This is a great guide.  Everything worked until I tried to enable a user.  Once I click the enable button, I receive: "Active Directory operation failed on "LABDC.lab.ad".  You cannot retry this operation: "Insufficient access rights to perform the operation."  This is logged in with the Domain Administrator account.  I also checked to make sure that the Administrator was added to the UC Administrators and RTC Universal Admins groups.  Any ideas?

Had the same problem and goti it fixt by editing user security setting in AD. AD Users & Computers >> View >> Advanced Features. Open user >> Security and allow inheritable permissions.

When trying to open the Control Panel I get an error "Response Group Configuration Tool Failure": An unknown error occured.

Is there any way to debug log files?

"allow inheritable permissions". I executed the Enable-CsUser cmdlet and it worked!

sorry, "allow inheritable permissions" did not work for me, but the cmdlet above

I recommend not use administrator built-in account for log on Lync Client, I create a username from scratch and it works :)

not forget to say thanks to our dear friend Mohamed Baher.. Thank Sir!!

I recommend not use administrator built-in account for log on Lync Client, I create a username from scratch and it works :)

not forget to say thanks to our dear friend Mohamed Baher.. Thank Sir!!

I recommend not use administrator built-in account for log on Lync Client, I create a username from scratch and it works :)

not forget to say thanks to our dear friend Mohamed Baher.. Thank Sir!!

I recommend not use administrator built-in account for log on Lync Client, I create a username from scratch and it works :)

not forget to say thanks to our dear friend Mohamed Baher.. Thank Sir!!

I recommend not use administrator built-in account for log on Lync Client, I create a username from scratch and it works :)

not forget to say thanks to our dear friend Mohamed Baher.. Thank Sir!!

Great guide, made the installation job very easy.  By any chance will you be adding deployment guide for enabling external users?  That would be very helpful.  Thanks,

There was a problem verifying the certificate from the server

plz help

I do have the certificate-problem as well:

Cannot sign in to Lync. There was a problem verifying the certificate from the server.

I do use a certificate from out CA and already deployed the CA-Cert through GPO.

When I log in the Admin-GUI using the Browser and HTTPS, it says the certificate is valid.

I´d appreciate any help.

I Installed Lync Server Successfully(All Services are running properly). But when I try to login to Lync Client using TLS it gives certificate error.

I am using Lync Client on the same machine where Lync Server is installed.

please help. I am stucked here.

Thanks and Regards,

Mahesh R. Kulkarni

I also had a problem connecting to Lync Server 2010 using the Lync Client and was getting a certificate error.  The reason for the certificate error was not actually a certificate problem at all.  It turns out that a user must be added to a Registrar Pool before it can connect to the Lync Server using the Lync Client.  If the user you are attempting to login as is not added to a pool you may get that certificate error among other error messages(as I did).  You can add a user to a Registrar Pool by using the Lync Server Control Panel or by using the  Lync Server Management Shell.

Adding a user to a Registrar Pool is easy using the GUI but when I tried to add my particular account to a Registrar Pool it gave an error stating something like "Active Directory operation failed,  You cannot retry this operation: Insufficient access rights to perform the operation."

It turns out that if the account you are trying to add to a Registrar Pool is part of the Domain Admins group, you can't add this user to a Registrar Pool by using the Microsoft Lync Server 2010 Control Panel GUI.  In order to get a user(who is also a member of the Domain Admins group) added to a pool and thus be able to sign in you have to add this user using the Lync Server management Shell.  For whatever reason Microsoft won't let you add a user(who is also a member of the Domain Admins group) to the Registrar Pool via the GUI interface, you can only add them using the command line.

Here's the command to add them:

Enable-CsUser -Identity "User Name" -RegistrarPool "Name.of.your.server" -SipAddressType SamAccountName  -SipDomain domain.local

Reference:technet.microsoft.com/.../gg398711.aspx

Hope this helps!