LCS 2003 & Windows Messenger 5 Connectivity
Overall the behavior below is applicable for LCS 2005 but given the new feature of Pools there may be some slight/subtle difference, so for now this is about 2003 and I will edit at a later time with 2005 applicable changes (if any).

When establishing connectivity for Windows Messenger 5 (WM5) to LCS for the first time, the following items need to be checked.
1) The user has been enabled, given a SIP-URI and homed on a server.
2) The user sip-uri (e.g. - toml@microsoft.com)
3) The domain in the sip-uri (e.g. -microsoft.com) is listed in LCS. For 2003 you would look on the domain tab under Users Services Global Settings For 2005 you would look at the properties of the Forest
NOTE: Please keep in mind that the domain used for LCS and WM5 does not need to match your Active Directory or DNS namespace. I like to use the example of toml@fuzzybunny.local. It is just an attribute that has to be set and the environment supports. While it does not have to match the DNS namespace, users of Autoconfiguration (discussed below) will have some further considerations.
4) The LCS server is configured to accept connections on TCP and/or TLS.
5) WM5 users in the domain can provide credentials using NTLM: DOMAIN\Toml or Kerberos: toml@domain.com. Again note that this does not have to match my sip-uri. NOTE: For WM5 clients in a workgroup, if the LCS server is configured for both Kerberos and NTLM when the client connects the server will present both options. If the WM5 client is passing the Kerberos style credentials we will attempt to logon using Kerberos as it is more secure but fail as we are in a workgroup. If we try Kerberos and fail we will not try NTLM as we won't try a less secure method. The solution, in this configuration, is to alter the logon credentials to use the NTLM style.

WM5 using TCP
1) Configure the client under Tools, Options, Accounts, Advanced to use TCP as a protocol and use the IP address of the LCS server. This eliminates name resolution problems and also validates connectivity without the overhead of TLS and certificates. If this fails to connect you need to double check all the items above.
Next you will want to change the settings to use the FQDN of the LCS server to test name resolution. If any of this fails, you can enable client side logging by changing the registry keys in the following location.
[HKEY_CURRENT_USER\Software\Microsoft\Tracing\RTCDLL]
"EnableFileTracing"=dword:1
"FileDirectory"= C:You have to EXIT the WM5 client, and when you restart a file with the name RTCDLL*.log

WM5 using TLS
1) The LCS server needs to have requested a certificate for the FQDN of the machine and also the trusted root authority. See my other posting about LCS 2003 and Certificates. http://tomllcskid.blogspot.com/2004/10/lcs-2003-certificates.html
2) LCS needs to be configured for TLS with the above certificate. Any errors here, refer to the url in step 1.
3) You have to have the trusted root authority certificate on the client
4) You have to configure WM5 for TLS and the name must be the same as the name on the certificate used by the LCS server. While there are situations in which it would not be the actual FQDN those are typically one-off situations and if you are doing that you probably don't need much of this info
If the client connection fails you want to refer to the above client side logging information. I also recommend to customers trying to use the IP address with TLS as this will almost always help give a certificate error which can help prove a connection is being established.

WM5 using Autoconfiguration
Autoconfiguration is where DNS and your sip-uri start to matter, so pay attention
WM5 using Autoconfiguration will make the following DNS queries when trying to connect and sign-in. We will use the example of toml@microsoft.com
_sip._tcp.microsoft.com
_sip._tls.microsoft.com
sip.microsoft.com
Notice that the above queries are based on the domain portion of my sip-uri. So for customers that do use a sip-uri that does not match their DNS namespace just have to make sure that they can make an authoritative zone for the namespace. For my wacky example toml@fuzzybunny.local you or your ISP would now need to configure a zone for this. Keep in mind that you only need to create a service record and that the HOST record it refers to could be in another domain (_sip._tls.fuzzybunny.local could refer to HOST lcsserver1.microsoft.com)

For customers who have the WM5 client configured for High Security Mode you will need one other registry key change, or change Group Policy (rtclient.adm is on product CD and called Allow Additional DNS Names)
1. Start, Run, Regedit, navigate to HKLM\Software\Policies\Microsoft
2. Under Microsoft create the following key: Messenger
3. Under the new Messenger key create the following key: Client
4. Under the new Client key create the following key: {83D4679F-B6D7-11D2-BF36-00C04FB90A03}
NOTE: that the {} are required in the key with the GUID (Globally Unique Identifier).
5. Under the new GUID key above create the following key: _Default
6. Create a new DWORD value: DisableStrictDNSNaming Set the value data to 1
7. Sign out and exit Windows Messenger
The reason for this key is that in High Security Mode the client is expecting to recieve a certificate for SIP.DOMAIN.COM which you likely did not name the server and get a certificate for. Enabling the group policy or registry value sets the client to ignore the Host name, in fact it will also ignore child domains - bogus.sales.domain.com would be accepted as it was a certificate for domain.com

Hope this helps.
Toml LCS kid