Windows Exchange Logon Hours Restriction

Okay the first thing to is to try https://testconnectivity.microsoft.com/

If a server error 500 occurs it might be related to the fact that the user is in a protected group, and thus some inheritance gets removed every hour..

From http://technet.microsoft.com/en-us/library/dd439375%28EXCHG.80%29.aspx

To check whether inheritance is disabled on the user:

Open Active Directory Users and Computers.
On the menu at the top of the console, click View > Advanced Features.
Locate and right-click the mailbox account in the console, and then click Properties.
Click the Security tab.
Click Advanced.
Make sure that the check box for "Include inheritable permissions from this object's parent" is selected.

Try also to remove the phone from the mail user.

The strict answer to your question "can I apply no policy?" is no.

So next we have to look at what the user thinks the policy is. Does he not want to get the security pop-up when adding the account? The don't enable any of the options that cause that pop-up.

The individual settings within ActiveSync policies fall in to two categories: those that affect only the mail client, and those that affect the whole device. Only the ones that affect the whole device result in a security prompt.

To make your user happy, create another ActiveSync policy just for him and apply it. Provided that you don't configure anything that requires system-level security changes, such as password rules and remote wipe, then he won't get the security prompt when the account is set up on the tablet.

Update to make my answer closer to reality:

If the device supports remote wipe, there is no way to suppress the security prompt for remote wipe.

• During the initial ActiveSync setup, Exchange asks the client "do you support remote wipe?"
  • If the device supports remote wipe, Exchange requires it.
  • If the device does not support remote wipe, then the "Allow non-provisionable devices" option is consulted.
    • If checked, the device is allowed.
    • If not checked, the device is denied a partnership. The phone will either return an error or just show an empty inbox.

There is no way to stop Exchange from asking if it supports remote wipe.

Update after you posted the pic:

You are not going to be able to get rid of that security prompt.

My Android phone will only display the security prompt for capabilities requested by the assigned policy. If the policy changes, I'll get a new prompt.

My boss's phone will display the security prompt with all of the security features it supports. When the policy changes, she does not get a new prompt.

So you are fighting two problems, neither of which you will be able to change:

1. There is no way to stop Exchange from asking a device if it supports remote wipe.
2. It appears that your device prompts for all of the security capabilities it supports, regardless of what the Exchange server asks for.