Maximum Number of names in a SAN Extension

In what is sure to be a long standing record (of sorts) for me (and maybe only me) – I just submitted a CSR to a public provider with 53 domains in the SAN field.  This raised the question:  “how many entries or names can be in that one field?”  I know there has to be some sort of limit. 

Handy Dandy, we had a TMG guy in the room, so we asked him.  While he did not know off the top of his head, he did have an answer in mere minutes (where I had googled for about 10 and found squat).

http://social.technet.microsoft.com/wiki/contents/articles/3306.aspx

So, now we know the field is defined by a database, that a Windows PKI CA is limited to 4k of names, and that somewhere around 150 25 character domain names eat up just under 4k.  By extension, we can assume (and we know what that means) that the Public cert providers are following the same RFC and that they will have a similar limit.

How about that?  An answer to a question you did not know you had!

YMMV

Handy PowerShell Transcript concept

A co-worker of mine put up this blog entry today, I like it.  I too have closed the PowerShell window before I really wanted to.  I use the F7 key, and the up/down arrows, but there is nothing like a literal log, especially when it comes to working up specific elements of a complex (or even brute force) script.  My thanks to Mr. Jaworski to putting this together – his technique works  on every PS install I have tried it on (so far ).

I modified the instructions Scott lays out, because I don’t like having an unlimited growth file.  I also did not see the point, however well taken, to some of the preliminary setup.  So, I distilled down to one line:

start-transcript "c:\PS log $(get-date -f "yyyy-MM-dd HHmm").txt”

This simple one liner gets you this:

The resulting file looks like this:

Note that the date/time format is in something *I* like, so you might want to change that around a tad.  But all the nice details are there.

Of course, you will need to “stop-transcript” when you get done.

YMMV

Lync Server 2010 cmdlet help

Things like built-in help files tend to get overlooked. We often work around things; and I like to have a separate reference handy.  In the case of Lync, there is a mass of great information inside of the PowerShell command “get-help.”    However, the amount of data can be daunting.  For my own purposes, I extracted this data and massaged it a bit. There are 546 cmdlets – the Table of Contents runs 18 pages.   The word doc has a clickable contents section, and each cmdlet has a hyperlink to the online content from TechNet.

You can get the document here.

Here is a PDF also for us iPad users.

AdminSDHolder with Exchange and Lync

The adminsdholder function protects certain user accounts inside of AD.  However, that same protection also presents challenges when connecting users to mobile devices, migrating accounts from application system to a new version, or moving accounts to new locations (like upgrading from OCS R2 to Lync).
If you get “access denied” or “Insufficient rights” errors, then you may have bumped up against some built-in protections that are provided by the AdminSDholder AD DS function set.  Simply, every 20 minutes or so, this process goes through and resets rights and permissions on certain accounts in AD.  This will screw up Exchange and Lync migrations because users in specific groups stop inheriting perms from above (they are protected!).  Going in an twiddling one check box fixes the situation, but you need to know where and why.
After reading this excellent blog article by AD DS MVP John Policelli, try this.

Uh oh.  that blog article cannot be found no more!  Try this location instead:
https://technet.microsoft.com/en-us/magazine/2009.09.sdadminholder.aspx

First, make sure your ADUC is set to show advanced features:

Then, take a look at the account that is giving you the error:
locate the user object, select properties | security | advanced, and then tick the check box indicated by balloon #3.

I think that I have seen this issue at least once (literally) in every Lync, OCS, and Exchange project I have worked on in the last 10 years.  The best practice, of course, would never have one of those protected group members with an email account or Lync/OCS account, but we know that is not always practical or enforced.
YMMV.

CU3 for Lync and Lync Server

CU3 is out.  Not listed on the update resource center quite yet, but here they are:

Lync 2010 Hotfix KB 2571543 (64 bit)

Lync 2010 Hotfix KB 2571543 (32 bit)

Lync Server 2010 Hotfix KB 2493736

Lync 2010 Group Chat Hotfix KB 2500446

YMMV

Outlook Anywhere cannot be disabled

Onsite with a client and we are having issues with getting Exchange 2010 to enumerate CAS websites.

Here is the lovely error we got: 

-------------------------------------------------------

An IIS directory entry couldn't be created. The error message is The remote procedure call failed and did not execute.  . HResult = -2147023169 + CategoryInfo:NotInstalled: (servername\Rpc (Default Web Site):ADObjectId) [Get-OutlookAnywhere],

-------------------------------------------------------
Oh lovely.  Cannot enable, disable, or get anywhere with this.  Poked, prodded, googled, etc.  Nada.  Finally, in disgust, I believe what I am being told, to whit:

Action 'Disable Outlook Anywhere' could not be performed on object 'servername.'

Servername
Error:
The Outlook Anywhere feature has multiple configurations on servername.domain.com.

OK, so where does powershell get this data from?  AD.  So off we go to AD.  And what did I find hiding out:

CN=Rpc (Default WebSite),CN=HTTP,CN=Protocols,CN=servername, CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=ExchangeOrgName,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=com

??

Two, count ‘em TWO RPC definitions.  Yup, the server (and AD) thought there were multiple configurations.  I carefully deleted one, and restarted the server.  And now I get much better response in enumerating Exchange web sites/services.  And OA can be configured again.

How it got there I have zero idea.  Three other CAS servers in the Org are just fine.  This one was just fine until about 1750 on 28 June 2011 when it was modified (according to AD) both at the same time.  Some sort of hitch in the get-along as far as I can tell.

YMMV.

Lync to CUCM Step Through

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26800

The above link shows step-by-step configuration tasks to set up the Direct SIP connectivity between Cisco Unified Communications Manager (CUCM) and Lync Server 2010. These steps include configuration of the media bypass feature that optimizes media flow by allowing Lync endpoints to directly establish a media connection with a gateway or private branch exchange (PBX) without going through the Lync Server Mediation Server.