Once active sync is enable for a user, is there a way to control what make\model of active sync device can connect to exchange?

The only thing would be to prevent Allow non-provisibale devices. http://msexchangeteam.com/archive/2007/05/23/439541.aspx However that will only prevent devices that fully support the ActiveSync Policies. After that there is nothing really to stop them. Mark Morowczynski|MCT| MCSE 2003:Messaging, Security|MCITP:EMA 2K7,EDA Win 7,ES,SA,EA|MCTS:Windows Mobile Admin|Security+|http://almostdailytech.com