We have a device that uses Exchange web services to download mail and calendar information. It uses active directory credentials to authenticate itself with Exchange. The device stores user id and password. When user changes password from his PC (as IT enforce password expiration), the device mail stops working until the password on the device is changed as well. While looking into this, we found that Windows CE based smart phone as well as iPhone doesn’t prompt for password when its password for Exchange is out of sync. They still work.
How is that possible? Is there some special Exchange configuration for it to work? That looks like a security hole to me.
I found that they do prompt for new password several hours later. Its just that cached credentials in Exchange cloud let iPhone and other smart phones go through for some time before they get password prompt when the cloud’s credentials get updated from active directory.