The smartphone I had before I bought my Nokia Lumia 930 was a Samsung S3. I changed phones after the S3 got run over by a car (a short, but dull, cautionary tale not worth relating here). The client I was working for at the time I still had the S3 had a BYOD option whereby you could hook up to their Exchange service via Exchange ActiveSync. It seemed like a sensible thing to do. The only snag was the EAS policy that was pushed out included device encryption. As soon as my S3 was encrypted it ran like a dog. A rotund, geriatric, three-legged dog. I couldn’t live with that, so I opted out of their service and decrypted the device.
Yesterday I was browsing my Lumia 930 settings to see if encryption was an option. I couldn’t see it, so started searching the Interweb for information. Here’s what I found…
“The Windows Phone OS supports using BitLocker technology to encrypt all user data stored locally on internal data partitions. This helps to protect the confidentiality of local device data from offline hardware attacks. If a phone is lost or stolen, and if the user locks their device with a PIN, device encryption helps make it difficult for an attacker to recover sensitive information from the device.
When device encryption is enabled, the main OS and internal user data store partitions are encrypted. SD cards that are inserted in the phone are not encrypted….
….Unlike BitLocker for desktop Windows, there is no recovery key backup and no UI option for end users to enable or disable device encryption on Windows Phones. Microsoft Exchange servers and enterprise device management servers cannot disable device encryption after it has been enabled.”
This is some good info, and apparently not well known, given the paucity of results from my searches.
Given that there is no UI for device encryption, the only known methods to enable it via a push from Exchange ActiveSync or an MDM device policy.
When I applied a policy forcing encryption to my Lumia 930, the only way I could determine whether encryption was enabled was via the Storage Sense app. The “After” picture below shows the encryption state. Blink and you’ll miss it.
Before
After
It is a little worrying that there is no way to decrypt the device. On the other hand there doesn’t seem to be a massive performance hit resulting from the encryption, so I’m happy to live with it.
Good article:)