Device Access Rules for automatic approval

# Allow all iPhones automatically
New-ActiveSyncDeviceAccessRule -QueryString "iPhone" -Characteristic DeviceType -AccessLevel Allow

# Allow all iOS devices
New-ActiveSyncDeviceAccessRule -QueryString "iOS" -Characteristic DeviceOS -AccessLevel Allow

# Allow Android devices
New-ActiveSyncDeviceAccessRule -QueryString "Android" -Characteristic DeviceOS -AccessLevel Allow

# Block specific problematic device types
New-ActiveSyncDeviceAccessRule -QueryString "OutlookBasicAuth" -Characteristic UserAgent -AccessLevel Block

# View all rules
Get-ActiveSyncDeviceAccessRule | Format-Table Name, Characteristic, QueryString, AccessLevel

# Check if device is explicitly blocked
$user = "john.doe@domain.com"
$cas = Get-CASMailbox -Identity $user
Write-Host "Blocked Devices: $($cas.ActiveSyncBlockedDeviceIDs)"

# Remove device from blocked list
$deviceId = "AppleDQ7xxxxx"
Set-CASMailbox -Identity $user -ActiveSyncBlockedDeviceIDs @{Remove=$deviceId}

# Or clear all blocked devices
Set-CASMailbox -Identity $user -ActiveSyncBlockedDeviceIDs $null

# Add to allowed list
Set-CASMailbox -Identity $user -ActiveSyncAllowedDeviceIDs @{Add=$deviceId}

# Verify
Get-CASMailbox -Identity $user | Select-Object ActiveSyncBlockedDeviceIDs, ActiveSyncAllowedDeviceIDs

# List available Mobile Device Mailbox Policies
Get-MobileDeviceMailboxPolicy | Select-Object Name, IsDefault, PasswordEnabled, AllowSimpleDevicePassword, MinDevicePasswordLength

# Check what policy is assigned
$user = "john.doe@domain.com"
Get-CASMailbox -Identity $user | Select-Object ActiveSyncMailboxPolicy

# Create a less restrictive policy if needed
New-MobileDeviceMailboxPolicy -Name "StandardDevices" -PasswordEnabled $false -AllowNonProvisionableDevices $true -AllowSimpleDevicePassword $true

# Assign policy to user
Set-CASMailbox -Identity $user -ActiveSyncMailboxPolicy "StandardDevices"

# Or use default policy
Set-CASMailbox -Identity $user -ActiveSyncMailboxPolicy "Default"

# Get all quarantined devices
$quarantined = Get-ActiveSyncDevice -ResultSize Unlimited | Where-Object { $_.DeviceAccessState -eq "Quarantined" }

Write-Host "Found $($quarantined.Count) quarantined devices"

# Approve each device
foreach ($device in $quarantined) {
    $mailbox = $device.Identity -split "\\" | Select-Object -First 1
    $deviceId = $device.DeviceId

    Write-Host "Approving $deviceId for $mailbox"$mailbox"
    Set-CASMailbox -Identity $mailbox -ActiveSyncAllowedDeviceIDs @{Add=$deviceId}
}

Write-Host "All quarantined devices approved"

$user = "john.doe@domain.com"

# Check device is now allowed
$devices = Get-ActiveSyncDeviceStatistics -Mailbox $user
$devices | Format-Table DeviceId, DeviceType, DeviceAccessState, LastSuccessSync

# Verify all states are "Allowed" not "Quarantined" or "Blocked""Quarantined" or "Blocked"
$blocked = $devices | Where-Object { $_.DeviceAccessState -ne "Allowed" }
if ($blocked) {
    Write-Host "Some devices still not allowed:" -ForegroundColor Yellow
    $blocked | Format-Table DeviceId, DeviceAccessState
} else {
    Write-Host "All devices allowed" -ForegroundColor Green
}

# Have user retry sync on device
Write-Host ""
Write-Host "User should now:"
Write-Host "1. Remove the Exchange account from device"
Write-Host "2. Re-add the account"-add the account"
Write-Host "3. Sync should now work"