Thursday, 29 May 2014

Lync 2013 Meeting Options Policies

Lync 2013 default meeting options can be configured at the global or site level. These setting effect scheduled meeting options (for example in Outlook as shown below); they do not affect ad-hoc meetings created by clicking the Meet Now option in Lync. When you create a meeting by clicking Meet Now, participant access is automatically open to all everyone, and anonymous users can join the meeting without having to wait in the lobby.



Meeting Security
It's worth making a special note of the AssignedConferenceTypeByDefault setting, as it's likely to raise security concerns for most. The default of $true creates scheduled meetings as public by default (although the user can change this themselves while creating the meeting), meaning the conference ID and the meeting link remain consistent each time the meeting is held. By changing this setting to $false you can set the default to private, which means the conference ID and meeting link changes from meeting to meeting. The latter is more secure, as there is less risk that someone accidentally join the wrong meeting.

Policy Configuration

To get the current Global policy run Get-CsMeetingConfiguration or specify the site to get a site policy Get-CsMeetingConfiguration -Identity site:<site>



Modify Global Policy
Set-CsMeetingConfiguration
e.g. Set-CsMeetingConfiguration -AssignedConferenceTypeByDefault $false

Modify Site Policy
Set-CsMeetingConfiguration -Identity site:<site>
e.g. Set-CsMeetingConfiguration -Identity site:Auckland -AssignedConferenceTypeByDefault $false

Create New Site Policy
New-CsMeetingConfiguration -Identity site:<site>
e.g. New-CsMeetingConfiguration -Identity site:Auckland -AssignedConferenceTypeByDefault $false

The following options are available on the above commands:

AdmitAnonymousUsersByDefault
Determines whether meetings will, by default, allow attendance by anonymous users/unauthenticated users. Set this value to $true if you would like new meetings to allow for attendance by anonymous users by default. Set this value to $false if you would prefer that, by default, new meetings do not allow for attendance by anonymous users. The default value is $true.

AssignedConferenceTypeByDefault
Determines whether new meetings will be configured, by default, as public meetings. Set this value to $true to use public meetings by default; set this value to $false to use private meetings by default. The default value is $true, however $false would be more secure creating a new meeting space for each meeting. To disable public meetings altogether use EnableAssignedConferenceType mentioned below.

CustomFooterText
Text to be used on custom meeting invitations.

DesignateAsPresenter
Indicates which users (besides the meeting organizer) are automatically designated as presenters when they join a meeting. Valid choices are: None; Company; and Everyone. By default, DesignateAsPresenter is set to Company, meaning everyone in your organization will have presenter rights the moment they join a meeting.

EnableAssignedConferenceType
Indicates whether users are allowed to schedule public meetings. The default value is $true. 

HelpURL
URL to a website where users can obtain assistance on joining the meeting.

LegalURL
URL to a website containing legal information and meeting disclaimers.

LogoURL
URL for the image to be used on custom meeting invitations.

PstnCallersBypassLobby
Indicates whether users dialing in over a public switched telephone network (PSTN) phone line should automatically be admitted to a meeting. If set to $true, PSTN callers will automatically be admitted to the meeting. If set to $false, then PSTN callers will initially be routed to the conference lobby. At that point, they will have to wait, on hold, until a conference presenter grants them access to the meeting. The default value is $true.

RequireRoomSystemsAuthorization
When set to $true all users must be authenticated before they can join a meeting using the Lync Room System. The default value is $false.




Wednesday, 21 May 2014

Lync 2013 Front End Service Stuck Starting

A common issue which can be encountered, is a Front End Service that get's stuck starting. No amount of restarting will fix this problem, and there are a number of reasons I have come across that may cause this.

Quite often there will be nothing in the event log, most likely because the service start will never time-out, and never actually fails to start. I have seen the service in this state for over 24 hours!!

1. Certificates
Microsoft documentation states that in Server 2012 to increase security, certificates that are not self signed (i.e. where the issue by and subject name are the same e.g. a Certificate Authorities certificate) should not in in the "Trusted Root Certificate Authorities" container in the Certificate store. Certificates that are NOT self signed should go in the "Intermediate Certificate Authorities".

Microsoft states the following here:
This issue occurs because a certificate that is not self-signed was installed in the Trusted Root Certification Authorities store. This is an incorrect configuration that can cause HTTP communication between Lync servers to fail with an untrusted root certificate error. Lync Server 2013 deployments in Windows Server 2012 may experience this issue because Windows Server 2012 implements checks for a higher level of trust for certificate authentication.
Note: A self-signed certificate is defined as a certificate in which the "Issuer" property and the "Subject" property on the certificate are the same. This is normal and expected for Root Certification Authorities.
To resolve this issue, use one of the following methods:
If you use group policies to deploy certificates, make sure that the Trusted Root Certification Authorities store only contains self-signed certificates (certificates in which the certificate property "Subject" is the same as the certificate property "Issuer"). Move any certificates that are not self-signed certificates from the Trusted Root Certification Authorities store to the Intermediate Certification Authorities store.
If you import new certificates manually, make sure that you select the computer’s Trusted Root Certification Authorities store for the self-signed certificates, and the computer’s Intermediate Certification Authorities store for the certificates that are not self-signed certificates.
You can use a Windows PowerShell command to find certificates that are put in the Trusted Root Certification Authorities store incorrectly on the local computer. The following command compares the "Issuer" property and the "Subject" property of each certificate in the store, and then outputs details of certificates that do not meet the criteria of a self-signed certificate:
Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Format-List * | Out-File "c:\computer_filtered.txt"

2. Quorum knickers in a twist
In order to fix this issue open the Lync Management Shell and enter the following command, then reboot the Front End server:


3. Patch RTM to latest update release
First install the cumulative update and reboot. Once the server comes back up, don't forget to run the SQL update script as per the update documentation. Once this is done you may need to forcefully stop and start the service and/or reboot the server.

To forcefully stop the stuck service run "sc queryex RTCSRV" from Windows Command Prompt. Take note of the process number then run "taskkill /f /pid <process number>".

4. Remove Lync Server Front End Component and Windows Fabric 

  • Run Test-CsDatabase -ConfiguredDatabases -SqlServerFqdn <SqlFqdn> | Select-Object databasename,installedversion,expectedversion and verify backend databases are at the same patch level as expected
  • Remove Lync updates from add and remove programs
  • Attempt to start service again (it will probably fail with event viewer event id 1000 and 1001)
  • Remove "Lync Server Front End Component" and "Windows Fabric" from add remove programs
  • Reboot Server
  • Run step 2 in "Lync Server Deployment Wizard Tool"
  • Attempt to start service again (If it gets stuck starting you may need to re-install updates)
  • Run "LyncServerupdateinstaller.exe" to install updates
  • Reboot server




Lync 2013 Meetings Fail in Migration Situation

After migrating to Lync 2013 from Lync 2010 or OCS, users may be unable to join Lync Online Meetings.

In the Lync client when you select "Meet Now" you may get the following error:



Additionally you may see the following event logged on the Front End server:
 Event 51048 LS MCU Factory:
McuFactory could not find the pool associated with one of the conference directories.
Failed to read pool FQDN associated with conference directory 20.
Cause: The pool associated with the conference directory does not exist anymore.
Resolution: Conference directories without a valid pool associated can be deleted using management tools.

If you run a trace on the Front End server you may see the following:
Start-Line: SIP/2.0 500 failedLookupForConferenceDirectoryOwner
ms-diagnostics: 3193;reason=”Could not find a front end server that owns the given pstn meetind id.”

This issue is commonly caused when you have orphaned conference directories. You can check for orphan directories using the following PowerShell command:


Review the output and check to see if there is a ServiceID matching a pool which no longer exists. BackCompatSite entries refer to OCS 2007 R2 servers added during a merge operation. If a Service ID exists for a pool that has already been deleted, the conference directory will need to be forcefully removed using the following PowerShell command:



Be careful here! Removing an active conference directory will force users to reschedule meetings!!


After you remove the conference directory you will need to restart the Front End Service for immediate results.


The effect of changing a LineURI on Lync Phone Edition Phones

We have a lot of CX500 phones that have been authenticated on the internal network using PIN authentication, and then sent out for use externally. Today I had a requirement to change the LineURI for a few of them, and was worried that in doing so the phones would be disconnected and need to return to the office to re-authenticate.

To test the theory:
  1. I grabbed a CX500 and logged in as a test user. 
  2. Once logged in I moved the phone to an external network
  3. I then changed the LineURI and waited 10 minutes
  4. The phone number had still not updated on the phones display so I rebooted the phone
  5. Still the phone number had not updated on the phones display, but good news I logged in OK
  6. I made an inbound call to the newly assigned number and it worked, so I assumed the display number may just take some time to filter through
  7. After a few hours the display number on the phone finally updated. Running update-csaddressbook did not seem to accelerate the process
  8. Days later the phone is still signed in with no issues reported




Monday, 19 May 2014

Friday, 16 May 2014

Configuring the Polycom VVX range for Lync

  1. Upgrade the phone software to the latest version
    • On the phone go to Home -> Settings -> Status -> Network -> TCP/IP Parameters. 
    • In a web browser go to the IP address shown. Log in using the default password which is 456.
    • Go to Utilities\Software Upgrade. Hit “Check for Updates”. Select the latest version (highest number) from the drop-down list and choose install. The phone will restart.
    • Note: as of version 5.1 the enhanced security settings result in the web interface being disabled by default. To enable it navigate Home -> Settings -> Advanced (default password 456) -> Administration Settings -> Web Server Configuration. Set "Web Server" to "Enabled" and "Web Config Mode" as per your preference. When you exit make sure you save the config.
  2. Date & time settings
    • Via the web browser settings log into the phone using the method above. Go to Preferences -> Date & Time and configure the "SNTP Server" and "Time Zone" settings (I use pool.ntp.org).

  3. Change the base profile
    • By default the options to connect the phone to Lync are not enabled. To access them you need to change the base profile of the phone. On the phone go to Home -> Settings -> Advanced (default password 456) -> Administration Settings -> Networking Configuration -> Base Profile and change to "Lync".
  4. Logging into Lync
    • Option 1 - Login using the web interface (as of version 5.2.0.8330)
      • From the web interface go to "Utilities" -> "Lync SignIn" (note that this will be greyed out until you change the phones base profile to Lync as you should have completed in earlier steps)


      • Select the "Authentication Type". You can log in using PIN authentication (if DHCP is configured for this) or the SIP URI with AD credentials. AD credentials can be entered with a domain and username, or with just a UPN (user@lync.co.nz). -> "Login Credentials", then enter your credentials.


      • Select "Sign In"



    • Option 2 - Login using the phone
      • On the device go to Home -> Settings -> Features -> Microsoft Lync. You can log in using PIN authentication (if DHCP is configured for this) or the SIP URI with AD credentials. AD credentials can be entered with a domain and username, or with just a UPN (user@lync.co.nz). Note that the "Sign-in" button in this menu is hidden under the "More" menu option.

The VVX phones should provision internally and externally with no problem.


Monday, 12 May 2014

Error's Deploying Lync Monitoring and Archiving

Script failed (code "ERROR_CREATE_DB") when installing "MonitoringStore
While deploying a new Lync 2010 Monitoring and Archiving server in the "Setup or Remove Lync Server Components" phase, the databases fail to install with the error message "Script failed (code "ERROR_CREATE_DB") when installing "MonitoringStore". If you check the log files referenced by the installer you will see something similar to the following:
Running script: C:\Windows\system32\cscript.exe //Nologo "C:\Program Files\Common Files\Microsoft Lync Server 2010\DbSetup\RtcCdrDbSetup.wsf" /dbexists /sqlserver:<SQLServer> /serveracct:<Domain>\RTCComponentUniversalServices /logsize:1024 /verbose
---------------
Installed SQL Server 2005 Backward Compatibility version is 8.05.2312
Connecting to SQL Server on <SQLServer>
SqlMajorVersion : 10
SqlMinorVersion : 50
SqlBuildNo : 4000
SQL version is acceptable: 10.50.4000.0
Default database data file path is D:\MSSQLData
Default database log file path is F:\MSSQLLogs
Database does not exist.
---------------
Exit code: ERROR_NO_DATABASE_EXISTS (-23)
When running /dbexists, non-zero exit codes are not necessarily errors
---------------
Running script: C:\Windows\system32\cscript.exe //Nologo "C:\Program Files\Common Files\Microsoft Lync Server 2010\DbSetup\RtcCdrDbSetup.wsf" /sqlserver:<SQLServer> /serveracct:<Domain>\RTCComponentUniversalServices;"RTC Component Local Group" /dbpath:"D:\CsData\MonitoringStore\(default)\dbpath" /logpath:"D:\CsData\MonitoringStore\(default)\logpath" /logsize:1024 /verbose
---------------
Installed SQL Server 2005 Backward Compatibility version is 8.05.2312
Connecting to SQL Server on <SQLServer>
SqlMajorVersion : 10
SqlMinorVersion : 50
SqlBuildNo : 4000
SQL version is acceptable: 10.50.4000.0
(Database doesn't exist. Performing clean install.)
Creating database LcsCDR
    DbFile : PhysicalName = d:\csdata\monitoringstore\(default)\dbpath\lcscdr.mdf
    LogFile: PhysicalName = d:\csdata\monitoringstore\(default)\logpath\lcscdr.ldf
Failed to create database LcsCDR
Error (
  name:        Error
  description:
  number:      -2147221242
  message:  
)
---------------
Exit code: ERROR_CREATE_DB (-4)
---------------
Research led me to a few posts referencing this KB Article, however in my case this was not the problem. It was actually much simpler - The DBA had not given my account enough permissions to create the new databases. I was very surprised that the installer didn't report a permission issue! The amount of global man hours that could be saved if developers spent a little more time on friendly errors messages!! ;)

All the setup logs can be found here -  %UserProfile%\AppData\Local\Temp\

Cannot get the ReportServerWebService URL
"Cannot get the ReportServerWebService URL. Verify that Reporting Services is deployed and configured properly on the target SQL instance:"<SQLServer>", and that WMI is included on the exception list of firewall setting on the server that is running Reporting Services"

This is most likely caused because the Report Server web services have not been configured or your firewall is preventing access. Open "Reporting Services Configuration Manager" and check for the following:



Once configured correctly make sure you can browse to the Report Server URL's which can be found in the Configuration Manager:





ReportServerCannot grant ReportsReadOnlyRole to user
ReportServerCannot grant ReportsReadOnlyRole to user "<UserAccount>". For details, see the following error message:Exception calling "Create" with "0" argument(s): "Create failed for Login '<Domain>\<UserAccount>'. "

Check the the Report Server databases have been configured and that the account you are running the installer with has sysadmin permissions to SQL.

If the database has not been configured you will see the following error when browsing Report Manager:




Saturday, 10 May 2014

Lync 2013 Deployment and Migration Step by Step

This is a step by step guide to assist those new to Lync in deploying an Enterprise or Standard Edition topology (its still a draft at the moment).

Hardware Prerequisites
Microsoft recommends the following minimum requirements for Front End Servers, Back End Servers, Standard Edition Servers, Persistent Chat Servers, and Persistent Chat Store and Persistent Chat Compliance Store (Back End Server Roles for Persistent Chat Server):

  • Dual CPU with 6 Cores, 2.26GHz
  • 32Gb Ram
  • 72Gb Disk Space
  • 1GHz Network adapter

For Edge Servers, Standalone Mediation Servers, and Directors Microsoft's recommendations are slightly less:
  • Dual CPU with 4 Cores, 2GHz
  • 16Gb Ram
  • 72Gb Disk Space
  • 1GHz Network adapter

In reality these can be much less depending on the number of users and activity. To give you an example for a deployment of 500 users, a Lync Front End will happily run as follows:
  • Single CPU with 4 Cores, 2.26GHz
  • 12Gb Ram
  • 72Gb Disk Space
  • 1GHz Network adapter

Software Prerequisites
Before you get started you will need to decide on and operating system and install some prerequisits. Lync 2013 is supported on Server 2008R2, 2012, and recently 2012R2 with the October 2013 cumulative update.

To make your life easier you can use Pat Richards prerequisites script for Server 2012 and 2012R2 - http://www.ehloworld.com/1697

Server 2008R2


Standard and Enterprise Edition Front Ends
  • .NET 3.5 (installed by default with Server 2008 R2)
  • SilverLight (Required from Lync Control Panel)
  • KB2646886 for IIS 7.5 - http://support.microsoft.com/kb/2646886/en-us *Install after PowerShell below is Run as it requires IIS to be installed

PowerShell for pre-req's:



Persistent Chat
PowerShell for pre-req's:


Director
PowerShell for pre-req's:



Edge
No additional prerequisites are required.

Mediation
No additional prerequisites are required.

Server 2012

  • Apply all Windows Updates
  • Microsoft .NET Framework 4.5 - http://go.microsoft.com/fwlink/p/?LinkId=268529
    • After Installation ensure WCF Activation and HTTP Activation are enabled
  • Windows PowerShell 3.0 (installed by default with Server 2012)
  • Windows Identity Foundation 3.5 (install from Server Manager)


Standard and Enterprise Edition Front Ends
  • .NET 3.5
  • SilverLight (Required from Lync Control Panel)

PowerShell for pre-req's:



Persistent Chat
PowerShell for pre-req's:


Director
PowerShell for pre-req's:



Edge
No additional prerequisites are required.

Mediation
No additional prerequisites are required.

Active Directory Preparation
Schema Update - Enable-CsAdServerSchema
Schema Check – Get-CsAdServerSchema


Forest Prep - Enable-CsAdForest -GroupDomain <domain to create security groups>
Forest Check - Get-CsAdForest



Domain Prep - Enable-CsAdDomain –Domain <domain to prepare>
Domain Check - Get-CsAdDomain



NOTE: After Active Directory preparation has completed it’s a good time to add the CSadministrator role to user account that will be performing the installation as well as any other account that will require full access to Lync. It is also worth adding RTCUniversalServerAdmins to the installation account.


DNS Records
Create the DNS records required to support the topology.

*Ensure that DNS round robin is enabled for DNS load balancing.


Lync File Share
The folder must be shared, however when the Topology is published the required NTFS permissions will be added.

Topology
Create your Lync Topology using the Topology Builder.

If you already have Lync 2010 installed select “Download Topology from existing deployments”, otherwise create a “New Topology”.


Standard Edition
Run “Prepare First Standard Edition Server” to install SQL Express and populate RTC databases. This step is only required for new deployments, and does not apply to migrations from Lync 2010.

Enterpise Edition
TBC

Install Backend Databases (this can be completed when publishing the topology)

Pre-req’s:

  • SQL sysadmin role is required to install Lync databases
  • Remote access to SQL must be configured and the relevant ports opened
  • If SQL mirroring has been defined then the SQL share and permissions must have already been created

Install-CsDatabase -CentralManagementDatabase -SqlServerFqdn <SQL Server FQDN>

NOTE: The databases can also be installed using the topology builder, however if the databases are not in the default path it is better to use PowerShell.



Publish the Lync Topology
When you publish the topology for the first time the backend databases are created. One if these databases, named XDS, holds data for the Central Management Store (CMS). This is an important database because it holds Lync Servers Topology, policy and configuration information.

  • Topology - Topology information that was generated by the Topology Builder tool
  • Policy - All of the policies that you configure in Lync
  • Configuration - Configuration information such as certificate and dial-in conferencing access numbers.

A replica copy of the XDS database is located locally on each Lync Server role as an instance of SQL Server Express named "RTCLOCAL"'.

Permissions required to publish the topology:


What should you check after the topology has been published successfully?

  • Check that the Lync Share has been populated


  • Check that the following Db’s have been created
    • LIS (Local Information Server)
    • XDS (Configuration Database)

Install Server Roles
Once the topology has been published you are ready to install the Lync Server roles on the pre-built servers. One of the nice things about Lync is the ease in which this is done. All you need to do is run the installer and work through the wizards. Each server will contact the Central Management Store (CMS) to learn the role it lays in the topology. With this information the required components will be installed.

For each server role the Lync Deployment Wizard needs to be run, here are the steps:

  1. Install Local Configuration StoreEdge Server

    Export-csconfiguration -filename c:\topology_export.zip
  2. Setup or Remove Lync Server Components

    Tip: The Edge Server requires that you add a DNS suffix to the computer name so that it matches the FQDN defined in the topology
  3. Request, Install or Assign Certificates

    Depending on your security requirements you may wish to create a certificate template that has a validity period equal to the period you expect the current version of Lync to be in service.
    • FE Certificate
      • SN: FQDN of Pool
      • SAN: FQDN of FE, meet, dialin, admin, lyncdiscoverinternal, lyncdiscover, web services internal, sip, sipinternal
      • OAuth – Lync servers use this to communicate between themselves
    • Mediation Certificate
      • SN: FQDN of Mediation server
    • Edge Server Certificate
      • Internal SN: FQDN of Edge server
      • External SN: Access FQDN
      • External SAN: Access FQDN, Conferencing FQDN, sip, sipexternal, xmpp
4. Start Services

After Lync server roles have been installed there is an additional step if you have deployed monitoring. From the Lync Deployment Wizard select “Deploy Monitoring Reports”. When asked for a read only group normally RTCUniversalReadOnlyAdmins would be selected.



Hope this helps, if you have any questions just leave a comment below.



Thursday, 8 May 2014

Bad Experience with 24/7 Hosting

If you are thinking of hosting a web site in New Zealand you've probably come across 24/7 Hosting.

I moved my sites to them a month ago and have had nothing but trouble with their support. I also paid for a service that I did not receive, and after many attempts to make contact, I am yet to receive a response let alone a refund!!

I am not alone either, I suggest having a read of these forums:
http://www.geekzone.co.nz/forums.asp?forumid=86&topicid=142666

http://www.scambusters.co.nz/forum/viewtopic.php?f=9&t=5985&sid=9b8e73de7d2c9bd450b45f14f169a241

http://www.nocowboys.co.nz/businesses/24-7-Hosting

Proceed with caution with these guys.