[Non-Touchscreen Windows Mobile Other] -MyHTC-:
Windows Mobile powered devices are shipped with default security settings.

The security model enables Mobile Operators to make post-production changes to security settings.

This can place significant restrictions on software which has not been signed and approved.

However you can change the default settings.

Take control of applications on your phone.

"All listed settings are decimal"

1. Connect the phone through ActiveSync.

2. Run your favorite remote registry editor "CeRegEditor (Download)" "Mobile Registry Editor (Download)" on your PC.

3. Navigate to HKEY_LOCAL_MACHINE\Security\Policies\Policies

RAPI Policy:

This setting restricts the access of remote applications that are using Remote API (RAPI) to implement ActiveSync operations

HKEY_LOCAL_MACHINE\Security\Policies\Policies

DWord = 00001001 Data = Use the following-->

0 = Indicates that the ActiveSync service is shut down. RAPI calls are rejected.

1 = Indicates full access to ActiveSync is provided. RAPI calls are allowed to process without restrictions.

2 = Indicates that access to ActiveSync is restricted to the SECROLE_USER_AUTH (User Authenticated) role. RAPI calls are checked against this role mask before they are granted.

Unsigned cabs role:

If this policy is set to 0, then unsigned CABs won't install. The typical role is UserAuth which means the CABs will install but they have a similar set of privileges as code running at the Normal level. If this policy is set to Manager, then the unsigned CABs have all privileges.

None: Is equivalent to having none of the role mask bits set, and means that no unsigned .cab files can be installed.

OEM: Equipment manufacturer role.

Operator: Settings can be changed by the mobile operator.

Operator-TPS: Settings can be changed by a Wireless Application Protocol (WAP) Trusted Provisioning Server (TPS).

Manager: Provides permissions to change all of the settings on the device.

UserAuth: Settings can be changed by an authenticated user.

UserUnAuth: Settings can be changed by anyone.

A specified role mask indicates accepted unsigned .cab files are installed with the role mask specified.

HKEY_LOCAL_MACHINE\Security\Policies\Policies

DWord = 00001005 Data = Use the following-->

0 = None

2 = OEM

4 = Operator

6 = OEM, Operator

8 = Manager

10 = OEM, Manager

12 = Operator, Manager

14 = OEM, Operator, Manager

16 = UserAuth

18 = OEM, UserAuth

20 = Operator, UserAuth

22 = OEM, Operator, UserAuth

24 = Manager, UserAuth

26 = OEM, Manager, UserAuth

28 = Operator, Manager, UserAuth

30 = OEM, Operator, Manager, UserAuth

64 = UserUnAuth

66 = OEM, UserUnAuth

68 = Operator, UserUnAuth

70 = OEM, Operator, UserUnAuth

72 = Manager, UserUnAuth

74 = OEM, Manager, UserUnAuth

76 = Operator, Manager, UserUnAuth

78 = OEM, Operator, Manager, UserUnAuth

80 = UserAuth, UserUnAuth

82 = OEM, UserAuth, UserUnAuth

84 = Operator, UserAuth, UserUnAuth

86 = OEM, Operator, UserAuth, UserUnAuth

88 = Manager, UserAuth, UserUnAuth

90 = OEM, Manager, UserAuth, UserUnAuth

92 = Operator, Manager, UserAuth, UserUnAuth

94 = OEM, Operator, Manager, UserAuth, UserUnAuth

128 = Operator-TPS

130 = OEM, Operator-TPS

132 = Operator, Operator-TPS

134 = OEM, Operator, Operator-TPS

136 = Manager, Operator-TPS

138 = OEM, Manager, Operator-TPS

140 = Operator, Manager, Operator-TPS

142 = OEM, Operator, Manager, Operator-TPS

144 = UserAuth, Operator-TPS

146 = OEM, UserAuth, Operator-TPS

148 = Operator, UserAuth, Operator-TPS

150 = OEM, Operator, UserAuth, Operator-TPS

152 = Manager, UserAuth, Operator-TPS

154 = OEM, Manager, UserAuth, Operator-TPS

156 = Operator, Manager, UserAuth, Operator-TPS

158 = OEM, Operator, Manager, UserAuth, Operator-TPS

192 = UserUnAuth, Operator-TPS

194 = OEM, UserUnAuth, Operator-TPS

196 = Operator, UserUnAuth, Operator-TPS

198 = OEM, Operator, UserUnAuth, Operator-TPS

200 = Manager, UserUnAuth, Operator-TPS

202 = OEM, Manager, UserUnAuth, Operator-TPS

204 = Operator, Manager, UserUnAuth, Operator-TPS

206 = OEM, Operator, Manager, UserUnAuth, Operator-TPS

208 = UserAuth, UserUnAuth, Operator-TPS

210 = OEM, UserAuth, UserUnAuth, Operator-TPS

212 = Operator, UserAuth, UserUnAuth, Operator-TPS

214 = OEM, Operator, UserAuth, UserUnAuth, Operator-TPS

216 = Manager, UserAuth, UserUnAuth, Operator-TPS

218 = OEM, Manager, UserAuth, UserUnAuth, Operator-TPS

220 = Operator, Manager, UserAuth, UserUnAuth, Operator-TPS

222 = OEM, Operator, Manager, UserAuth, UserUnAuth, Operator-TPS

Unsigned Applications Policy:

This setting indicates whether unsigned applications are allowed to run on the device. Any value other than 1 is treated as 0.

HKEY_LOCAL_MACHINE\Security\Policies\Policies

DWord = 00001006 Data = Use the following-->

0 = Indicates that unsigned applications are not allowed to run on the device.

1 = Indicates that unsigned applications are allowed to run on the device.

Grant Manager Policy:

This policy contains a list of roles that are elevated to manager. If this role contains "UserAuth" then every action taken by the user has full administative access.

None: Indicates that only the manager is granted the Manager role.

OEM: Equipment manufacturer role.

Operator: Setting can be changed by the mobile operator.

Operator-TPS: Settings can be changed by a Wireless Application Protocol (WAP) Trusted Provisioning Server (TPS).

Manager: Settings can be changed by the manager or administrator.

UserAuth: Settings can be changed by an authenticated user.

UserUnAuth: Settings can be changed by anyone.

A specified role mask indicates system administrative privileges are given to the role mask specified.

HKEY_LOCAL_MACHINE\Security\Policies\Policies

DWord = 00001017 Data = Use the following-->

0 = None

2 = OEM

4 = Operator

6 = OEM, Operator

8 = Manager

10 = OEM, Manager

12 = Operator, Manager

14 = OEM, Operator, Manager

16 = UserAuth

18 = OEM, UserAuth

20 = Operator, UserAuth

22 = OEM, Operator, UserAuth

24 = Manager, UserAuth

26 = OEM, Manager, UserAuth

28 = Operator, Manager, UserAuth

30 = OEM, Operator, Manager, UserAuth

64 = UserUnAuth

66 = OEM, UserUnAuth

68 = Operator, UserUnAuth

70 = OEM, Operator, UserUnAuth

72 = Manager, UserUnAuth

74 = OEM, Manager, UserUnAuth

76 = Operator, Manager, UserUnAuth

78 = OEM, Operator, Manager, UserUnAuth

80 = UserAuth, UserUnAuth

82 = OEM, UserAuth, UserUnAuth

84 = Operator, UserAuth, UserUnAuth

86 = OEM, Operator, UserAuth, UserUnAuth

88 = Manager, UserAuth, UserUnAuth

90 = OEM, Manager, UserAuth, UserUnAuth

92 = Operator, Manager, UserAuth, UserUnAuth

94 = OEM, Operator, Manager, UserAuth, UserUnAuth

128 = Operator-TPS

130 = OEM, Operator-TPS

132 = Operator, Operator-TPS

134 = OEM, Operator, Operator-TPS

136 = Manager, Operator-TPS

138 = OEM, Manager, Operator-TPS

140 = Operator, Manager, Operator-TPS

142 = OEM, Operator, Manager, Operator-TPS

144 = UserAuth, Operator-TPS

146 = OEM, UserAuth, Operator-TPS

148 = Operator, UserAuth, Operator-TPS

150 = OEM, Operator, UserAuth, Operator-TPS

152 = Manager, UserAuth, Operator-TPS

154 = OEM, Manager, UserAuth, Operator-TPS

156 = Operator, Manager, UserAuth, Operator-TPS

158 = OEM, Operator, Manager, UserAuth, Operator-TPS

192 = UserUnAuth, Operator-TPS

194 = OEM, UserUnAuth, Operator-TPS

196 = Operator, UserUnAuth, Operator-TPS

198 = OEM, Operator, UserUnAuth, Operator-TPS

200 = Manager, UserUnAuth, Operator-TPS

202 = OEM, Manager, UserUnAuth, Operator-TPS

204 = Operator, Manager, UserUnAuth, Operator-TPS

206 = OEM, Operator, Manager, UserUnAuth, Operator-TPS

208 = UserAuth, UserUnAuth, Operator-TPS

210 = OEM, UserAuth, UserUnAuth, Operator-TPS

212 = Operator, UserAuth, UserUnAuth, Operator-TPS

214 = OEM, Operator, UserAuth, UserUnAuth, Operator-TPS

216 = Manager, UserAuth, UserUnAuth, Operator-TPS

218 = OEM, Manager, UserAuth, UserUnAuth, Operator-TPS

220 = Operator, Manager, UserAuth, UserUnAuth, Operator-TPS

222 = OEM, Operator, Manager, UserAuth, UserUnAuth, Operator-TPS

Unsigned Prompt Policy:

This policy indicates whether the user is prompted to accept or reject unsigned .cab, theme, .dll and .exe files.

HKEY_LOCAL_MACHINE\Security\Policies\Policies

DWord = 0000101a Data = Use the following-->

0 = Indicates user will be prompted.

1 = Indicates user will not be prompted.

Privileged Apps Policy:

The Privileged Apps policy setting specifies which security model is implemented on the device. Any value other than 1 is treated as 0.

HKEY_LOCAL_MACHINE\Security\Policies\Policies

DWord = 0000101b Data = Use the following-->

0 = Two Tier: Applications run normal and cannot access the protected registry keys or protected system APIs.

1 = One Tier: Applications run privileged and can access all registry keys and all system APIs.

Password Required Policy:

This policy indicates whether a password must be configured on the device.

HKEY_LOCAL_MACHINE\Security\Policies\Policies

DWord = 00001023 Data = Use the following-->

0 = Indicates that a password is required.

1 = Indicates that a password is not required. "Any value other than 0 will indicate no password required".

Desktop Unlock Policy:

This policy indicates how the desktop must handle authentication when the device is locked.

HKEY_LOCAL_MACHINE\Security\Policies\Policies

DWord = 00001025 Data = Use the following-->

0 = Indicates that the user must authenticate on the device if it is locked upon connect.

1 = Indicates the user can authenticate by using a PIN on the desktop.

If you find any errors please let me know.

I will update the list as more policies are discovered