Rui Silva - UCspotting

Tales from the Crypt..oAPI Vulnerability (KB974571)

ucspotting — Thu, 15 Oct 2009 22:19:12 GMT

As much as I would like to catalog the story so far around KB974571 as fiction, the truth is that it resembles more to a horror movie.

Before going any further, I would like to say that Microsoft recommends thorough testing of any software patch/hotfix before applying them in a Production environment. Having said that, I would like to invite you all to read Best Practices for Applying Service Packs, Hotfixes and Security Patches.

The above mentioned TechNet article states the following:

The basic rules are:

"The risk of implementing the service pack, hotfix and security patch should ALWAYS be LESS than the risk of not implementing it."

And,

"You should never be worse off by implementing a service pack, hotfix and security patch. If you are unsure, then take steps to ensure that there is no doubt when moving them to production systems."

Whether you’re superstitious, religious or a devoted fan of Murphy Laws, the naked truth is that sh*t happens! And that’s exactly what recently happened with OCS and the release of the security patch KB974571. For more information, please read the post from the OCS Team Blog: Urgent: Known issue under investigation with KB974571 and LCS/OCS.

But the KB974571 hotfix has another side effect that I recently experienced. Besides affecting the services of LCS/OCS, the very same patch can also prevent the installation of new OCS servers.

Recently, I was building a new demo environment, when, nearly at the end of the installation of a standard edition server, during the activation phase of the server, I got the following error:

The OCS installation logs revealed the following information:

Failure
[0xC3EC796C] One or more errors occurred during execution of the wizard; the wizard was unable to complete successfully. Please check the log file for more information.

After expanding the log, the error pointed out to the Activation Standard Edition Server Log.

The error in the Activation Standard Edition Server Log was:

Failure
[0xC3EC78D8] Failed to read the Office Communications Server version information. This can happen if the computer clock is not set to correct date and time.

After spending some time troubleshooting the issue, with no solution in sight, I started to doubt the health of the virtual machines I was using (first) and then my sanity (last). But then, when I was on a dead end, a customer asked me to help him installing a new Edge Server. Guess what? Same error, same problem.

Since I was getting lots of noise around KB974571 (I already knew it could affect installed LCS/OCS services), I decided to uninstall that specific hotfix from the list of installed patches. That solved the problem!

Microsoft recommends to postpone installing KB974571 on any LCS 2005 / OCS 2007 /OCS 2007 R2 servers.

“Microsoft is investigating this issue, and will determine the most appropriate way to address it. Customers who are not running OCS or LCS server are not affected by this known issue, and can safely ignore this issue.

Customers who have deployed the OCS or LCS product on a server should assess the risk that is involved to decide whether to install the security update on that server. These customers should revisit this Knowledge Base article often, because this article will be updated as soon as more information and a resolution are available.”

[UPDATE]

There is now a fix for this issue, available through the KB974571 article. Look under the section “Resolution for the known issue”.

Live Meeting: Best Before Date (See Below)

ucspotting — Fri, 14 Aug 2009 18:52:49 GMT

Although on-premises web conferencing meetings organized with Office Communications Server (OCS) are not perishable products (and thus they don’t require a “best-before date”), there is some configuration involved around meeting life-cycle that I would like to explore a little bit further.

Suppose you organize a web conference using the Live Meeting client or the Conferencing Add-in for Microsoft Outlook. You invite some attendees and during the meeting some content is generated and uploaded (e.g. PowerPoint slides, polls, whiteboard, etc.).

Three weeks after this specific meeting has occurred, you want to review some of the annotations that were made on the slides and some of the brainstorming carved on the whiteboard. “No problem”, you think. After locating the appointment on the Outlook Calendar, you click the “Join the meeting” hyperlink, but suddenly the following error pops-up:

The meeting has ended or the information you entered was not recognized. Contact the meeting organizer for more information.

Before going any further, let’s review some of the concepts associated with meeting life-cycle:

Deactivation – The meeting is deactivated when the organizer terminates it and all the authenticated users leave. When you deactivate a meeting, you end the instance of the meeting, but the meeting continues to exist in the database and can be reactivated and rejoined.
Expiration – After the meeting is deactivated, the expiration clock starts ticking. When you reach the expiration time, it’s no longer possible to rejoin the conference, unless it’s reactivated. The default expiration time for scheduled meetings is 14 days.
Reactivation – If the meeting still exists in the database, it can be reactivated simply by rescheduling it using Outlook. Since you can reschedule it to occur in the past (although I can’t think on a reason to do this), the meeting will only reactivate if it falls in the last 14 days, because this is the default expiration time.
Content Expiration Grace Period – Grace period in addition to the expire time, after which the Web Conferencing Server should clean up content for a conference. When you reach the end of the grace period, the meeting and all associated meeting content are deleted from the database. The default grace period is 14 days after the expiration time.

With the present release of OCS it’s not possible to control the duration of the meeting expiration period (although the content grace period can be extended). This is the default behavior for the meeting expiration time (txs Tarang Mittal):

For a single one time scheduled meeting, the conferences expires after 14 days.
For a recurring meeting, the conference expires 14 days after the last instance of that meeting.
For a recurring meeting with no end date, the conference never expires.
For a Meet Now, the session expires in under 8 hours.

Hopefully, after this explanation we can now understand the error message we got when trying to rejoin a meeting that had ended 3 weeks before. Since the expiration time is 14 days, it’s no longer possible to rejoin it. The good news is that we have an additional 14 days for the content to expire, after the default meeting expiration period. So, by simply rescheduling the meeting using Outlook, we can now successfully reopen it and check the content we were looking for.

Managing Meeting Life Cycles with WMI

There are some parameters in OCS that can only be controlled using WMI, such as the ones involved with meeting life-cycle.

For conference deactivation, there are two pool-level WMI settings that are stored as properties in the MSFT_SIPMeetingScheduleSetting WMI class in the root\CIMV2 namespace:

UnAuthenticatedUserGracePeriod [Integer (0~60) minutes] – Grace period allowed for anonymous or federated users to stay in the meeting without any authenticated user in the meeting. The default value is 10 minutes.
MaxMeetingLength [Integer (0 ~ 8760) hours] – Maximum length of any meeting without join activity. The default value is 24 hours.

For conference expiration, there is one pool-level WMI setting that is stored as a property in the MSFT_SIPDataMCUCapabilitySetting WMI class in the root\CIMV2 namespace:

ContentExpirationGracePeriod [Integer (0~365) days] – Grace period in addition to the expire time, after which the Web Conferencing Server should clean up content for a conference. The default value is 14 days.

To use VBScript to modify deactivation and expiration WMI settings

The following 2 scripts will modify the WMI properties previously discussed. They must be run on the OCS Web Conferencing Server using the appropriate administrative permissions.

' 
' ContentExpirationGracePeriod
'

  Dim objLocator
  Dim objService
  Dim objInstances
  Dim objInstance

  Wscript.Echo "Connecting to local WMI store..."

  Set objLocator = CreateObject("WbemScripting.SWbemLocator")
  Set objService = objLocator.ConnectServer(".", "root\cimv2")

  Wscript.Echo "select * from MSFT_SIPDataMCUCapabilitySetting"
  Set objInstances = objService.ExecQuery _
    ("select * from MSFT_SIPDataMCUCapabilitySetting where backend=""(local)\\rtc""")
    ' For OCS Enterprise Edition: backend=""server name\\sql instance""

  If IsNull(objInstances) Or (objInstances.Count = 0) Then
    Wscript.Echo "Error: No instance"
  Else
    For Each objInstance in objInstances
      objInstance.Properties_.Item("ContentExpirationGracePeriod").Value = 365
      objInstance.Put_
      wscript.Echo objInstance.Properties_.Item("ContentExpirationGracePeriod").Value
      wscript.Echo "Done!"
    Exit For
    Next
  End If

  Wscript.Echo ""

' MaxMeetingLength
'

  Dim objLocator
  Dim objService
  Dim objInstances
  Dim objInstance

  Wscript.Echo "Connecting to local WMI store..."

  Set objLocator = CreateObject("WbemScripting.SWbemLocator")
  Set objService = objLocator.ConnectServer(".", "root\cimv2")

  Wscript.Echo "select * from MSFT_SIPMeetingScheduleSetting"
  Set objInstances = objService.ExecQuery _
    ("select * from MSFT_SIPMeetingScheduleSetting where backend=""(local)\\rtc""")
    ' For OCS Enterprise Edition: backend=""server name\\sql instance""

  If IsNull(objInstances) Or (objInstances.Count = 0) Then
    Wscript.Echo "Error: No instance"
  Else
    For Each objInstance in objInstances
      objInstance.Properties_.Item("MaxMeetingLength").Value = 8760
      objInstance.Put_
      wscript.Echo objInstance.Properties_.Item("MaxMeetingLength").Value
      wscript.Echo "Done!"
    Exit For
    Next
  End If

  Wscript.Echo ""

To use WBEMTest to modify deactivation and expiration WMI settings

Log on to a server with Office Communications Server 2007 R2 administrative tools installed, as a member of the RTCUniversalServerAdmins group or an account with equivalent user rights.
Click Start, click Run, type wbemtest, and then click OK.
In the Windows Management Instrumentation Tester dialog box, click Connect.
In the Connect dialog box, in Namespace, type root\cimv2, and then click Connect.
In the Windows Management Instrumentation Tester dialog box, click Query.
In the Query dialog box, type the following in the Enter Query box according to the WMI class name to be modified and then click Apply:
MSFT_SIPMeetingScheduleSetting
Select * from MSFT_SIPMeetingScheduleSetting where backend="(local)\\rtc"
MSFT_SIPDataMCUCapabilitySetting
Select * from MSFT_SIPDataMCUCapabilitySetting where backend="(local)\\rtc"

For an OCS Enterprise pool backend="server name\\sql instance"
In the Query Result dialog box, double-click the result.
In the Object editor dialog box for the WMI class, double-click the property you want to edit in Properties:
If you specified the MSFT_SIPMeetingScheduleSetting WMI class in step 6 of this procedure, double-click UnAuthenticatedUserGracePeriod or MaxMeetingLength.
If you specified the MSFT_SIPDataMCUCapabilitySetting WMI class in step 6 of this procedure, double-click ContentExpirationGracePeriod.
In the Property Editor dialog box, change the value to the new value in the Value box, and then click Save Property.
When you are finished with the editing, in the Object editor dialog box, click Save Object.
Close all dialog boxes, and then close Windows Management Instrumentation Tester.
To verify that the change was applied, open Event Viewer and look for event ID 56015.

For more information, please read Managing Meeting Life Cycles.

The Artist Formerly Known as… RingCam

ucspotting — Sat, 27 Jun 2009 14:04:48 GMT

A long time ago in a galaxy far, far away… there was a device called Microsoft RingCam:

RingCam: an inexpensive omnidirectional camera and microphone array designed for capturing meetings.

Hummm, could this be the missing link in Microsoft RoundTable evolution?

Can you notice the “subtle” differences on the video capturing head?

Oh well, at least the computer screen display didn’t change a lot from those early days:

After some thorough investigation, I realized that Microsoft RingCam was developed as part of the Distributed Meetings project from Microsoft Research:

“The project was initiated in 2001 in the Communication, Collaboration, and Multimedia Processing group in Microsoft Research with Anoop Gupta as group manager. Later Anoop Gupta toke the position of Bill Gates technical assistant and the research group was merged with Signal Processing Group in Microsoft Research with group manager Rico Malvar. The new name of the research group was Communication, Collaboration and Signal Processing.

Around 2003 a decision was made to convert the technologies, designed during this project, into Microsoft product. Ross Cutler left Microsoft Research to become architect of the new team. Microsoft researchers continued to help the product team. Three years later the product was named RoundTable and deployed for evaluation in most of the conference rooms in Microsoft. Now it is available for our customers and is the default client for Microsoft LiveMeeting and Microsoft Office Communicator. More information for this product can be found here. See Bill Gates and Jeff Rikes introducing the new product on CNN here.”

Here’s a small collection of some of the technical papers produced, as well as an explanatory video about the use of the distributed meeting technology:

I also collected some news that were published around that time:

It’s really fascinating how the vision of some people turns into one of the most fantastic collaboration products available today. Microsoft RoundTable it’s just another example of Microsoft Research motto: Turning Ideas into Reality!

Trivia

Did you know that Microsoft invested $8.2 billion in R&D in 2008? Are you aware that’s more than the combined R&D spending of IBM and either Oracle or Google?

Here’s a small excerpt from the "Shareholder Letter" in its 2008 Annual Report:

"At the heart of our success lies our commitment to innovation. No company in our industry invests more in research and development or has the same depth and breadth of talented researchers, scientists, and engineers working across the globe to create new technology breakthroughs. In 2008, we invested $8.2 billion in research and development, an increase of almost 15 percent compared with fiscal 2007."

The Butterfly Effect applied to OCS Edge Server R2

ucspotting — Mon, 25 May 2009 18:42:11 GMT

Chances are that, if you live in one of the green countries from the picture below (courtesy of Wikipedia), and if you tried to setup the OCS 2007 R2 Edge server role, you probably felt the frustration, combined with a little bit of despair and asked yourself at some time: “Am I going nuts?”, “Did I suddenly lose my skills?” or “Did I fell into a wormhole and I am now living in a parallel Universe?”.

Why only the green countries? I will explain in detail shortly, but in order not to create too much suspense, let me just say that these countries use a comma "," as the decimal separator and not a period ".".

I've been planning on blogging about this issue for some months now, but for one reason or another, I didn't manage to do it until now. Meanwhile, some other people decide to share their experiences about the very same issue, writing them in some blog posts that I would like to recommend:

I would also like to add that there is now a permanent fix for the problem I'm about to describe.

The Symptoms

Imagine the perfect installation of OCS 2007 R2, where all the requirements were met, where every single detail was taken care of, where every step of the official deployment guide was followed. But, at the very end, in the test phase, you taste the bitter taste of failure as some errors emerge:

Users see a “Limited External Calling” error in Communicator. If they click details, they get the message: "Some calls to and from people outside of your corporate network may not connect due to server connectivity problems. Try signing out and signing back in. If this problem continues, contact your system administrator with this information".
When an external user tries to call an internal user, the call is unsuccessful with the error: "The call was disconnected because you stopped receiving audio from <user>. Please try the call again".
When you validate the A/V Conferencing Server from the OCS Front-End, you get a "Validation Wizard completed with failures".

The Office Communications Server 2007 R2 Deployment Log shows the following error:
Failure
[0xC3FC200D] One or more errors were detected
A/V Authentication Edge Server: Could not contact A/V Authentication Edge Server.
To resolve this error, check for the following
1. The outbound proxy is reachable.
2. The outbound proxy and A/V Authentication Edge Server are in trusted server list of each other.
3. The outbound proxy and A/V Authentication Edge Server have valid certificates.
4. Conference Server certificate is valid.
5. A/V Authentication Edge Server Gruu is correct.
At the Mediation server, the Event 25015 is logged (this is actually the responsible for the Limited External Calling issue previously described):
"The A/V Authentication Service returned invalid response. Connections that require Firewall traversal will not be successful.
Response Code: 400
Response Text: Bad Request
Cause: Either the A/V Authentication Service is not running or unreachable."

The Cause

Although OCS has lots and lots of (good) troubleshooting tools, sometimes it's not easy to spot the error, even when it is right in front of your eyes.

Analyzing the Communicator log from the external user, revealed the "Version Mismatch" error. The error has to do with localization (decimal separator), which caused a string comparison to fail: "2,0" with a comma it's different from "2.0" with a period! I must confess I would never get there without the help from a Microsoft colleague.

Here's the relevant excerpt from the communicator log and a glance of the Snooper Tool:

SIP/2.0 501 Not Implemented
Ms-diagnostics: 9008;source="ptstu-ocs10.demo.local";reason="VersionMismatch";component="Media Relay Authentication Service"

<?xml version="1.0"?>
<response xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" requestID="37875240" version="2,0" serverVersion="2.0" to="sip:ptstu-ocs10.demo.local@demo.local;
gruu;opaque=srvr:MRAS:TIS6zHHx10mnGGNqE01JjwAA" from="sip:rusilva@demo.local" reasonPhrase="Version Mismatch" xmlns="http://schemas.microsoft.com/2006/09/sip/mrasp" />

A Workaround

To workaround this problem, change the locale setting to English/US for the local account that the A/V Edge service and the A/V Edge Authentication service use (RTCProxyService).

Give the RTCProxyService account local login rights (it’s quicker to just add it to the local Administrators group).
Logon to the OCS Edge server with the RTCProxyService credentials.
Open Control Panel > Regional and Language Options and change the Current format to English (United States).
Log off the RTCProxyService, log back in with the Administrator, remove the RTCProxyService from the Administrators group, restart all the OCS services and voilá! If everything else is well configured, you now have a fully functional OCS solution.

The (Definitive) Solution

Fortunately, the April updates for Communications Server 2007 R2 include a patch for this specific problem. Read the following KB article for more information: The Communications Server 2007 R2 - A/V Edge Authentication Server does not recognize a token request if the locale for RTCProxyService is not en-US/409 (and then apply the KB967831 hotfix).

The Wrong Way!

When you apparently reached a dead-end and start doubting about yourself, you usually start trying some silly things. One of the approaches I took was to add the OCS Edge server to the list of authorized hosts. Don’t do this!!! The Edge server should never be placed in the Host Authorization tab, doing so will break the communication workflow.

The (Wrong) Usual Suspect: NAT

At the beginning of the troubleshoot process, my prime suspect was NAT, since I was using for the first time one of the coolest features of OCS 2007 R2 (the A/V Edge interface can now be NAT'ed) and the symptoms were typical of NAT'ed A/V Edge interface.

There are some requirements for this particular configuration to work, I strongly recommend the reading of the excellent post by Rick Varvel: Configuring R2 A/V Edge Service for NAT.

At the end, NAT had nothing to do with the problem, I can assure you this features works perfectly.

The Butterfly Effect

The Butterfly Effect has origin in chaos theory and describes how small variations of the initial condition of a dynamical system may produce large variations in the long term behavior of the system. The phrase refers to the idea that a butterfly's wings might create tiny changes in the atmosphere that may ultimately create a tornado in a certain location.

In other words, sometimes a comma makes all the difference!

The OCPhone Update Wars: The Return of the LG-Nortel 1.0.199

ucspotting — Sat, 23 May 2009 13:51:01 GMT

In a previous post, How to upgrade Polycom CX700 1.0.452.0 using the OCS 2007 R2 Device Update Service, I asked if someone could lend me an Office Communicator Phone Edition (OCPhone) with firmware version 1.0.199. Well, Minsoo Park from LG-Nortel (kudos for him) was kind enough to lend me one IP Phone 8540 with this old firmware version, so that I could test the OCS 2007 R2 Device Update Service is capable of upgrading it.

My first step was to provision the Device Updater with an appropriate firmware version (3.5.6907.9) for the LG-Nortel IP Phone 8540, which I immediately approved.

There was no need to modify the Client Version Filter, since I was already allowing OCPhone software version 1.0.199 and higher to connect to my OCS pool.

As soon as I plugged the device in and signed in with valid credentials, I noticed it was requesting the Address Book files, but there was no sign of it willing to contact the update service.

#Software: Microsoft Internet Information Services 7.0
#Version: 1.0
#Date: 2009-05-22 16:05:55
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2009-05-22 16:51:13 192.168.200.101 GET /Abs/Int/Handler/F-0bf7.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 2 5 0
2009-05-22 16:51:15 192.168.200.101 GET /Abs/Int/Handler/F-0bf7.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 1 2148074254 0
2009-05-22 16:51:15 192.168.200.101 GET /Abs/Int/Handler/F-0bf7.dabs - 443 DEMO\ocphone 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 200 0 0 15
2009-05-22 17:05:50 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d8b.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 2 5 15
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d8b.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 1 2148074254 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d8b.dabs - 443 DEMO\ocphone 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 404 0 0 15
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/F-0d8b.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 2 5 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/F-0d8b.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 1 2148074254 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/F-0d8b.dabs - 443 DEMO\ocphone 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 404 0 0 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d8a.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 2 5 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d8a.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 1 2148074254 15
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d8a.dabs - 443 DEMO\ocphone 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 404 0 0 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/F-0d8a.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 2 5 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/F-0d8a.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 1 2148074254 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/F-0d8a.dabs - 443 DEMO\ocphone 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 404 0 0 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d89.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 2 5 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d89.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 1 2148074254 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d89.dabs - 443 DEMO\ocphone 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 404 0 0 15
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/F-0d89.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 2 5 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/F-0d89.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 1 2148074254 0
2009-05-22 17:05:53 192.168.200.101 GET /Abs/Int/Handler/F-0d89.dabs - 443 DEMO\ocphone 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 404 0 0 0
2009-05-22 17:06:53 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d8b.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 2 5 0
2009-05-22 17:06:53 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d8b.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 1 2148074254 0
2009-05-22 17:06:53 192.168.200.101 GET /Abs/Int/Handler/D-0bf7-0d8b.dabs - 443 DEMO\ocphone 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 404 0 0 0
2009-05-22 17:06:53 192.168.200.101 GET /Abs/Int/Handler/F-0d8b.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 2 5 0
2009-05-22 17:06:53 192.168.200.101 GET /Abs/Int/Handler/F-0d8b.dabs - 443 - 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 1 2148074254 0
2009-05-22 17:06:53 192.168.200.101 GET /Abs/Int/Handler/F-0d8b.dabs - 443 DEMO\ocphone 192.168.20.115 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 404 0 0 0

The solution

The solution to this particular problem is at the very end of the Microsoft Office Communicator 2007 R2 Phone Edition Release Notes:

If the ExternalUpdatesDownloadURL and ExternalUpdatesStoreURL properties of the Windows Management Instrumentation (WMI) class MSFT_SIPUpdatesServerSetting are set to NULL, you need to use the following procedure to change the settings to update the device.

Click Start, click Run, and then type wbemtest to open Window Management Instrumentation Tester.
Click Connect. In Namespace, type root\cimv2, and then click Enter. This enables all the buttons on the wbemtest user interface.
Click Query, and type the following query, where $poolbackend$ is the back-end database for the pool (use '(local)\\rtc' for the OCS Standard Edition):
select * from MSFT_SIPUpdatesServerSetting where backend='$poolbackend$'
This query opens one instance of this class. Double-click the instance.
Double-click the ExternalUpdatesDownloadURL and ExternalUpdatesStoreURL properties to edit them, and type the values for each property as follows:
For ExternalUpdatesDownloadURL, type:
https://**POOL_FQDN**/RequestHandlerExt/ucdevice.upx
For ExternalUpdatesStoreURL, type:
https:// **POOL_FQDN**/DeviceUpdateFiles_Ext
Click Save Property and Save Object to save the instance.
Verify that the Windows Management Instrumentation (WMI) values are updated by querying the class as described in step 3. The ExternalUpdatesDownloadURL and ExternalUpdatesStoreURL properties should be set to a non-NULL value.

Updating older firmware versions fails because the devices are expecting both the internal and external download URLs to be populated in the inband provisioning data received from the pool. With a clean R2 install, those fields are not populated, and as a result, the device rejects the inband provisioning data (thanks Thijs).

After making these changes and restarting the OCS Frontend Service, I rebooted once again the IP Phone 8540 and it was magic! The device got the inband provisioning and the expected 2-step upgrade process (update first to the interim version 1.0.522.103 and afterwards to the R2 version 3.5.6907.9) ran really smoothly, as you can see from the IIS logs below…

#Software: Microsoft Internet Information Services 7.0
#Version: 1.0
#Date: 2009-05-22 17:38:28
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2009-05-22 17:40:13 192.168.200.101 POST /RequestHandler/ucdevice.upx - 80 - 192.168.20.115 Microsoft+UCPhone+Device 200 0 0 6563
2009-05-22 17:42:27 192.168.200.101 GET /DeviceUpdateFiles_Int/OCInterim/ENU/CPE.nbt - 80 - 192.168.20.115 Microsoft+UCPhone+Device 200 0 0 134262
2009-05-22 17:42:27 192.168.200.101 GET /DeviceUpdateFiles_Int/OCInterim/ENU/CPE.cat - 80 - 192.168.20.115 Microsoft+UCPhone+Device 200 0 0 31
2009-05-22 18:10:09 192.168.200.101 POST /RequestHandler/ucdevice.upx - 443 - 192.168.20.115 Microsoft+UCPhone+Device 200 0 0 171
2009-05-22 18:13:02 192.168.200.101 GET /DeviceUpdateFiles_Int/UCPhone/LG-Nortel/IP8540/A/ENU/3.5.6907.9/CPE/CPE.nbt - 80 - 192.168.20.115 Microsoft+UCPhone+Device 200 0 0 172705
2009-05-22 18:13:02 192.168.200.101 GET /DeviceUpdateFiles_Int/UCPhone/LG-Nortel/IP8540/A/ENU/3.5.6907.9/CPE/CPE.cat - 80 - 192.168.20.115 Microsoft+UCPhone+Device 200 0 0 31
2009-05-22 18:15:14 192.168.200.101 GET /Abs/Int/Handler/F-0bf7.dabs - 443 - 192.168.20.115 Microsoft+UCPhone+Device 401 2 5 15
2009-05-22 18:15:14 192.168.200.101 GET /Abs/Int/Handler/F-0bf7.dabs - 443 - 192.168.20.115 Microsoft+UCPhone+Device 401 1 2148074254 0
2009-05-22 18:15:14 192.168.200.101 GET /Abs/Int/Handler/F-0bf7.dabs - 443 DEMO\ocphone 192.168.20.115 Microsoft+UCPhone+Device 200 0 0 0
2009-05-22 18:19:17 192.168.200.101 POST /requestHandler/ucdevice.upx - 80 - 192.168.20.115 Microsoft+UCPhone+Device 200 0 0 125
2009-05-22 18:21:48 192.168.200.101 POST /RequestHandler/ucdevice.upx - 443 - 192.168.20.115 Microsoft+UCPhone+Device 200 0 0 171

…and also from the Device Update Audit logs:

Logging DateTime,User Name,User Host Address,Device Type,Request DateTime,Mac Address,Serial Number,Vendor,Model,Revision,Locale,Requested<FileName;Version;TimeStamp>[# Seperated for Multiple],Response<FileName;Version;TimeStamp>[# Seperated for Multiple]
05-22-2009 18:40:12,,192.168.20.115,UCPhone,22-05-2009 10:40:06,"001B9E2CCD9A","1108006386","LG-Nortel","IP8540","A","ENU",cpe.nbt;0.0.0.0;01-01-1601 00:00:00,http://PTSTU-OCS01.demo.local/DeviceUpdateFiles_Int/OCInterim/ENU/CPE.nbt;1.0.522.103;05-04-2009 20:09:14
05-22-2009 19:10:09,ocphone@demo.local,192.168.20.115,UCPhone,22-05-2009 11:10:10,"001B9E2CCD9A","1108006386","LG-Nortel","IP8540","A","ENU",cpe.nbt;1.0.522.103;05-04-2009 20:09:14,http://PTSTU-OCS01.demo.local/DeviceUpdateFiles_Int/UCPhone/LG-Nortel/IP8540/A/ENU/3.5.6907.9/CPE/CPE.nbt;3.5.6907.9;05-04-2009 20:09:14
05-22-2009 19:19:17,,192.168.20.115,UCPhone,22-05-2009 11:18:00,"001B9E2CCD9A","1108006386","LG-Nortel","IP8540","A","ENU",cpe.nbt;3.5.6907.9;05-04-2009 20:09:14,
05-22-2009 19:21:48,ocphone@demo.local,192.168.20.115,UCPhone,22-05-2009 11:21:47,"001B9E2CCD9A","1108006386","LG-Nortel","IP8540","A","ENU",cpe.nbt;3.5.6907.9;05-04-2009 20:09:14,

With this post I conclude the OCS 2007 R2 Device Update Service Troubleshooting trilogy:

QED, quod erat demonstrandum, the Device Update Service from Office Communications Server 2007 R2 can successfully upgrade any Communicator Phone Device that has firmware version 1.0.199 or later.

A final note, there are some very, very old pre-production devices that have firmware version 1.0.111.0, which cannot be updated neither by OCS 2007 R2 nor by OCS 2007 “R1”. The pre-production devices can be updated to newer R1 firmware using the Beta3 Update Server of OCS 2007 (good luck trying to find the Beta 3 version!). However, you cannot use them against an RTM 2007 or 2007 R2 Update Server. The problem is that devices must report their brand, firmware, version, model, etc to the Update Server. The pre-production devices report an empty string for brand, model and revision, which the Update Server doesn’t understand or accept (thanks again Thijs).

The case of the disappearing tabs

ucspotting — Thu, 14 May 2009 17:28:00 GMT

One of the coolest features of Office Communications Server (OCS) 2007 R2 is the Response Group Service (also known as Automatic Call Distribution – ACD – in telephony world), a technology that’s mostly used in Contact Centers, but that can be applied in many different scenarios…

But the purpose of this post is not to describe the Response Group Service, instead is to discuss some problems I faced when configuring custom tabs in Communicator (custom tabs are the preferred method to sign in to formal groups in Response Group Service).

The problem

I followed the detailed instruction to configure the Response Group Tab. Basically there are 2 steps involved:

Create the custom tab definition file;
Configure Group Policy to apply that file to clients.

Regarding the first step, my XML file consists of the definition of 2 tabs: one for the Response Group, and other for displaying a Live Search box.

<?xml version="1.0"?>
<tabdata>
  <tab>
    <image>https://ptstu-ocs01.demo.local/Rgs/Clients/RgsOcTab.png</image>
    <name>Response Group Tab</name>
    <tooltip>Response Group Tab</tooltip>
    <contenturl>https://ptstu-ocs01.demo.local/Rgs/clients/Tab.aspx</contenturl>
    <siteid>1</siteid>
  </tab>
  <tab>
    <image>https://ptstu-ocs01/images/windows-live.png</image>
    <name>Microsoft Mobile</name>
    <tooltip>Microsoft Mobile Tab</tooltip>
    <contenturl>http://mobile.microsoft.com</contenturl>
    <siteid>2</siteid>
  </tab>
</tabdata>

The second step is also very simple: importing the Communicator R2 Group Policy extension (communicator.adm), and then configuring the setting “Tab URL” (in my case, the value was https://ptstu-ocs01.demo.local/OCTabs.xml).

The problem was that, although all the necessary configuration was in place, there was no sign at all of the 2 custom tabs I had defined previously!

The solution (and troubleshooting process)

In order to solve the problem, I had to change 4 settings.

According to Configuring Custom Tabs in Communicator 2007 R2, the site defined by contenturl must “be located on the intranet, or on a secure or trusted site on the internet” .(particularly if you’re using integrated authentication). The first step to solve my problem was adding http://*.demo.local to Internet Explorer Trusted Sites.
After modifying the Trusted Sites setting there was still no sign of the custom tabs. After a little research on the Internet, I found out that the <contactid> behavior changed in OCS 2007 R2:
“The Communicator R2 client tab functionality has changed from what it was in Communicator 2007. In OC 2007 you could pass the contactID parameter to tabs that were listed at the bottom of the Communicator contacts display. Microsoft has changed the use of tabs in OC 2007 R2 such that you can only display static tabs at the bottom of the Communicator contacts display area. The previous functionality has been moved to the tabs at the bottom of the contact card for each user.”
Since I had <contactid>true</contactid> in my XML file (I omitted the <contactid> element on purpose from my previous listing), this was preventing the Response Group tab from displaying correctly. So, where was the missing tab, you may ask… Again, according to Configuring Custom Tabs in Communicator 2007 R2:
!ELEMENT contactid (“true” | “false”) - Determines whether the tab appears in the contact card. Tabs defined without contactid or with contactid=false will appear only in the Communicator window.Tabs defined with contactid=true will appear in the contact card, and Communicator will pass the selected contact to the defined page. The default value is “false.”
And you know what? Opening the contact card from my user (see the picture below) revealed the link to the tab.
Once I modified the Trusted Sites setting and removed the <contactid> element, the tabs appeared in Communicator, but the content wasn’t being shown:

This kind of error is most often related with proxy settings. Changing the list of exceptions in Internet Explorer advanced proxy settings usually solves the problem.
The last configuration setting I had to change was only affecting a small subset of users that already were using Windows 7 and Internet Explorer 8. This small group still didn’t have the tabs displayed in Communicator. After a long troubleshooting process I finally spotted the problem: in the Tab URL Group Policy I typed a backslash “\” instead of the usual “/” (picture below):
This was the very last issue preventing the tabs from displaying correctly. I guess this is somehow related with stronger security settings in Windows 7 and IE 8.

How to upgrade Polycom CX700 1.0.452.0 using the OCS 2007 R2 Device Update Service

ucspotting — Thu, 16 Apr 2009 11:55:55 GMT

Let me start by saying that, although the title of this post refers Polycom CX700 (because was this device I used), the procedures described here will probably work with other devices (e.g. LG-Nortel or Microsoft).

If you read my previous post Troubleshooting OCS 2007 R2 Device Update Service for Communicator Phone Edition, you probably noticed the comments about upgrading Office Communicator Phone Edition (OCPE) version 1.0.452.0.

When I wrote that post, I hadn’t tested anything lower than 1.0.522.34, so, to tell you the truth, I was not sure it was possible to upgrade these early (Beta) versions. Until today!

When I had the chance to put my hands on one of these early babies (thanks Paulo Silva), I didn’t think twice.

The upgrade process

As soon as I plugged the device into my test environment and tried to sign in, I got the following error:

Cannot sign in to Communications Service. Current version
does not work with the available server. Contact your
system administrator.

I immediately understood what the problem was: the Client Version Filter. Lowering the allowed OCPhone version to 1.0.199 did the trick.

After a quick reboot and still no signs of a successful upgrade, I noticed that I was getting an Update Status (0x0/404) on the phone. The IIS log confirmed the HTTP error 404 – File Not Found. The device was requesting the file /UCDeviceUpdates/ucdevice.upx, which cannot be found because the virtual dir /UCDevicesUpdate doesn’t exist.

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2009-04-15 17:47:37 192.168.200.101 POST /UCDeviceUpdates/ucdevice.upx - 80 - 192.168.20.103 Microsoft+UCPhone+Device 404 0 2 0

I’m not sure why the device requests that specific URL. In the tests I made with an even lower version, 1.0.199, the requested URL was /RequestHandler/ucdevice.upx, which is the correct one. Further investigation is needed to determine the cause of this issue.

In order to try to overcome the situation, I decided to create the /UCDevicesUpdate virtual dir, replicating all the settings of the /RequestHandler folder. Here’s how to do it on IIS 7.0 (with IIS 6.0 would probably be easier, since there is an option to redirect a virtual dir):

Open Internet Information Services (IIS) Manager, right click the web site and select Add Application. Name it UCDeviceUpdates, select the LSGroupExpAppPool, and point it to the same Physical path as /RequestHandler.

Select the newly created application (/UCDeviceUpdates), on the Features View select Authentication and then disable Windows Authentication.

If we stop now (as I first did), we would get the HTTP Error 405.0 - Method not allowed.

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2009-04-15 18:07:35 192.168.200.101 POST /UCDeviceUpdates/ucdevice.upx - 80 - 192.168.20.103 Microsoft+UCPhone+Device 405 0 64 31

The Handler Mappings for /UCDeviceUpdates must be changed so that they match /RequestHandler, particularly the *.upx Script Map.

With these changes in place, the upgrade process went as expected: the device gets in-band provisioning about the update URL, downloads and installs the interim version (1.0.522.103), reboots, downloads and installs the approved version (3.5.6907.9), does a final reset and it’s ready to use with Office Communications Server 2007 R2.

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2009-04-15 18:36:09 192.168.200.101 POST /UCDeviceUpdates/ucdevice.upx - 80 - 192.168.20.103 Microsoft+UCPhone+Device 200 0 0 6531
2009-04-15 18:38:28 192.168.200.101 GET /DeviceUpdateFiles_Int/OCInterim/ENU/CPE.nbt - 80 - 192.168.20.103 Microsoft+UCPhone+Device 200 0 0 139006
2009-04-15 18:38:28 192.168.200.101 GET /DeviceUpdateFiles_Int/OCInterim/ENU/CPE.cat - 80 - 192.168.20.103 Microsoft+UCPhone+Device 200 0 0 15
2009-04-15 18:46:05 192.168.200.101 POST /requestHandler/ucdevice.upx - 80 - 192.168.20.103 Microsoft+UCPhone+Device 200 0 0 2093
2009-04-15 18:49:09 192.168.200.101 GET /DeviceUpdateFiles_Int/UCPhone/Polycom/CX700/A/ENU/3.5.6907.9/CPE/CPE.nbt - 80 - 192.168.20.103 Microsoft+UCPhone+Device 200 0 0 183461
2009-04-15 18:49:09 192.168.200.101 GET /DeviceUpdateFiles_Int/UCPhone/Polycom/CX700/A/ENU/3.5.6907.9/CPE/CPE.cat - 80 - 192.168.20.103 Microsoft+UCPhone+Device 200 0 0 15
2009-04-15 18:50:29 192.168.200.101 POST /requestHandler/ucdevice.upx - 80 - 192.168.20.103 Microsoft+UCPhone+Device 200 0 0 140
2009-04-15 18:51:51 192.168.200.101 POST /RequestHandler/ucdevice.upx - 443 - 192.168.20.103 Microsoft+UCPhone+Device 200 0 0 187
2009-04-15 18:56:47 192.168.200.101 GET /Abs/Int/Handler/F-0bd2.dabs - 443 - 192.168.20.103 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 401 2 5 0
2009-04-15 18:56:47 192.168.200.101 GET /Abs/Int/Handler/F-0bd2.dabs - 443 DEMO\OCPhone 192.168.20.103 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+CE) 200 0 0 125

A final note: I didn’t use the Test Devices option, instead I approved the update (this means that all qualified devices would get the update without first testing it).

Epilogue

So far, the OCS 2007 R2 Device Update Service revealed to be capable of successfully upgrading OCPE version 1.0.452.0 and later. The early beta versions can sometimes be tricky and require some tweaks, like creating a new virtual dir (as explained in this post).

I’ve read some post regarding the 1.0.452.0 version stating that WINS is required. In the tests I made, I didn’t use WINS, only DNS (I had the UCUPDATES and UCUPDATES-R2 defined as A records and pointing to the OCS pool IP address).

I would love to test version 1.0.199. Can someone lend me one? :-)

Upgrading to OCS 2007 R2: trouble removing the legacy pool

ucspotting — Wed, 08 Apr 2009 11:49:38 GMT

Let me start by saying that, so far, every migration I did from OCS 2007 to OCS 2007 R2 went like a charm. Kudos for the Microsoft OCS team, who came up with a really easy process and pretty well documented: Migration From Office Communications Server 2007.

But every now and then, some minor problems occur. Recently, at the very end of the migration process, I got this error while trying to remove the legacy OCS pool:

Failure
[0xC3EC79F9] You need SQL Server, SQL Server 2000 Client Tools (for connecting to SQL Server 2000 SP4 or later) or SQL Server 2005 Backwards Compatibility Pack (for connecting to SQL Server 2005 SP1 or later) installed on this computer to be able to create an Enterprise pool.

The error occurred on the legacy front-end (OCS 2007) when I tried to remove the pool, using the Office Communications Server 2007 Management Console.

The solution is easy, the SQL Server 2005 Backwards Compatibility Pack must be installed on the front-end in which the remove operation is being performed, since a connection to the back-end database is required.

The SQL Server Backwards Compatibility Pack is part of the Feature Pack for Microsoft SQL Server 2005 and can be downloaded through this link.

And after that, well, the game was mine.

Troubleshooting OCS 2007 R2 Device Update Service for Communicator Phone Edition

ucspotting — Wed, 11 Mar 2009 14:24:55 GMT

One of the big improvements with the release of Office Communications Server (OCS) 2007 R2 was the new Device Update Service, much more simple than the previous version. Goodbye Windows SharePoint Services on a different server, no more additional complexity in order to update the UC devices deployed in an organization. Now, the Device Update Service is automatically installed on the Web Components Server, which is part of the Front-end server, on a consolidated topology (the only one supported in R2).

Device Update Service supports two types of UC devices: OCS 2007 R2 Communicator Phone Edition (OCPE or Tanjay) and RoundTable (must be manually configured).

Device Update Service is mostly used to upgrade OCPE phones (LG-Nortel IP8540, Polycom CX700 and older Microsoft branded), so one could expect this process to be the most common cause of troubles and frustration. And that is, in fact, the case! Now even more, since there is a new version of the firmware for OCS 2007 R2.

Before we dive into the troubleshooting process, let us know better the Device Update Service Architecture and how it works:

In the default configuration, Communicator Phone Edition connects to Device Update Service in the following manner:

The first time a user starts Communicator Phone Edition and signs in, the device gets in-band provisioning information from the server or Enterprise pool hosting the device user account. The information contains the internal and external URL of the server running Device Update Service.
If the device is turned on, but no user signs on, and no user has ever previously signed on to the device, the device sends a DNS lookup request to ucupdates-r2.<DNS domain name that was provided by DHCP> and obtains the internal and external URL of the server running Device Update Service.
Thereafter, when the device is turned on as well as every 24 hours by default, Communicator Phone Edition checks for updates by sending an HTTP request over port 443 to the Web Components Server hosting Device Update Service. The request includes the current version that Communicator Phone Edition is running.
Device Update Service returns a response containing one of the following:
- If no approved updates exist for the current version of the firmware, the response contains downloads=0. For test devices, updates must be pending rather than approved for this to occur.
- If an approved update exists for the current version, the response contains an internal and external URL for Device Update Service. For test devices, updates must be pending rather than approved for this to occur.
In the latter case, Communicator Phone Edition sends an HTTPS update request over port 443 to Device Update Service.
The update image is downloaded to the device.
The device waits for five minutes of idle activity, and then restarts to complete the update.

Obtaining and approving new OCPE updates

The latest firmware version, (3.5.6907.0, by the time this post was written), can be downloaded from the Microsoft site. The downloaded file is a self-extracting executable that contains a .cab archive with all the supported phones.

In order to upload the update file, we must run the Device Update Service Management Console: open the OCS R2 Management Console, right click the pool and select Device Updater. From the Tools menu, click Upload .cab File, navigate to the .cab file that you want to upload, and then click Open.

Check the Pending tab of the Device Update Service Management Console to verify that the new update is listed.

You can also verify that the upload process went OK by checking the shared updates folder (if you’re using Enterprise edition). For the Standard edition, the default path is %ProgramFiles%\Microsoft Office Communicator 2007 R2\Web Components\DeviceUpdateFiles. There should be a folder hierarchy like the one depicted in the following picture. Note that there are some Logs folders that I’ll cover a little bit ahead.

After the update file is uploaded, the corresponding firmware can be approved for all devices in the organization by selecting it and then clicking Approve. The revision should be more recent than the revision for the last update the UC devices received.

Prior to making the update widely available, it is recommended that you test it on some devices. To add a test device, go to the Test Devices tab, click Add, type a Friendly Name and then fill up the MAC address or serial number of the device (there’s no need to approve the update).

Restart the device and that should trigger the update process, as described before.

If the previous version of the device is less than 1.0.522.98, it will first get updated to an interim build (1.0.522.103) that comes with OCS 2007 R2. This means that, in this case, 2 upgrade cycles are necessary before the device gets the approved/pending build.

Log Files

You can use the logs in the Logs\Server\Audit\imageUpdates\ folder to audit software update requests from UC devices. There you can find some files named RequestHandlerAuditLog_<server_name>_<date>.log with the information you need to troubleshoot the update service. You can view server log files in a text editor or Microsoft Excel.

In the following example, an LG-Nortel device with version 1.0.522.34 is configured as a test device and will receive the most up-to-date firmware. Since 1.0.522.34 is lower than 1.0.522.98, the device must first be upgraded to the interim version (1.0.522.103), then reboot and finally it receives the most recent version available on the server.

Logging DateTime,User Name,User Host Address,Device Type,Request DateTime,Mac Address,Serial Number,Vendor,Model,Revision,Locale,Requested<FileName;Version;TimeStamp>[# Seperated for Multiple],Response<FileName;Version;TimeStamp>[# Seperated for Multiple]
03-06-2009 17:07:20,ruisilva@demo.local,10.1.1.123,UCPhone,06-03-2009 09:07:20,"0021630F207B","C185H001209","LG-Nortel","IP8540","A","ENU",cpe.nbt;0.0.0.0;01-01-1601 00:00:00,
03-06-2009 17:10:39,ruisilva@demo.local,10.1.1.123,UCPhone,06-03-2009 17:10:39,"0021630F207B","C185H001209","LG-Nortel","IP8540","A","ENU",cpe.nbt;0.0.0.0;01-01-1601 00:00:00,http://ocs.demo.local/DeviceUpdateFiles_Int/OCInterim/ENU/CPE.nbt;1.0.522.103;16-12-2008 04:43:58
03-06-2009 17:18:54,ruisilva@demo.local,10.1.1.123,UCPhone,06-03-2009 17:18:53,"0021630F207B","C185H001209","LG-Nortel","IP8540","A","ENU",cpe.nbt;1.0.522.103;16-12-2008 04:43:58,http://ocs.demo.local/DeviceUpdateFiles_Int/UCPhone/LG-Nortel/IP8540/A/ENU/3.5.6907.0/CPE/CPE.nbt;3.5.6907.0;16-12-2008 04:43:58

In the first line, the device gets in-band provisioning information from the server or Enterprise pool hosting the device user account. After a *manual reboot*, on the second line, it gets the interim version. Finally, on the third line, and after an *automatic reboot* (notice the 8 minute gap) the phone receives the 3.5.6907.0 version.

But besides the logs from the update service,the IIS logs can be extremely valuable to the troubleshooting process. This is the corresponding IIS log from the example above (I removed some unnecessary lines):

#Software: Microsoft Internet Information Services 7.0
#Version: 1.0
#Date: 2009-03-06 16:00:51
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2009-03-06 17:07:20 10.1.1.90 POST /RequestHandler/ucdevice.upx - 443 - 10.1.1.123 Microsoft+UCPhone+Device 200 0 0 124
2009-03-06 17:10:39 10.1.1.90 POST /RequestHandler/ucdevice.upx - 443 - 10.1.1.123 Microsoft+UCPhone+Device 200 0 0 171
2009-03-06 17:12:57 10.1.1.90 GET /DeviceUpdateFiles_Int/OCInterim/ENU/CPE.nbt - 80 - 10.1.1.123 Microsoft+UCPhone+Device 200 0 0 137810
2009-03-06 17:12:57 10.1.1.90 GET /DeviceUpdateFiles_Int/OCInterim/ENU/CPE.cat - 80 - 10.1.1.123 Microsoft+UCPhone+Device 200 0 0 15
2009-03-06 17:18:54 10.1.1.90 POST /RequestHandler/ucdevice.upx - 443 - 10.1.1.123 Microsoft+UCPhone+Device 200 0 0 187
2009-03-06 17:21:45 10.1.1.90 GET /DeviceUpdateFiles_Int/UCPhone/LG-Nortel/IP8540/A/ENU/3.5.6907.0/CPE/CPE.nbt - 80 - 10.1.1.123 Microsoft+UCPhone+Device 200 0 0 170679
2009-03-06 17:21:45 10.1.1.90 GET /DeviceUpdateFiles_Int/UCPhone/LG-Nortel/IP8540/A/ENU/3.5.6907.0/CPE/CPE.cat - 80 - 10.1.1.123 Microsoft+UCPhone+Device 200 0 0 15

Notice the line where the interim file CPE.nbt is downloaded to the phone. It takes some time (137.810 ms), because the file has a few megs.

2009-03-06 17:12:57 10.192.32.90 GET /DeviceUpdateFiles_Int/OCInterim/ENU/
CPE.nbt - 80 - 10.1.1.123 Microsoft+UCPhone+Device 200 0 0 137810

And then, notice the line where the phone requests the most recent version available. It took 170.679 ms to download the file.

2009-03-06 17:21:45 10.192.32.90 GET /DeviceUpdateFiles_Int/UCPhone/
LG-Nortel/IP8540/A/ENU/3.5.6907.0/CPE/CPE.nbt - 80 - 10.1.1.123 Microsoft+
UCPhone+Device 200 0 0 170679

Troubleshooting Process

Now that we have a pretty good understanding of the Device Update Service, what can we do if something doesn’t go as expected? Let’s look at the troubleshooting process:

Reset the device and sign in with a user that is not signed in anywhere else (my advice is to create a special account for this purpose… And make sure it’s configured for Enterprise Voice!!!).
Make sure the Device Update Service is well configured and that the DHCP options required by OCPE are in place:
- Device Update Service Required Components
- Microsoft Office Communicator 2007 R2 Phone Edition Deployment Guide
Read Microsoft Office Communicator 2007 R2 Phone Edition Release Notes. Read this document all the way till the end, because there are important notes and suggested solutions for some common problems.
Confirm that a VDir named OCInterim is created under the DeviceUpdateFiles_Int and DeviceUpdateFiles_Ext folders in IIS. This folder contains the interim version (1.0.522.103) necessary for devices that are currently with version 1.0.522.98 or lower.
Open a browser and navigate to the URL that contains the update (for example http://ocs.demo.local/DeviceUpdateFiles_Int/UCPhone/LG-Nortel/IP8540/A/ENU/
3.5.6907.0/CPE/CPE.nbt). You should be able to download the CPE.nbt file.
A common cause of problems for the Enterprise version has to do with permissions in the shared updates folder. If that’s the case, you’ll get a 500 HTTP error in the IIS log:
```
2009-03-06 12:35:36 10.1.1.90 GET /DeviceUpdateFiles_Int/UCPhone/
LG-Nortel/IP8540/A/ENU/3.5.6907.0/CPE/CPE.nbt - 80 - 10.1.1.1 Microsoft+
UCPhone+Device 500 19 5 62
```
One solution is to modify the ACL: add the Everyone group with Read permissions to the shared folder. Or you can also try this method, as explained by Jens: HTTP Error 500 19 when accessing OCPE firmware URLs on Windows 2008.
Make sure you’re using a supported device. Microsoft DV1 is no longer supported and even the interim update will not work.
If you’re trying to update a really old version of the software, make sure that’s not blocked by the Client Version Filter. Using the OCS Management Console, right click the pool name, select Filtering Tools and then Client Version Filter. Edit the OCPhone field accordingly.
Use the available audit update server logs and IIS logs. I’ve never used the client logs, because they require further processing, but I admit they can be useful if everything else fails.
On the phone About screen, validate when the device last checked for updates. On the About screen you’ll see: Last Update Status: (0x####/0x#####). The normal state should be 0×00/0 or 0x0/200. The first field is a WinInet error code. An error here would indicate a problem contacting the server. The list of possible values can be found in this KB article: WinInet Error Codes. For further explanation of these codes,please read this post: Microsoft Office Communicator 2007 Phone Edition Status Codes.
If you’re upgrading version 1.0.452.0, you may need to create a virtual dir called UCDeviceUpdates on the OCS server running the update service. Check the IIS logs to confirm the device is requesting that specific URL. Read this post with detailed instructions: How to upgrade Polycom CX700 1.0.452.0 using the OCS 2007 R2 Device Update Service.
If you’re brave enough, try to approve the update, instead of using Test Devices. Please be aware that this means that all qualified devices will be upgraded, before you properly test the update.
Wait 5 minutes! Remember the device will automatically update itself and reboot after 5 minutes of idle activity.

And this pretty much covers the troubleshooting process for the OCPE devices. I would like to hear from you if you have ever encountered a distinct situation that you managed to solve in a different way.

RemovePlusFromRequestURI (or how to make OCS non-RFC 3966-compliant)

ucspotting — Sat, 28 Feb 2009 21:16:40 GMT

As you know, Office Communications Server 2007 Mediation Server uses a plus sign (+) to prefix E.164 numbers in the Request Uniform Resource Identifier (URI) for outgoing calls. However, certain private branch exchanges (PBXs) do not comply with RFC 3966 and do not accept numbers that are prefixed with a plus sign (+).

To make sure that OCS 2007 operates correctly with non-RFC 3966-compliant PBXs, Microsoft released an update for Mediation Server (R1), which is described in KB articles 952780 and 952785. After installing the update, it’s necessary to create a configuration file – MediationServerSvc.exe.config – with the following content:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
                 <appSettings>
                                <add key="RemovePlusFromRequestURI" value="Yes" />
                 </appSettings>
</configuration>

What about R2?

For OCS 2007 R2, the behavior changed a little bit. Microsoft incorporated the previous described workaround in the R2 binaries, but the configuration file is no longer needed. Instead, there’s a new WMI setting, RemovePlusFromRequestURI , which is described on this page: Enterprise Voice Server-Side Components:

Compatibility with PBXs That Do Not Support the Plus Sign

By default, E.164 numbers in the Request URI of outgoing calls from Office Communications Server 2007 R2 are prefixed with a plus sign. Most PBXs process such numbers without problem. Some PBXs, however, do not accept numbers that are prefixed with a plus sign and do not route those calls correctly.

To assure interoperability with these PBXs, Office Communications Server 2007 R2 has a new Mediation Server setting for WMI called RemovePlusFromRequestURI. This setting can be set to YES or NO. The default value is NO.

If a PBX downstream from the Office Communications Server 2007 R2 Mediation server does not accept numbers prefixed with a plus sign, set the value of RemovePlusFromRequestURI to YES. This causes Mediation Server to remove the plus signs from the Request URIs of outgoing calls. It also causes the plus signs to be removed from the To and From URIs.
If the downstream PBX accepts numbers prefixed with plus signs, leave the value of RemovePlusFromRequestURI set to its default value of NO. This causes Office Communications Server 2007 Mediation Server to pass Request URIs, To URIs, and From URIs unchanged (that is, with plus signs).

Actually the RemovePlusFromRequestURI is a boolean property that can be set to TRUE or FALSE. The easiest way of changing its value, is by means of a VBScript:

' RemovePlusFromRequestURI
'

  Dim objLocator
  Dim objService
  Dim objInstances
  Dim objInstance

  Wscript.Echo "Connecting to local WMI store..."

  Set objLocator = CreateObject("WbemScripting.SWbemLocator")
  Set objService = objLocator.ConnectServer(".", "root\cimv2")

  Wscript.Echo "select * from MSFT_SIPMediationServerConfigSetting"
  Set objInstances = _
    objService.ExecQuery("select * from MSFT_SIPMediationServerConfigSetting")

  If IsNull(objInstances) Or (objInstances.Count = 0) Then
    Wscript.Echo "Error: No instance"

  Else

    For Each objInstance in objInstances

      objInstance.Properties_.Item("RemovePlusFromRequestURI").Value = "TRUE"
      objInstance.Put_
      wscript.Echo "Done"
    Exit For
    Next

  End If

  Wscript.Echo ""

Run this script on the Mediation Server (don’t forget to run it using Administrator credentials) and you’re done.

To check the current value of this property (or to verify that the script worked), you can use the WBEMTest tool (also check this nice article: WBEM What?).

WMI Settings:
Namespace: root\cimv2
Class: MSFT_SIPMediationServerConfigSetting (Open Class)
Property: RemovePlusFromRequestURI
Possible Values: TRUE/FALSE

To use WBEMTest to verify WMI settings:

Log on to the Mediation Server as a member of the RTCUniversalServerAdmins group or an account with equivalent user rights.
Click Start, click Run and type wbemtest.
In the Windows Management Instrumentation Tester dialog box, click Connect.
In the Connect dialog box, type root\cimv2 in the Namespace box. Click Connect.
Click Open Class. In the Get Object Path box, type MSFT_SIPMediationServerConfigSetting, and then click OK.
In the Object Editor for MSFT_SIPMediationServerConfigSetting dialog box, click Instances.
Double-click MSFT_SIPMediationServerConfigSetting=”{…}”.
Scroll down to the property RemovePlusFromRequestURI and verify its value.
Close the Windows Management Instrumentation Tester dialog box.

Don’t forget to restart the Mediation Server service, after modifying this setting!

What are those pesky files in my root folder?

ucspotting — Sat, 21 Feb 2009 20:47:35 GMT

Have you noticed that after you install an OCS server, there are some additional files dropped in the root folder (C:\)? These are the temporary files of the VC++ 2008 Redistributable package, which extracts them to the root of the drive where the installation was run from.

This is the complete list of those pesky files:

11/07/2007  08:00 AM            17,734 eula.1028.txt
11/07/2007  08:00 AM            17,734 eula.1031.txt
11/07/2007  08:00 AM            10,134 eula.1033.txt
11/07/2007  08:00 AM            17,734 eula.1036.txt
11/07/2007  08:00 AM            17,734 eula.1040.txt
11/07/2007  08:00 AM               118 eula.1041.txt
11/07/2007  08:00 AM            17,734 eula.1042.txt
11/07/2007  08:00 AM            17,734 eula.2052.txt
11/07/2007  08:00 AM            17,734 eula.3082.txt
11/07/2007  08:00 AM             1,110 globdata.ini
11/07/2007  08:44 AM           855,040 install.exe
11/07/2007  08:00 AM               843 install.ini
11/07/2007  08:44 AM            75,280 install.res.1028.dll
11/07/2007  08:44 AM            95,248 install.res.1031.dll
11/07/2007  08:44 AM            90,128 install.res.1033.dll
11/07/2007  08:44 AM            96,272 install.res.1036.dll
11/07/2007  08:44 AM            94,224 install.res.1040.dll
11/07/2007  08:44 AM            80,400 install.res.1041.dll
11/07/2007  08:44 AM            78,864 install.res.1042.dll
11/07/2007  08:44 AM            74,768 install.res.2052.dll
11/07/2007  08:44 AM            95,248 install.res.3082.dll
11/07/2007  08:00 AM             5,686 vcredist.bmp
11/07/2007  08:50 AM         1,927,956 VC_RED.cab
11/07/2007  08:53 AM           242,176 VC_RED.MSI

The good news is that you can safely delete those files if they are really bothering you. But be careful! Be sure you don’t delete any other file necessary to the smooth operation of the server.

Hey dude, where’s my OCS 2007 R2 Management Console?

ucspotting — Sat, 21 Feb 2009 15:51:13 GMT

As you probably know by now, the setup process for Office Communications Server 2007 R2 has changed a little bit. One of the changes is that now you must manually install the Administrative Tools in a separate step (before, they were automatically installed with the product).

Whether you’re installing them on an OCS server or on any other x64 server you use for administration purposes, just kick the Setup Deployment Wizard and select Administrative Tools.

What about the Edge?

By now, you are wondering if the process for the OCS Edge server role is the same. The answer is YES! As you know, the administration of the Edge server is made through the Computer Management snap-in, rather than through the OCS R2 Management Console available in the Administrative Tools folder.

You only get the extended Computer Management snap-in *after* you manually install the OCS Administrative Tools.

Can I install the OCS R2 Admin Tools on a 32-bit machine?

Yes, you can. The supported platforms to deploy the OCS R2 Administrative Tools are: Windows Server 2003 with SP2 (x86, x64), Windows Server 2008 (x86, x64) and Windows Vista Business or Enterprise with SP1 (x86, x64).

Although OCS 2007 R2 is only supported on a 64-bit platform, the 32-bit Administrative Tools are available as part of the 64-bit installation media. You can find them under \SUPPORT\I386. In this folder there are a couple of files that are required as pre-requisites. Install them in the following order:

sqlncli.msi – SQL Server Native Client
vcredist_x86.exe – VC++ 2008 Redistributable
.NET Framework 3.5 SP1 – Download from web or use \Setup\amd64\dotnetfx35.exe
OCSCore.msi – Office Communications Server 2007 R2 Core Components
AdminTools.msi – Office Communications Server 2007 R2 Administrative Tools

The 64-bit experience is much better, because the Setup Wizard will install all the pre-requisites automatically. Just for fun, if you didn’t know the correct order for the x86 installation process, this is the pop-up you’d get when running the AdminTools.msi file:

OK, i see there’s a file OCSCore.msi, so let’s double click it. Damn! Another pop-up:

Hummm, the SQL Server Native Client must be this file: sqlncli.msi. Success, it’s installing! So, let’s try again the OCSCore.msi… Another pop-up, what else is new???!!

Running vcredist_x86.exe… Success! I’m pretty sure this was the last pre-requisite, let’s try again the OCSCore.msi. Ah, the .NET Framework 3.5 SP1, of course!!!

Did you have fun? I sure did :-)

Useful commands when deploying OCS 2007 R2

ucspotting — Tue, 20 Jan 2009 22:11:31 GMT

First of all, don’t panic! Office Communications Server (OCS) 2007 R2 still has a nice graphical setup wizard that guides you through the installation process. But sometimes, for very specific tasks, the command line is your best friend.

This post is more a “note to self”, since I use this commands a lot, but I hope you find it useful too.

OCS 2007 R2

For OCS, the command-line utilities LCSCMD and RGSCOT are installed with the Office Communications Server 2007 R2 Administrative Tools. By default, they are located in the following location %ProgramFiles%\Common Files\Microsoft Office Communications Server 2007 R2.

To request a Web Server certificate from an online CA for Communicator Web Access:

LcsCmd.exe /Cert /Action:Request /sn:im.contoso.com /san:im.contoso.com,
download.im.contoso.com,as.im.contoso.com,cwa.contoso.com,cwa-server.contoso.com 
/ca:"ca-server.contoso.com\Contoso Root CA" /OU:IT /org:Contoso /country:PT 
/city:Lisbon /state:Lisbon /friendlyName:CWACertificate /exportable:TRUE

To generate the Web Server certificate request file for Communicator Web Access:

LcsCmd.exe /Cert /Action:Request /sn:im.contoso.com /san:im.contoso.com,
download.im.contoso.com,as.im.contoso.com,cwa.contoso.com,cwa-server.contoso.com 
/filename:c:\certrequest.txt /OU:IT /org:Contoso /country:PT /city:Lisbon 
/state:Lisbon /friendlyName:CWACertificate /Online:FALSE /exportable:TRUE

To create contact objects for Response Group Service:

RGSCOT /Create /PoolFQDN:ocspool.contoso.com /DisplayName:"Information Desk" 
/DisplayNumber:+3515555555 /PrimaryUri:sip:InformationDesk@contoso.com 
/LineUri:tel:+3515555555
 
RGSCOT /Create /PoolFQDN:ocspool.contoso.com /DisplayName:"Help Desk" 
/DisplayNumber:+3519999999 /PrimaryUri:sip:HelpDesk@contoso.com 
/LineUri:tel:+3519999999

Exchange Server 2007

When integrating Exchange Unified Messaging with OCS, there might be necessary to generate a new certificate, in order to replace the self-signed generated automatically by Exchange. This time, instead of using command-line utilities, I’ll use some Exchange Management Shell cmdlets.

To generate the request for the UM certificate:

New-ExchangeCertificate -generaterequest -subjectname "dc=com,dc=contoso,o=Contoso,
cn=um-server.contoso.com" -domainname UM-SERVER,um-server.contoso.com,
autodiscover.contoso.com -PrivateKeyExportable $true -path c:\certrequest.txt

To import the issued certificate:

Import-ExchangeCertificate -Path c:\certnew.cer

To enable the certificate:

Enable-ExchangeCertificate -Thumbprint 5113ae0233a72fccb75b1d0198628675333d010e 
-Services "POP, IMAP, UM, IIS"

This is just a sample of some commands that I generally use when installing and configuring OCS 2007 R2. There are many, many more actions that can be performed using the command line, such as preparing Active Directory, installing server roles, creating pools, moving the backend database and so on, and so on.

BTW, before you ask, there are still no specific PowerShell cmdlets for OCS 2007 R2. Let’s wait for OCS Wave “14”!

How many public certificates do I really need?

ucspotting — Mon, 29 Dec 2008 20:44:11 GMT

– How many public certificates do I need, in order to configure external access to my OCS 2007 pool?
– 3. One for the HTTP Reverse Proxy, one for the OCS Access Edge and one for the OCS Web Conferencing Edge.
– Even if I'm using a consolidated Edge topology?
– Yes!
– But can't I just use a super-mega-jumbo SAN certificate with all the required alternative names?
– No!
– Why not?
– Because!

Well, to tell you the truth it's not "because", it is the official support policy written in the OCS 2007 Supportability Guide, the OCS 2007 Planning Guide and the OCS 2007 Edge Server Deployment Guide.

Here's a summary of the external certificate requirements:

For each unique IP address on the external interface that you use for the Access Edge Server and Web Conferencing Edge Server, you will need a separate certificate. We recommend that you use a separate external IP addresses for each server role, even if all servers are collocated. An external certificate is not required on the A/V Edge Server.
Office Communications Server 2007 will support certificates with a length of up to 1024 bits.
Office Communications Server 2007 server certificates must be configured with an enhanced key usage (EKU) extension for server authentication.
For a list of public certificate authorities who have partnered with Microsoft to ensure that their certificates comply with specific requirements for Office Communications Server, see http://r.office.microsoft.com/r/rlidOCS?clid=1033&p1=SupportedCAs.
For both internal and remote clients, the CA certificate chain for the Office Communications Server 2007 deployment must be downloaded and installed to the certificate store of the client computer in the Trusted Root Certification Authorities folder.
All server certificates must support server authorization (Server EKU 1.3.6.1.5.5.7.3.1).
All server certificates must contain a CRL Distribution Point (CDP).
Auto-enrollment is supported for internal Office Communications Server servers, including an array of Standard Edition Servers configured as Director.
Auto-enrollment is not supported for Office Communications Server edge servers.
For the A/V Edge Server, an additional certificate is required for audio/video authentication. The private key of the A/V authentication certificate is used to generate authentication credentials. As a security precaution, you should not use the same certificate for A/V authentication that you use for the internal interface of the A/V Edge Server. We recommend that you issue this certificate from an internal CA, but you can also use a certificate from a public CA

– But why can't I just use my internal CA?
– Well, to tell you the truth, it's technically possible, as long as you remember these guidelines:

Public certificates are required if you enable Web conferencing and enable your users to invite anonymous participants (individuals from outside your organization that do not have Active Directory credentials).
Public certificates are required for public IM connectivity, and they are highly recommended for enhanced federation. The public certificate must be from a public CA that is on the default list of trusted root CAs installed on the server.
It is possible to use your Enterprise subordinate CA for direct federation, as well as for testing or trial purposes if all partners agree to trust the CA or cross-sign the certificate.

It is very unlikely that these requirements will change with the release of Office Communications Server 2007 R2.

Connecting Communicator R2 to Exchange UM

ucspotting — Wed, 24 Dec 2008 19:45:19 GMT

Recently, I was doing some tests with Exchange Unified Messaging, but when I tried to connect to Exchange Voice Mail using Communicator R2, I got the following error:

"Incompatible security setting.
The call could not be completed because security levels do not match"

An Exchange UM dial-plan supports three different security levels: Unsecured, SIP Secured, and Secured. The following table shows the differences in terms of Mutual TLS and SRTP for the various security levels.

VoIP Security	Mutual TLS	SRTP
Unsecured	Disabled	Disabled
SIP Secured	Enabled (required)	Disabled
Secured	Enabled (required)	Enabled (required)

When integrating Exchange UM with Office Communications Server 2007, consider the following when selecting the dial plan security level:

Mutual TLS is required between Exchange UM and OCS, therefore the Unsecured level is not an option.
Office Communicator 2007 clients support SRTP (Secure Real-Time Transport Protocol), therefore both Secured as well as SIP Secured security levels can be used. The encryption level that Communicator uses can be set by means of Group Policy or by changing the PC2PCAVEncryption registry key.
If Communicator Phone Edition (aka Tanjay) is deployed, the security level should be set to Secured.

The registry key PC2PCAVEncryption (REG_DWORD) can be used to specify whether encryption is supported, required, or not supported when making and receiving audio and video calls. The supported values are:

0 = Support encryption, but do not require it. Should only be used with the TLS network protocol. (default)
1 = Require encryption. Unencrypted calls are not accepted. Should only be used with the TLS network protocol.
2 = Do not support encryption. Encrypted calls are not accepted.

BTW, if you're playing around with this registry key (or any other), you may find useful to know that Communicator uses the following precedence, when applying settings:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Communicator
HKEY_CURRENT_USER\Software\Policies\Microsoft\Communicator
Office Communications Server 2007 in-band provisioning
Communicator 2007 Options dialog box

Further investigation revealed the following error on Communicator logs:

"SIP/2.0 415 Unsupported Media Type"

After this, it seemed quite obvious that the problem had to do with encryption, more specifically to the SRTP setting. The solution? There are 2 possible ones:

Change the Exchange UM VoIP Security level to "Secured" (it was SIP Secured before).
Create the registry key PC2PCAVEncryption and change its value to 0

One final note: the problem didn't affect Office Communicator 2007, only the R2 client, so we can assume the R2 clients will be more secure than its predecessors.