Skype for Business 2019 MACP stopped authenticating after installing update.

Question

I recently updated our working Skype for Business 2019 (standard install, single server, simple AD environment) to the Jun 2023 patch. Prior to this we were using the MACP interface without issue. After the update, we get errors when logging in that state "Error: insufficient permissions"

I've checked that the accounts used are still in the correct groups, and the Classic Silverlight control panel still works under the same account.

I used the CLSLogger, and extracted the authentication traces with Snooper, and I see this when i attempt to log in:

15:33:09:392 Start-Line: POST /WebTicket/WebTicketService.svc/Auth?isSIPInfoRequired=false
15:33:09:393 Start-Line: 200 OK
15:33:09:404 Start-Line: GET /OcsPsws/Service.svc/CommandDescriptions?$format=json
15:33:09:404 Start-Line: 500 Internal Server Error

There is a ton more data per entry, but those are the flags that I see. anyone else running into this before I attempt to get MS help involved and they tell me to move to teams over and over. No, I don't think I will. (Our business use requirement is on-prem servers.)

Answer 1

I found a solution that worked for me at least.

I was just taking shots in the dark after digging into this for a while. I decided to double check all the prerequisite Widows features and I had two that were missing.

BITS and Telnet-Client.

They are listed in the PowerShell command provided on the Microsoft support site for the update, but not in the originally listed prerequisites.

https://support.microsoft.com/en-us/topic/updates-for-skype-for-business-server-2019-kb4470124-890f4878-c6fe-f71b-c85f-db2acc284b94

I hope this works for you also.

Answer 2

I have a Skype for Business (SFB) Server 2019 in our environment, and I am using the Modern Admin Control Panel (MACP). Recently, I am experiencing login issues in MACP. The error indicates that the user has insufficient permissions for the admin user, even though the admin user has the necessary permissions and is a member of the CsAdministrator group. End users can log in and work smoothly, but the admin user cannot log in to MACP.

Additionally, I have noticed a scenario where the login functionality works immediately after restarting the server, but only for a few times. Below are the details of my SFB Server Service Updates (SU) and Cumulative Updates (CU):

CsServerVersion:

Skype for Business Server 2019 (7.0.2046.0): Volume license key installed.

CsServerPatchVersion:

ComponentName Version

---

Microsoft Unified Communications Managed API 6.0, Core Runtime 64-bit 7.0.2046.385

Skype for Business Server 2019, Administrative Tools 7.0.2046.524

Skype for Business Server 2019, Application Host 7.0.2046.123

Skype for Business Server 2019, Audio Test Service 7.0.2046.123

Skype for Business Server 2019, Centralized Logging Service Agent 7.0.2046.244

Skype for Business Server 2019, Conferencing Server 7.0.2046.244

Skype for Business Server 2019, Control Panel 7.0.2046.521

Skype for Business Server 2019, Core Components 7.0.2046.530

Skype for Business Server 2019, Core Management Server 7.0.2046.123

Skype for Business Server 2019, Emergency Mitigation Service 7.0.2046.521

Skype for Business Server 2019, Front End Server 7.0.2046.404

Skype for Business Server 2019, Performance Counter Cumulative Update 7.0.2046.123

Skype for Business Server 2019, Replica Replicator Agent 7.0.2046.123

Skype for Business Server 2019, Skype for Business Web Application 7.0.2046.530

Skype for Business Server 2019, Web Components Server 7.0.2046.524

Skype for Business Server 2019, Web Conferencing Server 7.0.2046.521

Note: Recently, I updated the Windows Server SU. However, I am still facing the issue even though I reverted back the SU for doubt. The issue persists till now.

Please suggest how I can solve this.

Answer 3

We had the same issue. With the help of Microsoft support, the issue was related to TLS. We had to apply thoses Pre-requisite registry keys : https://learn.microsoft.com/en-us/skypeforbusiness/manage/topology/disable-tls-1.0-1.1

(TLSPreReq.reg and TLSDisable.reg)