Windows Mobile Device Lockdown

Device lockdown replaces the standard device home screen and Windows Start button with a customizable home screen. Users have access only to authorized applications and websites, and are prevented from accessing all other applications and device controls. With the lockdown policy we are also able to change the home screen based on their current speed. This is called the Speed Lockdown.

Please see the Windows Mobile Device Speed Lockdown page for more information about the Speed lockdown.

Lockdown Policy dialog box

By locking down devices, organizations can minimize the risk of unauthorized persons accessing information on their mobile devices. Administrators can control exactly which programs users are allowed to run, and which websites they are allowed to visit. This decreases the amount of down-time caused by users changing settings that may adversely affect the operation of the device or application software, and also decreases support costs. MobiControl allows running the mobile devices in a kiosk mode with a read-only access to provide critical information to the end users, without giving them access to change the settings.

The lockdown menu can only be dismissed by an administrator. Specification of a user password is optional. If not configured the device user can access the lockdown menu directly after turning on the device. If a user password is defined, then the password must be entered in order to access the lockdown menu.

To configure lockdown settings for a device or group of devices, select the target device or group in the device tree view in the main console window and select Security from the Configure Device(s) submenu.

Field Name	Description
Enable lockdown menu	Use this check box to enable or disable the device lockdown menu.
Device Program Menu	The device program menu is a list of programs and websites to which the user has access. There are pre-configured HTML menu templates that can be edited or applied to the menu, and an option to enable or disable the launching of a menu item with keyboard shortcuts. Please see the Device Program Menu section below for details.
HTML menu template	Select a menu template from the drop-down list. Please see the Templates section below or the Customizing Lockdown Program Menu Templates page for more information.
Enable program launch via keyboard shortcuts	Keyboard shortcuts such as numeric keys can be used to launch lockdown menu items. See the Shortcuts section below.
Device Navigation Bar	Note: This applies to only Pocket PC and CE devices; it does not apply to Smartphone devices. The device navigation bar, commonly referred to as the task bar, contains the Start button and small icons for quick access to device status and settings such as the time, date, wireless status, or volume control. By default, when lockdown is enabled, the standard operating system navigation bar is replaced with a customizable navigation bar. Select the Configure button to specify which icons in the custom navigation bar are to be made available to the device user. Please see the Navigation Bar Configuration section below for details.

Add New Menu Item dialog box

Tip:

To provide the device users with access to specific websites and prevent access to other websites, provide the URL in the Program Path of the Add New Menu Item line.
If you link to a search engine the end user will gain full access to the Internet.

Device Program Menu

Use the New button to add menu items. Each entry consists of a user-friendly name and a complete file path to the executable, .lnk shortcut file, .cmd script file, or website address (URL). To adjust the position of the menu items, use the Move Up and Move Down buttons.

Field Name	Description
Display Name	This is the displayed name of the menu item which will appear on the device.
Program Path	Notes: For command line parameters, a comma must be used to separate the program path from the parameter. For example, write `\windows\poutlook.exe,contacts without spaces.` Incase a " character is required for paths including spaces in them, in place of double quotes, %22 MUST be used. This is the path for the web address, or executable file on the device. You can either type in the path or you can browse the file using the browse button . You can only browse the files if the device is connected to the desktop via ActiveSync. For instance, the program path for Pocket Word is `\windows\pword.exe`. The path will not be displayed on the Menu page.
Image (optional)	Note: If you wish to replace an image that had been previously imported, upload the new graphic file, maintaining the same file name as the old one. You will be asked to confirm the overwrite of the old file. Click Yes, and the new image will be in effect. This is the name of the image file that you want to display in the lockdown menu with this menu entry. By selecting the image in this dialog box, it will be automatically delivered to the device along with the lockdown configuration. Select an image from the drop-down list, or click the browse button to select an image from your desktop computer. In order to display this image in the lockdown menu, it is necessary for the HTML template to have a special `<MCDispImgN>` tag. Please see the Customizing Lockdown Program Menu Templates page for instructions on how to make this image appear in the Lockdown menu.
Launch automatically on startup	When this option is checked, the selected program will be automatically executed on startup (i.e. after a soft reset, or restart of the lockdown process).

Tip:

On devices that feature a numeric keypad, an alternative to tapping the screen to launch the menu entries is entering the number that corresponds to the menu item. For example, press 2 to launch the second menu item.

Device lockdown page

Templates

The lockdown program menu is displayed as an HTML web page to the user. The Template drop-down box allows you to select an HTML template from a list of built in templates and your own customized templates.

You can easily create a customized lockdown template by copying an existing template and directly modifying HTML code in the built-in Lockdown Menu Template Editor available in MobiControl. (Please see the Customizing Lockdown Program Menu Templates page.) You can also use your favorite HTML editor. When editing the HTML file, be sure to preserve the special MobiControl Menu tags. These special tags are automatically replaced with the appropriate Program Menu entries by MobiControl.

Once you have selected the desired template and clicked the OK button, MobiControl will merge the menu items that you have configured with the selected template and generate a custom HTML menu page.

Keyboard Shortcuts

If the checkbox next to Enable program launch via keyboard shortcuts is selected, program menu items may launch in a few additional ways: pressing a numeric key on the device or using a scanner will launch the program menu item corresponding to the value of the numeric key or barcode. To prevent this, clear the checkbox next to Enable program launch via keyboard shortcuts.

Navigating Device Lockdown

Back Button:
While you are navigating a web page within the lockdown, the back button will allow you to return to the previous page.

Right Click Option:
Click and hold on the device screen to bring up the "Right Click" menu. This allows you to copy and paste contents from within the lockdown.

Note:

This feature is only supported on Windows Mobile 5.0 or later devices.

Navigation Bar Configuration

Navigation Bar Configuration dialog box

Field Name	Description
Use custom lockdown navigator	Enabled custom lockdown navigation bar displaying all the available icons This option will only allow the selected icons to show up in a custom navigation bar. The user will have the ability to click on the icons and have view-only access. The user will not be allowed to make any configuration changes using the icons on the navigation bar. Please see the descriptions of the six options following this table. Note: The icons of the lockdown custom navigation bar are non-responsive on Windows CE 6.0 devices due to a current limitation. This will be addressed in a later version.
Use standard operating system navigation bar	Enabled Windows navigation bar This option will display the standard operating system's navigation bar. This option is recommended if there are specific icons that appear in the standard navigation bar that are not available in the custom navigation bar. In order to prevent the user from accessing Programs listed in the Start menu and links to Settings from popup balloons accessed through the navigation bar icons, the navigation bar is disabled by default. For only Pocket PC devices, it is possible to enable the navigation bar icons. This option will allow the user unrestricted access to the Windows navigation bar.
Hide navigation bar	For only Windows CE.NET devices, this option will hide the navigation bar completely. Disabled and enabled "Hide navigation bar"

Field Name

Description

Use custom lockdown navigator

Enabled custom lockdown navigation
bar displaying all the available icons

This option will only allow the selected icons to show up in a custom navigation bar. The user will have the ability to click on the icons and have view-only access. The user will not be allowed to make any configuration changes using the icons on the navigation bar. Please see the descriptions of the six options following this table.

Note:

The icons of the lockdown custom navigation bar are non-responsive on Windows CE 6.0 devices due to a current limitation. This will be addressed in a later version.

Use standard operating system navigation bar

Enabled Windows navigation bar

This option will display the standard operating system's navigation bar. This option is recommended if there are specific icons that appear in the standard navigation bar that are not available in the custom navigation bar.

In order to prevent the user from accessing Programs listed in the Start menu and links to Settings from popup balloons accessed through the navigation bar icons, the navigation bar is disabled by default.

For only Pocket PC devices, it is possible to enable the navigation bar icons. This option will allow the user unrestricted access to the Windows navigation bar.

Hide navigation bar

For only Windows CE.NET devices, this option will hide the navigation bar completely.

Disabled and enabled "Hide navigation bar"

Enabled custom lockdown navigation bars with date-time and volume

The Date-Time option will display the time on the custom lockdown navigation bar. When the time is selected, a window will display the date, time and user's appointments.
The Volume option will cause the volume icon to be displayed on the custom lockdown navigation bar. When the volume icon is selected, the volume window will open and the user will be able to adjust the mobile device's sound and volume, change it to vibrate or turn off the sound completely.

Enabled custom lockdown navigation bars with battery and wireless network
The Battery option will cause the battery icon to be displayed on the custom lockdown navigation bar. When the battery icon is selected, a window will display the percentage of the battery charge.
The Wireless Network option will cause the wireless bar icon to be displayed on the custom lockdown navigation bar. When the wireless bar icon is selected, a window will display the mobile device's wireless settings such as the signal strength, MAC address and IP address.

Enabled custom lockdown navigation bar notification and Start menu
The Notification option will cause the Notification icon to appear in the custom lockdown navigation bar when there is an unacknowledged notification on the device. When the notification icon is selected, a pop-up menu will display, from which the user can select the notification to be displayed. This option also controls the display of the Notification menu entry in the Lockdown window.
The Start Menu option allows the custom navigation bar to replace the standard Start menu with a listing of the programs specified in the Program Menu. This allows the Start menu to be used as an "application switcher" to move quickly from one application to another.