NextHop

Lync and Learn, Session 7 - Federation with Exchange Online and Lync Online

NextHop — Thu, 02 Feb 2012 23:59:00 GMT

The seventh Lync and Learn session will focus on federation with Exchange Online and Lync Online and will be led by Loryan Strant. Loryan is Director and Co-Founder at Paradyne and has 10 years of experience in various senior consulting positions. He is passionate about the cloud and excited to share his Office 365 knowledge with the community. There will be a Q&A following the Lync and Learn session.

Presenter: Loryan Strant, Office 365 Grid

Date/Time: Thursday, February 9^th at 2:00 PM Pacific Time. (1 Hour presentation)

To sign up for this webcast please visit Lync and Learn - Federation with Exchange Online and Lync Online. View past Lync and Learn sessions here.

Lync Server Resources

We Want to Hear from You

Microsoft Lync Server 2010 Support for Large Meetings White Paper

NextHop — Wed, 01 Feb 2012 18:00:00 GMT

Most hosted meetings have fewer than 250 participants, but what if you need to host larger meetings? The published maximum size of a conference hosted on Microsoft Lync Server 2010 in a shared pool (a pool that hosts all Microsoft Unified Communications workloads including IM/Presence, Conferencing, and Enterprise Voice) is 250 users. However, Microsoft Lync Server can support meetings with up to 1000 participants using Lync Server Audio/Video Conferencing service, which includes sharing PowerPoint presentations. Support for these large meetings requires a dedicated Lync Server 2010 pool configured to support large meetings. The pool must be managed in a way that ensures hosting of only one large meeting at a time. For additional information about scalability considerations and implementation requirements for a dedicated pool for large meetings, including topology, hardware, software, and configuration requirements, as well as best practice recommendations for supporting large meetings, see the white paper: Microsoft Lync Server 2010 Support for Large Meetings in the Microsoft Download Center.

Note: This information applies only to Lync Server 2010 on-premises meetings.

Lync Server Resources

We Want to Hear from You

Next-level Topologies for Archiving Server and Monitoring Server

NextHop — Tue, 31 Jan 2012 13:55:00 GMT

When designing Lync Server 2010 topologies there are multiple options available for deploying a Monitoring Server and an Archiving Server. Lync Server 2010 server roles can be collocated. Collocation improves network efficiency, increases flexibility, and reduces hardware costs. This article explores several alternative scenarios to consider when deploying a Monitoring Server or an Archiving Server.

Author: Byron Spurlock

Publication date: January 31, 2012

Product version: Lync Server 2010

During a recent Lync Server 2010 deployment, a customer asked; “We want to deploy Archiving Server and Monitoring Server, what scenarios options are available to us beyond the basics?” This is great question and it inspired me to write this article. This article covers Archiving Server and Monitoring Server topologies that are not typical scenarios.

We will begin by looking at the following areas:

What is the Archiving Server?
What is the Monitoring Server?
What are the key components that comprise an Archiving Server and a Monitoring Server?
What are the core supported topology scenarios?
Next -level collocation topology scenarios.

What is the Archiving Server?

Corporations and organizations are subject to an ever increasing number of industry and government regulations that require them to retain communications such as instant messages or conferencing dialogs. The Lync Server 2010 Archiving Server archives instant messages and conferencing (meeting) traffic sent through Lync Server 2010.

What is the Monitoring Server?

Monitoring your Lync Server 2010 deployment is accomplished by using the Lync Server QoE Monitoring service and the Lync Server Call Detail Recording service. The Lync Server QoE Monitoring Service monitors and records network connectivity and media information for the peer-to-peer and conferencing modalities supported by Lync Server 2010. The Lync Server Call Detail Recording service supports compliance requirements necessitated by an organization’s regulatory policies. The data collected by these services, is stored in the QoEMetrics and LcsCdr databases. The data can be viewed using Monitoring Server Reports.

Key Components

Before we dig into the core scenarios, let’s examine the components that make up the Archiving Server and Monitoring Server.

Monitoring Server Components

Data Collection Agents By default these agents are installed on each Front End Server during the core files installation of a Lync Server 2010 deployment. The agent (CDR or QOE) takes SIP messages and sends data to the Monitoring Server queue on its respective server.
Monitoring Server This Lync Server role captures call detail records and monitors Lync end points for call quality. The Monitoring Server is associated with at least one Registrar pool through Topology Builder during initial configuration.
Monitoring Server databases The Back End repository of the Monitoring data resides in SQL Server and stores separate databases for CDR and QoE information. The Monitoring Server databases run on minimum SQL Server 2005 SP3. The Back End database is supported in a cluster state of up to 16 nodes or a two-node, Active - Passive pair.
Message Queuing Message Queuing runs on each Monitoring Server and Front End Server in the pool. It captures and sends data to the Monitoring Server.
System Center Operations Manager management pack (Optional) This optional component can be installed on the Monitoring Server to facilitate capturing CDR and QoE data. When installed on the Monitoring Server the Operations Manager management pack will record all the captured data and is viewable via System Center Operations Manager Console. When enabled real-time alerts and thresholds are configurable and provide a rich experience for reporting and trends.
Monitoring Server Reports (Optional) This optional component contains out-of-the-box reporting tools that collect data from the Monitoring Server. This information is derived from the CDR and QoE information stored in the SQL Server databases. The reports work in conjunction with SQL Server Reporting Services installed with the Monitoring Server.

Archiving Server Components

Archiving agents By default these agents are installed on each Front End Server during the core files installation. Archiving agents capture instant messages from users and send them to the destination queue located on the Archiving Server. The Archiving Server can be associated with one or more Front End pools in an environment.
Archiving Server This Lync Server role is responsible for capturing instant messaging related communications from Lync clients. All instant messages traverse the Front End servers during internal and remote client communications.
Archiving Server back-end database The Back-end repository of the Archiving Server data resides in SQL Server and stored in a database. The Archiving Server databases run on a minimum SQL Server 2005 SP3. The Back End database is supported in a cluster state of up to 16 nodes or a two-node, Active - Passive pair.

Note: Additional information on the required components can be find in the Technical Library:

Core Supported Topology Scenarios

Before we explore the next-level topologies, let’s review the core scenarios. Lync Server 2010 supports a variety of collocation scenarios. Collocation reduces hardware costs by running multiple components on one physical server (if you have a small organization), or by separating components onto different servers (if you have a larger organization that needs scalability and performance). Consider scalability factors before you decide whether to collocate the Archiving Server or its database with other server roles or databases.

Archiving Server Topologies

Scenario 1. Archiving Server with single pool. The Archiving Server archives a single pool.

Figure 1. Archiving Server with single pool.

Scenario 2. Archiving Server with multiple pools. The Archiving Server archives multiple pools within the same organization.

Figure 2. Archiving Server with multiple pools.

Monitoring Server Topologies

Scenario 1. Monitoring Server with single pool. The Monitoring Server reports for a single pool.

Figure 3. Monitoring Server with single pool.

Scenario 2. Monitoring Server with multiple pools. The Monitoring Server reports for multiple pools within the same organization.

Figure 4. Monitoring Server with multiple pools.

Next-level Collocation Topology Scenarios

When designing a deployment scenario you may want to evaluate different Monitoring and Archiving Server collocation options. In the following section we will visit some of those topologies and talk about what scenarios they can be used in.

1. Separate Archiving and Monitoring Server. The Archiving Server and the Monitoring Server both reside on their own physical\virtual node. The Monitoring and Archiving database each reside on a single physical SQL server in separate instances; the SQL server resides on its own dedicated node.

Note: If you collocate the Archiving database with the Monitoring database, back-end database, or both of these databases, you can either use a single SQL instance for any or all of the databases, or you can use a separate SQL instance for each database with the limitation that each SQL instance can contain only a single back-end database, single Monitoring database, and single Archiving database.
(The database server cannot support more than one Front-End pool.)

Figure 5. Separate Archiving Server and Monitoring Server.

Scenario

Customer has a significant number of users, wants to capture reports for Archiving and Monitoring, and wants to separate both roles, in order to handle the maximum number of users. With both roles residing on separate servers they can leverage a dedicated or existing SQL server.

2. Collocated Archiving and Monitoring Servers with separate SQL Server. The Archiving Server and Monitoring server are both collocated on the same physical node. The SQL databases for each role resides on a dedicated node.

Figure 6. Collocated Archiving Server and Monitoring Server with separate SQL Server.

Scenario

Customer has determined that the Archiving and Monitoring servers are not that significant in the environment despite having deployed both roles. They decide to collocate both roles. This cuts down on the number of servers in the Lync Server environment by leveraging an existing or dedicated SQL Server node.

3. Collocated Archiving and Monitoring Servers with same SQL Server. The Archiving and Monitoring server are both collocated on the same node with the SQL Server.

Figure 7. Collocated Archiving Server and Monitoring Server with shared SQL Server database.

Scenario

Customer has determined that the Archiving and Monitoring Servers are not that significant in the environment and they have a limited amount of hardware to dedicate to the reporting capabilities. They ask if they can leverage a single node to host the Archiving and Monitoring role and install SQL Server on the same node.

4. Archiving and Monitoring Server with separate nodes on Back End SQL Cluster. The Archiving and Monitoring Server both reside on separate physical\virtual nodes. SQL Server contains the respective database for each role in a two node active – passive cluster in the same or separate instances.

Figure 8. Archiving Server and Monitoring Server with separate nodes on back-end SQL Cluster.

Scenario

The Archiving and Monitoring roles are mission critical applications. Being deemed mission critical, the related databases must be available in the event of a disaster. This is accomplished by insuring that one of the SQL nodes is available in the event a single back-end node becomes unresponsive or unavailable.

Note: The back-end SQL Server for Lync Server and the Archiving Server and Monitoring Servers can exist in a clustered state. The two node active-passive scenario is the supported cluster state for Lync Server databases.

5. Monitoring or Archiving collocated with SQL. The Archiving Server or the Monitoring Server are collocated with a dedicated SQL Server. The remaining role is located on a separate node utilizing the back-end database residing on the collocated SQL Server.

Figure 9. Monitoring service or Archiving services collocated with SQL Server.

Scenario

Based on company policy, a customer identifies that either the Monitoring service or the Archiving service will receive significantly more volume than the other service. The identified service will require more resources (CPU) and will, therefore, be located on a separate node. The associated back-end database for this service will be collocated with the other application.

Summary

When creating or upgrading a Lync Server 2010 environment to include an Archiving Server and/or Monitoring Server, consider using next-level collocation topologies. Next-level collocation deployments take advantage of the Lync Server 2010 collocation capabilities to meet the needs of your organization and maximize your hardware resources.

Lync Server Resources

We Want to Hear from You

Keywords: Archiving, monitoring, collocation, Lync topologies

Updates Available for Office Communications Server 2007 R2 and Group Chat

NextHop — Mon, 30 Jan 2012 17:57:00 GMT

The Communications Server Products team has released updates for Office Communications Server 2007 R2 and Office Communications Server 2007 R2, Group Chat.

Updates Resource Center for Office Communications Server 2007 R2 and Clients

Updates for Communications Server 2007 R2

Description of the cumulative update package for Communicator 2007 R2: January 2012

Description of the cumulative update for Office Communications Server 2007 R2 Group Chat server: January, 2012

Description of the cumulative update for the Office Communications Server 2007 R2 Group Chat Administration Tool: January, 2012

Description of the update for the Office Communications Server 2007 R2 Group Chat client: January, 2012

Office Communications Developer Center

Lync Developer Center

Lync Server Resources

We Want to Hear from You

Update: Installing the Mobility and Autodiscover Services

NextHop — Thu, 19 Jan 2012 19:03:00 GMT

When configuring the cumulative update for Lync Server 2010: November 2011 for Mobility on Windows Server 2008 Service Pack 1, you must perform additional steps to configure IIS 7.0 ASP.NET settings. The Lync Server 2010 deployment documentation for Mobility in the Lync Server 2010 Technical library has been updated to indicate these additional steps and their proper sequence.

Author: Ellen Zehr

Publication date: January 19, 2012

Product version: Lync Server 2010

The steps are as follows:

Install a hotfix that allows you to configure the CLRConfigFile parameter in the applicationHost.config file.
Install the Mobility Service.
Modify some ASP.NET settings in the applicationHost.config file.
Restart IIS.

Details are available at Installing the Mobility and Autodiscover Services.

When configuring the cumulative update for Lync Server 2010: November 2011 for Mobility on Windows Server 2008 R2, you do not need to perform these additional steps to configure IIS 7.5 ASP.NET settings. The Mobility installer automatically configures the ASP.NET settings for you.

Announcing Microsoft Lync Server Top Solutions RSS Feed

NextHop — Wed, 18 Jan 2012 00:16:00 GMT

The Microsoft Lync Server Top Solutions RSS feed contains the answers our engineers use to resolve many top support calls. The Top Solutions feed pairs the latest top customer issues with the best Microsoft resolutions from KB articles, blogs, TechNet and MSDN. The RSS feed also keep you ahead of the curve by alerting you to potential problems and linking you directly to resolutions that can help avoid them.

Lync Server Resources

We Want to Hear from You

Lync Online Web Scheduler Now Available

NextHop — Fri, 13 Jan 2012 19:49:00 GMT

The Microsoft Lync Online Web Scheduler is a web-based meeting scheduling and management tool for users who don’t have access to Microsoft Outlook, or are on an operating system not based on Windows. With Lync Online Web Scheduler, you can create new meetings, modify your existing meetings, and send invitations using your favorite email program. For details see: Lync Online Web Scheduler.

Author: Brian Crum

Publication date: January 13, 2012

Product: Lync Online

Lync Server Resources

We Want to Hear from You

Interview with a Lync Pro: Randy Wintle

NextHop — Tue, 10 Jan 2012 14:00:00 GMT

The Microsoft Lync Server technical community is full of knowledgeable IT professionals who work tirelessly to share their wealth of experience and expertise with the world. They blog, tweet, deliver presentations, and answer questions in the forums to help foster expert knowledge for administrators and IT Pros in every corner of the globe.

In mid-2011, I decided to use my own blog, Justin Morris on UC, to interview and learn from these noteworthy individuals who consistently go the extra mile to help all of us better understand Microsoft Lync Server. The series has now moved to the NextHop blog, and for my first post on NextHop, I interviewed Lync MVP, Randy Wintle, from Unify Square to find out how he got into IT and why he loves Microsoft Lync.

Author: Justin Morris

Publication date: January 11, 2012

Product version: Lync Server 2010

What's your technical background? How did you end up where you are today?

I grew up around technology. My father was a network engineer with a CCNP, so networking and other technology was always a big part of my life. Funny enough, when I was younger, I actually swore I would never get involved in IT, because of all the on-call hours and long days my dad had to work. Funny how that worked out! I went to college to study information technology. Then I picked up a job doing help desk and server administration, and things just kind of took off from there. I started out consulting doing SCOM work, and working with a data center environment. I used to spend hours crimping cat 5 cable in a cold, noisy data center.

Randy Wintle delivering a video presentation on cable modems in middle school.

Can you tell us what your position at Unify Square entails?

At Unify Square, my job is to design and implement Microsoft Unified Communications (UC) Solutions for large enterprises. A lot of this lately has been PBX replacement planning with Lync. We typically play a role that focuses on design and guidance, but I still get my hands dirty most days installing servers and troubleshooting occasional big issues.

What made you get into UC and a specialization in Lync Server?

Funny you should ask. Back at my old job doing SCOM work, my boss asked me one day if I wanted to get involved with this Microsoft Office Communications Server stuff. I remember reading the CHM files and playing around with it on my own time trying to understand it. The technology was completely foreign to me at the time. My first implementations were very basic IM/P implementations of Office Communications Server R1 and migrations from Live Communications Server to Office Communications Server. From there, I progressed to voice and larger implementations, until I had the opportunity to join Unify Square.

What's your favorite thing about Lync?

The best thing about Lync is that it is a true UC platform. To provide users a true UC platform, you must use software, and Microsoft does that very well.

What was the most challenging Live Communications Server/Office Communications Server/Lync Server problem you ever solved?

There are a couple of issues I solved in the past that stand out as particularly complex.

The first issue that pops into my head was during a Live Communications Server to Office Communications Server 2007 R2 migration. With these earlier migrations, some customers had previously installed Live Communications Server data in the System container of the Active Directory Schema. This was how it was meant to be back with Live Communications Server. However, with Office Communications Server and Office Communications Server R2, the configuration container was recommended. This resulted in a migration of configuration data to the configuration container in the Active Directory schema.

Microsoft documented the process, and provided a series of scripts to migrate this data prior to installing Communications Server or Communications Server 2007 R2 in the environment. However, a couple of bugs were discovered, which essentially took down a 40K user pool that was live in production.

Through some troubleshooting, we identified two problem areas:

To begin with, the scripts, although they had completed successfully would not confirm that the migration was successful. You had to run them a second time to get a confirmation. This was scary to do with migration scripts in production.

Secondly, the documentation required you to manually delete the old data from the Systems container in Active Directory. The problem was that Live Communications Server services would not start if the data existed in both places, resulting in an outage.

So we solved the issue through some trial and error, and finally by deleting the data from the system container. In the process, we were able to help Microsoft correct the documented process. More on that here: LCS 2005 SP1 Migrating Global Settings from System Container to Configuration Container.

Then there was another issue, more recent and involving Lync. We had a strange situation at a customer site, in which some users were not able to make external audio calls. When analyzing the logs, we saw media allocation to the A/V Edge Server was not happening. It was weird because they were going through the MRAS process as expected and able to connect to the A/V Edge on the required ports for allocation.

In the end, this turned out to be a configuration issue. Someone mistakenly configured the wrong A/V Edge association, resulting in some bizarre behavior where a user would get authentication credentials from one server, but try to allocate at another. Additional details on that issue can be found here: What happens when you’re A/V Edge Is Misconfigured: STUN/TURN.

If you could think of one feature you'd like included in the next version of Lync, what would it be?

I’ll have to go with a full-featured mobile platform. I know it will come when the time is right. J

What do you feel is your area of expertise, where you consider yourself a bit of a rock star?

Lately, especially since I wrote the Microsoft Lync Server 2010 Resource Kit chapter, External User Access, which focused on Edge Server, I have a greater understanding of Edge. Edge Server is a complicated beast, and I am proud to say I understand most of it, or at least I think I do.

Your blog covers everything from mobility, to SBAs, to reverse proxies. When did you start it and what direction has it taken?

My blog started out as a place to put information for my peers at my previous job. When I was doing implementations, I would just write about everything I ran into. Eventually, I moved this to my own personal platform and started promoting myself as a blogger. Lately, I have reduced the number of posts, as I am focusing on producing quality posts for real world issues. My mission has always been to provide guidance for issues that are not documented, or issues with which admins are struggling. My most popular post to date is my guide on publishing Lync through Microsoft Threat Management Gateway 2010, I actually posted this when Communications Server 2010 was in beta, but it still drives the largest number of hits to my blog each day.

Where are you from and what do you think makes your hometown/city great?

I currently live in Standish, Maine. I grew up in Portland, Maine and just bought my first house in Standish. Standish sits along Sebago Lake in Maine--it’s a beautiful area. Maine’s tagline is “vacation land” and it truly is. The summers in Maine are amazing. As long as you avoid the big tourist crowds, you can really have some fun here. Portland is quite an amazing city. It’s very small, but has a so much packed into it, tons of foodie restaurants, unlimited bars, and a great place for the arts.

When you're not dishing out quality technical know-how, what do you do for fun?

Well, I am a proud father of a 16-month-old boy, so that really is what I do now on the weekends. I wouldn’t have it any other way though! Having a kid is a great way to never be bored. The only other thing I dare mention as a hobby of mine is watching the Boston Bruins.

Proud father, Randy Wintle, with his young son. Check out those matching shirts!

Summary

Thanks a lot for participating and being our first Lync Pro to be interviewed on NextHop, Randy!

Additional Information

Randy Wintle’s blog, UC Made Easy.
Randy Wintle on Twitter.
Justin Morris’s blog, Justin Morris on UC.
Justin Morris on Twitter.
Additional Interview with a UC Pro articles.

Lync Server Resources

We Want to Hear from You

Keywords: Lync MVP, interview, Randy Wintle, IT Pro, Lync Server

Lync and Learn, Session 6 - Office 365 Administration

NextHop — Sat, 07 Jan 2012 00:55:00 GMT

On Thursday, January 12, at 3:00 PST, there will be a one hour Lync and Learn session entitled Lync and Learn - Office 365 Administration. The session will include the following topics:

Small business administration
Exchange Online administration
Manage Lync Online
Basic tasks in SharePoint Online
Basic tasks in Windows PowerShell

You must register to participate in the live presentation. Visit Lync and Learn - Office 365 Administration for additional information.

Lync and Learn is an online session led by Office 365 Product Managers and Community Grid members. Lync and Learn sessions address different Office 365 subjects and scenarios and are beneficial to anyone who wants to learn more and expand their knowledge of the Office 365 suite. View past Lync and Learn sessions here.

Lync Server Resources

We Want to Hear from You

Lync and Learn, Session 5 - Lync for Mac 2011

NextHop — Sat, 07 Jan 2012 00:49:00 GMT

Check out this video by Dave Kong, product manager on the Lync marketing team, that covers Lync support for the Mac platform: Lync and Learn - Lync for Mac 2011. The session covers the basic features for Mac 2011, differences in support between Lync Server and Lync Online, and differences in features between Lync 2010 and Lync for Mac 2011.

Lync Server Resources

We Want to Hear from You

Video: Troubleshoot Lync for Mac Issues in Lync Online for Office 365

NextHop — Wed, 04 Jan 2012 05:11:00 GMT

Check out this new technical support video on Office 365: Troubleshoot Lync for Mac Issues in Lync Online for Office 365.

Author: Rob Latino

Publication date: January 3, 2012

Product: Lync Online

Lync Server Resources

We Want to Hear from You

Script to Delete Galcontacts.db for Multiple Microsoft Office Communicator 2007 R2 and Lync 2010 Users

NextHop — Thu, 22 Dec 2011 20:45:00 GMT

When a Communicator 2007 R2 or Lync 2010 client is unable to synchronize address book files, manually deleting the Galcontacts.db and Galcontacts.idx helps resolve the problem. However, manually deleting the files is not a scalable solution for an organization that has more than 25 users. This article describes a script that can help you automatically delete Galcontacts.db and Galcontacts.idx files.

Author: Edwin Joseph

Publication date: December 22, 2011

Product versions: Microsoft Lync 2010 and Microsoft Office Communicator 2007 R2

Introduction

In Microsoft Office Communication Server 2007 R2 and Microsoft Lync server 2010, the Address Book Service (ABServer.exe) generates two sets of files which are used by two groups of clients. For clients with sufficient local storage space, ABServer.exe generates a full address book file that contains a large set of user and contact object attributes.

This file is downloaded from server and is stored in GalContact.db file on the client by Microsoft Office Communicator 2007 R2. Sometimes, due to possible corruption in the GalContacts.db or GalContacts.Idx file, the client looks for an address book file that does not exist. This usually occurs when the Address Book Server is unable to generate an address book file for more than 3 days.

This article helps administrators delete the SIP profile on a user’s computer which in turn deletes the Galcontacts.db and Galcontacts.idx file. This may be necessary when a user has corruption issues with the Galcontacts.db and Galcontacts.idx file. The script that can be deployed using automatically applied group policy. The script can be placed on a file share so that user can execute the script on their workstation. This automated process deletes the Galcontacts.db and Galcontacts.idx files for multiple users.

Address Book Service Background

As previous discussed, in Office Communication Server 2007 R2 and Lync Server 2010, the Address Book Service (ABServer.exe) generates two sets of files used by two groups of clients. For clients with sufficient local storage space, the ABServer.exe generates a file that contains a full address book that contains a large set of user and contact object attributes. To optimize download efficiency, it also generates up to 29 delta files that contain incremental updates containing the last one day, two days, and up to 29 days’ worth of changes. These files have the *.lsabs file extension.

When Communicator and Lync clients access and successfully connect to the Address Book Service URL for the first time, the client attempts to download the latest complete address book file. On subsequent days, the client attempts to download a delta file based on the last full synchronization date. During daily client usage, this delta file is based on the previous day’s changes. If the client is offline for a day or more, it determines which delta file it must download to get up to date. For example, if the client is offline from Friday afternoon to Monday morning, it will attempt to download a delta file containing 3 days of changes. If the client is offline for more than 30 days, it must download the full address book file. The client stores this information in the local database, called GalContacts.db.

If the GalContacts.db or the GalContacts.Idx file becomes corrupted, a client may keep looking for address book file that does not exist. This may occur when the Address Book Server is unable to generate the address book file for more than three days. There are several reasons why the Address Book Service is not able to generate an address book file, ranging from Backend SQL Server connectivity issues to network share issues.

In situations when Communicator or Lync is unable to synchronize the address book files, manually deleting the Galcontacts.db and Galcontacts.idx from the users workstation helps solve the problem. However, this is not a scalable solution for large organizations. To solve this problem, I have written a script that deletes the SIP profile folder on the user’s computer which in turn deletes the Galcontacts.db and Galcontacts.idx file.

Note: When restarting Communicator or Lync after deleting the SIP profile folder, the client will attempt to download the address book file resulting in heavy bandwidth consumption.

For more information see: Address Book Server: Address Book File Download Service.

The Script

'==========================================================================

' NAME: Delete sip profile

' BY Edwin Joseph

' COMMENT: this script delete the sip profile for the user from machine

' the purpose here is delete the galcontact.db file so that communicator can download a new one

'==========================================================================

Option Explicit

Dim objShell12

Dim objUserEnv

Dim strUserPro

Dim userProfile,SipProfile

Dim OSType

Set objShell12=CreateObject("WScript.Shell")

Set objUserEnv=objShell12.Environment("User")

strUserPro= objShell12.ExpandEnvironmentStrings(objUserEnv("TEMP"))

userProfile = objShell12.ExpandEnvironmentStrings("%userprofile%")

DeleteSip strUserPro 'delete user sip profile

'delete sip Profile

'the sip profile path is diffrent according to OS Type

OSType=FindOSType

If OSType="Windows 7" Or OSType="Windows Vista" Then

SipProfile=userProfile & "\AppData\Local\Microsoft\communicator"

ElseIf OSType="Windows 2003" Or OSType="Windows XP" Then

SipProfile=userProfile & "\Local Settings\Application Data\Microsoft\communicator"

End If

DeleteSip SipProfile

'this is also to delete user sip profile

SipProfile=SipProfile & "\Sip_*"

DeleteSip SipProfile

WScript.Quit

Sub DeleteSip (strSipPath)

On Error Resume Next

Dim objFSO

Dim objFolder,objDir

Dim i

Set objFSO=CreateObject("Scripting.FileSystemObject")

Set objFolder=objFSO.GetFolder(strSipPath)

'delete folder

For i=0 To 10

For Each objDir In objFolder.SubFolders

objDir.Delete True

'clear all objects

Set objFSO=Nothing

Set objFolder=Nothing

Set objDir=Nothing

End Sub

Function FindOSType

'Defining Variables

Dim objWMI, objItem, colItems

Dim OSVersion, OSName

Dim ComputerName

ComputerName="."

'Get the WMI object and query results

Set objWMI = GetObject("winmgmts:\\" & ComputerName & "\root\cimv2")

Set colItems = objWMI.ExecQuery("Select * from Win32_OperatingSystem",,48)

'Get the OS version number (first two) and OS product type (server or desktop)

For Each objItem in colItems

OSVersion = Left(objItem.Version,3)

Select Case OSVersion

Case "6.1"

OSName = "Windows 7"

Case "6.0"

OSName = "Windows Vista"

Case "5.2"

OSName = "Windows 2003"

Case "5.1"

OSName = "Windows XP"

End Select

'Return the OS name

FindOSType = OSName

'Clear the memory

Set colItems = Nothing

Set objWMI = Nothing

End Function

'==========================================================================

How to Use This Script

Copy the highlighted section and paste into Notepad.
Save the Notepad file as DeleteSipProfile.vbs.

This VBS file can be executed in multiple ways.

Method 1: Network share

This method requires end user assistance and awareness. This is, however, the fastest way to achieve the end result.

Copy the DeleteSipProfile.vbs to a network share that all users can access.
Train end users to exit Communicator or Lync, then double click DeleteSipProfile.vbs.
When the user receives the message: Open File – Security Warning Click Run.
Re-start Communicator.

Method 2: Group policy

To use the group policy method, deploy the VBS file as a logon policy. All end users need to do is log off, then log on to their Windows workstation.

Copy the DeleteSipProfile.vbs from the \\domain\Sysvol\domain\scripts folder.

Create a new Group Policy Object.

A.) Suppress the Open File – Security Warning

Open the new Group Policy Object. In the left pane, expand User Configuration, and then expand Administrative Templates.
Expand Windows Components, and then click Attachment Manager.
In the right pane, double-click Default risk level for file attachments.
Click the Setting tab, and then click Enabled.
In the Set the default risk level drop down list, select High Risk.
Click Apply, and then click OK.
Double-click Inclusion list for low file types.
Click the Setting tab, and then click Enabled.
Enter the file types you don't want to be warned about in the box (for example: .vbs) in the Specify low risk extensions box.
Click OK.

B.) Deploying logon script

Open the new GPO In the left pane, expand User Configuration, and then expand Windows Settings.
Click Script (logon\logoff).
In the right pane, double-click Logon.
In the Logon Properties windows Click Add.
In the Script Name field type in \\domain\Sysvol\domain\scripts\DeleteSipProfile.vbs.
Then click OK.
In the Logon Properties windows click Apply and then click OK.
Link this new GPO to Users OU and if possible enforce it.
Run GPupdate /force on the Domain Controller.

Note: Do not forget to unlink the policy after confirming that all users have logged out and logged in.

Summary

In this article we have examined how to delete corrupted GalContacts.db or GalContacts.Idx files from multiple workstations using a script. This script has been tested for both Windows XP and Windows 7 client operating systems. This script is handy tool for an administrator to automate the deletion of GalContacts.db or GalContacts.Idx files by deploying it as a group policy.

Lync Server Resources

We Want to Hear from You

Troubleshooting Lync Mobile Device Sign-in

NextHop — Tue, 20 Dec 2011 01:07:00 GMT

Questions about signing in to Lync 2010 on a mobile device? Check out the Office 365 Technical Blog and see this late breaking update: Update: Lync Mobile Device Sign-in and Troubleshooting.

Author: Patrick Kelley

Publication date: December 19, 2011

Product version: Microsoft Lync 2010

Lync Server Resources

We Want to Hear from You

Deploying the Survivable Branch Appliance in Lync Server 2010 for Cisco Integrated Services Router/Service Ready Engine White Paper

NextHop — Wed, 14 Dec 2011 22:45:00 GMT

The Deploying the Survivable Branch Appliance in Lync Server 2010 for Cisco Integrated Services Router/Service Ready Engine white paper is now available from the Microsoft Download Center. This white paper describes how to use a Cisco 3925 ISR G2 configured with a SRE-900 Service Module (Cisco Service Ready Engine Virtualization (SRE-V) support platform) to be deployed as a Survivable Branch Appliance (SBA) in a Lync Server 2010 environment. In this configuration, Lync Server exists on a virtual installation of Windows Server 2008 R2 that is hosted on VMware ESXi. This white paper also includes instructions about how to install the SBA software, configure the device, and integrate it into your Lync Server deployment.

Authors: Karl Good and Jack Wight

Publication date: December 14, 2011

Product version: Microsoft Lync Server 2010

Summary

The Survivable Branch Appliance (SBA) is a purpose-built appliance to increase voice resiliency in branch office scenarios. Built by Microsoft unified communications (UC) partners, this appliance is a blade server running the Windows Server 2008 R2 operating system and Microsoft Lync Server 2010 communications software. The SBA is built with an Integrated Services Digital Network (ISDN) card and comes pre-installed with Lync Server 2010 Registrar and Mediation Server components with a public switched telephone network (PSTN) gateway in a single appliance chassis. The SBA is targeted for branch office scenarios to provide high availability to the majority of Lync Server services (particularly Enterprise Voice) in the face of network connectivity failures in the primary site where Lync Server is deployed.

Successfully deploying the SBA with Cisco ISR/SRE helps you ensure that you can keep important communication links open with this specific combination of services. The introduction of the SBA role deployed on a Cisco 3925 ISR G2 configured with a 900 Series SRE module also helps ensure voice only between branch office sites can be maintained in the event of a network connectivity failure.

This white paper includes the following sections.

Planning to Deploy a Generic SBA

Planning for a successful generic SBA deployment includes:

Defining a static IP address for an SBA
Defining an Active Directory name for an SBA
Defining a central office site
Adding a branch office site by using Topology Builder
Creating an SBA in a Cisco ISR/SRE environment
Special Active Directory user accounts
Setting up client computers running Lync 2010

Setting up a Cisco ISR/SRE
Configuring the Cisco Router – Network
Creating a Virtual Windows Image on the Cisco ISR/SRE
Configuring the Cisco Router – Telephony

Configuring the Cisco router for telephony includes:

Establishing PSTN Connections

Installing an SBA on a Cisco ISR/SRE

Successfully installing an SBA on a previously installed virtual Windows Server 2008 R2 image requires following these manual steps:

Setting the SBA registry key
Installing the SBA software

Homing users in the SBA
Testing your new SBA deployment
Troubleshooting your SBA and Cisco ISR/SRE deployment

Resources

Lync Server Resources

We Want to Hear from You

Group Chat 2010 Support for SQL 2008 R2

NextHop — Tue, 13 Dec 2011 19:57:51 GMT

Today we are pleased to announce support for SQL Server 2008 R2 for Group Chat 2010 Server databases.

Author: Terry Adams

Publication date: 12/09/11

Product version: Group Chat Server 2010

Keywords: Group Chat 2010 supportability; SQL 2008 R2

The Lync Server product team has completed testing of Group Chat Server 2010 and SQL Server 2008 R2. The product now fully supports SQL Server 2008 R2 for all Group Chat Server 2010 databases.

Lync Server Resources

We Want to Hear from You

Useful Tips for Testing Your Lync Server 2010 Edge Server

NextHop — Wed, 07 Dec 2011 22:45:00 GMT

Deploying Microsoft Lync Server 2010 Edge Server can be a daunting task. Installing the software is straightforward, but getting every functional element of all the ancillary components configured properly is a challenge. Before the deployment is fully functional you need to solve issues such as firewalls, network capacities, reverse proxy, DNS, routes, certificates, and so forth. This troubleshooting checklist was developed to facilitate a smooth deployment of Edge Server.

Authors: Patrick Kelley with Sebastiaan Poels

Publication date: December 7, 2011

Product version: Microsoft Lync Server 2010

In creating this checklist the following assumptions were made:

Lync Server 2010 is fully functional.
Edge Server is part of a workgroup and is located in a firewalled DMZ.
Lync Server 2010 is in a consolidated configuration.
VPN is not being utilized from a client perspective.
Lync Server 2010 is deployed with all roles (IM, Conferencing, and AV).
Edge Server is deployed and the Lync Server 2010 topology reflects all proper settings.

Note: For an overview of the supported Lync Server 2010 Edge Server deployment strategy please see the following: Edge Deployment Overview.

Step 1: DNS

Table 1 below shows all the DNS entries required for a Consolidated Edge Server.

Note: All names and IP addresses are assumptive.

Table 1. DNS Entries

Because these DNS entries are public, they need to resolve externally for all users. To test this functionality, run a simple NSLookup from any machine on a public network. As an example, Figure 1 is a lookup of Microsoft’s external SRV. Figure 2 shows the A records. All the DNS entries from Table 1 should succeed with the expected IP addresses. Table 1 is a reference table that can be used to check all the required DNS records. When you have verified that all DNS entries are correct, you can move on to Step 2.

Figure 1. NSLookup SRV Records

Figure 2. NSLookup A Records

Table 2 is a list of all required DNS records for a typical Edge Server environment. Verifying that these records exist and resolve publicly, is a critical step for a proper DNS deployment.

Table 2. DNS Records Reference Table

Task	Behavior	Function
Nslookup from the External client
Nslookup for Access Edge (sip.domain.com)	Reply with the external IP of your Access Edge interface	IM/Presence
Nslookup your Web Conferencing Edge (WebCon.domain.com)	Reply with the external IP of your Web Conferencing interface	Conferencing
Nslookup for AV edge (av.domain.com)	Reply with the external IP of your AV Edge interface	Audio/Visual
Nslookup for Meet Simple URL (meet.domain.name)	Reply with the external IP of your Reverse Proxy interface	Simple URL
Nslookup for Dial-In Conferencing Simple URL (dailin.domain.com)	Reply with the external IP of your Reverse Proxy interface	Simple URL
Nslookup for Lync External Web Farm (WebFarm.domain.com)	Reply with the external IP of your Reverse Proxy interface	Lync Web Services
Nslookup for Open Federation Discovery (_sipfederationtls._tcp. domain.name)	Reply with a SRV record pointing to the Access Edge interface on port 5061	Federation
Nslookup for Automatic sign-on (_sip._tls. domain.name)	Reply with a SRV record pointing to the Access Edge interface on port 443
Nslookup from the Lync 2010 Edge Server
Nslookup the Internal Lync 2010 Pool (Pool.domain.com)	Reply with the Internal Pool IP address	Next Hop to internal Lync 2010 Pool
Nslookup from the Lync 2010 Pool
Nslookup the Lync 2010 Internal Edge interface (LyncEdge.domain.com)	Reply from the internal interface of the Lync Edge server	Edge Server functions

Step 2: Ports

When all DNS entries from Step 1 are valid and working, the next step to verify that all ports are open and functional. To accomplish this task perform run a series of simple Telnet tests to verify that the firewall ports are open and accepting connections. To build off the examples above, test connectivity to your Edge Servers external interfaces from any public network. The results should look like Figure 3 below. When the Telnet session connects the screen goes blank. This verifies that the port is open and properly connected.

Figure 3. C:\>Telnet FQDN Port

Table 3 is a list of all required network ports in a typical Edge Server environment. Verifying that all ports are open is a essential step when building a network architecture.

Table 3. Firewall Ports Reference Table

Task	Port/Protocol
Telnet from External Client
Test to SIP.domain.com	443/SIP
Test to SIP.domain.com	5061/SIP
Test to WebConf.domain.com	443/PSOM
Test to AV.domain.com	443/STUN
Test to WebFarm.domain.com	443/SSL
Telnet from Lync 2010 Edge
Telnet to Pool.domain.com	5061/SIP
Telnet from Lync 2010 Pool
Telnet to LyncEdge.domain.com	5061
Telnet to LyncEdge.domain.com	443
Telnet to LyncEdge.domain.com	5062
Telnet to LyncEdge.domain.com	4443
Telnet to LyncEdge.domain.com	8057

Step 3: Certificates

When your DNS resolves perfectly and ports are open and communicating — you are ready to address certificates.

The Lync Server 2010 Deployment Wizard facilitates the certificate setup process, but multiple issues need to be clarified to ensure a successful deployment.

Note: For assistance with setting up certificates please see the following TechNet URL: Set Up Edge Certificates.

External Interface Certificates

All Public facing certificates must be issued by an approved Public CA that supports Unified Communications: see Unified Communications Certificate Partners for Exchange Server and for Communications Server for detailed information.
If Public IM Connectivity (PIC) with AOL is required, the certificate must contain an Enhanced Key Usage (EKU) for the server and the client. The Lync Deployment Wizard does not request the client EKU by default. Use the following Windows PowerShell cmdlet to accomplish this task:

Request-CsCertificate -New -Type AccessEdgeExternal -Output C:\ <certfilename.txt or certfilename.csr> -ClientEku $true -Template <template name>

When deploying an Edge Server array, the certificate must have an exportable private key and the same certificate must be used on all Edge Servers. (A/V authentication requires this regardless of the number of servers).
The Certificate Name (CN) must match the FQDN of the Lync Server 2010 Access Edge external interface.
The Subject Alternate Names (SAN) attributes must contain the following:

FQDN for Access Edge (same as CN).
Web Conferencing FQDN.
All supported SIP domains beyond the primary (sip.contoso.com, sip.fabrikam.com).
The A/V authentication service FQDN does not need to be listed.
The order of the SAN’s is not important.

The reverse proxy also needs a public certificate for web farm publishing. This is the FQDN configured from the internal Lync Server 2010 pool (see Figure 4).

Figure 4. FQDN

Internal Interface Certificate

The internal certificate can be issued by an internal PKI infrastructure or by a Public CA from the approved CA list. Utilizing an internal CA can save the expense & administrative overhead of utilizing a public entity.
The CN is typically the Edge Server internal interface FQDN; however a wildcard certificate is supported.
No SAN is required.

Reverse Proxy Certificate

It must be a Public CA certificate.
The CN is the external web farm FQDN from the Lync Server 2010 pool.
The SAN’s is the simple URLs configured from the Lync Server 2010 pool (meet.domain.com & dialin.domain.com).
The CN must be a SAN.

Summary

Deploying an Edge Server can be the most challenging aspect of your deployment. It requires an understanding the application layer and many ancillary components such as the network layer and the Public Key Infrastructure (PKI). Because so many components must work in unison, it is easy to miss important architectural details. This document provides an easy reference for DNS, Firewall, and Certificates. We hope it will help you pinpoint issues and successfully deploy the Lync Server 2010 Edge Server.

Additional Resources

Tools

Lync Server Resources

We Want to Hear from You

Got Telephony Skills? Add Lync to Your Résumé. Learn, Share, Win Prizes.

NextHop — Tue, 06 Dec 2011 18:35:00 GMT

Voice and Data networking professionals can add a valuable new Microsoft Lync skillset to their résumé and help their companies on the journey to unified communications by participating in The Ultimate Voice Career Promotion. Learn, share win; by participating you’ll be eligible to win prizes that include $150 Best Buy vouchers and a $5,000 Kinect entertainment system (prizes US only, Dec 2011 through June 2012).

Author: Matthew Woodget

Publication date: December 5, 2011

Product version: Microsoft Lync Server 2010

As a Voice or Data Networking professional responsible for telephony you may have heard the buzz about Lync and wondered how to build the knowledge you need to assess and introduce it at your company. Recently Lync turned One, here’s an article about the first year. We’ve created a set of easy to access resources (videos available to get started here) to help you ramp fast. But instead of leaving it at that, we want to encourage you to share what you’ve learned with others through The Ultimate Voice Career Promotion.

Through The Ultimate Voice Career Promotion, you can add a valuable new skillset to your resume and increase the productivity of your entire office. At the same time, you’ll be eligible to win prizes that include $150 Best Buy vouchers and a $5,000 Kinect entertainment system!

There are lots of ways to earn points to be eligible to win:

Bite Sized Training Videos—Watch Lync training videos on-demand.
Deeper Learning—Attend monthly web clinics.
Blog—Post a blog review about Lync.
Your Lync Story—Post a video about your experience with Lync.
Twitter—Tweet about your Lync experience.

There are also lots of ways to win. Use your points to unlock chances to win prizes every month. Your points won’t expire until the end of June 2012. Also, any month you earn points results in an entry for that period’s grand prize – a pretty sweet Home Entertainment System make over and learning vouchers for even deeper training.

The Ultimate Voice Career Promotion sweepstakes launched November 23rd and the first 500 people to participate and earn points will receive a cool (pun intended) insulated lunch tote—so get started now.

How is this different?

We already have some awesome, comprehensive, deep, multi day training. The resources I’m sharing with you today are as easy and quick to jump into as watching a mere five minute long video and as deep as hour long monthly clinics you can join online at times convenient to you. Sign up to learn, share and win at The Ultimate Voice Career Promotion.

Why did we do this?

Enterprises around the world are adopting Lync’s telephony capabilities with millions of people already relying on Lync instead of a traditional IP PBX phone, and a staggering 250% growth rate in Lync’s first year in market. Lync changes how telephony is delivered in enterprises, but it doesn’t change the need for your skills and knowledge.

Next, improved access to Microsoft Lync telephony knowledge

Respecting the journey is critical and giving you a low friction, easy access way to learn how to transfer your skills into a software powered enterprise voice component of a Unified Communications system was required. The reality is that you as a voice professional bring with you an enormous amount of experience and the skill set required to make Enterprise Voice work, be it TDM, IP or Software based. If "IT apps folks" were to pick up the responsibility they'd have to build those skills, but you already have them. Of course, we know the future of productivity requires Unified Communications and not siloed, disconnected systems. And because the telephony workload is a vital component of UC we knew it was important to address this topic and help those with the experience and skills make the leap to Lync.

What about job security?

As it happens the role of the voice person arguably isn't any more at risk than any of us in technology, let alone with the current economy. In fact, as telephony skills are transferable into the software based telephony system components of Lync it gives voice professionals who learn it an opportunity to have a more beefy resume than those who don’t. We wanted to make sure you had the resources to be the best and have the most robust résumé. And the best bit? The efficiencies of software powered communications will free some of your bandwidth up to focus on value added initiatives within your organization; be they cost savings, enabling remote teams, or providing your company with a competitive edge in a decade that will be marked by the need for business to focus on growth.

Summary

If you manage a TDP or IP PBX today and either your company is deploying Lync or you want to be ahead of the curve for when they do this is a great set of resources for you. Either way you now have an improved path to learn about Lync’s telephony capabilities and more. Start with some low friction, low time commitment videos, and then participate in monthly web clinics. Share your knowledge to beef up your online reputation and further enhance your résumé and if you are in the US get ready to win big!

Additional Information

So what are you waiting for? Go to The Ultimate Voice Career Promotionand start learning, sharing and winning. Make sure you check out the T&Cs, whilst many of the resources are available ‘cross geography’ online the sweepstakes component is for United States residents only at this time. Follow the action on Twitter: #lync #lyncsweeps.

Register at The Ultimate Voice Career Promotion

Lync Server Resources

We Want to Hear from You

Keywords: Lync, Telephony, Voice, UC, Unified Communications, Networking, Voice Professional, Voice Expert, Cisco, Avaya, Nortel

Assigning Telephone Numbers to Lync Enterprise Voice Users

NextHop — Wed, 30 Nov 2011 19:10:00 GMT

To provide the best user experience and prepare for future growth, it is important to use the correct numbering format when assigning phone numbers to users. This article describes how to effectively assign phone numbers to Lync Server 2010 Enterprise Voice users.

Author: Thomas Binder and Doug Lawty

Publication date: November 30, 2011

Product version: Lync Server 2010

When rolling out Enterprise Voice in your organization, use the following best practice recommendations to define your numbering plan and to assign telephone numbers to Enterprise Voice users. Defining the correct numbering plan is a crucial factor in the success of your Enterprise Voice deployment. To provide the best user experience, allow room for future growth opportunities, such as expansion to other countries or merger and acquisitions (M&A).

Telephone Numbering Goals

Design your phone number plan for Lync to take into consideration the following objectives:

Compliance with Internet Engineering Task Force (IETF) standards.
Specify a valid caller ID. This enables a callee to quickly return a missed call.
Define phone numbers with extensions.
Leverage telephone numbers configured in Active Directory.
Plan for future growth.
Avoid common mistakes.

Let’s consider each of these objectives in more detail and provide recommendations for assigning phone numbers in different situations.

Standards-compliance

Lync Server 2010 follows RFC 3966. RFC 3966 prescribes the format of TEL URIs in SIP. The RFC also defines additional parameters – such as extension, phone context, and so forth – to add to the TEL URI. Phone numbers can be either local or global. Global phone numbers must start with a + sign followed by digits that represent an E.164 number. E.164 is the standard for PSTN numbers and specifies country codes. Local numbers – those that are not globally unique – must provide the context in which they are unique. To specify this context, the phone-context parameter is added to the TEL URI. The combination of the phone number and phone context creates a number unique.

The following are valid RFC 3966 TEL URI examples:

tel:+12125550135.
tel:+12125550135;ext=135 where the extension is part of the phone number.
tel:+12125550100;ext=863 where the extension is not part of the phone number.
tel:135;phone-context=HQ.

All these formats comply with RFC 3966. It is not recommended, however, to assign all formats to users. A phone number is assigned to a Lync user when the Line URI property of the user’s Active Directory account is populated with a string similar to the listed examples. The following sections explain the recommended number format for each Line URI.

Specify valid caller ID

When a private number format (such as tel:135), is used in Lync and an employee places outbound calls, the correct caller ID is not displayed. When a Lync user makes an outbound call, we want the called party to see a valid number so she can return the call. When the user does not have a public telephone number, we want to display the company’s receptionist or auto attendant caller ID, so that the called party can return the call. To accomplish this, we have the following options:

Direct inward dialing (DID) – sometimes called direct dial-in (DDI) – these numbers are globally unique phone numbers that can be called directly from the PSTN. If the user has a DID assigned, it will be presented as the caller ID for all outgoing calls and no additional configuration is necessary. Use one of the formats where the user’s DID is specified as a global number – for example tel:+12125550135 or tel:+12125550135;ext=135. (The next section encourages the use of the second format.)
If a user does not have a DID number and can only be reached through an internal extension, configure a DID number as the caller ID so that the callee can return the call. Usually, this number is the company’s receptionist or auto attendant number. Use the format where the call back number is specified as a global number and the user’s internal extension is added – for example tel:+12125550100;ext=863.

Note. Lync Server also provides the ability to suppress the caller’s ID by replacing it with another number (for more information read Voice Routes in the Technical Library).

As a best practice make sure to always provide a caller ID that can be called back when calling outside the enterprise. Specify a Line URI that contains a DID number.

Define Phone Numbers with an Extension

Phone number extensions are used in multiple ways in Lync. If you dial in to a conference and you want to join as an authenticated user, you must provide your extension and PIN. Also if you want to authenticate with your PIN on a Lync qualified phone, your extension and PIN numbers are required. For more information read Device Connection Process in the Technical Library. Users without an extension receive a warning message on the dial-in conferencing page (see Figure 1). This may lead to support calls.

Figure 1. A warning is displayed for users that do not have an extension configured

The user experience is improved when users can authenticate with a short extension instead of a 10-digit phone number. If a user does not have an extension configured, instead of requiring the user to enter their full phone number, Lync attempts to normalize the entered digits to the full E.164 phone number. If it finds a matching normalization rule to map the entered digits into a valid internal phone number, Lync Server is able to authenticate the user. However, the more complex the deployment the more likely it is that this approach will not work. For example, if users are travelling and dial in to conference numbers in other countries with different normalization rules, their extension may not be recognized.

Best practice is to always assign extensions to all users using one of the formats with the ext parameter.

Leverage Telephone Numbers Configured in Active Directory

Phone numbers within a PBX deployment must be unique. In an enterprise with multiple PBXs deployed, it is possible that some of these local numbers may overlap. If a user, whose PBX phone is hosted on one PBX, calls another internal user whose PBX phone is hosted on a PBX with an overlapping number range, the caller needs to use a prefix to differentiate the call and dial out to the other PBX.

By contrast Lync relies on Active Directory services to provide a companywide directory service. Using local extensions or regional number formats in one of the telephone number fields of a global directory does not work. Users from one location are not able to call users in a different location using their local phone number.

As a best practice, populate Active Directory with phone numbers that are globally unique.

Allow for growth

A deployment may begin with a single integrated PBX or gateway. Superficially, it makes sense to build a Lync dial plan that accommodates the dial plan of the PBX. This works when all your users are in a single region. It may also work if you use local extensions in Lync.

However, building a plan based on a local extension limits future growth. When you integrate additional locations, a numbering plan based on a local extension no longer works. This occurs because the expanded deployment is not local to only one location. When you federate with other companies or when you deploy SIP Trunking be sure that all numbers provided are globally unique and routable.

Even when you start with a limited scenario, plan for future growth. Always use globally unique numbers.

Avoid Common Mistakes

There are a number of different configurations that may initially seem like a good idea due to their simplicity. Later they may turn out to be poor decisions that block future growth.

Common mistakes include, but are not limited, to the following:

Do not include an outside line access code as part of the phone number.
In a U.S. based company users often have to dial a 9 as the common outside line code, some administrators mistakenly configure phone numbers to be normalized to +912125550135, instead of the actual E.164 number, +12125550135.
Do not treat private extensions as global numbers.
When the company does not use DIDs, some administrators mistakenly decide to populate the Line URI with the extension and prefixes a plus, for example +863 instead of the correct +12125550100;ext=863.
Failure to include the country code.
Since the company is only active in a single country some administrators mistakenly decide not to include the country code in the phone numbers, for example +2125550135 instead of +12125550135.

This can lead to the following problems in the following situations:

People cannot dial E.164 numbers using Outlook contacts or through the Lync Browser Helper if normalization rules only allow for your dial plan.
Federated partners receive the phone number through the Lync contact card but are not able to call the number, because their configuration correctly expects E.164 numbers.

Because +91 is the international dialing code for India, +912125550135 is routed to India.
Because +86 is the international dialing code for China, +863 is routed to China.
Because +212 is the international dialing code for Morocco, +2125550135 is routed to Morocco.

The company expands to international locations, which requires it to change all existing locally defined phone numbers to globally unique numbers.
The company wants to integrate SIP Trunking. Because most SIP Trunk providers do not support private numbers, you need to use globally unique numbers.

Using global numbers simplifies your Lync Server dial plan more than is possible with a typical PBX deployment. One could say this is another reason why Lync isn’t an IP-PBX. It’s not a private branch exchange. It’s an enterprise-wide Unified Communications system.

Summary

After defining the goals and best practices for assigning a user’s phone number in the enterprise, the following summarizes how to configure phone numbers for users with DIDs and for those with only internal extensions.

Configuring Users with DIDs

For users with a DID phone number, specify the global number and the extension in the user’s Line URI. After deciding how many digits to use for the extension, append the last number of digits from the user’s DID to the Line URI with the extension parameter. As an example, if the PSTN phone number for a user is +12125550135, specify the Line URI as, tel:+12125550135;ext=135, assuming a 3 digit extension.

Configuring Users with Internal Extensions

For users with private extensions that can only be dialed from within the organization, you must specify the call back phone number displayed as the caller ID and append the user’s extension. For example the Line URI of tel:+12125550100;ext=863 presents as caller ID the number of an auto attendant (+12125550100) while 863 represents the extension of the user.

Note. When you use this format, no other phone number in your Lync deployment can be assigned the number, +12125550100, without an extension. You must configure the auto attendant with an extension (for example tel:+12125551000;ext=0), and create a normalization rule to normalize incoming call for +12125550100 to tel:+12125551000;ext=0. This can be accomplished by creating a pool level dial plan for the gateway receiving the inbound call.

RFC 3966 is flexible in terms of defining phone numbers. It is recommended to use the ext format for all users – those with DIDs and those with private numbers. This provides users with the best PIN authentication experience and always provides a valid caller ID for outbound calls.

Using an E.164 global number in the Line URI at the initial deployment, provides the most flexibility for future growth of your Lync Server environment – whether you deploy additional PSTN gateways in the same or new locations, introduce SIP Trunking, or expand to new locations.

Lync Server Resources

We Want to Hear from You

Keywords: Lync, Enterprise Voice, phone number plan, E.164, extensions, Line URI

Users Unable to Join Lync Hosted Conferences from Cisco Unified Communications Manager 8.5

NextHop — Tue, 22 Nov 2011 20:00:00 GMT

In the past couple of months, we have seen an increase in dual tone multi-frequency (DTMF) issues generated when Cisco Unified Communications Manager v8.5 connects to Lync Server 2010. Lync uses DTMF to signal the conference ID that is required to join a conference. SIP trunk integration with Cisco Unified Communication Manager (CUCM) version 8.5.1.12900-7 is supported by Lync Server 2010. For additional information, see the article, Unified Communications Open Interoperability Program – Lync Server. This article addresses an issue encountered by attendees using CUCM v8.5 who are unable to join meetings hosted by Lync Server 2010.

Author: Jigar Dani

Publication date: November 2011

Product version: Lync Server 2010

Symptom

When users with Cisco phones and conference room endpoints connected to CUCM v8.5 try to join a Lync conference, they may receive multiple prompts to enter the conference ID. After entering a valid ID they may not be able to join the conference. IP phones that support RFC 2833 DTMF MTP pass-through will not experience this issue because DTMF encoding is not performed by CUCM.

Cause

After performing a code level investigation we discovered that when CUCM transcodes DTMF digits it does not send the digits in the proper format.

To troubleshoot the issue, collect a network trace from the Mediation Server connected to CUCM. Then, analyze a login attempt to join a Lync hosted conference. Figure 1 shows a network trace of a Lync client attempting to join a conference hosted on Lync Server 2010. Customer information was eliminated for privacy reasons. To filter only the network packets of interest, I set the Wireshark filter to: (udp.length != 24 && rtpevent && rtp.marker==1). I’ve highlighted the raw data that identifies the RFC 2833 RTP DTMF event. A detailed explanation of this raw data is provided later in this document.

Figure 1. Network trace: CUCM endpoint failing to join a Lync conference

Figure 2 captures a network trace of a CUCM endpoint that successfully joins a Lync conference. To filter the DTMF digits from the network trace, I set the Wireshark filter to: (udp.length == 24 && rtpevent && rtp.marker==1). I highlighted the RTP event (i.e. DTMF digit).

Figure 2 Network trace: CUCM endpoint successfully joining Lync conference.

Why am I using the filter udp.length == 24 && rtpevent && rtp.marker==1?- I want to filter packets that are exactly 24 bytes. This should be the length of DTMF digits. RTPEvent filter helps me identify packets that are DTMF digits. RTP Marker filter set to 1 helps identify just the first packet of a DTMF digit (5-8 packets make 1 DTMF digit). This first DMTF packet contains all the information we need.

Event Duration 800 is signified by hex 03 20 raw data - the data 00 00 after that is basically Trailer for Ethernet II as you can see above. In Figure 1, the duration zero should have been represented by 00 00. However, in its place we see the following data representing the event duration:

We found that we could isolate all the packets containing this garbage raw data by filtering for the right length, in this case udp length 24. So why length 24?

A DTMF packet, which is 24 octets, consists of a UDP header (8 octets) + RTP header (12 octets) + RTP Payload (RTPEVENT=DTMF) (4 octets).

The DTMF digit in RTP Payload as defined in RFC 4733 (obsoletes RFC 2833) is shown below:

0 1 2 3

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

The RTP header (assuming no CSRC) as defined in RFC 1189 is shown below:

0 1 2 3

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

|V=2|P|X| CC |M| PT | sequence number |

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

| timestamp |

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

| synchronization source (SSRC) identifier |

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

The UDP header as defined in RFC 768 is shown below:

0 7 8 15 16 23 24 31

+--------+--------+--------+--------+

| Source | Destination |

| Port | Port |

+--------+--------+--------+--------+

| | |

| Length | Checksum |

+--------+--------+--------+--------+

The hex data beyond 24 octets is something that should not be sent to Lync in a DTMF digit. This is what causes Lync to ignore these digits.

Resolution

To resolve this issue, upgrade to the supported CUCM version 8.5.1.12900-7.

Conclusion

This conference join issue due to garbage DTMF digits transmitted by CUCM has been identified by Cisco and a fix was provided in version 8.5.1.12900-7. This is also the first CUCM v8.5 that is supported for Lync. Please upgrade CUCM to this supported version to fix the above DTMF issue.

Additional Resources

Unified Communications Open Interoperability Program – Lync Server

Integrating Microsoft Lync Server 2010 and Cisco Unified Communications Manager

RFC 4733

RFC 1189

RFC 768

Lync Server Resources

We Want to Hear from You

On-Premises to Cloud Interoperability with Lync Online and Exchange Online

NextHop — Mon, 21 Nov 2011 23:00:00 GMT

With the launch of Office 365 and increasing popularity of Microsoft cloud services, questions are surfacing about how to configure interoperability between Lync Server 2010 on-premises deployments, Exchange Online, and Lync Online. A deployment that includes integration between an on-premises deployment and cloud services is known as a hybrid deployment.

Author: Randall DuBois

Publication date: November 21, 2011

Product version: Lync Server 2010

To assist you in evaluating and taking advantage of the benefits of a hybrid deployment, we recently updated the following topics.

Lync Server 2010 Topics

Exchange Server 2010 Topics

Checklist: Connect Lync Server 2010 to Exchange Online UM

Office 365 Blog Articles

Additional Resources

Microsoft Office 365

Lync Server Resources

We Want to Hear from You

Certificate Expiration Alerting

NextHop — Fri, 18 Nov 2011 17:00:00 GMT

Microsoft Lync Server and Microsoft Exchange Server utilize certificates to manage encryption and authentication. When certificates expire unexpectedly, network administrators are under pressure to resolve the problem quickly. Fortunately, most trusted Certificate Providers inform customers by email before certificates expire. But what happens when certificates are issued by an internal Microsoft Windows Certification Authority? If customers do not have a monitoring solution, such as Microsoft System Center Operations Manager, to provide status updates on certificate expirations, it is a real challenge to keep track of scheduled certificate expirations. The Certificate Expiration Alerter is a free tool that helps prevent unplanned certificate expirations.

Author: Fabian Kunz

Publication date: November 17, 2011

Product version: Windows Server 2003 CA, Windows Server 2008 CA, Windows Server 2008 R2 CA

Introduction

The Certificate Expiration Alerter helps IT departments monitor the expiration status of all certificates issued by an internal Windows Server Certificate Authority (CA). When a certificate is about to expire, the Certificate Expiration Alerter sends an email notification with information about the certificate.

This allows the IT administrator to proactively take action and renew the certificates before they expire and prevent possible service downtimes. This article explains how to use this tool.

Description

The Certificate Expiration Alerter is a command-line tool based on .NET Framework 2.0. The tool connects to a Windows Certification Authority (CA) specified as a command-line parameter. It detects which certificates are scheduled to expire on a specified day defined by a command-line parameter. After running the tool the administrator receives email notifications that identify which certificates are set to expire on the specified day. There is an optional regex parameter to filter certificates with specific Common Names. The administrator must create a Scheduled Task to run the tool once per day.

Purpose

This tool monitors internally issued certificates that are scheduled to expire. Armed with this information, the administrator can proactively take action to renew certificates before they expire.

Requirements

This tool runs on Windows Server 2003, Windows Server 2008 or Windows Server 2008 R2. The Windows version is supported only in English and German. The minimum requirement to run the tool is .NET Framework 2.0.

Examples

CertExpAlerter is a command-line tool that supports the following parameters. The parameters are:

-m = SMTP server name or ip address to relay the notification message.
-s = sender’s email address in the format sender@company.com.
-r = recipient’s email address in the format recipient@company.com. To supply multiple email addresses, use the delimiter ";".
-d = number of days to check when a certificate expires.
-c = CA server path in form of “CAServerName\Common Name of the CA certificate”
-f = regular expression to filter based on the certificate’s Common Name.

The common use case is Scenario 4. Before you create a Scheduled Task for this tool, first run Scenarios 1 and Scenario 2. Scenario 1 (Test Email Receipt) validates that the tool can successfully send emails. Scenario 2 ensures that the user account, used by the Scheduled Task, has sufficient privileges to connect to the Windows CA. If both tests are successful, you can create the Scheduled Task.

Scenario 1: Test email receipt.
This command-line sends an immediate test email. This allows the administrator to verify that the tool sends certification expiration notifications.

CertExpAlerter.exe -m SMTPServerName -s sender@company.com -r recipient@company.com

Scenario 2: List all issued certificates.
This command-line argument lists all certificates issued by the CA and includes their expiration information.

CertExpAlerter.exe -c "CAServer\Root CA"

Scenario 3: List all issued certificates scheduled to expire in x days.
This command lists all certificates scheduled to expire in exactly 15 days.

CertExpAlerter.exe -c "CAServer\Root CA" -d 15

Scenario 4: Send email notification that identifies certificates scheduled to expire in x days.
The administrator must create a Scheduled Task and run the tool on a daily basis. An email is sent to recipient@company.com if a certificate will expire in exactly 30 days.

CertExpAlerter.exe -m SMTPServerName -s sender@free-fsolutions.com -r recipient@company.com -d 30 -c "CAServer\Root CA"

Scenario 5: Filter based on certificate Common Name.
To query certificates that match a specific regular expression in the Common Name, use the parameter: -f. This parameter uses regular expressions (regex). This parameter is not case sensitive. This parameter can be used in any of the previous listed scenarios, except in scenario Test email receipt.

This command returns all certificates with a Common Name that starts with the string PC.

CertExpAlerter.exe -c "CAServer\Root CA" -f "^PC"

This command returns all certificates with Common Name that does NOT start with the string PC.

CertExpAlerter.exe -c "CAServer\Root CA" -f "^(?!PC)"

Output

Figure 1 illustrates listing of all certificates with their expiration date information’s (Scenario 2).

Figure 1. Quering certificates

Figure 2 illustrates querying certificates where the Common Name begins with “test” (Scenario 5).

Figure 2. Quering certificates with the optional filter parameter

Figure 3 illustrates querying certificates about to expire in exactly 707 days (Scenario 3).

Figure 3. Quering certificates with the optional filter parameter

The email notification contains information about the certificate that matches the optional filter and the specified day criteria scheduled to expire (Scenario 4). This is illustrated in Figure 4.

Figure 4. Email notification

Summary

Monitoring solutions, such as System Center Operations Manager, provide administrators with advanced notification of scheduled certificate expirations. If you do not have an installed monitoring solution, however, CertExpAlerter offers an easy and free solution to monitor your certificates. Download the tool here: Certificate Expiration Alerter. Please reach out to me if you have further questions.

Lync Server Resources

We Want to Hear from You

Keywords: Certificate, Expiration, Alerter, Expired, Expire, CA, Lync Server

Mac Users: Download Lync for Mac 2011 Today

NextHop — Wed, 16 Nov 2011 19:07:00 GMT

Working on a Mac in Office 365 just got better. Lync for Mac 2011 is now available to all Office 365 users who are licensed to use Lync Online.

Author: Rory Conway

Publication date: November 16, 2011

Lync for Mac 2011 enables Mac users to see their colleagues’ online presence while working in Outlook or collaborating on Office documents. Lync for Mac enables users to quickly send an instant message, start a video chat, or schedule an Online Meeting from within Outlook for Mac 2011.

For the full article by Rory Conway, visit the Office 365 site: Mac Users: Download Lync for Mac 2011 Today.

Lync Server Resources

We Want to Hear from You

Enabling Lync Media to Bypass a VPN Tunnel

NextHop — Tue, 15 Nov 2011 20:00:00 GMT

Many organizations utilize Virtual Private Networks (VPNs) to secure traffic when users are outside the corporate network. VPNs have numerous security benefits, but they can actually degrade the call experience for Microsoft Lync users. This occurs because Lync traffic is already secured. This article explores this common Lync Server 2010 deployment issue, and demonstrates how to utilize the existing infrastructure to redirect media traffic to bypass the corporate client VPN Solution. This solution maintains a secure environment and improves the Lync 2010 user experience.

Authors: Kevin Peters, Randy Wintle

Publication date: November 15, 2011

Product version: Lync Server 2010

Many organizations that deploy Lync Server 2010 encounter voice quality issues associated with the usage of a client VPN solution in combination with Lync 2010. When users connect to the corporate network using a VPN client, Lync media traffic is sent through the VPN tunnel. This configuration can create additional latency and jitter because media traffic must pass through an additional layer of encryption and decryption. The issue is compounded when the VPN concentrator is busy. Real time media traffic is not prioritized. This means that other network activity, such as a large file transfer, can potentially degrade the call experience of users.

To provide users with the best possible media quality, organizations should deploy a solution that prevents time sensitive real time media (voice/video) from traversing the VPN and simultaneously allows standard corporate network traffic to traverse the VPN. When considering this solution organizations should know the following:

All Lync 2010 traffic is encrypted by default. SIP signaling traffic is encrypted using TLS, and all media traffic (audio, video and application sharing) is encrypted using SRTP. Because of this, Lync traffic does not need to be routed through encryption tunnels unless your organization specifically requires dual layer encryption.
The Edge Server was designed to provide superb media quality to internet based users. Because of this, media that relays through the Edge Server is typically more reliable and of higher quality than media that traverses the corporate client VPN Solution.

Because end users typically require continuous VPN connectivity, it is not feasible for users to disconnect from the VPN before making or receiving Lync calls. The solution is to force Lync traffic around the client VPN, while allowing users to connect to other internal corporate resources. The solution encompasses the following areas:

Create a split tunnel VPN configuration.
Revise the Windows Firewall policy or corporate VPN firewall rules.
Configure specialized DNS entries.

The Problem

Lync Server 2010 utilizes the Interactive Connectivity Establishment (ICE) protocol to establish media sessions between all Lync 2010 endpoints and servers. ICE attempts to establish media sessions between clients using all available ICE candidates on the client at the time of the call. Candidates are a combination of available IPv4 addresses and randomly allocated media ports on the machine with Lync 2010 installed. When a client VPN is connected, it often registers an IP address on a remote access interface on the client PC. Because of this, it is considered a valid IPv4 address; a candidate will be allocated for media connectivity to other clients. This is important because ICE tries candidates in the order shown below. When a media path is validated, the connectivity checks stop and the media is established.

1. UDP Direct- Physical (or virtual RAS) interfaces with IPv4 addresses assigned.

2. UDP NAT- Applies only when two users, who are outside the corporate firewall, are connected to the Lync infrastructure through the Edge Server. This scenario involves trying connectivity through the reflexive IP addresses for each home user. The reflexive IP address is the public IP address of the home router.

3. UDP Relay- Between two external users or an external user and an internal user. This connectivity is relayed through the public IP address of the Audio/Video Edge service.

4. TCP Relay- The relay address (Audio/Video Edge Server public interface) when connectivity is not available on UDP. TCP Relay is a last resort.

When a Lync 2010 user is connected through VPN and attempts to call an internal Lync 2010 client, or tries to establish a media session with a Lync 2010 Server (Mediation Server, A/V Conferencing Server), the traffic attempts to pass through the VPN interface and is considered a UDP Direct candidate. If this connectivity check succeeds, the media traverses the client VPN solution.

Figure 1. Lync 2010 Call Process through VPN - The Problem

This scenario is a common default configuration issue. The requirements below define a solution that forces Lync client traffic through the Lync Edge Server (UDP Relay candidates).

For more details on how ICE works for all Lync 2010 scenarios, see the Lync 2010 Resource Kit External User Access Chapter.

Solution Configuration

The solution to force VPN traffic through the Edge Servers must allow external Lync clients connected through VPN to do the following:

1. Connect to corporate and external resources (split-tunnel).

2. Resolve external DNS entries for the Lync Edge services, Lync Web services and Exchange Web Services.

3. Register through the Lync Access Edge service.

4. Block connectivity from VPN connected Lync 2010 clients to all Lync Servers and all internal client subnets through the VPN tunnel. In our example we used Windows Firewall to block this traffic. You can achieve similar results, however, if your VPN appliance has detailed rules to firewall client VPN traffic.

5. Allow VPN connected clients to establish media through the A/V Edge Server public interface.

Split-Tunnel VPN Policy

To allow Lync traffic to reach the public IPs of all services, the VPN appliance must be configured to allow a split-tunnel. A split-tunnel is a VPN connection that allows connections intended for internal resources to traverse the VPN. All other user requests are sent through the internet connection and bypass the corporate network. For more information on spilt-tunnel VPNs read Split tunneling.

In most split-tunnel VPN scenarios, DNS is provided by an internal DNS server. The server needs to be configured as described later in this article in the section Specialized DNS entries.

It is critical that all public IP addresses used for the Lync and Exchange environments are excluded from entering the VPN tunnel. A tunnel-all VPN policy does not allow traffic to bypass the tunnel and does not work with this solution.

Configuration of the VPN appliance is considered out of scope for this document; please consult your VPN appliance vendors’ documentation for more information on configuration recommendations.

Windows Firewall Policy

Administrators can create a custom Windows Firewall rule set to prevent Lync client traffic from entering the VPN. There are multiple options to push this policy, but this article will use the Windows Firewall snap-in to create the rules. Using group policy, administrators can follow the same configuration tasks. Deploying rules through group policy scales well in larger environments. For the scenario described below, we assume the following:

Corporate subnets all fall within the 10.0.0.0/8 range.
VPN subnet is 172.16.1.0/8.
A Connection type of Remote Access is shown in windows when VPN is connected.
A Network type of Domain is shown in windows when connected to the VPN.

Note: If you are not using Windows Firewall, but want to deploy firewall rules through your VPN appliance, consider the following rules:

Table 1. Firewall Rules to Block Lync Traffic over VPN

Source	Destination	Port	Description
Client VPN Subnets	Corporate VPN network	1024-65535 TCP/UDP (this is by default; however these port ranges are configurable. See the QoS Deployment Guide for more details.	Lync 2010 client media traffic to all other internal clients.
Client VPN Subnets	All Lync Servers, including the Edge Server internal interface	All Ports TCP/UDP	Lync 2010 client traffic to Lync Servers, all should be blocked.

The above rules, used in conjunction with the remaining configurations, allow you to force Lync 2010 traffic to relay through the Edge Server.

As mentioned above, all Windows Firewall configurations shown here are created using the local Windows Firewall Snap-In.

Windows Firewall Policy Configuration Steps

To begin, create a new inbound rule for the Lync application (Communicator.exe). This rule needs to be a Custom rule. See Figure 2 below.

Figure 2. New Inbound Rule Type Custom

Next, specify the executable for Lync or Communicator (Communicator.exe) as shown in Figure 3. Although this article only covers the Lync client, the same principles can be applied to other applications such as Microsoft Office Live Meeting 2007 or the Microsoft Lync 2010 Attendee.

Figure 3. Communicator.exe specified as the program path

For protocols and ports, leave the default settings as shown in Figure 4. This blocks all ports and all protocols.

Figure 4. Default Configuration for Protocol and Ports

To scope, define the VPN subnet in the Which local IP addresses does this rule apply to box, and the corporate and VPN subnets in the Which remote IP addresses does this rule apply to box. See Figure 5. Defining the VPN subnet in the remote IP address field prevents hair-pinning. Hair-pinning occurs when traffic enters and leaves the same interface on a network device, such as a VPN concentrator. Blocking hair-pinning prevents two VPN based users, from sending their peer to peer media traffic through the VPN tunnel.

Figure 5. VPN subnet defined as the local IP, VPN and corporate subnets defined as remote subnets.

When in the Scope section, customize the interface type to include only Remote Access. See Figure 6. This prevents the configuration from being applied when not connected to the corporate VPN.

Figure 6. Custom Interface Type of Remote Access selected

For action, choose block as shown in Figure 7.

Figure 7. Blocking configured to prevent connections from utilizing VPN based IP address

In the Profile screen select Domain. See Figure 8. This ensures the settings are only applied when connected to the users’ corporate Active Directory domain. This setting cannot be used for machines that are not joined to the domain. This setting keeps the configuration from being applied when connected to VPN networks other than the users’ corporate connection with the same network numbering.

Figure 8. Network profile type of Domain

Give the rule a meaningful name and description see Figure 9.

Figure 9. Configure the name of your rule and provide a description

After creating the inbound rule, create an outbound rule with the same configuration.

Specialized DNS Entries

Because connections to all internal IP addresses are blocked, you must provide valid DNS entries that resolve public IP addresses in response to queries from the Lync client. To achieve this use a dedicated DNS server, with pin point zones as explained in the article Communicator Automatic Configuration and Split-Brain DNS.

The Lync client makes connections to the following resources. You need to provide the public IP addresses back for those requests:

Lync Edge Server services (Access Edge, Web Conferencing Edge, and Audio/Video Edge).
Simple URLs (reachable through the reverse proxy).
Exchange Web Services (EWS), Autodiscover service and all other client connectivity.

Lync Edge Services

To force the Lync client traffic around the VPN, the public IP addresses for all three Edge services must be returned to the Lync client when it makes a query. This allows the Lync client to connect to the Access Edge as an external client. This is required because users must register as external to obtain proper Media Relay Authentication Server (MRAS) credentials. For more details on MRAS, see Microsoft Lync Server 2010 Resource Kit: External User Access.

Example:

Table 2. Example Edge Server DNS Entries

Record	Resolves to	Description
Sip.contoso.com	167.55.49.32	Access Edge interface
_sip._tls.contoso.com	Sip.contoso.com:443	Auto Login SRV record for clients
Web.contoso.com	167.55.49.33	Web Conferencing Edge Server
Av.contoso.com	167.55.49.34	A/V Edge Server

Simple URLs

Just like SIP traffic, you must block all https pool traffic from entering the VPN. All URLs defined for simple URLs and pool web services (including external web services FQDNs) must return a public IP address routed outside of the VPN tunnel.

Example:

Table 3. Example Simple URL DNS Entries

Record	Resolves to	Description
Web-external.contoso.com	167.55.49.35	Pool external web services
Meet.contoso.com	167.55.49.35	Meeting join page
Dialin.contoso.com	167.55.49.35	Dial-In conferencing settings page

Exchange Web Services

Because you are blocking the Lync client from reaching any internal subnets, you must ensure that all Exchange services are reached through their public IP addresses.

Example:

Table 4. Example Exchange Web Services DNS Entries

Record	Resolves to	Description
autodiscover.contoso.com	167.55.49.36	Exchange Auto Discover
owa.contoso.com	167.55.49.36	Exchange Web Services/Outlook Web Access

Summary

When these changes are implemented, the Lync client will connect to the Access Edge Server for all signaling connections when on the corporate VPN (see Figure 10). In addition, media sessions will not be allowed to establish connectivity through the VPN tunnel. Media sessions will be routed through the A/V Edge Server public interface (see Figure 11).

Figure 10. Lync client signaling bypassing the corporate VPN with windows firewall configuration

Figure 11. Lync client media bypassing the corporate VPN with windows firewall configuration

Reference Articles

Lync Server Resources

We Want to Hear from You

Keywords: Lync, VPN, ICE, Lync Edge Server, Windows Firewall, Virtual Private Network

Introduction to SharePoint Online —Lync and Learn Online Session

NextHop — Mon, 14 Nov 2011 18:00:00 GMT

Do you want to learn more about the Office 365 suite? If so, attend the upcoming event: Lync and Learn - Introduction on How Businesses can Benefit from SharePoint Online. Lync and Learn online sessions are led by Community Grid members and address different Office 365 subjects and scenarios. They are beneficial to anyone who wants to learn more and expand their knowledge of the Office 365 suite.

How businesses can benefit from SharePoint Online is the third Lync and Lean session and will guide you through the various functionalities and benefits of SharePoint Online. The event is scheduled for Thursday, November 17th, at 11:00 AM PST.

Author: Jim Bradley

Publication date: November 14, 2011

For the full article visit: Lync and Learn - Introduction on How Businesses can Benefit from SharePoint Online.

To register for the session, see Lync and Learn - How Businesses can Benefit from SharePoint Online Event ID: 1032499462.

Lync Server Resources

We Want to Hear from You

Troubleshooting for Lync for Mac 2011 with Lync Server 2010

NextHop — Fri, 11 Nov 2011 00:17:00 GMT

Microsoft Communicator for Mac 2011 and Microsoft Lync for Mac are two instant messaging (IM) clients that are designed to be used with the Apple operating system in a Communications Server or Lync Server 2010 unified communications environment. This combination of technologies necessitates that the user understands the preliminary steps that are required to get Mac-oriented IM clients connected to the Windows unified communications environment. This article provides some handy troubleshooting steps that may be required to test Microsoft Lync for Mac connectivity to the Microsoft Lync Server 2010 pool servers, and provides information for collecting the logs that are required for troubleshooting.

Author: Edwin Joseph

Publication date: November 2011

Product version: Microsoft Lync for Mac version 14.0.1

The purpose of this article is to explain how to troubleshoot Microsoft Lync for Mac connectivity to Microsoft Lync Server 2010 or pool servers, and collect the required logs for troubleshooting. It is intended for people who’ve had some exposure to the Mac operating system. This information is distributed in various formats, such as PDF and HTML, across various sites (blogs, discussion forum, and so on) and documents that have been consolidated to provide effective troubleshooting.

The versions of the Mac operating system that will be discussed in this article are:

Mac OS X Snow Leopard (version 10.6)
Mac OS X Lion (version 10.7)

The steps that are used to troubleshoot Mac OS X Lion and Mac OS X Snow Leopard are similar.

Common Troubleshooting

For information about troubleshooting network connectivity issues by using tools such as Ping, Port Scan, and proxy configuration, installing certificates on the Mac, and verifying certificate presence, refer to the following blog post: Troubleshooting Connectivity for Messenger for Mac 7.0.2 and Communicator for Mac 2011 with Communications Server 2007 R2 and Lync Server 2010.

NOTE: Command key or also commonly known as the Apple key.

When working with Mac OS X Lion or/and Microsoft Lync for Mac, make sure that you have the 14.0.1 update installed for Microsoft Lync for Mac 2011.

Download the update from the Download Center at Microsoft Lync for Mac 2011 14.0.1 Update.

Set Configuration Settings for Lync for Mac

In this section, we’ll walk through setting up some common configuration settings for Lync for Mac, such as changing the sign-in address, changing settings related to Microsoft Exchange Server, and changing settings for Microsoft Outlook.

1. Start Microsoft Lync for Mac, and then press the Command key and the “,” (comma) key to set the preference.

1. Start Microsoft Lync for Mac, and then click Lync in the menu options.

2. In the Lync menu, click Preferences.

3. Click the Account tab to display the email address or SIP URI (Figure 1).

Figure 1: Account settings for Lync for Mac 2011

4. If required, select Show me away when I am Inactive for this many minutes, and then select the number of minutes in the drop-down box.

5. If required, select appropriate check boxes for Microsoft Exchange and Microsoft Outlook.

For advanced troubleshooting, do the following steps:

1. Under Server Settings, click Edit to manually enter the pool name for both internal and external use. Manual configuration can help to troubleshoot DNS name resolution issues.

2. You can also enable Kerberos authentication for Lync for Mac from Advanced Server Settings (Figure 2).

NOTE: When connected to the internal corporate network (LAN), to enable Kerberos authentication for Lync for Mac, verify that the Kerberos plug-in has been enabled in Mac OS X and is working correctly.

Figure 2: Advanced Server Settings

Log on to Microsoft Lync for Mac

1. Click the General tab in preferences to enable logging.

NOTE: After logging has been enabled in Preferences, sign out of or exit from Microsoft Lync for Mac, and then restart Microsoft Lync for Mac.

2. The logs are located in users/username/library/logs/Microsoft-Lync-0.log. (The zero increments as the log file grow.)

Figure 3: Preference General tab

Set Phone Calls Settings

The Phone Calls tab can be useful in troubleshooting voice call related issues. To set the appropriate Phone Call options, such as Call Forwarding and Unanswered Calls, do the following:

1. Click the Phone Calls tab in the preference settings for Microsoft Lync Communicator for Mac 2011 (Figure 4).

2. Select the appropriate settings for Call Forwarding options.

3. In the drop-down box under Unanswered Calls, you can choose to forward the call to a phone number or to voice mail, and then select the number of seconds that should elapse before an unanswered call is redirected.

Figure 4: Preference Phone Calls tab

Summary

In this article we’ve looked at Microsoft Lync for Mac which is the latest instant messaging client offering from Microsoft for Mac users to connect to the Lync 2010 Server unified communication environment. Microsoft Lync for Mac can be installed with the Mac OS running an Intel processor only, and it offers features for collecting logging information that are comparable to other Lync Server 2010 clients.

For a comparison of features and capabilities of Lync Server 2010 clients, refer to the article at TechNet, Client Comparison Tables