TsooRaD

Discover E2003 Relay IP

2012-01-20T10:49:00.001-08:00

Situation

Faced with discovery and documenting “hundreds” of potential IP’s in the relay lists spread across 14 e2003 servers, I went looking for a more programmatic methodology.

Potential Solution

Found this: http://support.microsoft.com/kb/935635

While the output is a little clunky, it works way better than me writing them down manually, or screen shots. The reference KB would have you do this from an Exchange server. I am using a domain workstation with good results. With a little excel work, I will be able to combine all this into one PS script to create receive connectors in E2010.

This is probably old info to some of you. YMMV.

OCS 2007 R2 updates

2012-01-19T12:56:00.001-08:00

Nice to know that even after the release of Lync, the Microsoft OCS team is still keeping things updated…

New today

Servers

http://www.microsoft.com/download/en/details.aspx?id=19178

communicator

http://www.microsoft.com/download/en/details.aspx?id=21547

and the ever popular GC…

http://www.microsoft.com/download/en/details.aspx?id=12180

UCMA redistributable (for those doing ExUM you may need this)

http://www.microsoft.com/download/en/details.aspx?id=7557

Enjoy! YMMV.

Who can Federate tool

2012-01-19T10:53:00.001-08:00

Situation

You want to demonstrate to a potential client who their users would want to federate with for business processes.

Possible Solution

MVP Matt Landis has written a nifty little utility…. http://gallery.technet.microsoft.com/Who-Can-Federate-Tool-a9e00d23

The WCF Tool (who can federate tool) will scan through your Outlook contacts and give you a "heads up" on which of your business partners have public Microsoft Lync or OCS federation enabled. This is a great tool to run for people who do or don't have Microsoft Lync to show them who they could connect with in their own contact list.

Useful, eh? This worked nicely for me – found several on my contact list that I had not thought about.

YMMV

Create CSR from TMG

2011-12-30T13:20:00.001-08:00

Scenario

You need to create a Certificate Signing Request (CSR) for your TMG to support Lync (or Exchange or whatever) - AND you need this certificate to have SAN (Subject Alternative Name) entries.

What to do?

Chad McGreanor has a great write-up on this!

Changes?

If you do not already have a Local Computer Certificates\Personal\Certificates container in your TMG deployment, you can still use this process – by accessing the CSR process as shown here:

YMMV

DB errors after lyncserverupdateinstaller.exe is run

2011-12-29T16:26:00.001-08:00

Situation

You have recently updated Lync Server 2010 to the latest Cumulative Update and you are having issues that appear to be DB related.

Possible Fix

It is entirely likely that you may have missed updating your databases as required. This used to be a separate download. Now that the lyncserverupdateinstaller.exe is available (see this MS KB) I have noticed that sometimes people forget to update the databases which is a separate step.

AFTER you run the lyncserverupdateinstaller (remembering to do outside in methodology), here is what you need to do, by type of database environment:

If Enterprise Edition Back End Server databases are not collocated with any other databases, such as Archiving or Monitoring databases, at the command line, type the following:

Install-CsDatabase –Update –ConfiguredDatabases –SqlServerFqdn <SQL Server FQDN>

If Enterprise Edition Back End Server databases are collocated with other databases, such as Archiving or Monitoring databases, at the command line, type the following:

Install-CsDatabase –Update –ConfiguredDatabases –SqlServerFqdn <SQL Server FQDN> -ExcludeCollocatedStores

For Standard Edition, type the following:

Install-CsDatabase –Update –LocalDatabases

YMMV

OAB and GAL issues

2011-12-28T13:56:00.001-08:00

Situation

I just spent the last 3-4 hours doing this research for some random issues as listed below. What resulted was a pretty comprehensive Tshoot OAB/GAL issues outline. Thought I would share.

Issue is (seemingly) random users get created but never show in the GAL – no pattern.

Issue is (seemingly) random users cannot see all users in GAL – no pattern.

- If you create a brand new Outlook profile on a newly installed client with a newly created account, in cached mode, are you able to download a full OAB successfully (this happens automatically with a new OL profile).

o If yes, do you see the "missing" account ?

o If yes, then the OAB is the correct one, and is correctly being updated.

- If no, you have a problem with syncing your OAB. It should point only to the GAL and if it does, and there are no sync errors, it MUST contain the errant account if this appears correctly in the GAL.

The answer to the short experiment above drives which of the following choices to pursue.

1. Can you see the Contact if you turn off Outlook Cached Mode?

2. Does the Contact resolve in Outlook Web Access?

3. Can others see the Contact?

4. Ensure that the user’s default external e-mail address and the windows e-mail address (AD attribute) are exactly the same.

5. If you have a client in cached mode that is not updating the OAB, remove/rename *.oab files in their %userprofile%\Local Settings\Application Data\Microsoft\Outlook. Next time you start Outlook it will re-download the address book and create new OAB files. The problem was the oab files got corrupt and would not catch new updates.

6. If it continues to happen, try excluding these oab files from your anti-virus scanner.

7. Recreate the users Outlook Profile and download all the content fresh

8. folder underneath OAB named d33d3462-etc-etc where the OAB resides had read only permissions set for authenticated users. The OAB folder did not have that permission.

9. On the e2010 server, make sure the Microsoft exchange file distribution service is running.

10. Make sure the recipient that does not show up has an x500 address entry

11. Does anything show in a BPA from e2003?

12. Does anything show in a BPA from e2010?

13. Which server is the OAB generator? Anything in the event log there?

14. Make an e2010 server the OAB generator

a. Any ol2003? Then you need PF distribution

b. Only OL2007 or higher? Use e2010 and web distribution

These seem fairly on point:

http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/b12fb4e6-9da2-450e-b994-0b90eb5252bc/

The domain controller that you are using for OAB gen specified in the 9117

event isn’t seeing that user. Make sure there is not a 9325 in the

application log skipping him because of a bad attribute. You can download a

copy of OABInteg from http://code.msdn.com/oabinteg. Use an online profile

and run oabinteg /s:srvname /t:proxytest /v:2 /l and look at the errors in

the log.

Try deleting the user's oab files then have him redownload.

Go to C:\Users\username\AppData\Local\Microsoft\Outlook

Delete all files with .oab

Outlook, send\receive download address book.

Also did you move this user to another new mailbox store? If so make sure the mailbox store has been set to use the default OAB.

Exchange 2007/2010 Web services and Autodiscover Ultimate Troubleshooting Guide

I decided to put this ultimate guide to spare the hustle and allow smoother and nicer web services experience.
Well, let us first list the directories that are used in the Exchange web service:

· EWS is used for OOF, Scheduling assistance and free+busy Lookup.
OAB provides offline address book download services for client.
Autodiscover is used to provide users with autodiscover service.
EAS provides ActiveSync services to Windows Mobile based devices.
OWA provides outlook web access for users.
ECP provides Exchange control panel feature for Exchange 2010 users only.

Issues that might be resolved using the troubleshooting steps here:

· You cannot set the OOF using outlook client, you receive the server not available error.
You cannot view free/busy information for other users.
You cannot use scheduling assistance, also you might receive not free/busy information data retrieved.
You cannot download Offline Address book errors.
You cannot use autodiscover externally.
Certificate mismatch error in autodiscover, users prompted to trust certificate in outlook 2007/2010.

I will update this post to include all of the errors that I face and solve in my work or on EE to help experts all over EE to quickly solve their issues.
First let us start by the configuration required post Exchange 2007/2010 installation for the above to work correctly:
Configure External and Internal URLs for OWS, ref: http://technet.microsoft.com/en-us/library/bb691323(EXCHG.80).aspx

· You have to configure the internal URL to be the server name in case you have multiple servers in NLB.
External URL will be the URL used by users to access webmail e.g. https://mail.domain.com/owa
Mail.domain.com in multiple CAS servers will be the NLB FQDN.
Configure External and Internal URLs for OAB, ref: http://technet.microsoft.com/en-us/library/bb123710.aspx
This will point if multiple CAS servers are used then this will point to NLB FQDN.
If single server used this will point to the internal server FQDN in the internal URL, and the mail.domain.com which is used by webmail users.

Configure the autodiscover internal URL:

· You will use the powershell cmdlet : Set-ClientAccessServer –Identity <CAS Server Name> -AutoDiscoverServiceInternalUri: <Internal URL>, this FQDN must match the URL included in the certificate.
If you cannot use autodiscover.domain.com internally (you have a domain name of domain.local and you must use it), you will get a certificate miss match error, you will have to include the internal name in the certificate if you purchase an external certificate.
If you have multiple CAS in NLB this will be the NLB FQDN.
You cannot set autodiscover external URL since outlook will try to access https://autodiscover.domain.com/autodiscover/autodiscover.xml, this behavior is by design and cannot be changed.
Autodiscover.domain.com must be included in the certificate that you assign to IIS if you purchasing a certificate externally from 3rd party provider.

Configure EAS internal and External URLs, ref: http://technet.microsoft.com/en-us/library/bb629533(EXCHG.80).aspx

· This URL will point to the NLB FQDN internally
This IRL will point to NLB FQDN Externally.

Configure the EWS (which provides availability, OOF) internal and external URLs

· You can set the internal FQDN and External FQDN using: get-webservicesvirtualdirectory | Set-WebServicesVirtualDirectory –InternalUrl: https://url.domain.local/EWS/Exchange.asmx –ExternalURl: https://url.domain.com/EWS/Exchange.asmx

after all of the above settings you have to take into considerations the following note:

· All of the above uses https connection, so SSL certificate must be configured and assigned to IIS on the CAS servers.
Since all of the above uses https, if you have a proxy traffic might be affected.
Make sure that clients can access the URL internally and externally, you can do that by going to the above URL using IE or Firefox and validate that you can access them.

For some people after doing the above configuration you still receive some errors so make sure of the following:

· IIS is started.
OWA application pool, OAB application pool and EWS application pool are running and started with no errors
If you receive authentication error, error 500 service not available, error 400 login time out, or unspecified error you will need to rebuild your virtual directories. You can do that as following:

· For OWA:
Get-owavirtualdirectory | remove-owavirtualdirectory
New-owavirtualdirectory.
You can repeat this step for EWS (webservicesdirectory), OAB (OABvirtualdirectory) and autodiscover(autodiscovervirtualdirectory)

You will have to note that you will need to re-configure any customizations you made to OWA after removing and deleting it, also you will have to redo any internal and external URL configuration you have did in the past

Troubleshooting Offline Address Book Generation on Exchange 2010

After migrating from Exchange 2007 to Exchange 2010, we began noticing that address book downloads failed during a manual send/receive operation with:

‘error (0x8004010F) operation failed. An object cannot be found.’

Basically, this error is happening because Outlook 2007 and higher clients rely on web based distribution of the offline address book, and that address book is not found on the CAS Server.

The fix is to enable the Default Offline Address book on the mailbox server for Web-based distribution:

This setting does not go into effect immediately. If you want to force it to start working immediately, you need to perform these steps:

1) Update the address book

2) Restart the File Distribution Service on the CAS Server

Performing this step will cause the CAS to download a copy of the OAB from the Mailbox server, see this post for more info on the Exchange File Distribution service.

3) Force Active Directory to sync (repadmin /syncall /APed)

Now, when you force a send/receive from Outlook, the address book will download cleanly!

There are other reasons why clients may be getting error 0x8004010F, check out this post for more information: http://blogs.msdn.com/dgoldman/archive/2008/10/01/understanding-why-error-code-0x8004010f-is-thrown-when-trying-to-download-an-oab.aspx

Also, if you are getting Event 9320 in your event logs, you can safely ignore those per this blog:

http://blogs.msdn.com/dgoldman/archive/2009/12/01/please-read-events-9320-and-9359-on-new-installation-of-exchange-2010.aspx

Lync Mobile Client for iPhone/iPad

2011-12-22T15:27:00.001-08:00

Background

In November 2011, Microsoft released the mobility updates for Lync. Get the bits here. There is also a mobility guide on how to deploy, what needs to change, what stays the same, and what needs adding to your environment. Get the guide here.

Then just a few weeks ago, Microsoft released the actual clients. Windows 7.x mobile, of course, was available almost immediately, the Droid crowd got theirs quickly also. But iOS users had to wait for the AppStore to approve and release. And now they are here! To get your very own install, try the following links:

Client Setup

Once you have this wonderful tool installed, setup is very easy. Here is the initial screen:

Add the obvious information that is needed for autologin. You may need to add your account details if your AD login is different from your SIP address. If so, pull down the “more details” as shown. Also notice the toggle for “auto-detect.”

Then you enter your call back number. This is important because the Lync Mobility setup uses a server-centric call back routine much like the old COMO client did. You can make phone calls from the client, but the SERVER will call you, then call your other party. Works well.

Here is the options screen. Notice that everything is nice and clean. Well laid out and coherent. This is direct contrast to the Damaka Xync client that is clunky at best and confusing to use. Anyone familiar with Lync on the desktop will need no training to use this mobile client on iOS.

For those sharp-eyed readers, notice that I took all these screen shots from an iPad client. But the iPhone client is, as far as I can tell, exactly the same. Nice and consistent. Obviously, the iPad client benefits from a greatly expanded screen size, so all things are not exactly the same, but dang!

Also, because my iPhone is actually a phone with service (my iPad is not) the iPhone Lync client can be used to make phone calls as described above. The iPad client will join meetings, and when you initiate the call, the SERVER will call your cell phone (provided that is the number you entered in the setup). Nifty.

Here, I have entered a phone number and tapped on “call” – the system tells me to answer the call, which is the server connecting me.

Then, the server calls the other party…both sides think the server called them, which in fact it did. But now I can call clients using my cell phone, and having the call come from the office! Nice.

What doesn’t work?

The iOS client has specific functionality – as outlined by the chart that you can find here. But the bottom line is that it works very well, and looks good to boot! Sadly (at least for my expectations) it will not do Audio, Video, or Desktop Sharing (like Xync – but Xync is a full edge client). To be fair, the other clients do not perform those functions either. A list of what CANNOT be done from the Lync iOS client:

add a custom location
publish status based on calendar free/busy
view frequent contacts group (nobody got this one)
modify contacts list (the symbian client can do this)
tag contacts for status change alerts
manage contact group (symbian can manage group contents)
automatically log conversations in Exchange (nobody got this one)
use dial-in conferencing (more on this a bit later)
view meeting video ()
use in-meeting controls, presenter or otherwise (nobody got this one)
desktop share (nobody got this one)
navigate a list of your meetings (I don’t understand why the iOS clients are listed as not being able to do this. I can see a list of my day’s meetings!)
manage team call settings
manage delegates
initiate call to Response Group
support e-911
make calls on behalf of
conduct two-party calls with external user (although it will call my cell phone, so I don’t know what is meant by this)
conduct multiparty calls with external users (ditto as above)
client-side archiving
client-side recording

iOS clients can send location data in an IM. Very nice for tracking down your clients location or possibly showing your buddies what bar you are in….

Conclusions

Overall, I think this is solid release with some great functionality. The Damaka Xync client, as a full edge client, has full functionality. However, the Xync client has a strange interface and some things do not work quite as well I would like them to work; the Microsoft Lync Mobility client has a very clean interface that is instantly familiar – and it provides its’ feature set seamlessly. And free. Free is a very good price.

YMMV

MiFi speed–WiFi is getting better

2011-12-14T14:05:00.001-08:00

Sitting in a car dealer getting my car fixed…. With my zippy new Verizon MiFi…not too shabby.

Lync Server 2010 ROI

2011-12-12T07:40:00.001-08:00

Over at cio.com, Sprint reveals how much it saved by deploying Lync Server. Discussion points cover why Sprint did it and where the savings are and several pain points are also highlighted.

Take a look here.

YMMV

Lync Server 2010 Troubleshooting

2011-12-12T07:34:00.001-08:00

Fellow MVP Stale Hansen has published a sweet Lync Server 2010 Troubleshooting Tips article.

Take a look here. I think you will find it extremely useful.

YMMV

Microsoft SIP error codes

2011-12-12T07:27:00.001-08:00

When reviewing troubleshooting traces from both server roles and client side log files, you will encounter numerous SIP codes that may seem to be a complete different language.

Here is a nice MSDN guide to those SIP codes.

The guide is presented in terms of what the log file will reflect for various states and errors, whether they are unhandled or unidentified. Very helpful for those situations where things are just not operating as expected.

Client Error Display and Logic

Handled Error Display

Unhandled Error Display

YMMV

Lync 2010 & Exchange UM Integration

2011-12-12T07:25:00.001-08:00

If you are deploying Lync Server 2010 with Exchange 2010 Unified Messaging, then this guide is your friend.

The sections of this document help you understand how to deploy and troubleshoot this vital UC component interaction to include conducting testst using synthetic transactions.

YMMV.

Lync Server 2010 Support for Communicator Mobile for Java/Nokia

2011-12-09T15:24:00.001-08:00

Maybe a tad esoteric…but if you need it you NEED it.

Configuring Microsoft Lync Server 2010 to Support Communicator Mobile for Java and Communicator Mobile for Nokia

This document provides the necessary steps for installing the Communicator Mobile component alongside Lync Server 2010 so that Office Communicator Mobile 2007 R2 for Java and Office Communicator Mobile for Nokia 1.0 can connect to the Communicator Mobile component as usual, and the Communicator Mobile component can connect to Lync Server 2010.

YMMV

Useful Tips for Testing Your Lync Server 2010 Edge Server

2011-12-08T14:17:00.001-08:00

Patrick Kelly and Sebastiaan Poels just published a nice Lync Edge troubleshooting tips article.

Go here to get it.

YMMV

XyncCollab Lync Client Review

2011-11-12T00:28:00.001-08:00

The ability to connect a mobile device to the Lync infrastructure is a feature that is missing (natively) from the Microsoft suite of Lync clients. We have been told that the mobile clients are “coming” but - nothing yet. Damaka.com publishes a line of Lync Server 2010 clients for mobile devices known as Xync. According to damaka, Xync is available for iOS, Android, and Symbian. Isn’t this a pretty picture?

Xync for iOS has my attention – you guessed it – I have an iPhone and an iPad. I would LOVE to have something to replace iDialogue and its’ need for an OCS CWA server. This article is a review of the Xync client, how it operates against my production Lync environment, how it interacts with my laptop (full Lync) client, and a run through of how the Xync client behaves in IM, video, and audio calls and conferencing.

Let's start with the Xync client itself. There are three (count ‘em!) versions. Xync, XyncConf, and XyncCollab. Actually, there are two more also, Xync-HD and XyncConf-HD. So, when faced with five different choices, which one do you want? I asked that very question to the fine folks at damaka, and after a (what I feel was a lengthy) delay, I got the following answer:

Xync - Presence,IM,audio,video call
XyncConf - IM conf and Audio conf in addition to xync features
XyncCollab - Collaboration features in addition to XyncConf features.

Take a look at this and observe that the prices go up as the features go up. I do not have understanding of the business logic that made up the delineation of the feature sets into three clients, but there it is. Also, note that the XyncCollab client (the one I purchased) is not marked as “+” (meaning both iPhone and iPad).

Why is there no HD version of XyncCollab? According to damaka’s Ramesh Chaturvedi, the XyncCollab-HD is coming and should be on the appstore soon (in approval process).

What are the differences between iPhone functionality and iPad functionality (xync and conf and hd) ? According to Mr. Chaturvedi, each is optimized for the intended platform. I used the XyncCollab on an iPad, and noticed some things that did not work as expected – such as following the screen orientation, and having that lovely 1x-2x button on the bottom right corner of the display. Using the 1x-2x button increased the view – and not too badly either. Resolution seemed to scale fairly well; not like some games and whatnot where the smaller screen resolution for the iPhone looks crappy (to put it mildly) when increased to 2x.

damaka claims to offer full functionality – full Lync/OCS client – no backend hardware/services required. As to the “no backend” part, I agree. Xync connected via our Edge just fine – in fact, it used the obvious route of discovering the SRV record and connecting. Here is the login screen.

The various data blocks are filled out like normal. Tapping the indicated icon will present you with the custom login screen. Notice the Office 365 option; pretty nice for a third party.

Back to our initial login screen…enter the necessary info, then tap the key icon.

Hola! We are in. I did nothing other than what I would do for my regular Lync client on my laptop, nor did my companies admin have to do anything to support my efforts. Notice that brought my contact list groups right in as expected.

The basic controls are (from left to right across the bottom), create a conference, create a voice conference, voice calls, active sessions, preferences, and sign out. I never did get the conference controls to work. Many times I would follow the “double tap” instructions only to have the client disappear from screen.

Very funky and strange. Sometimes the client crashed and sometimes it did not. When it did not crash, the client went down into the tray and I had to double the home key to go get it or choose Xync again from the desk(tablet)top. If this is why you want to use this tool, I would say it makes it a “no go.” Adelante.

IM worked well when I got that far. Choose a contact, and then the arrow icon on the right side.

From the next screen, you can choose your communication modality.

From left to right, IM, voice call, video call, and I will leave it to you to guess the purpose of the “x'” – although that is pretty obvious. One quirk I did notice here was that you can have one of each with each contact. So, opening an IM, a call, and video session results in three separate sessions with that contact. Not what I was expecting. But hey, lookee! File transfers worked!

Once you have an IM session open, hitting the drop down as shown gives you the modality choices again. But, then we had multiple sessions open at once. And if you do that, you need to know that there is swiping needed to go swipe left/right to page through the sessions. That took me a goodly bit of time to discover.

Voice calls worked well, as did video calling. On the iPad you can flip between the two cameras – so this makes your iPad a potential mobile conference room video source. Here is a nice shot of my hotel; pretty good video from the front iPad camera.

However, on the same vein, the initial video setup has your local video plunked right on top of the remote video. And it took me some frustrating time to figure out that I could swipe the local video and make it disappear. Other than troubleshooting, I don’t see a lot of value in the local video being the size it is, nor does it have much value – I know who I am and what I look like!

Video is h.263, Mr. Chaturvedi said that rtvideo is planned and coming.

Audio calls, using the interface given, turned my iPad into a telephone across the local wireless connection. Sweet!

Desktop Sharing also worked well, but only as a participant. I could not originate the DTS session. Once I had the share sent my direction, I could have control – so this is a partial win.

Independent General Observations

The User guide/manuals are on the damaka website. There is a goodly amount of help/information there.

I noticed that PIC contacts took a LOOOOOONG time to update presence. I never spent any time on this, but contacts which showed online in my Lync client would show as offline in Xync. Odd. Yet once I sent them an IM from Lync, the Xync updated their presence and then was willing to work with that contact.

Having my iPad be able to make and take phone calls based on the corporate PSTN structure was simply outstanding. Video calls ditto.

I noticed no method of location input – how does this translate to e9-1-1? Mr. Chaturvedi said that this feature is Not supported for location services at this time. If you need this for your deployment, then you may be out of luck until a further update.

I find the pricing a tad steep – but who else is providing this service for my device for my infrastructure?

Performance over hotel wireless (on both ends) was highly acceptable. Not perfect, but my assessment of the performance issues was that the wireless was the issue, not the iPad or the Xync client.

Licensing for individual v enterprise is available as is the possibility of using MDM on site to allow the corporate to control clients.

Finally, damaka has Xync data which can be found here:

http://xync.damaka.com and http://videos.damaka.com

I hope this helps you make your mobility client decision.

YMMV

IMAP fails Exchange 2010

2011-10-27T15:37:00.001-07:00

The Situation/Problem

E2007 migration to E2010. Client needs IMAP to work for some high-powered clientele – this thing really needs to be SSL also. E2007 is working as required, so E2010 should slam dunk this requirement, right? Wrong!

Using a CASArray, so I configured a Thunderbird to go right at a CAS; nope….no good.

Changed the CAS to plaintextlogin (set-imapsettings –logintype plaintextlogin) – still no go. Restarted services and spattered the sacred IT Chicken Blood on the nearest wall. We were also seeing weird results in password types – Thunderbird will “probe” the target server for you – which resulted in Kerberos/GSSAPI as the auth choice – no, that is wrong, we want SSL and regular text password. Double checked the e2007 server and determined that the e2010 IMAP was configured identically to the E2007.

Double checked that I had changed the IMAP SSL certificate on both CAS array members correctly… (Set-ImapSettings -server Server01 -X509CertificateName CertificateName01) - You do know about the x509 and IMAP SSL thing, right?

I just wasted 3 hours of my life over this….

The Fix

Then this was found on the forums…You must be kidding me! So here is what fixed my issue:

Open the file at

C:\program files\Microsoft\Exchange Server\V14\ClientAccess\PopImap\Microsoft.Exchange.Imap4.exe.config

I went to bottom of the <dependentAssembly> as shown here:

And inserted what was indicated. Note that I have four lines of additions there, so what you see below is wrapped. However, I have also cleverly given you an example to follow. How thoughtful of me, eh?

After restarting the IMAP service on the CAS, everything worked ok. Changed IMAP back to “SecureLogin” – still good.

Now, I did not try the POP fix as that was not needed for my client environment…

YMMV

RUS Issue #2 (ExBPA)

2011-10-21T10:40:00.001-07:00

Situation

First off, you would think the ExBPA would be smart enough to recognize this situation and not behave this way, but that is a subject for another post.

The E2010 Exchange Best Practice Analyzer (ExBPA) throws the following error when run against a new E2010 install. The environment originally came from E2003, then moved to E2007, now moving to E2010. The E2003 was removed 18 months or so ago…

This link from the ExBPA gives some great information provided you are still running E2003. If you are not, what to do?

There are a variety of resources in google-land that will advise you to just ignore the errors messages. As an example, here is one with an Exchange MVP advising against doing some drastic like removing whole containers from the configuration. Sembee gives great advice. But what if you don’t like seeing those Red X notices? What if your boss does not like them and judges you accordingly? Let’s see if we can do something non-invasive to remove this specific error.

The Fix (NOT SUPPORTED!)

Read the first link above, and then attempt to digest this part of it:

The Microsoft Exchange Server Analyzer Tool queries the Active Directory directory service to determine the value of the msExchAddressListServiceLink attribute for each Recipient Update Service object in the directory. The msExchAddressListServiceLink attribute is a link from the address list service to the Exchange Server computer it should be running on. If the Exchange Analyzer finds that there is no msExchAddressListServiceLink attribute for a Recipient Update Service object, or the msExchAddressListServiceLink attribute value for the object is not populated, an error is displayed.

How does this translate into reality? From an ADSIedit viewpoint, we can see the RUS container is very much still in AD (the reference environment came from E2003). In this view, I am showing the actual attribute on the domain RUS object.

So, this is why the ExBPA is pitching the error. What do we put in there to remove the error. Well, the name of an Exchange server of course! But what format and where can I get it?

Here is the format:

CN=E2010,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=domain,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=com

And here is where you can get this wonderful data string:

Plug this into the attribute of the RUS object as shown:

Depending on which DC/GC you are talking to with what server, wait 15 minutes or so for replication to occur, then re-run ExBPA. The RUS error will now be gone. Please note that this is visual only, E2010 ignores the RUS containers as RUS no longer exists in E2010 (E2007 for that matter).

This is NOT a supported fix. I suppose if you are still running E2003 and get this error, you could use this to resolve that instance as it illustrates the guidance of the recommended fix.

The Fix #2 (Supported)

After doing a bit more research, and reviewing exactly how to remove E2003, I realized that removing the RUS is part of the process:

Perform the following steps to delete the domain Recipient Update Services:
1. In Exchange 2003 or Exchange 2000 System Manager, expand Recipients, and then select Recipient Update Services.
2. Right-click each domain Recipient Update Service, and then select Delete.
3. Click Yes.
You will not be able to delete the Recipient Update Service (Enterprise Configuration) by using Exchange 2003 or Exchange 2000 System Manager. Perform the following steps to delete the Recipient Update Service (Enterprise Configuration) by using ADSI Edit (AdsiEdit.msc):
1. Open ADSI Edit, expand Configuration, expand CN=Configuration,CN=<domain>, expand CN=Services, expand CN=Microsoft Exchange, expand CN=<Exchange organization name>, expand CN=Address Lists Container, and then select CN=Recipient Update Services.
2. In the result pane, right-click Recipient Update Service (Enterprise Configuration), click Delete, and then click Yes to confirm the deletion.

YMMV

Empty Server Container in Exchange Configuration

2011-10-20T17:39:00.001-07:00

edit 10.21.2011 1414 PST

Discovered that the ExBPA pitches an error if the servers container is missing. D’oh! Makes sense, sorta. So I recreated the servers container in the First Administrative Group, with only the right type of container and name “Servers” – and that got rid of the error AANNDD the Exfolders access to the E2007 PF still works. Nifty, eh?

Situation

While in the midst of an upgrade to to 2010, we noticed that PF replication was bombing, ExFolders would not connect to the E2007 MBX – it threw a “recipient cannot be found” error - and we were getting sporadic weirdness with the AddReplicaToPFRecursive.ps1 script. We are using E2010 SP1 RU5.

Odd.

The client had previously removed Exchange 2003 in favor of Exchange 2007 some 18 months or so ago. Exchange 2003 was removed and roles transferred, but the server was never uninstalled. This left some remnants behind, as you would expect. The server was removed from AD with ADSIEdit as part of an AD cleanup prior to deploying E2010.

The Fix

A little light reading here and then we followed the obvious indication to remove the empty “servers” container from the “First Administration Group” left over from Exchange 2003. DO NOT remove the entire “First Administration Group” container, or any others left over from legacy versions.

Wala! At least this was an easy one. This was supposedly fixed with E2010 SP1 RU5, but apparently not.

YMMV

WNLB not working on local subnet

2011-10-19T20:29:00.001-07:00

I ran into a very odd situation today. Now, I know that there are those out there in cyberland who will have seen this before, but I have not, and on the odd chance that it might help you, I post this.

Situation

Doing WNLB, using VMWare hosting the WNLB servers. Therefore, according to VMWare we should be using multicast. So we did. And swiftly noticed that other servers on the local VLAN could not find the WNLB address. In fact, we noticed that the switch itself could not ping the WNLB address. Devices on OTHER vlans could ping the WNLB. WTF?! Double-check the setup and redo the static ARP on the switch with this:

ARP 10.1.8.75 03bf.c0a8.0164 ARPA

Here is what it looked like AFTER we did the proper static ARP configuration on the switch…

Notice that a tracert is showing that even the simplest action is pushing the packets at the local gateway.

We are using the following switch hardware:

Cisco IOS Software, Catalyst 4500 L3 Switch Software (cat4500-ENTSERVICESK9-M), Version 12.2(54)SG, RELEASE SOFTWARE (fc3)
System image file is "bootflash:cat4500-entservicesk9-mz.122-54.SG.bin"
cisco WS-C4948-10GE (MPC8540) processor (revision 5) with 262144K bytes of memory.
Processor board ID FOX092101VW

The Fix

After going back and forth, including rebuilding the WNLB configuration, we realized we were dealing with a multicast capable switch. Having nothing to lose, we did the following on the switch:

no ip multicast-routing

wala! Now we can resolve the WNLB, ping it, tracert to it, and actually access services on the member servers. Oddly, I had a colleague with a similar issue at the same time. Their situation was resolved by using the arp IP MAC arpa command not only on the switch the WNLB connected to, but all distribution switches and the core of the stack also.

YMMV

RIP Steve Jobs

2011-10-05T17:34:00.001-07:00

Steve Jobs is gone. Somebody who really made an impact in the world. RIP.

Lync is attempting to connect to:

2011-09-11T11:11:00.001-07:00

Thanks to Elan Shudnow and Bob Wille who helped get to the bottom of this.

The Issue

At a client site the other day, my Lync client pitched the following error:

Now, as you might imagine, the name here does not match what my client was expecting to find. Clicking on “connect” fails with this error:

Using the “Try Another Server” allows my client to connect normally; closing the error message with the upper right corner red ‘x’ allows my client to connect normally.

What is going on here? The Lync client does a number of automatic lookups when initiating login so it can locate an appropriate server. Here we can see my client querying the local DNS to find its’ server, and we can also see the client ASKING for the address for the lyncfrontendvip that is causing this error.

The Question

What is causing this behavior? Handled correctly, this is not stopping my client from connecting (eventually); however, this is certainly unexpected. So, here is a netmon trace of my client but this time from another location (my hotel). Note the Lync client is no longer requesting the odd vipname address.

Why is this happening?

As it turns out, my client’s environment/site location is configured for Lync Phone Edition support; this means that DHCP option 120 was created and configured to deliver information necessary for allowing proper Lync Phone operations. This screen cap shows this DHCP delivery; and here is the vipname being delivered to my Lync client.

What is happening is that the DHCP, configured for Lync Phone support, is delivering (as it should) SIPServer data to the client host machine. Clearly, Lync client is hardcoded to default to the SIPServer definition address if that DNS query is valid. Hence, inside my client’s environment, my Lync client was delivered a SIPServer definition, and used it in favor of the expected _sipexternaltls._tcp.domain.com. When it attached to the defined SIPServer, it then failed to login (duh!) because my account did not exist on that system. Cancelling the dialogue or telling the client to try another server works because Lync then tries the existing returns for _sipexternaltls._tcp.domain.com.

Conclusion

Consultants who are working in a Lync Phone enabled client environment may see this Lync behavior. However, your regular users who are roaming, visiting THEIR client sites might see this also. Their solution, if they don’t figure it out for themselves will be to cancel the error dialogue. Your job will be to explain the whole mess to them. I hope this helps.

YMMV.

Cross-forest E2010 user moves

2011-08-26T15:57:00.001-07:00

The Issue

Recently, I had to migrate/move users from E2003 to E2010 cross-forest. FIM took care of the basic user objects (MEU’s) in the new forest, so I developed the following. It would seem that this process, while hinted at in various websites, blogs, and articles, was always sort of vague – and in my case the permissions referenced were not enough to complete the tasks. The source object modifications failed. As I was doing the moves with a domain admin/org admin in the target, I had no issues there.

The Solution

csv format

# remember to not have a trailing line feed after the last entry

# - it causes the script to loop on a blank line

# - you can also remove the database field and e2010 will distribute mailboxes automatically among the available databases

---

identity,database

%m@domain.com,databasename

---

Perms needed

# The various texts indicate much less perms (recipient admin and local admin to the server) than I show here.

# These work much better!

Target: Domain Admin and Exchange Org Administrator

Source: Domain Admin and e2003 Full Admin

--- script follows ---

$SourceCredentials = Get-Credential

$TargetCredentials = Get-Credential

set-location "D:\program files\microsoft\exchange server\v14\Scripts"

import-csv d:\migrationcsvfiles\testusers.csv | foreach {.\Prepare-MoveRequest.ps1 -Identity $_.identity -RemoteForestDomainController whateveritis.domain.com -RemoteForestCredential $sourceCredentials -LocalForestDomainController whateveritis.domain.com -LocalForestCredential $targetCredentials -UseLocalObject}

# I noticed some random AD GUID errors when running both lines at once, so I started the top four lines, then did not copy in the line return after the new-moverequest and things stop erroring. YMMV.

import-csv d:\migrationcsvfiles\testusers.csv | foreach {New-MoveRequest -Identity $_.identity -RemoteLegacy -TargetDatabase $_.database -RemoteGlobalCatalog whateveritis.domain.com -RemoteCredential $sourceCredentials -DomainController whateveritis.domain.com -TargetDeliveryDomain "domain.com"}

---

404 Errors with Successful Exchange 2010 EMC Actions

2011-08-24T21:33:00.001-07:00

The Issue

Actions in the EMC such as moving active databases or any command that modifies an object are successful, but complete with a warning message:

Warning:
The cmdlet extension agent with the index 0 has thrown an exception in OnComplete(). The exception is: System.Net.WebException: The request failed with HTTP status 404: Not Found.
   at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Microsoft.Exchange.SoapWebClient.CustomSoapHttpClientProtocol.<>c__DisplayClass4.<Invoke>b__3()
   at Microsoft.Exchange.SoapWebClient.HttpAuthenticator.NetworkServiceHttpAuthenticator.AuthenticateAndExecute[T](SoapHttpClientProtocol client, AuthenticateAndExecuteHandler`1 handler)
   at Microsoft.Exchange.SoapWebClient.SoapHttpClientAuthenticator.AuthenticateAndExecute[T](SoapHttpClientProtocol client, AuthenticateAndExecuteHandler`1 handler)
   at Microsoft.Exchange.SoapWebClient.EWS.ExchangeServiceBinding.FindFolder(FindFolderType FindFolder1)
   at Microsoft.Exchange.ProvisioningAgent.MailboxLoggerFactory.EwsMailer.GetAdminAuditLogsFolder(ADUser adUser)
   at Microsoft.Exchange.ProvisioningAgent.MailboxLoggerFactory.EwsMailer..ctor(OrganizationId organizationId, ADUser adUser, ExchangePrincipal principal)
   at Microsoft.Exchange.ProvisioningAgent.MailboxLoggerFactory.Create(OrganizationId organizationId, ADUser mailbox, ExchangePrincipal principal)
   at Microsoft.Exchange.ProvisioningAgent.AdminLogAgentClassFactory.ConfigWrapper.get_MailboxLogger()
   at Microsoft.Exchange.ProvisioningAgent.AdminLogProvisioningHandler.OnComplete(Boolean succeeded, Exception e)
   at Microsoft.Exchange.Provisioning.ProvisioningLayer.OnComplete(Task task, Boolean succeeded, Exception exception)

The Fix (partial)

This is, of course very annoying and looks pretty bad. After some googling, I found this blog.

While not exactly accurate to my situation (my EWS is configured properly) I figured it could not hurt to try.

Get-AdminAuditLogConfig

Set-AdminAuditLogConfig -AdminAuditLogEnabled $false

These screen caps show that the adminaudit logging was indeed set to the Exchange 2010 SP1 default.; disabling this function makes the error warnings cease and the desired actions are s still successful. Because my EWS was configured properly, I believe the system is throwing the error because my EWS is already configured to support HLB that does not exist (yet). I will reverse this command after we deploy the HLB layer to confirm.

YMMV

E2010 EMC cannot read local server

2011-08-24T14:12:00.001-07:00

The Issue

Opened the EMC on several E2010 servers today. Was rudely told that the EMC could not contact the local server. A reboot fixed the problem, but I don’t like that.

I found this little routine here.

1. make sure IIS WinRM extension is installed
2. open powershell and run command : WinRM Quickconfig
3. Open IIS go to Powershell virtual directory and check that SSL in disabled and authentification is set only to Anonymous
4. Open Windows powershell modules
5. run Remove-PowershellVirtualDirectory command
6. run New-PowershellVirtuallirectory command
7. IISreset

I did not have to do the entire thing in my case. I did, however, check each and every e2010 (all 14) in the environment. NONE of them had the WinRM installed. All of them had the PowerShell vDir with anonymous disabled, but not requiring SSL.

What’s up with that? I checked the e2010 on server 2008 R2 prerequisites and the IIS WinRM is not listed for any role – which explains why it was not present on any of my servers.

The Fix

So, my final resolution was:

Install IIS WinRM Extension
Enable Anonymous on the PowerShell vDir

YMMV

Lync on Wireless (Remote user)

2011-08-22T10:41:00.001-07:00

The Issue:

I have been having Lync connection issues – as in server drops, random disconnects, bad bad bad. I have done some local troubleshooting, and it appears that I have identified an issue that is very close to the “sun in the IR sensor” that used to shut down/disable HP printers.

The Cause:

It would appear that every time the microwave oven upstairs is running, the entire network drops. Not just the wireless, but the entire thing. This is interesting in that the kitchen is on the far side of the house – at least 80 feet way in a straight line, and upstairs to boot. I am hardwired in to Comcrappy home internet. Wireless is DLink. One difference between this setup and my previous residence is that the microwave is in a cabinet which may be focusing the oven radiation spill at this end of the house.

The Solution:

I don’t have one, yet.

YMMV

Configure DHCP Options to enable sign-in for IP Phones

2011-08-18T15:38:00.001-07:00

In this white paper Microsoft provides details about how to configure DHCP servers from the following manufacturers: BlueCat, Cisco, Linux, Infoblox, and QIP. It extends the information provided in the topic “Configuring DHCP Options on DHCP Servers other than Windows DHCP Server.” The information in this white paper does not apply to DHCP servers that are a component of Windows Server.

Get the guide here.

Monitor OCS and Lync Call Capacity

2011-08-17T12:04:00.001-07:00

Tom Pacyk over at ConfusedAmused has a very nice set of scripts to help the Lync/OCS administrator look at the peak call numbers on your Mediation servers.

http://www.confusedamused.com/notebook/monitoring-ocs-and-lync-peak-call-capacity/

YMMV

Maximum Number of names in a SAN Extension

2011-08-16T21:53:00.001-07:00

In what is sure to be a long standing record (of sorts) for me (and maybe only me) – I just submitted a CSR to a public provider with 53 domains in the SAN field. This raised the question: “how many entries or names can be in that one field?” I know there has to be some sort of limit.

Handy Dandy, we had a TMG guy in the room, so we asked him. While he did not know off the top of his head, he did have an answer in mere minutes (where I had googled for about 10 and found squat).

http://social.technet.microsoft.com/wiki/contents/articles/3306.aspx

So, now we know the field is defined by a database, that a Windows PKI CA is limited to 4k of names, and that somewhere around 150 25 character domain names eat up just under 4k. By extension, we can assume (and we know what that means) that the Public cert providers are following the same RFC and that they will have a similar limit.

How about that? An answer to a question you did not know you had!

YMMV

Handy PowerShell Transcript concept

2011-08-05T16:38:00.001-07:00

A co-worker of mine put up this blog entry today, I like it. I too have closed the PowerShell window before I really wanted to. I use the F7 key, and the up/down arrows, but there is nothing like a literal log, especially when it comes to working up specific elements of a complex (or even brute force) script. My thanks to Mr. Jaworski to putting this together – his technique works on every PS install I have tried it on (so far ).

I modified the instructions Scott lays out, because I don’t like having an unlimited growth file. I also did not see the point, however well taken, to some of the preliminary setup. So, I distilled down to one line:

start-transcript "c:\PS log $(get-date -f "yyyy-MM-dd HHmm").txt”

This simple one liner gets you this:

The resulting file looks like this:

Note that the date/time format is in something *I* like, so you might want to change that around a tad. But all the nice details are there.

Of course, you will need to “stop-transcript” when you get done.

YMMV

Lync Server 2010 cmdlet help

2011-08-03T10:08:00.001-07:00

Things like built-in help files tend to get overlooked. We often work around things; and I like to have a separate reference handy. In the case of Lync, there is a mass of great information inside of the PowerShell command “get-help.” However, the amount of data can be daunting. For my own purposes, I extracted this data and massaged it a bit. There are 546 cmdlets – the Table of Contents runs 18 pages. The word doc has a clickable contents section, and each cmdlet has a hyperlink to the online content from TechNet.

You can get the document here.

Here is a PDF also for us iPad users.

AdminSDHolder with Exchange and Lync

2011-08-02T07:35:00.001-07:00

The adminsdholder function protects certain user accounts inside of AD. However, that same protection also presents challenges when connecting users to mobile devices, migrating accounts from application system to a new version, or moving accounts to new locations (like upgrading from OCS R2 to Lync).

If you get “access denied” or “Insufficient rights” errors, then you may have bumped up against some built-in protections that are provided by the AdminSDholder AD DS function set. Simply, every 20 minutes or so, this process goes through and resets rights and permissions on certain accounts in AD. This will screw up Exchange and Lync migrations because users in specific groups stop inheriting perms from above (they are protected!). Going in an twiddling one check box fixes the situation, but you need to know where and why.

After reading this excellent blog article by AD DS MVP John Policelli, try this.

First, make sure your ADUC is set to show advanced features:

Then, take a look at the account that is giving you the error:

locate the user object, select properties | security | advanced, and then tick the check box indicated by balloon #3.

I think that I have seen this issue at least once (literally) in every Lync, OCS, and Exchange project I have worked on in the last 10 years. The best practice, of course, would never have one of those protected group members with an email account or Lync/OCS account, but we know that is not always practical or enforced.

YMMV.

CU3 for Lync and Lync Server

2011-07-26T10:59:00.001-07:00

CU3 is out. Not listed on the update resource center quite yet, but here they are:

Lync 2010 Hotfix KB 2571543 (64 bit)

Lync 2010 Hotfix KB 2571543 (32 bit)

Lync Server 2010 Hotfix KB 2493736

Lync 2010 Group Chat Hotfix KB 2500446

YMMV

Outlook Anywhere cannot be disabled

2011-07-20T18:25:00.001-07:00

Onsite with a client and we are having issues with getting Exchange 2010 to enumerate CAS websites.

Here is the lovely error we got:

-------------------------------------------------------

An IIS directory entry couldn't be created. The error message is The remote procedure call failed and did not execute. . HResult = -2147023169 + CategoryInfo:NotInstalled: (servername\Rpc (Default Web Site):ADObjectId) [Get-OutlookAnywhere],

-------------------------------------------------------
Oh lovely. Cannot enable, disable, or get anywhere with this. Poked, prodded, googled, etc. Nada. Finally, in disgust, I believe what I am being told, to whit:

Action 'Disable Outlook Anywhere' could not be performed on object 'servername.'

Servername
Error:
The Outlook Anywhere feature has multiple configurations on servername.domain.com.

OK, so where does powershell get this data from? AD. So off we go to AD. And what did I find hiding out:

CN=Rpc (Default WebSite),CN=HTTP,CN=Protocols,CN=servername, CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=ExchangeOrgName,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=com

Two, count ‘em TWO RPC definitions. Yup, the server (and AD) thought there were multiple configurations. I carefully deleted one, and restarted the server. And now I get much better response in enumerating Exchange web sites/services. And OA can be configured again.

How it got there I have zero idea. Three other CAS servers in the Org are just fine. This one was just fine until about 1750 on 28 June 2011 when it was modified (according to AD) both at the same time. Some sort of hitch in the get-along as far as I can tell.

YMMV.

Lync to CUCM Step Through

2011-07-18T08:57:00.001-07:00

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26800

The above link shows step-by-step configuration tasks to set up the Direct SIP connectivity between Cisco Unified Communications Manager (CUCM) and Lync Server 2010. These steps include configuration of the media bypass feature that optimizes media flow by allowing Lync endpoints to directly establish a media connection with a gateway or private branch exchange (PBX) without going through the Lync Server Mediation Server.

Static Routes in Server 2008 R2 Not Consistent

2011-06-29T11:46:00.001-07:00

The Issue:

Onsite with a customer setting up the initial E2010 DAG MBX servers. In constructing the MAPInet and REPLnet NICs on each server, we noticed that the static routes were not behaving as expected.

We checked the commands for establishing the static routes and how the NICs were setup. We were consistent across the board, on both subnets and sites. As an example, here is what we were using from the one site:

route add 10.12.93.0 mask 255.255.255.0 10.1.26.1 if 15 –p

This resulted in a 80% failure rate at that one site to establish a static route for the REPLnet traffic (for you score keepers, this equates to 40% failure across the environment). Obviously, we cannot continue with DAG construction until this is resolved.

The Fix

netsh int ipv4 add route 10.12.93.0/24 “replnet” 10.1.26.1

Using the netsh method resulted in 100% success at not only putting a persistent route into place but actually having it work!

Thanks to http://fixmyitsystem.com/2010/10/adding-static-route-using-netsh-and.html for having a nice little article on this subject.

YMMV.

2008r2 and TMG and VPN = NO!

2011-06-24T16:26:00.001-07:00

The Issue

Having just ran around the world on this, it would appear that even with TMG SP1, Server 2008R2 does not allow TMG to do simple PPTP VPN. I foolishly thought I would insert the VPN service into my lab as a quick test. All my web publishing rules continued to work flawlessly; Lync Web Components; NAT for my Lync, Exchange 2010 publishing – everything worked except VPN.

If you are intensely interested, the VPN connection would be made, but no traffic was allowed to flow. Don’t know why, and at this point I don’t much care.

The Fix

I fixed it by building a new server on 2008 SP2. If you are doing a project that includes TMG and want to have the same TMG provide VPN, you should most likely think about it and lab it before you continue.

Hopefully, someone can point out the errors of my ways and show me what I did wrong. YMMV.

Open Services applet in Standard Mode

2011-06-20T11:34:00.001-07:00

Ever since somebody at Microsoft decided we needed the services.msc applet to open in “extended” mode, I have been clicking on “standard” to get the view I wanted. This last week I finally got fed up with this, and decided to do something about it. As it turns out, this is not the easiest thing to change. Apparently, us poor users are not allowed to change the behavior for the named services.msc. We are not worthy.

What you have to do is author a new named instance – and of course remember to use that one. I was unsuccessful at renaming, deleting, or otherwise removing the original services.msc. I am sure there is some method to do so, but I was unwilling to dink too much with an operating system that was working before I messed with it. YMMV.

Here is what I did: (the example is using an x64 Win7 O/S, but it works equally well for Server 2008, and I imagine, Vista (why are you using that?).

Go to c:\windows\system32 and locate the services.msc applet. Right-click it and select “author.”

When services opens, click File | Options as shown.

Now, change that console mode to “author.”

Say OK to this…

Change the view to standard…

Now, save this to a name and location of your choosing…

Now when you go to a command line (or in my case about 90% of the time a powershell prompt), and type in jmwservices.msc, I get this “new and de-proved” services applet in standard mode. I suppose you could mod the original references to the new applet if you want to get fancy.

Enjoy!

Lync Client Add-ins

2011-06-02T17:42:00.001-07:00

Tabbed IM conversations! Nice!

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=e6e96569-43da-48fa-a4bc-cd63cda1b2de

Conversation Translator. Conversation Translator provides a real-time language translation service for Lync instant messaging (IM) conversations. With Conversation Translator, both the sender and receiver can converse in their native language, and Conversation Translator handles the translation.

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=3db63eb2-190b-47c8-bb8e-e8bbdaf74b07

Conversations Analyzer for Microsoft Lync 2010. Conversations Analyzer is an application that reviews your Microsoft Lync instant messaging (IM) conversation history and gives you scores for your use of trust-building language in day-to-day communications with business associates and friends. Conversations Analyzer applies trust rules to determine the occurrence of words and phrases that have a positive or negative effect on trust.

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=8bb96deb-2872-4ee8-a96b-9e8e61719ee8

Lync Server 2010 Backup

2011-05-25T20:21:00.001-07:00

Published up on Microsoft Download, we now have some official word on backup and restore for Lync Server. Quoted from DrRez:

This document describes a methodology for backing up and restoring the data that is required for full recovery of Microsoft Lync Server 2010 services. It includes the procedures for backing up data and recovering from the following levels of failure: Standard Edition Server, Central Management Server, Enterprise Edition Back End Server, a server that is a member of any Lync Server pool, a Lync Server pool, a File Store, an Archiving Server or a Monitoring Server with a collocated database, and a stand-alone Archiving database or Monitoring database.

Visit Backing Up and Restoring Lync Server 2010 to download the whitepaper.

Download Silverlight v4

2011-05-17T09:27:00.001-07:00

My client does not allow the Lync FE servers to reach the internet directly on 80 or 443. Therefore I needed to find a download of Silverlight for the Lync Control Panel.

Here it is.

AntiVirus and Lync

2011-05-11T07:42:00.001-07:00

Right from the online CHM file entry on virus scanning exclusions. I had a bit of trouble finding this, even though I knew it was there. A colleague reminded me of this, so I thought I would throw up a quick reference so I can always find it. I had a client ask me this question, and my response was “the entire install structure, the standard SQL exclusions, and the file share location.

Here is the link to the official material, and below is the data copied from that link so I don’t have to go hunting for it! Note that the Lync file share is not on this list; however, I have seen some issues with meeting content when the server is actively scanning that location. I cannot say for certain that the virus scanning on the server was causing the issue, but I do know that disabling the virus program on the server fixed the issue. On the client side, it appears that some client virus engines get in the way of certain Lync functions unless you specifically add the Communicator.exe program to the engine’s allowed programs.

Specifying Anti-Virus Scanning Exclusions

To ensure that the antivirus scanner does not interfere with the operation of Microsoft Lync Server 2010, you must exclude specific processes and directories for each Lync Server 2010 server or server role on which you run an antivirus scanner. The following processes and directories should be excluded:

Lync Server 2010 processes:
- ASMCUSvc.exe
- AVMCUSvc.exe
- DataMCUSvc.exe
- DataProxy.exe
- FileTransferAgent.exe
- IMMCUSvc.exe
- MasterReplicatorAgent.exe
- MediaRelaySvc.exe
- MediationServerSvc.exe
- MeetingMCUSvc.exe
- MRASSvc.exe
- OcsAppServerHost.exe
- QmsSvc.exe
- ReplicaReplicatorAgent.exe
- RTCArch.exe
- RtcCdr.exe
- RTCSrv.exe
IIS processes:
- %systemroot%\system32\inetsrv\w3wp.exe
- %systemroot%\SysWOW64\inetsrv\w3wp.exe
SQL Server processes:
- %ProgramFiles%\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLServr.exe
- %ProgramFiles%\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
- %ProgramFiles%\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe
Directories:
- %systemroot%\System32\LogFiles
- %systemroot%\SysWow64\LogFiles

dot net v4 breaks iSCSI from NetApp v6.3sp2

2011-05-04T09:02:00.001-07:00

edit 15 May 2011

Some feedback from NetApp is that this will work *IF* the SDW and NET3.51 are installed first before putting NET 4 into place.

---

In our environment, .net v4 also appeared to block installation of BES 5.0.3. My support chain contacted NetApp engineering, who says that .net v4 is supported.

FWIW, we are using Server 2008 R2 SP1, with all updates (straight install), VMware ESX and ESXi v4, UCS hardware. I do not know the NetApp filer model/version.

What we saw: after install of the base O/S, we installed the NetApp v6.3sp2 LUN driver. Everything appeared to work failry well, until we committed to the LUN and the connection process started. All we ever got was the 120 second time out. On the back end, the LUN looked connected at the NetApp, but on the server, there was nothing. Attempts to reconnect at that point resulted in being told that LUN was already dedicated.

Removing .net 4 components from the server allowed full, normal, LUN connection.

YMMV

E2010 sp1 cannot close EMC

2011-04-28T09:51:00.001-07:00

Just installed e2010 with SP1 - CAS/HT server. EMC will not close. Seems to be an IE9 issue, with mixed reporting of not having the issue and having the issue. If you have the issue, the fix appears to be uninstalling IE9. Of course, with the way IE is linked into the O/S, this route may result in other issues.

See this thread for some background.

In my case, simply rebooting the server as a post-install action cleared the issue.

YMMV.

Server 2008 R2 SP1 AD errors

2011-04-27T17:37:00.001-07:00

At a customer site doing some due diligence on AD health. DCDiag from the first Exchange 2010 CAS server against the FSMO holder failed on the DFRSEvent and KCCEvent checks with an event ID of 0x6BA. Running the same test on the FSMO holder (we need to extend the schema folks!) failed with 0x6BA also.

Once we got the first issue reduced, then another popped up on both the FSMO holder and the DCDiag from the Exchange CAS server: 0x8000043B

Doing a little googling revealed this blog entry that got me started on fixing the issue. However, this blog entry clearly stated that the “Remote Service Management (RPC)” was the culprit.

Enabling this rule in the DC’s firewall did not help me; so I started with all the rest that looked like they might be what I was looking for. Not the most scientific method, but my reasoning was that it was better than turning the FW off entirely. Also, all other data I could find for this issue all pointed back to the one blog – that guy should be charging for plagiarism! For my situation, we had to enable this other rule also: “Remote Administration (RPC)” as shown.

At this point, DCDiag /s:fsmohost completed so quickly you would have thought the entire thing errored out. Instead, what it did was pitch the KCCEvent event ID: 0x8000043B. Not good, I still need the FSMO holder to behave so I can extend the schema (amongst other tasks…). After wading through more googles, the fix to this second layer of error was:

dcdiag /fix

wala! Nice clean dcdiag runs from both the FSMO holder and the exchange servers.

Lync Server 2010 Support for SQL 2008 R2

2011-04-20T10:37:00.001-07:00

NextHop announced formal support for SQL 2008 R2, all database uses, for Lync Server.

Here is the formal notification.

Client Virtualization in Lync 2010

2011-04-14T11:52:00.001-07:00

A new document up in the download center outlines BPR for running Lync 2010 in a virtualizzed environment.

Get it here

Lync Server Help Desk Resource

2011-04-13T13:28:00.001-07:00

Do you support Lync users? Are you a newbie type and are sort of lost? Then this is for you! Also for those who think they are “experts,” because we can always learn something.

This resource is aimed at first-level help desk agents who support Microsoft Lync Server 2010 clients. Note: The .zip file contains both the print documentation and the Help file.

Get it here

Lync Security Guide

2011-04-13T13:24:00.001-07:00

The Security Guide provides guidelines for assessing and managing security risks to your Lync Server 2010 deployment.

Get it here

Lync Bandwidth Calculator

2011-04-13T13:17:00.001-07:00

A handy excel tool for calculating, you guessed it, bandwidth requirements for Lync.

Get it here

Visio and/or Word “*.exe stopped working” error

2011-04-04T16:34:00.001-07:00

So, I have this zippy new laptop from work. Nice piece of gear. Windows 7 x64 Ultimate, bright display, 8GB RAM, good HD, pretty quick overall. Did I mention how nice this thing is? Office 2010, added Visio 2010 – I have these documentation needs and I simply must have both of these. Clients sort of expect to see the “expert” using the “latest and greatest” so I use the Office 2010 level. Note that I put those words in quotations.

Doing a cut n paste from Visio to Word was resulting in one of the two kicking up an error about how the “…*.exe has stopped working.” This gives you a few selections like checking online for a solution – ya right, or closing the program. Luckily I have not lost any data…but this is really annoying and slowing down my work.

I fixed it by removing the “send to bluetooth” add-in for both programs. I would give you screen shots, but I did not just disable the add-in, I removed them.

Problem solved. So if you have these little “issues” with office apps “stopping” then try that….why would I want to send my multi-megabyte doc to some bluetooth device? Printing? Maybe, but not me.

Adelante.

Lync Install error

2011-04-03T16:33:00.001-07:00

While doing the “Prepare first Standard Edition Server” step, I ran into the following error…

SqlExpressRtc...installing...failure code –2068774911

this turned out to be fixed by going to:

HKEY_Local_Machine\System\CurrentControlSet\Control\Session Manager

and then delete the following key:

PendingFileRenameOperations

I then rebooted. I don’t know if that was required. But my problem was resolved and I was able to move forward. Kudos to Thomas Foreman for posting this in a forum.

Lync Server 2010 Resource Kit

2011-03-25T14:04:00.001-07:00

Gees, two edits in one day…

This is only the first three chapters…

On the Microsoft download site, we now have the Lync 2010 Server 2010 Resource Kit. This is the technical reference that is a companion to the product documentation.

Enjoy!

Symantec Endpoint Protection removal hell

2011-03-21T23:22:00.001-07:00

Update: I have stopped trying. I hang my head in abject defeat. I edited registry until my fingers bled….and all I accomplished was a network stack that refused to work. I tried, I really did. I followed instructions, I used the”approved” vendor-supplied tool, I read the blogs. Nada. At the end, I had the Teefer2 driver and service gone, with a NIC and driver that Win7 said it liked and enabled, but the firewall would not start because the Base Filtering Engine would not start because of a) lack of permissions, and b) having a wrong pw on the localservice account. Luckily, this is why the VM is so good for us. Eliminar la instancia de la imagen y seguir adelante.

I had to remove SEP 11 from a system. Oooops! First, I could not get it to go away. Had to get a removal tool. That took some judicious torrent work to find as I could not get Symantec non-help to give it to me….I did not have a license nor a support agreement nor the magic decoder ring…just a P2V image from which I was trying to remove SEP. C’mon folks… it is just a lab machine! I have all the approved licensing….except for this Symantec piece I was trying to remove so I could be legal….my mistake.

Adelante.

So CleanWipe did its’ thing. Sort of. It left me with a non-working network stack due to this Teefer2 driver that really does not want to go away. After many hours, literally, of Google, I stumbled upon some advice that led me to remove the hklm/system/currentcontrolset/enum/root/symc_teefer2mp key. At which point I was caught in a BFO….I think I know why these Symantec products are so hard to get rid of….

BTW, as background, in my reading over the last few hours, it is apparent that this teefer2 POS has a purpose in life redirecting traffic to SEP for scanning. My hypothesis is: in an effort to make sure that malware cannot circumvent SEP, the clever developers created registry keys that cannot be modified except by superhuman effort. OMG!

My right hand hurts from the mouse clicking that it takes to remove on sub-sub-sub key. But hey, it is only 0100 on a Monday night. WTF eh wot? People buy this on purpose?

See all that? Each and every key – and I have removed about 20 so far, require administrator explicit assignment for full control and seize ownership so as to enable deletion. EACH ONE. And under the GUID there is several more. Logged in with safe mode, as the machine administrator, not a member of administrators, and then have regedit run as administrator. Save me Mr. Wizard!

Updated Lync Server Virtualizaiton Guide

2011-03-10T07:40:00.001-08:00

Microsoft has updated their Lync Server 2010 virtualization guidance and best practice document. Get it here.

Lync Server 2010 Stress and Performance Tool

2011-03-10T07:36:00.000-08:00

The Lync Server 2010 Stress and Performance Tools (LSS) can be used to prepare, define and validate performance targets of user scenarios offered by on-premise Lync Server 2010 deployment. LSS includes multiple modules and can simulate simultaneous users on one or more Lync Servers. More detailed information can be found in the documentation provided within the installation package.

Get it here.

Lync Server Capacity Planner

2011-03-10T07:33:00.000-08:00

A nice capacity planner for Lync Server. Keep in mind that this is not a bible but it does represent a very solid starting point and you may find that the output meets your requirements as is. Get it here.

Deploy Lync 2010 Multi-Forest

2011-03-10T07:25:00.000-08:00

Published this month is a new guide on deploying Lync Server 2010 in a multiple forest environment. Get the doc here.

Lync User Training Materials

2011-03-10T07:16:00.000-08:00

I ran across this compendium of Lync User Training at VoipNorm...with a bit of re-edit, I am reposting here. Great stuff, thanks Chris!

Adoption and Training

Training PACK

Quick Start Guides

What's New Video's & Articles

Short Video's

Work Smart

Presence & IM Training

Voice & Video Training

Conferencing & Collaboration Training

Web App Training

Delegate Training

Attendant Training

Response Group Service Training

Update Rollup 3 for Exchange 2010 SP1 and Exchange 2007 SP3

2011-03-10T06:58:00.000-08:00

EHLO has announced the following updates for Exchange 2010 and Exchange 2007. See the details here.

Exchange 2010 SP1 UM & UCMAredist.msp

2011-02-24T14:10:00.001-08:00

I ran into a bizarre error today. The client has two full-up DAG servers – all roles on each server, including UM. We noticed that the UM role would not stay running. Checking the DR site revealed that the DR server had the exact same set of errors and the UM service would not stay running. The errors we were seeing are:

(application log, EID 1000, source “application error”)

Faulting application name: UMworkerprocess.exe, version: 14.1.218.11, time stamp: 0x4c5faa82
Faulting module name: Microsoft.Rtc.Internal.Media.dll, version: 3.5.6907.206, time stamp: 0x4c2c21fe
Exception code: 0xc0000005
Fault offset: 0x000000000019ccab
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13

(application log, EID 1430, source MSExchange Unified Messaging)

The Unified Messaging server shut down process umservice (PID=17732) because a fatal error occurred.

(application log, EID 1038, source MSExchange Unified Messaging

The Microsoft Exchange Unified Messaging service was unable to start. More information: "Microsoft.Exchange.UM.UMService.UMServiceException: The UM worker process exceeded the configured maximum number of consecutive crashes, "5".
   at Microsoft.Exchange.UM.UMService.WorkerProcessManager.RestartWorkerInstance(WorkerInstance workerInstance)
   at Microsoft.Exchange.UM.UMService.WorkerProcessManager.OnWorkerExited(WorkerInstance workerInstance, Boolean resetRequested, Boolean fatalError)
   at Microsoft.Exchange.UM.UMService.WorkerInstance.OnExited(Object sender, EventArgs e)
   at System.Diagnostics.Process.OnExited()
   at System.Diagnostics.Process.RaiseOnExited()
   at System.Threading._ThreadPoolWaitOrTimerCallback.WaitOrTimerCallback_Context_f(Object state)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading._ThreadPoolWaitOrTimerCallback.PerformWaitOrTimerCallback(Object state, Boolean timedOut)"

WFT?!

I could not find anything obvious, and a Google on these items turned up nothing substantive. I double-checked my install as-builts, verified that the proper prerequisite were met (desktop-experience, speechplatformruntime, ucmaruntimesteup). I also checked the remainder of the services to confirm that all other Exchange functions were as expected.

I went down the galgrammargenerator route to rule out corrupt grxml files. I stood up a naked E2010 in a lab, installed the UM role, grabbed the core grxml files and still the UM service would not start and stay running. I then removed the service and reinstalled, which did not help.

What DID work was that I remembered that the OCS to OWA integration required a ucmaredist.msp file…so I tried that. Voila!

Question to ponder: why did the lab server install and function properly without the ucmaredist.msp file? I built the lab server using the same sequence and files as the prod server so as to duplicate the error.

Lync 2010 DNS and certificate fun

2011-02-23T19:32:00.001-08:00

Maybe I am dense, and maybe I just did not know before this. Or maybe I forgot. No matter.

The scenario is multi-label domains inside of a single forest. And using one of them to log in, and having the SIP domain be something other than that login.

So, we have a forest/domain of domain.org, and another name on the same domain as second.com. We want the FQDN of the server (an SE in this case) to be on the certificate, but we also need to have the second domain listed as well; otherwise the client gets confused. We will ignore the other SAN entries in hopes of keeping this simple.

Our certificate looks like this:

CN= fqdn.domain.org, SAN=fqdn.domain.org,sip.second.com

We put the (we thought) proper DNS records in place: SRV and A records in each zone. Except that we had the second.com zone point the SRV to the A record in the zone for domain.org. Our logic was imperfect in expecting the client to accept the certificate because of the re-direct would end up with a cert that had a name that rooted in the SIP domain (sip.second.com). Ooops. Cert errors. You can click through them, or accept them forever, but that is clunky.

The proper method is to have a full _sipinternaltls._tcp.domain.org SRV record pointing to an A record for each affected domain, SIP or server. In our case the SIP domain SRV record pointed at the fqdn.domain.org server. While technically the names matched, root certs were in AD and chained properly, the client did not like not having a clean track. After all, the client started the session looking at username@second.com and got pointed to fqdn.domain.org. The bottom line is that the client expected to show up at a server that was, or at least reported itself as, somethingorother.second.com.

Simple?

Lync Server 2010 Virtualization White Paper

2011-02-21T13:57:00.001-08:00

Microsoft has revised their virtualization guidance for Lync 2010. Download the new white paper here.

Lync BPA

2011-02-21T07:43:00.001-08:00

The Lync Server 2010 Best Practices Analyzer is here.

Lync 2010 documentation

2011-02-15T16:33:00.001-08:00

http://technet.microsoft.com/en-us/library/gg398616.aspx has many updated Lync 2010 documents. From the basics to the byzantine. Enjoy.

Lync not searching GALContacts.db

2011-02-11T09:43:00.001-08:00

We all expect the Lync client to just give us the name of the contact right after we type in the first few letters of the contact name. But what happens when it does not? For some strange reason, yesterday, right after an initial deployment of the first pool server, the clients would not search the GAL. We patiently waited for the db file to arrive (overnight – it just worked out that way). Nothing. No galcontacts.db. We created the initial 10 users and ran update-csaddressbook. Nothing.

The really strange part is after a log off/login cycle – with a full client exit, we did get the galcontacts.db file along with the idx, but the client did NOTHING. Then it started just giving me the “A” list – which is the two builtins – Audio Test Service & Announcement Service – as shown…

But no real user. You could not even type in the full SIP URI and get the user. So I removed the db and idx file, logged back in, and then I could use the manual method. Put the db and idx back in place, the situation returned. Odd.

Long story short, there was something wrong with that galcontacts.db and galcontacts.db.idx pair. We forced a new gal download by removing the existing files, closing the client completely, and setting the client to ignore the gal download delay by setting the registry as shown…

reg add HKLM\Software\Policies\Microsoft\Communicator /v GalDownloadInitialDelay /t REG_DWORD /d 0 /f

After getting a new GAL, everything was fine.

Lync 2010 Visio Stencil

2011-02-10T10:48:00.001-08:00

For those folks who are into creating Visio diagrams of the topology, design, and architecture of Lync Server 2010, here is a squeaky new copy of the official vision stencil for Lync 2010.

Lync 2010 Planning Tool is here

2011-02-07T18:29:00.001-08:00

Finally! Woo hoo! Et Cetera! One of the nicest things for your Lync project is now in a final form.

clicketh here for the download

Greatness

2011-02-04T09:20:00.001-08:00

"Greatness lies in your ability to overcome."

Walter Irvin

‘nuff said

Uninstalling Lync 2010 Server

2011-01-27T20:08:00.000-08:00

I had to answer this question today… how to get rid of a POC environment that was living in a production AD DS? Ooopsie. Fail. The obvious stuff did not work, nor did reading the oh-so-helpful chm documentation.

Then I found this: http://terenceluk.blogspot.com/2011/01/step-by-step-instructions-for.html. Very nice. Worked. And also this:

http://ucmadeeasy.wordpress.com/2010/11/09/lync-server-2010-active-directory-references-and-how-to-remove-them/. Slick work!

and then there is this:

"bootstrapper.exe /scorch"

‘nuff said – use at your own discretion.

Lync Work Flows

2011-01-25T18:23:00.001-08:00

I work with some very talented people. One of our architects came up with the following layout that presents the Lync system and the business case for each piece with the connected and supporting technologies shown in perspective. This is some extremely nice work. Credit for the creation of this work of art-meet-techno-buzz goes to Paul Gurman. On his own no less!

Clicking on the graphic will take you to my SkyDrive so you can download the file. For those who wish to print this, have your full size paper and plotter handy. Remember that this is copyright protected material and belongs to Paul Gurman and Nexus IS.

move that sql database

2011-01-20T17:04:00.001-08:00

setup:

SQL 2005SP3 (I am told this should work on SQL2008 also but I have not confirmed)

detach the database from server 1

attach the database to server 2

recreate the user at the SQL level – then get denied because the user already exists inside the database. Ooops!

Flail. Repeat. LOL.

Seriously, for those of us who are not SQL admins, this stuff is a different language. Some cursory gooogly work revealed my total lack of sql syntax knowledge. A call to an SQL programmer-now-IT-Manager friend of mine gave me some good insight, and we (he) figured out the following fix.

use databasename
go
exec sp_change_users_login 'update_one', 'nameinsidedatabaseaccount', 'nameinsidesqlsecurityaccount'
go

New canned e2010 solutions

2011-01-13T17:58:00.001-08:00

EHLO has announced some new tested solution whitepapers. The one I looked at is pretty nice. See them here.

Time Management

2011-01-12T17:46:00.001-08:00

Got this today from my manager. I have seen it before, but had forgotten how true it is.

One day, an expert in time management was speaking to a group of business students and, to drive home a point, used an illustration those students will never forget. As he stood in front of the group of high-powered over-achievers he said, "Okay, time for a quiz" and he pulled out a one-gallon, wide-mouth mason jar and set it on the table in front of him. He also produced about a dozen fist-sized rocks and carefully placed them, one at a time, into the jar. When the jar was filled to the top and no more rocks would fit inside, he asked, "Is this jar full?"

Everyone in the class yelled, "Yes." The time management expert replied, "Really?"

He reached under the table and pulled out a bucket of pebbles. He dumped some pebbles in and shook the jar causing pieces of pebbles to work themselves down into the spaces between the big rocks. He then asked the group once more, "Is the jar full?"

By this time the class was on to him. "Probably not," one of them answered. "Good!" he replied. He reached under the table and brought out a bucket of sand. He started dumping the sand in the jar and it went into all of the spaces left between the rocks and the pebbles. Once more he asked the question, "Is this jar full?" "No!" the class shouted. Once again he said, "Good." Then he grabbed a pitcher of water and began to pour it in until the jar was filled to the brim.

Then he looked at the class and asked, "What is the point of this illustration?" One eager beaver raised his hand and said, "The point is, no matter how full your schedule is, if you try really hard you can always fit some more things in it!" "No," the speaker replied, "that's not the point.

The truth this illustration teaches us is, "If you don't put the big rocks in first, you'll never get them in at all.”

WS08R2 Standalone Root CA

2011-01-12T08:45:00.001-08:00

High level instructions for installing a Standalone CA

NOTE: If you have an Enterprise or Datacenter edition server, the preferred install will be an Enterprise Root. If you have only Standard Edition WS08R2 Server, then you are not able to install an Enterprise CA and you will have to do a Standalone Root CA.

Start with a Windows 2008 R2 server. I used a DC, but there are some who think that is an issue. You should choose what you think works best for your environment or what matches your security model. If you choose to do a Standalone RootCA, then you will need this entire document to include the CLI work at the end.

1. Open servermanager

2. Add roles

3. Choose Active directory certificate services

4. Say next on the Intro screen…

5. Select as shown here:

6. Choose appropriately here. I recommend the Enterprise, it really is easier. However, you can choose Standalone also.

7. Choose Root

8. Choose new key

9. Setup like this:

10. You can rearrange the name as appropriate… take note of it though!

11. I choose to use a LONG period of time… I don’t like to have to renew certs more than I have to…your security paradigm may require you to keep this figure below the default of five years.

12. Accept these defaults… you can change them if you wish…if you change them, be sure to document the change from the default.

13. The webserver setup is so that you can get certs if you are authorized. Exchange UM,OCS, Lync, SQL, and SharePoint come to mind.

14. Because I let the wizard choose for me, these options were filled in for me and will support what I need for the aforementioned applications.

15. Install

Total install time was less than 15 minutes.

16. If you chose to use a standalone edition, then you will need to publish the resulting trusted root cert into Active Directory…

Microsoft Windows computers and some devices are automatically configured with some well-known third-party root certificates. However, if you are using your own PKI, you need to install the root certificate. There are various ways to achieve this, including the following methods:

If you are using a Microsoft Enterprise root certification authority, the root certificate is automatically installed on computers in the forest, using Active Directory Domain Services.
If you are not using a Microsoft Enterprise root certification authority but want all computers in the forest to automatically trust the root certification authority, you can publish the root certificate in the Enterprise Trust Store, using Group Policy or the Certutil command.
If you not using a Microsoft Enterprise root certification authority and want only groups of computers in the forest to automatically trust the root certification authority, you can publish the root certificate to domains or organizational units (OUs) using Group Policy. Only computers that have the Group Policy applied will automatically trust the root certification authority. Add the root certificate to the Group Policy object Trusted Root Certification Authorities under the Public Key Policies folder for the Computer Configuration container.
If you are using Microsoft Certificate Services with Internet Information Services (IIS), you can request and install the root certificate with the Web enrollment service.
You can request and retrieve the certificate using the Microsoft Certreq command-line utility.
You can export the certificate to a file and import it if exporting the public key is enabled within the certificate.

17. To accomplish this using certutil.exe:

Run the following commands to register the digital certificate of the Standalone Root CA and its CRL in Active Directory:

certutil -f dspublish <CA_Cert_File_Name> RootCA and certutil – f -dspublish <CRL_File_Name>

The files <CA_Cert_File_Name> and <CRL_File_Name> are located in the folder %SystemRoot%\System32\CertSrv\CertEnroll

You don’t have to do the CRL but it does make things go smoothly when the host server starts looking for the CRL and can find it because you did publish it….

If you use a standard edition with Standalone Root CA, then you will need to do this command to allow the CA to issue SAN certs:

certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2

One additional thing you can do is to change the certificate issue period from the default 1 year to something a little more lengthy. Using regedit, goto:

HKLM\system\currentcontrolset\services\certsvc\configuration\<CAname> – where CAname is whatever you called the CA in the previous steps.

What you want to do is modify the “ValidityPeriodUnits” as shown here.

If you followed things all the way through, you have a Standalone RootCA, with a trusted root cert for a period of 20 years, the trusted root is published into your AD DS (along with the CRL), individual certificates can be SAN/UCC, and the issued certificates will be for a two-year period.

cert fun with e2010

2011-01-11T19:56:00.001-08:00

Why do I have to put up with this? Isn’t there something that should have progressed over the last 10 years or so that would remove this irritation from my life? This time it was this provider…but where does the error lie?

http://www.entrust.net/knowledge-base/technote.cfm?tn=8351

The kb fixed up the issue, but why did I have to fix it? This is a mainstream provider with a mainstream app on a mainstream system. To paraphrase the mavens of sports broadcasting, “C’mon man!”

Lync Server Admin Guide

2010-12-18T07:54:00.000-08:00

Get your copy now! Lync Server 2010 Deployment Administration Guide.

http://download.microsoft.com/download/A/0/C/A0C4F98C-DB2D-4235-AA11-155F2682A371/LS_Admin.doc

Pre-sales project information

2010-12-16T07:28:00.001-08:00

When you are in front of clients in the pre-sales mode, you need good, solid information that you can relate. And the information needs to come from reliable, quotable resources. This article on Forbes.com presents an initial analysis of a new McKinsey report on collaboration. I encourage you to track down the actual report so you dig out the nuggets that will help you be more successful. There is nothing in this particular article that is vendor specific; rather, the information is business related and gives quantifiable data points using common metrics. Perfect for creating credibility and focusing the discussion on business requirements and pain points.

Lync Project Elements

2010-12-06T17:14:00.001-08:00

Part of being a consultant in knowing what needs doing and what does not need doing – and this is per project. However, there is always the starting, generic list. What follows is an example of that list. The elements of this list represent those subject areas that need attention at some point in the Lync project. Each of these elements has between three and 10 more sub-elements. In some cases, the sub-elements have tertiary elements. If a task needs to be at the quaternary level, I consider it for a move or maybe that I need to move its’ parent up a level. This avoids the issue of having too many project levels and getting lost in the weeds during planning; or worse yet, overlooking a project task. Remember that not all of these will apply to each project you do. And this list can be easily modified to meet core Exchange projects also.

1. Conduct Requirements discover

2. Design Lync 2010 Server System

3. Specify Client Deployment

4. Build Host Servers

5. Train the Trainer

6. Install SQL 2008 as two-node cluster

7. Install and configure 2 Lync EE FE servers as pool

8. Migrate existing R2 pool and users and component functionality

9. Remove existing R2 system

10. Install and configure HLB devices

11. Install and configure Monitoring and Archiving Lync Server roles using VM

12. Create Hyper-V specifications

13. Modify DNS

14. Modify External DNS

15. Assist with Certificates (External)

16. Assist with Internal PKI

17. Firewall rules

18. Configure ISA/TMG RP

19. Install and Configure Lync Edge Server pool

20. Define IP (internal and external)

21. Install and configure media gateway

22. Assist with Avaya PBX changes

23. Install, configure, & test Exchange UM

24. Create Dial Plan

25. Implement Dial Plan

26. Project Management

Lync Server 2010 Documentation

2010-12-01T17:16:00.001-08:00

Just in case you cannot find these docs elsewhere (and also so I don’t forget myself) – here are a few links to Lync Server documentation:

Microsoft Lync Server 2010 Archiving Deployment Guide

Microsoft Lync Server 2010 Monitoring Deployment Guide

Microsoft Lync Server 2010 Documentation Help File

Migrating from Office Communications Server 2007 R2 to Lync Server 2010

Microsoft Lync Server 2010 Enterprise Edition Deployment Guide

Enabling Quality of Service with Microsoft Lync Server 2010

Microsoft Lync Server 2010 Enterprise Voice Deployment Guide

Microsoft Lync Server 2010 Response Group Deployment Guide

Microsoft Lync Server 2010 Standard Edition Deployment Guide

Microsoft Lync Server 2010 Device Management and Troubleshooting Guide

Microsoft Lync Server 2010 Edge Server Deployment Guide

Microsoft Lync Server 2010 Client and Device Deployment Guide

Microsoft Lync Server 2010 Active Directory Guide

Microsoft Lync Server 2010 Call Park Deployment Guide

Microsoft Lync Server 2010 Reference: Call Data Recording and Quality of Experience Database Schema

Microsoft Lync Server 2010 Supportability Guide

Microsoft Lync Server 2010 Announcement Deployment Guide

Microsoft Lync Server 2010 Group Chat Administration Guide

Microsoft Lync Server 2010 Group Chat Deployment Guide

Zen Excellence

2010-11-29T15:09:00.001-08:00

The master in the art of living makes little distinction between his work and play, his labor and his leisure, his mind and his body, his education and his religion.

He hardly knows which is which; he simply pursues his vision of excellence in whatever he does – leaving others to decide whether he is working or playing.

To him, he is always doing both.

I am psyched!

2010-11-22T09:45:00.001-08:00

I found out Friday that last July I was awarded MVP for Communications Server. Woo hoo!

I am totally wrapped around the axle on this!

quotes

2010-11-12T12:40:00.001-08:00

"Success consists of going from failure to failure without loss of enthusiasm."

Winston Churchill

No ringback in Lync

2010-11-05T18:27:00.001-07:00

I just did a deployment where the PSTN was a Nortel and we used an AudioCodes 1000 gateway. Everything worked out well until we noticed that outside calls coming through the Nortel got dead air until the Lync user either answered the call or Lync sent the call to voice mail.

Seeing as how Lync to Lync calls behaved properly, and tracing showed the proper SIP 180 responses, the obvious culprit was either the gateway or the Nortel. Turns out that in an AudioCodes gateway there is a setting for allowing ringback to leave the system and head for the PSTN!

Now, I am not a gateway guru, but don’t you think that would be a desired thing to have? Well, it is off by default. Flip it over a bit and voila! Ringback to PSTN.

Lync Server 2010 IIS 7 prerequisites

2010-11-02T20:50:00.001-07:00

IIS 7 webserver components for Lync FE

There are actually two ways do get this all done in one swoop. Using the GUI is good, but wouldn't you rather just do some cut n paste?
Note that there subtle differences here in the syntax although the individual feature add statements are the same.

For Server 2008 SP1 or SP2:

Open a command line (runas administrator). Then do the following (command will have wrapped):

servermanagercmd.exe -i web-common-http web-static-content web-http-errors web-http-redirect web-asp.net web-net-ext web-isapi-ext web-isapi-filter web-http-logging web-log-libraries web-http-tracing web-basic-auth web-windows-auth web-client-auth web-url-auth web-filtering web web-stat-compression web-mgmt-tools web-mgmt-console web-scripting-tools web-mgmt-compat web-metabase web-wmi web-lgcy-scripting web-lgcy-mgmt-console

For Server 2008 R2:

Open powershell (runas administrator), then do the following (again commands have wrapped here):

import-module servermanager

add-windowsfeature web-common-http, web-static-content, web-http-errors, web-http-redirect, web-asp-net, web-net-ext, web-isapi-ext, web-isapi-filter, web-http-logging, web-log-libraries, web-http-tracing, web-basic-auth, web-windows-auth, web-client-auth, web-url-auth, web-filtering, web-stat-compression, web-mgmt-tools, web-mgmt-console, web-scripting-tools, web-mgmt-compat, web-metabase, web-wmi, web-lgcy-scripting, web-lgcy-mgmt-console

Lync Server 2010 SE Install

2010-11-01T18:36:00.001-07:00

Now that we have the prerequisites installed, the CMS in place, the schema extended, and the topology built, here in part three we will continue through the SE install and take a first look at the Lync Control Panel.

To get started, return to the deployment wizard and select the “Install or Update Lync Server System.”

Notice that the first selection is to install the local configuration store. This is an important difference from OCS and the reason we needed to have the CMS installed and why we did the topology builder work. After that, the install proceeds very much like OCS, so I will not go into details. One note of importance: If you configured an element in topology builder, changes to the environment that involve that element will get changed in topology builder and re-published.

Note that at the end, the wizard shows you the powershell commands. Those who are seriously interested could reverse engineer these strings and do some serious learning. Moving on.

Now we are going to do the PKI for the SE. Remember the questions that were asked in the topology builder? Did you document your answers? Thankfully, if the answer is “no” you can simply open your topology builder and look. I am going to use a single name cert, and when the Reverse Proxy comes into being, I will redirect from public DNS name to internal fqdn. The Lync cert wizard is different from the OCS cert wizard, but nothing too weird.

Notice how the wizard wants a cert for each function. After clicking no NEXT no less than five times I get to actually define my cert. I use the KISS method.

After that some basic cert info like who what where etc. Then we get this gem straight from the topology builder! Nice! However, if you are not planning on doing the RP redirect thing, you better know which name there corresponds to which. Remember that we left those boxes checked? Lync is going to look at the topology build in the CMS, as replicated to the local configuration store, and assign the certificate as needed. We have one cert, so there will be no issues. But if you use three different certs you may need to track things a bit closer.

On this next screen, read and understand. For my purposes all my answers are no, AND I already have sip.tsoorad.net defined on my topology so that name was already included. For those who use those expensive public certs, adding yet another domain name might just bump you to a more expensive cert. For those who are doing internal certs, but have multiple sip domains that meet the listed items, you better be prepared to hit the necessary check boxes.

A few more default “next” clicks and the certreq gets pushed to my internal EntCA.

We have a cert. Leave the “assign this certificate…” box checked and the wizard will assign the certificate as needed. In our case, the FE, and both web sites (internal and external).

After a few more obligatory “next” clicks we are finished with the cert request and assignment.

Almost done! Start the services.

Now, let’s take a quick tour of the Lync Control Panel. This is a Silverlight app. It is really pretty nice. We won’t go into great levels of detail here. Remember that we added a user to the CSAdministrator group in a previous section? You will need that user or another user of that group to operate the LCP and expect to be able to change things.

How pretty. One stop shopping. Sorta. Remember that many of the functions that were previously included in the R2 MMC are now configured in the Topology Builder and you will not find those items here. Take a review of the categories on the left hand side.

Users – self explanatory

Topology – no IP, certificates or anything like that. But you can start/stop, view replication, view settings, etc. This is where you go to drain a server.

IM and Presence – URL and File filter.

Voice Routing – Dial Plan, Voice Policy, Routes, PSTN Usage, Trunks, and a rudimentary Voice Route helper. You can export and import configurations from here. But only for voice elements, not the entire system.

Voice Features – Call Park and Unassigned numbers

Response Groups – Workflows, Queues, Groups

Conferencing – Policy, Meeting Configuration, Dial in Access, PIN Policy

Clients – Policy, Policy, Policy. In Lync, there is no ADM or GPO. All things are done either by the client manually or by the admin with policies.

External User Access – pay attention here. Policy, Access Edge Configuration (yes, as in affect how the Edge Server(s) act, Federation control, PIC.

Monitoring and Archiving – CDR, QoE, Archiving Policy, Archiving Configuration

Security – remember the Kerberos, NTLM security settings? and how to auth to the web components? and the Conferencing PIN policy (again)

Network Configuration – don’t get excited, this is not the system configuration, but all things Call Admission Control.

We have now installed the basic SE front end and looked at the control panel. In our next installment we will install the edge.

Lync Server 2010 SE Install Part Two

2010-10-26T22:42:00.001-07:00

So here we are with the basic prerequisites installed and the Topology Builder done.

Before too much more time goes by, we need to get AD DS tools in place so we can do the schema work. You can use the server manager GUI; I prefer a command line:

servermanagercmd.exe –i rsat-adds

This will complain a bit about being deprecated in 2008 R2, but it will work just fine. After a reboot, we’ll extend the schema, build our topology, publish the topology and be ready for Part Three where we will (finally) install the Lync Server 2010 Standard Edition.

Once you have that done, choose the Prepare First Standard Edition Server. This will setup the Central Management Service. You need this, and you cannot skip this step.

At this time, let’s extend the schema.

With the open install wizard:

This selection will produce the following menu of choices. Work your way down from the top. If you read instructions, you will notice that Microsoft cleverly numbered the steps.

My screen scrolls, and there is a step 6 and step 7 hiding. Whatever you do, do not ignore step 7. Trust me.

Alright! Here we are ready to deploy…

…but first you need to build up your topology. Let’s take a quick look at the bare bones of SE with Edge. Because this is in a lab, the IP scheme is a little funny what with all three IP subnets being private scopes, the TMG Reverse Proxy appears to be hanging off my larger domain (it is), and all my PKI will be done with my lab Enterprise CA. I don’t intend to show how or why specific topology items are the way they are, just that those items need definition to achieve our goal of an SE, with and Edge and being ready for EV.

The organization – take a look at the simplified URL’s…yes yes yes!

The site – this is a new concept. Notice that the federation route is here.

The SE pool screen 1 – the normal stuff:

The SE pool screen2:

Observe the separation of server roles here. This is important to keep your perspective. While we are doing an SE, with all roles combined, this is clearly setup for separate servers doing separate things in a highly available, heavy-duty environment. Look at the very bottom where you can see the inclusion of the “branch site” – another key change to Lync Server 2010.

Finally, look at the edge configuration. This is where the inbound next hop goes, as well as the IP addressing, enabling federation, and the NAT selection. Keep in mind that all roles get NAT]’d in Lync Server 2010. To make changes after your system is deployed, you will be visiting the topology builder again.

OK, enough messing around. Let’s publish this bad boy and move forward with installing bits that make this come to life. Right click the organization, and from the resulting menu, first save a file copy for future reference and then choose publish.

Read through all the various requirements (remember the CMS we installed in part one?) and then click Next.

In our case, there is only one CMS, so this choice is obvious. In a real-world scenario, there might well be multiple SE or EE pools and choices of hosts for the CMS that might not be on your SE host. Click next to move on.

Here we are in the midst of the blessed event. The entire publishing process can take a bit for the first time. Subsequent publishing events go fairly quickly.

Notice how the last little piece includes enabling the topology.

We now have extended the schema, installed the CMS, worked up a topology and published the topology, so now we are ready to install the bits and make all this work. In part three we will do that and also take a look at the new control panel.

edited note: I changed the title removing the “RC” part as the code went RTM just yesterday. This series will continue ahead with RC code. I do not anticipate significant changes with the install or planning processes.

Lync Server 2010 Dialin Conferencing DMTF Controls

2010-10-08T18:54:00.001-07:00

Finally.

In Conference DTMF Controls

DTMF
Feature

*6 Mute or unmute your microphone *****YES*****

*4 Toggle audience mute

*7 Lock or unlock the conference

*9 Enable or disable announcements for participants entering and exiting the conference

*3 Privately play the name of each participant in the conference

*1 Play a description of the available DTMF commands

*8 Admit all participants currently in the lobby to the conference

The DTMF commands listed above may differ based on the configuration on the Organizer's site. To ensure accuracy, please click on the "Find a local number" link in the invite for your meeting.

RU1 to E2010 SP1

2010-10-07T10:58:00.001-07:00

Out quickly with rollup 1 to sp1 for e2010. Notice “they” did not (at least in print) fix the various sp1 upgrade/install issues that were widely encountered…

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=a371fa96-e85b-4a4f-8242-15d56595d0ec&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+MicrosoftDownloadCenter+%28Microsoft+Download+Center%29&utm_content=Google+Feedfetcher#tm

Lync Server 2010 RC SE Install

2010-09-24T22:50:00.001-07:00

edited 29 Oct 2010 for IIS prereq changes

This is Part One of installing a Lync Server 2010 Standard Edition Environment.

We’ll get the prerequisites into place for a 2008 R2 server, and do the install up to the Topology Builder.

In the next part, we’ll take a look at the Topology Builder and install the Central Management Service.

After that we’ll get an Edge going too. Maybe later, if I can swing some hardware, we’ll demo some voice.

-------------------------------------------------------------------------

Lync Server 2010 Standard Edition does not have a lot of existing documentation available in the help file, and I know many peeps want to have a guide for installing this most basic component of Lync Server 2010. Let’s jump right in!

I am using x64 Server 2008 R2 running in VMWare.

This means that my install is done, and I have run all existing updates from Microsoft Update onto my server and then rebooted it. I have joined my domain. I am using a gawd account (domain admin, enterprise admin, schema admin) so I don’t have any permissions to worry about. I have also cranked the UAC down to nothing. Hey, this is a lab box, and it is behind a TMG, and you ain’t getting to it. No worries here. YMMV.

Because of the R2, we have the following prerequisites that must be met to install Lync Server 2010:

IIS7 with the following components:

For Standard Edition servers and Front End Servers, and Directors, the Microsoft Lync Server 2010 installer creates virtual directories in IIS for the following purposes:

To enable users to download files from the Address Book Service
To enable clients to obtain updates (for example, Microsoft Lync 2010)
To enable conferencing
To enable users to download meeting content
To enable unified communications (UC) devices to connect to Device Update Service and obtain updates
To enable users to expand distribution groups
To enable phone conferencing
To enable response group features

Lync Server 2010 requires the following IIS modules to be installed:

Static Content
Default Document
HTTP Errors
ASP.NET
.NET Extensibility
Internet Server API (ISAPI) Extensions
ISAPI Filters
HTTP Logging
Logging Tools
Tracing
Windows Authentication
Request Filtering
Static Content Compression
IIS Management Console
IIS Management Scripts and Tools
Tracing
AnonymousAuthenticationModule
ClientCertificateMappingAuthenticationModule

There are actually two ways do get this all done in one swoop. Using the GUI is good, but wouldn't you rather just do some cut n paste?

For Server 2008 SP1 or SP2:

Open a command line (runas administrator). Then do the following (command will have wrapped):

servermanagercmd.exe -i web-common-http web-static-content web-http-errors web-http-redirect web-asp.net web-net-ext web-isapi-ext web-isapi-filter web-http-logging web-log-libraries web-http-tracing web-basic-auth web-windows-auth web-client-auth web-url-auth web-filtering web web-stat-compression web-mgmt-tools web-mgmt-console web-scripting-tools web-mgmt-compat web-metabase web-wmi web-lgcy-scripting web-lgcy-mgmt-console

For those Server 2008 R2 folks: open powershell (runas administrator), then do the following - again command have wrapped here:

import-module servermanager

add-windowsfeature web-common-http, web-static-content, web-http-errors, web-http-redirect, web-asp-net, web-net-ext, web-isapi-ext, web-isapi-filter, web-http-logging, web-log-libraries, web-http-tracing, web-basic-auth, web-windows-auth, web-client-auth, web-url-auth, web-filtering, web-stat-compression, web-mgmt-tools, web-mgmt-console, web-scripting-tools, web-mgmt-compat, web-metabase, web-wmi, web-lgcy-scripting, web-lgcy-mgmt-console

Note that there subtle differences here in the syntax although the individual feature add statements are the same.

In addition (no you are not done yet!)

IIS URL Rewrite module at http://go.microsoft.com/fwlink/linkid=197391

Important: If you are running Windows Server 2008 R2, you must install version 1.1 of the URL Rewrite module, available at http://go.microsoft.com/fwlink/?linkid=197394.

IIS Application Request Routing module at http://go.microsoft.com/fwlink/?linkid=197392

You will also need:

.NET Framework 3.5.1 (right from the Server 2008 R2 install)

MSMQ (you will want this so you can do monitoring and archiving)(again, right from the Server 2008 R2 install)

Telnet client (used for troubleshooting)

Go get:

If you are doing just Server 2008 SP2, you will need MS KB 968929, "Windows Management Framework (Windows PowerShell 2.0, WinRM 2.0, and BITS 4.0)," at http://go.microsoft.com/fwlink/?linkid=197390 - this is not needed for 2008 R2.

And, because we want to play with everything, we need Windows Media Format Runtime also… for R2, we have the following zippy command line: (and yes it wrapped)

%systemroot%\system32\dism.exe /online /add-package /packagepath:%windir%\servicing\Packages\Microsoft-Windows-Media-Format-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.mum /ignorecheck

For you 2008 SP2 fans, use this command: (wrapped)

%systemroot%\system32\pkgmgr.exe /quiet /ip /m:%windir%\servicing\Packages\Microsoft-Windows-Media-Format-Package~31bf3856ad364e35~amd64~~6.0.6001.18000.mum

My server wanted a reboot in the middle of all this because I ran the .NET updates into this also. You will want those, because there are several that fix some applications issues with Lync Server.

OK, so, we are pretty close! After doing all that, we execute the setup.exe found in the ISO under setup\amd64.

Say yes to the warning about The Microsoft Visual C++ 2008 redistributable being required to run Microsoft Lync Server 2010 communications software. If you install Lync Server 2010 by using the Lync Server Deployment Wizard, Setup prompts you to install this prerequisite, and it automatically installs it if it is not already installed on the computer. If you choose not to install it, Setup terminates. We don’t want that do we?

Now we are to this point:

Because I am in a lab VM, I take this and move on.

Accept the terms of the license agreement. If you don’t, you can’t install. Which brilliant lawyer figured that out?

After a couple of screen blinks, we get this:

Now, in R2, we’d blast ahead and prepare AD, but in Lync, we MUST have the topology builder. The topology builder is a great tool, does wonders for your success rate in deploying working solutions, and is needed later in your environment to make changes. Besides, Lync Server 2010 is not going to install if you don’t put the Topology Builder in place, and then export your complete plans first, so let’s just do it, OK?

Now, that wasn’t too bad?

This is what we get for our efforts…isn’t that pretty?

In our next installment, we’ll fire up the Topology Builder and get hot on installing our environment.

Exchange 2010 SP1 curiosity(ies)

2010-09-17T13:00:00.001-07:00

“(ies)” because there are mulitples.

I went to remove the default mailbox database from a new e2010 sp1 install today. In the midst of the fun, I noticed that I still could not remove the database from the EMC. I had previously moved the arbitration mailboxes and the discover assistant mailbox.

But still, I got this error:

But, turning to the EMS proved very fruitful.

Wazzup wid dat? How can the GUI not allow the removal, but powershell yank it right out. The GUI is just a shell of the CLI. So what gives?

Also, note that GUI talks about set-mailboxplan and get-mailboxplan. Neither of those commands exist on the copy of Exchange 2010 SP1 that is running on this server. Nice, eh?

Exchange 2010 public folder custom forms

2010-09-15T17:52:00.001-07:00

Kudos to Dustin Rush, NAC Architecture

We are in the midst of an e2003-e2010 migration, and the customer has a custom contact form in the organization forms library. Regular public folder replication created the requisite public folder structure on the e2010. The custom form sort of worked in that new items in the contact list used the custom form, that data was intact, but viewing existing contact cards in the public folder reverted to the OOBE view.

Various efforts at enforcing the custom form from Outlook proved fruitless.

Dashing Dustin found this tool (DocMessageClass) that allowed us to modify the object attribute for each of the contacts in the public folder. The process took very little time – maybe 3-4 minutes for 10k+ objects.

quotes

2010-09-14T09:45:00.001-07:00

Michael Jordan:

"I've failed over and over and over again in my life and that is why I succeed."

Lou Holtz:

"Life is ten percent what happens to you and ninety percent how you respond to it."

Spam spam spam spam

2010-09-12T13:08:00.001-07:00

The Nigerian spam scam is making its’ rounds again. I’ve been seeing this in filters for the last month or so. Here is the first paragraph of what I received today:

Compliments of the day Sir,

How are you doing? Please this email is in regards to a consignment abandon which has been confiscated in your likely details etc, as the real approved receiving beneficiary from African delivering Company. we are running a scan text on this item to know why dropped before we discovered that it is a high valued and personal allocation, cash money is the content for delivering in your personal and company's favour hence this email. I have a scan copy result of Dubai airport detecting machine and can prove it.

Just for an eyeball test, how many grammar errors can you find in this short cut? But, the scary part is not the bad grammar. The scary part is that this spam is showing up because somebody is saying “wow, my lucky day!” and actually responding to this and following through, and losing their money. This spam exists because if the numbers are big enough, even the 1/2 of one percent (or whatever the return is) is worth it to the originator.

Can people really be THAT stoopid?

Default Exchange 2010 RBAC groups

2010-09-01T22:40:00.001-07:00

I had to look this up the other day – and I did not think it was all that easy to figure, so I made up this little table so I could get my head around the DEFAULT RBAC groups. Keep in mind that the base recommendation is to create your own groups to match your specific requirements. This table illustrates the what comes OOBE and represents some great starting points for understanding what is going on under the hood with RBAC.

Built-in RBAC Group

Functionality

Default assigned roles

Default Members

Delegated Setup

Members of this management role group have permissions to install and uninstall Exchange on provisioned servers. This role group shouldn't be deleted.

View-Only Configuration

None

Discovery Management

Members of this management role group can perform searches of mailboxes in the Exchange organization for data that meets specific criteria.

Legal Hold

Mailbox Search

None

Help Desk

Members of this management role group can view and manage the configuration for individual recipients and view recipients in an Exchange organization. Members of this role group can only manage the configuration each user can manage on his or her own mailbox. Additional permissions can be added by assigning additional management roles to this role group.

User Options

View-Only Recipients

None

Hygiene Management

Members of this management role group can manage Exchange anti-spam features and grant permissions for antivirus products to integrate with Exchange.

Application Impersonation

Receive Connectors

Transport Agents

Transport Hygiene

View-Only Configuration

View-Only Recipients

FQDN of server

Public Folder Management

Members of this management role group can manage public folders. Members can create and delete public folders and manage public folder settings such as replicas, quotas, age limits, and permissions as well as mail-enable and mail-disable public folders.

Mail Enabled Public Folders

Public Folders

Exchange Public Folder Administrators

Recipient Management

Members of this management role group have rights to create, manage, and remove Exchange recipient objects in the Exchange organization.

Distribution Groups

Mail Enabled Public Folders

Mail Recipient Creation

Mail Recipients

Message Tracking

Migration

Move Mailboxes

Recipient Policies

Exchange Recipient Administrators

Records Management

Members of this management role group can configure compliance features such as retention policy tags, message classifications, transport rules, and more.

Audit Logs

Journaling

Message Tracking

Retention Management

Transport Rules

None

Server Management

Members of this management role group have permissions to manage all Exchange servers within the Exchange organization, but members don't have permissions to perform operations that have global impact in the Exchange organization.

Database Copies

Databases

Exchange Connectors

Exchange Server Certificates

Exchange Servers

Exchange Virtual Directories

Monitoring

POP3 And IMAP4 Protocols

Receive Connectors

Transport Queues

None

UM Management

Members of this management role group can manage Unified Messaging organization, server, and recipient configuration.

UM Mailboxes

UM Prompts

Unified Messaging

None

View-Only Organization Management

Members of this management role group can view recipient and configuration objects and their properties in the Exchange organization.

Monitoring

View-Only Configuration

View-Only Recipients

Exchange View-Only Administrators

Organization Management

Members of this management role group have permissions to manage Exchange objects and their properties in the Exchange organization. Members can also delegate role groups and management roles in the organization. This role group shouldn't be deleted.

Active Directory Permissions, Address List, Audit Logs, Cmdlet Extension Agents, Database Availability Groups, Database Copies, Databases, Disaster Recovery, Distribution Groups, Edge Subscriptions, E-Mail Address Policies, Exchange Connectors, Exchange Server Certificates, Exchange Servers, Exchange Virtual Directories, Federated Sharing, Information Rights Management, Journaling, Legal Hold, Mail Enabled Public Folders, Mail Recipient Creation, Mail Recipients, Mail Tips, Message Tracking, Migration, Monitoring, Move Mailboxes, Organization Client Access, Organization Configuration, Organization Transport Settings, POP3 And IMAP4 Protocols, Public Folder Replication, Public Folders, Receive Connectors, Recipient Policies, Remote and Accepted Domains, Retention Management, Role Management, Security Group Creation and Membership, Send Connectors, Transport Agents, Transport Hygiene, Transport Queues, Transport Rules, UM Mailboxes, UM Prompts, Unified Messaging, User Options, View-Only Configuration, View-Only Recipients

Exchange Organization Administrators

LM and OC password lockout

2010-08-19T14:04:00.001-07:00

A bit of trivia I discovered today. The OC client and the LM client are sort of linked at the hip. I backed into this via Outlook and the LM addin…because I got locked out of my office account while testing the client’s install. Something got bollixed up with the passwords…and here is what happened.

While doing some testing I had to change the login account on my OC. I noticed that when I did that, the LM client picked up the change. Nice!

But alas! the password in the LM client account setup remains as the previous login…

Naturally, this resulted in the account being locked out for password failure. So, while the LM did pick up the user name change, it bombed on the password.

Also, note that this is different depending on which way you work it…certainly not a two way street. In the first scenario, I changed the username from OC, and LM picked up the change but not the password. Going the other way is even worse; changing the username in LM only sent the sign-in name to OC client… the underlying verification stayed the same in both clients – and both were wrong. In addition, the LM had the password from the other account!

Let’s hope this get’s fixed in CS 2010 where the LM and OC are one client.

disable “Schedule a Conference Call” button in Outlook LM plugin

2010-08-19T12:38:00.001-07:00

I got asked today on how to do this. Being as clueless as I am, I started with a little research. Doggoned if I didn’t hit paydirt after only a few reads. This is good stuff, so I want to make sure that I don’t lose it.

See this article here for the original material – figures there would be a KB for this. I am reposting here for my own edification.

There is a registry entry that can be used to disable this button:

1. Locate and then click to select the following registry subkey:

HKEY_LOCAL_MACHINE\Software\Microsoft\Live Meeting\Addins

Note Use this subkey for x86-based systems. If you are running a x64-based system, locate and click the following subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Live Meeting\Addins

2. After you select the subkey that is specified in step 3, point to New on the Edit menu, and then click DWORD Value.

3. Type RemoveConferenceCall, and then press ENTER.

4. Right-click RemoveConferenceCall, and then click Modify.

5. In the Value data box, type 1, and then click OK.

6. On the File menu, click Exit to close Registry Editor.

Change the Value to 0 and the button will be available again.

A full list of livemeeting registry keys can be found here: http://technet.microsoft.com/en-us/library/dd637135(office.13).aspx

quote o’ da day

2010-07-29T14:58:00.001-07:00

"Giving money and power to government is like giving whiskey and car keys to teenage boys."

P.J. O’Rourke

Reveal hidden devices server 2008

2010-07-24T08:05:00.001-07:00

I do a lot of lab work. I use virtual images. I build the base image and then copy/move as needed. Recently, I took an entire lab build and needed to start it on a new VM host.

The first 2008 DC I started told me that I could not rename the NIC because “…a connection with the name specified already exists.”

Found this article here, which fixed me right up. The relevant portions are included for reference.

The following procedure will show no-longer-connected devices in Device Manager for Server 2008.

Open a command window with elevated privileges (Start -> Right-click "Command Prompt", select "Run as Administrator")

In the command window, execute the following commands:

SET DEVMGR_SHOW_NONPRESENT_DEVICES=1
START DEVMGMT.MSC

The second command starts the Device Manager. It MUST be started from the elevated-privilege command window for this procedure to work.

In Device Manager, click the VIEW menu item and select "Show hidden devices".

This should show any hidden devices. For network adapters, expand the network adapters node. Right-Click any device you wish to remove, and click Uninstall.

single cert for ocs/exchange

2010-07-21T12:57:00.001-07:00

this is a rewrite of previous post that got thrown away somehow…

Single certificate for OCS/Exchange firewall usage

Certificates can be complicated to understand, difficult to manage, and if you don’t have an internal PKI structure, downright expensive as you move forward with more and more dynamic applications that extend your Unified Communications to your remote users and business partners.

Internal certificates work wonders for your Active Directory Domain Services members. For Unified Communications, where OCS and Exchange are going to be using the same ISA 2006 server as the firewall, utilizing a Subject Alternative Name (SAN) certificate for your edge configuration and your ISA configuration can save you time, management hassles, and possibly provide cost savings as well. For internal servers, an internal PKI is just fine, but for the public interface of your system, you should most likely be looking at using a public-sourced key such as Go-Daddy, Thawte, DigiCert, etc. OCS Federation, remote users, and Public Instant Messaging Connectivity (PIC) demand public certificates. I know that I do not want to ship my internal CA root certificate to a slew of administrators and expect them to get that certificate into the correct spot for our systems to co-exist. But I digress.

The following table shows the SAN names needed on a certificate to support the base OCS and Exchange functions on ISA 2006/TMG/UAG – and I imagine that this certificate construction will work just fine on many other firewalls as well. The table comes from my test domain; you should replace my test domain with your own domain name.

Obtain a public SAN (UCC) certificate from your favorite provider; import the certificate into your OCS Edge server and your ISA server computer account Trusted Root Certificate store and then you can use one certificate for all these uses. This approach leaves you with only the one certificate to manage and renew, or, if life treats you badly, move to a new server.

	SAN Name (what URL?)	Usage	Notes
1	SIP.tsoorad.net	OCS Edge Server	IM, Presence, Federation, PIC
2	LM.tsoorad.net	OCS Edge Server	Web Conferencing
3	AV.tsoorad.net	OCS Edge Server	A/V
4	OCS.tsoorad.net	ISA Reverse Proxy	Web Components
5	CWA.tsoorad.net	ISA Web Listener	Communicator Web Access
6	DOWNLOAD.CWA.tsoorad.net	ISA Web Listener	Cname for CWA desktop sharing
7	AS.CWA.tsoorad.net	ISA Web Listener	Cname for CWA desktop sharing
8	MAIL.tsoorad.net	ISA publisher	Outlook Anywhere, EAS, OWA, POP, IMAP
9	AUTODISCOVER.tsoorad.net	ISA Web Listener	Autodiscover is used by outlook and OCS.

Evolution II

2010-07-14T09:19:00.001-07:00

For those that don't know about history...here is a
condensed version.

Humans originally existed as members of small bands of nomadic hunters/gatherers. They lived on deer in the mountains during the summer and would go to the coast and live on fish and lobster in the winter.

The two most important events in all of history were the invention of beer and the invention of the wheel. The wheel was invented to get man to the beer. These were the foundation of modern civilization and together were the catalyst for the
splitting of humanity into two distinct subgroups:

Liberals
Conservatives.

Once beer was discovered, it required grain and that was the beginning of agriculture. Neither the glass bottle nor aluminum can were invented yet, so while our early humans were sitting around waiting for them to be invented, they just stayed close to the brewery. That's how villages were formed.

Some men spent their days tracking and killing animals to BBQ at night while they were drinking beer. This was the beginning of what is known as the Conservative movement...

Other men who were weaker and less skilled at hunting learned
to live off the conservatives by showing up for the nightly BBQ's and doing the sewing, fetching, and hair dressing. This was the beginning of the Liberal movement.

Some of these liberal men eventually evolved into women. They
became known as girlie-men. Some noteworthy liberal achievements include the domestication of cats, the invention
of group therapy, group hugs, and the concept of Democratic
voting to decide how to divide the meat and beer that
conservatives provided.

Over the years conservatives came to be symbolized by the largest, most powerful land animal on earth, the elephant. Liberals are symbolized by the jackass for obvious reasons.

Modern liberals like imported beer (with lime added), but most prefer white wine or imported bottled water. They eat raw fish but like their beef well done. Sushi, tofu, and French food are standard liberal fare.. Another interesting evolutionary side note: most of their women have higher testosterone levels than their men. Most social workers, personal injury attorneys, journalists, dreamers in Hollywood and group therapists are liberals. Liberals invented the designated hitter rule because it wasn't fair to make the pitcher also bat.

Conservatives drink domestic beer, mostly Bud or Miller. They eat red meat and still provide for their women. Conservatives are big game hunters, rodeo cowboys, lumberjacks, construction workers, firemen, medical doctors, police officers, engineers, corporate executives, athletes, members of the military, airline pilots and generally anyone who works productively. Conservatives who own companies hire other conservatives who want to work for a living.

Liberals produce little or nothing. They like to govern the producers and decide what to do with the production. Liberals believe Europeans are more enlightened than Americans. That is why most of the liberals remained in Europe when conservatives were coming to America . They crept in after the Wild West was tamed and created a business of trying to get more for nothing.

Here ends today's lesson in world history.