[Brendan42]

I'm testing an IT policy to enable content protection on our devices. The changes I've used so far are as follows:
BES 4.1.5, Exchange 2003.

Rule Name,Rule Value
Password Required True
User Can Disable Password False
User Can Change Timeout False
Set Password Timeout 2 minutes
Set Maximum Password Attempts 10
Force Lock When Holstered True
Content Protection Strength Strong
Security Service Colors 006400;b22222 (green and red, just to see what it does)
Force Content Protection of Master Keys True
Force Include Address Book In Content Protection True
External File System Encryption Level Encrypt to Device Key (excluding multi-media directories)
Memory Cleaner Maximum Idle Time 5
Force Memory Clean When Idle True
Force Memory Clean When Holstered True
Disable Phone Call Log Wireless Sync True
Require Password for Discoverable Mode (Bluetooth) True

Question is: How do I exclude the address book from content protection AND prevent the user from changing this setting. According to the BES IT Policy help, I can set "Force Include Address Book In Content Protection" to TRUE and still force the address book to be excluded, but it has to be set to No by both the device and the server. I've set the option to "No" on the device, but can't find the setting on the BES. Any ideas please?