Log Name: System
 Source: Schannel
 Date: 3/16/2016 16:16:16 PM
 Event ID: 36882
 Task Category: None
 Level: Error
 Keywords: 
 User: NETWORK SERVICE
 Computer: LyncSE-AE.tailspintoys.com
 Description:
 The certificate received from the remote server was issued by an untrusted certificate authority. Because of this, none of the data contained in the certificate can be validated. The SSL connection request has failed. The attached data contains the server certificate.
 

And you wonder which certificate is causing the issue and where is the elusive "attached data". To find out you can look at the certificate data by going to the Details Tab, select Friendly View and scroll down to the section "In Bytes", you can then see certificate details such as Subject Name in the data. For eg. there is an issue with the CA chain for the certificate presented by im.FourthCoffee.com in the following screenshot:

Alternatively, you can use any HEX converter and paste the data field from the XML View into it for viewing the data. 

You may run into these frequently if you do not update your servers regularly or if you do not install root certificate updates by Microsoft through Windows Update. The CAs can get their certificates published by Microsoft via “Windows Root Certificate Program”, you can find more information about this at https://social.technet.microsoft.com/wiki/contents/articles/2592.aspx.  As members of this program the CAs can get their Root Certs published via windows update (The updates also remove Root CA certs from time to time, for eg. DigiNotar was removed a few months ago Microsoft Security Advisory 2607712). 

This is the error that the users were getting:

Cannot perform this action, and the cause is unknown. Contact your system administrator to investigate this problem.

To  check what was happening, I looked at the configuration information on the client and figured out their Internal Distribution Group Expansion string. To do so, Ctrl+Right Click on the Communicator icon in the System tray and then click on Configuration Information. Distribution Group Expansion URLs are listed near the top as "DG URL Internal" and "DG URL External".

Since the problem was apparent on the internal network as well as external we started troubleshooting the internal issue first, the internal URL is of the following format : https://<Pool FQDN>/GroupExpansion/Int/service.asmx

To test we simply paste the URL in IE on the client machine and were prompted for password and then presented the DG expansion page, which is expected. I ensure that there were no proxies configured and the Validation Wizard on the server passed as well. Since there were no obvious problems, i decided to collect STRACE logs for Communicator.exe and analyze them using HTTPReplay.

STRACE log shows 401 (this why we get the prompt for password when using IE) followed by 500 errors from the server:

 POST /GroupExpansion/Int/service.asmx HTTP/1.1
 Accept: text/xml
 SOAPAction: "DistributionListExpander/ExpandDistributionList"
 Content-Type: text/xml; charset=utf-8
 User-Agent: Microsoft+Office+Communicator/2.0
 Host: ocspool-fkl.mmc.com
 Authorization: Negotiate TlRMTVNTUAADAAAAGAAYAHgAAAAYABgAkAAAAAYABgBIAAAADAAMAE4AAAAeAB4AWgAAAAAAAACoAAAAAAAIogUBKAoAAAAPTQBHAEQAZQBkAGEAaABlAHIAQQBVAFMAWQBEAAAAAQBMAFAAMQA2ADYANgAyAFoAmvOAYNdNMBcAAAAAAAAAAAAAAAAAAAAAMcimIYIFnCkyISDgYYY5cJQCU6AhuS+w
 Connection: Keep-Alive
 Cache-Control: no-cache
 Content-Length: 425
 --------------------------------------------------------------------------------
 <soap:Envelope xmlns:soap="https://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="https://www.w3.org/2001/XMLSchema" xmlns:soapenc="https://schemas.xmlsoap.org/soap/encoding/"><soap:Body><ExpandDistributionList xmlns="DistributionListExpander"><groupMailAddress>distributionlistmailaddress@tailspintoys.com</groupMailAddress></ExpandDistributionList></soap:Body></soap:Envelope>
 --------------------------------------------------------------------------------
 06:58:40:949 - Response length is 616 (238+378)
 --------------------------------------------------------------------------------
 HTTP/1.1 500 Internal Server Error
 Date: Tue, 19 Jun 2012 06:58:40 GMT
 Server: Microsoft-IIS/6.0
 X-Powered-By: ASP.NET
 X-AspNet-Version: 2.0.50727
 Cache-Control: private
 Content-Type: text/xml; charset=utf-8
 Content-Length: 378
 --------------------------------------------------------------------------------
 <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="https://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="https://www.w3.org/2001/XMLSchema"><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>a3b071b8-aba2-4a8f-9987-c674c99a5466</faultstring><detail /></soap:Fault></soap:Body></soap:Envelope> 
 --------------------------------------------------------------------------------

This clearly indicates a problem with the server, so we collected Logs on the server using OCS Logger and selected the component "Dlx" (Stands for DL eXpansion, ingenious!) with ALL Flags and I found the following:

 00001 TL_ERROR(TF_COMPONENT) [2]1668.3974::06/19/2012-07:24:10.526.02f72991 (Dlx,Service.GetSecurityDescriptorBinaryForm:99.idx(1095))ObjectSecurity property accessor failed: The binary form of an ACE object is invalid.
 00002 Parameter name: binaryForm at System.Security.AccessControl.GenericAce.CreateFromBinaryForm(Byte[] binaryForm, Int32 offset)
 00003 at System.Security.AccessControl.RawAcl.SetBinaryForm(Byte[] binaryForm, Int32 offset)
 00004 at System.Security.AccessControl.RawSecurityDescriptor..ctor(Byte[] binaryForm, Int32 offset)
 00005 at System.DirectoryServices.ActiveDirectorySecurity..ctor(Byte[] sdBinaryForm, SecurityMasks securityMask)
 00006 at System.DirectoryServices.DirectoryEntry.GetObjectSecurityFromCache()
 00007 at System.DirectoryServices.DirectoryEntry.get_ObjectSecurity()
 00008 at Microsoft.LiveServer.DLExpansion.Service.GetSecurityDescriptorBinaryForm(SearchResult group)
 00009 TL_ERROR(TF_COMPONENT) [2]1668.3974::06/19/2012-07:24:10.526.02f72992 (Dlx,Service.GetSecurityDescriptorBinaryForm:99.idx(1099))Security descriptor not found for : System.DirectoryServices.SearchResult
 00010 TL_ERROR(TF_COMPONENT) [3]1668.3974::06/19/2012-07:24:10.526.02f72a8e (Dlx,Service.TraceExtension.ProcessMessage:99.idx(2207))( 00D93EE2 )6411c44d-7394-4a6b-a724-9939702f00ba: 6411c44d-7394-4a6b-a724-9939702f00ba, stack trace: NULL
 

Did a quick search for  "ObjectSecurity property accessor failed: The binary form of an ACE object is invalid." and found https://support.microsoft.com/kb/928569/ which describes an issue with .Net framework 2.0. Installed the hotfix on the server and the issue got fixed!

"Triggering UR regenerate - function not available when RTCSRV service is not running. Start the RTCSRV service."

 I kept getting the above error even though  the OCS service (RTCSRV) was running!

This issue is caused due to missing SPNs in Active Directory which is used by the UR for authentication. To fix the issue we need to add a ServicePrincipalName to the Front-End server account in AD:

RestrictedKrbHost/PoolFQDN

 This can be done through ADSIEdit or through the command line setspn utility.

setspn -a RestrictedKrbHost/PoolFQDN <FEServerName>

 Once that is done, you should be able to run the command successfully:

The format of these entries is "XX:YYYYYYYYY", where XX defines the type of the policy and YYYY is a number denoting the specific policy applied for that user.

The values of XX based on my lab experiments are as following:

XX=0 - Default Policy
XX=1 - Conference Policy
XX=5 - Location Policy
XX=7 - Voice Policy
XX=9 - Dial plan policy
XX=11 - Client Version Policy
XX=13 - Client Policy
XX=15 - Archiving Policy
XX=19 - PIN Policy
XX=21 - External Access Policy

Each user has a default policy associated with their account, therefore msRTCSIP-UserPolicies for every user will have an entry of 0=<random number>.

If we use the table above to analyze Molly's account (screenshot below) we can figure out that the user Molly has a 'External Access Policy' and a 'Client policy' applied along with the default policy.

Why is this important? Or how can modifying this cause problems? I came across a case where the customer used a VBScript to update the External access policy for all users to "21=9" instead of using Lync Server Management Shell or Lync Server Control Panel. The logic of the script was to modify each Lync enabled user's msRTCSIP-UserPolicies to remove "21=8" and add "21=9". The problem was that some of the users had a different policy applied to them, policy with value  "21=4" and when the script ran it added "21=9" to those users account along with "21=4".  This left the user's account in an inconsistent state, where they had two policies assigned for controlling the same functionality (External User Access).

To test the theory in our labs, I just added another entry in the msRTCSIP-UserPolicies for External Access Policy when one already existed.

[The existing policy was 21=1 and I added 21=2 manually]

After adding a duplicate entry I attempted to sign-out from the already signed-in client the following error was logged:

Log Name:      Lync Server
Source:        LS Client Version Filter
Date:          8/25/2012 6:20:00 AM
Event ID:      41009
Task Category: (1041)
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      LyncSE-FE.tailspintoys.com

Description:
Exception occurred while processing request.

Method: UNKNOWN  Exception: An item with the same key has already been added.
Exception Type: System.ArgumentException
Stack Trace:
  at System.Collections.Generic.Dictionary`2.Insert(TKey key, TValue value, Boolean add)
  at Microsoft.Rtc.Management.ServiceConsumer.PolicyScopeContext.PolicyAssignments.Parse(String policyAssignmentData)
  at Microsoft.Rtc.Management.ServiceConsumer.PolicyScopeContext..ctor(String policyAssignments)
  at Microsoft.Rtc.Management.ServiceConsumer.PolicyReader.Read[T](String policyAssignmentData)
  at Microsoft.Rtc.ClientVersionFilter.ClientVersionFilter.OnRequest(Object sender, RequestReceivedEventArgs eventArgs)

Cause: Internal error.

Resolution:

Contact Microsoft Customer Service and Support.

Event Xml:

<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">
 <System>
   <Provider Name="LS Client Version Filter" />
   <EventID Qualifiers="33809">41009</EventID>
   <Level>3</Level>
   <Task>1041</Task>
   <Keywords>0x80000000000000</Keywords>
   <TimeCreated SystemTime="2012-08-25T06:20:00.000000000Z" />
   <EventRecordID>94037</EventRecordID>
   <Channel>Lync Server</Channel>
   <Computer>LyncSE-FE.tailspintoys.com</Computer>
   <Security />
 </System>
 <EventData>
   <Data>UNKNOWN</Data>
   <Data>An item with the same key has already been added.</Data>
   <Data>System.ArgumentException</Data>
   <Data>   at System.Collections.Generic.Dictionary`2.Insert(TKey key, TValue value, Boolean add)
 at Microsoft.Rtc.Management.ServiceConsumer.PolicyScopeContext.PolicyAssignments.Parse(String policyAssignmentData)
 at Microsoft.Rtc.Management.ServiceConsumer.PolicyScopeContext..ctor(String policyAssignments)
 at Microsoft.Rtc.Management.ServiceConsumer.PolicyReader.Read[T](String policyAssignmentData)
 at Microsoft.Rtc.ClientVersionFilter.ClientVersionFilter.OnRequest(Object sender, RequestReceivedEventArgs eventArgs)</Data>
</EventData>
</Event>

 Under these conditions if you try to sign-in again the client seems to take a lot of time at the following screen:

And eventually errors out with the following message:

After some time the client tries again and will keep on repeating the process. Each time it fails Event 41009 is logged. Collecting ClientVersionFilter/UserServices in the Lync Logging Tool does not reveal much information and the ClientVersionFilter log is blank.

In SipStack logs the server does not respond after the client sends the final REGISTER packet [tested TLS-DSK, Kerberos and NTLM auth]:

In network traces we see an Ack+RST from the server after some time(27 Secs in the screen shot below) indicating that the server closed down the connection from the client:

The Lync Control panel, unfortunately, does not show any problems with the user's account:

Customer reported that when they try moving the user to a legacy pool they get an error similar to "An item with the same key has already been added." as well. The resolution is to simply remove the extra/duplicate entry from the user account. Once the entry is removed the user will be able to sign-in again, no changes required.

 The entry which needs to be removed should be the one which was added manually, if the other entry is removed you will get an error similar to the following:

Add-WindowsFeature  MSMQ-Server,MSMQ-Directory,Web-Server,Web-Static-Content,Web-Default-Doc,Web-Scripting-Tools,Web-Windows-Auth,Web-Asp-Net,Web-Log-Libraries,Web-Http-Tracing,Web-Stat-Compression,Web-Default-Doc,Web-ISAPI-Ext,Web-ISAPI-Filter,Web-Http-Errors,Web-Http-Logging,Web-Net-Ext,Web-Client-Auth,Web-Filtering,Web-Mgmt-Console,Web-Asp-Net,Web-Dyn-Compression,Web-Mgmt-Console,Windows-Identity-Foundation,rsat-adds,telnet-client,net-wcf-http-activation45,net-wcf-msmq-activation45,Server-Media-Foundation

Please note, that if you are installing Lync Server 2013 on the new Windows Server 2012 (as you should be), you may run into problems with pre-requisites and get the following error:

Error: Prerequisite not satisfied: The following Internet Information Services (IIS) role services must be installed before attempting to install this product: Static Content, Default Document, HTTP Errors, ASP.NET, .NET Extensibility, Internet Server API (ISAPI) Extensions, 
ISAPI Filters, HTTP Logging, Logging Tools, Tracing, Client Certificate Mapping Authentication, Windows Authentication, Request Filtering, Static Content Compression, Dynamic Content Compression, IIS Management Console, IIS Management Scripts and Tools Prerequisite
 not satisfied: Before you install Microsoft Lync Server 2013, you must install Microsoft ASP.NET 4.5 by using the Add Roles and Features Wizard in Windows Server 2012 Server Manager. Install the ASP.NET 4.5 role service of the Web Server (IIS) role. Prerequisite not satisfied: 
Before you install Microsoft Lync Server 2013, you must install Microsoft Windows Communication Foundation Activation by using the Add Roles and Features Wizard in Windows Server 2012 Server Manager. Install WCF Services and HTTP Activation, which are included with 
the Microsoft .NET Framework 4.5 feature. Prerequisite not satisfied: You must install the Media Foundation feature or Desktop Experience feature of Windows before attempting to install this product.

▼ Details
└ Type: MultipleBlockingPrereqException
└ ▼ Stack Trace
└
at Microsoft.Rtc.Internal.Tools.Bootstrapper.BootstrapperTask.CheckAndInstallPrereqs()
at Microsoft.Rtc.Management.Internal.Utilities.LogWriter.InvokeAndLog(Action action)

Unfortunately, the error above does not indicate the real problem. You have to ensure that you have installed .NET 3.5 for the installer to succeed, you will need connectivity to the internet. If that is not possible please refer to the following MSDN article for installation steps: https://msdn.microsoft.com/en-us/library/hh848079%28v=vs.85%29.aspx.

 Hope this helps someone out there.

Tell me, I’ll forget
Show me, I’ll remember
Involve me, I’ll understand

This is a quick and dirty guide for setting up Lync Server 2013 Standard Edition FrontEnd in a lab environment using HyperV for test driving the new Lync Server 2013 preview and getting familiar with this early release. You should read the documentation available here for further information. This is NOT an official guide and is only meant for people who like to look at some screenshots and need a step-by-step document for familiarizing themselves with the process.

Installing Lync Server 2013 is fairly similar to setting up Lync Server 2010, the only major difference is that you now need some additional components to get things up and running. It’s almost as easy as 1, 2, 3 if you have worked on Lync Server 2010 before

STEP 1: Download the bits required for Lync Server 2013.

1. Download the Lync Server 2013 Preview ISO from https://technet.microsoft.com/en-US/evalcenter/hh973393

2. Download Windows Identity Foundation from https://www.microsoft.com/en-us/download/details.aspx?id=17331

3. Download  Power Shell V3.0 from https://www.microsoft.com/en-us/download/details.aspx?id=29939 (Windows6.1-KB2506143-x64.msu)

4. Download the new Silverlight client from https://go2.microsoft.com/fwlink/?LinkId=116053&v=5.0.61118.0

STEP 2: Setup the Infrastructure and pre-requisites.

1. Setup two Windows 2008 R2 SP1 virtual servers in HyperV and connect them via a virtual Network. We will use one server as AD, DC and CA, while the other server will be for running Lync Server 2013 Standard Edition. [We can add other feature roles as I explore the product further]

2. Configure hostnames and IP addresses on the server and ensure network connectivity. My lab configuration is as follows:

3. Install Active Directory and DNS on LS13-DC by running dcpromo. Also, install Certificate Authority [Install Enterprise root CA for simplicity].  Note: You should install IIS before installing CA in case you need Web Enrollment feature for generating certificates. Reboot the server once done.

4. Setup DNS records for automatic sign-in. See here for details.

5. On the Standard Edition Front-End server LS13-FE, join the recently created domain (contoso.com) and then install the following:

i. Install IIS by running the following command:

ServerManagerCmd.exe -Install Web-Server Web-Scripting-Tools Web-Windows-Auth Web-Asp-Net Web-Log-Libraries Web-Http-Tracing Web-Stat-Compression Web-Default-Doc Web-ISAPI-Ext Web-ISAPI-Filter Web-Http-Errors Web-Http-Logging Web-Net-Ext Web-Client-Auth Web-Filtering Web-Mgmt-Console, Web-Dyn-Compression

ii. Install Windows Identity Foundation downloaded earlier

iii. Install Power Shell V3.0 downloaded earlier

iv. Mount the Lync Server 2013 ISO and install .Net Framework 4.5 RC available in the Setup\amd64 directory

v. Install Desktop Experience and Message Queuing [with Directory Services Integration] using the Server Manager.

vi. Create a new Shared Folder on the server named LyncShared and give Administrators Ownership in the sharing and full control under security settings.

vii. Reboot the server

STEP 3: Installing Lync Server 2013 Standard Edition Front-End. [On LS13-FE]

1. Mount the ISO for Autorun or navigate to amd64 folder and launch Setup.exe

2. Install Visual C++ 11 runtime when prompted.

3. After this you will see a familiar screen prompting you to install Lync Core components on the server.

4. Click on install and read through all the legalese, click on Accept when you are done to begin the installation.

5. You will now see another familiar installation Wizard, however, note some of the things have changed:

6. Next, we will ‘Prepare Active Directory’ for installing Lync 2013. (make sure you are logged into the domain as a schema admin for this step). Run through Schema prep, forest prep and domain prep.

7. Click on Back once finished, since we only have one DC we do not have to verify replication. Now run "Prepare first Standard Edition server"

8. This step may take some time depending on your hardware config as the SQL Installation is processor intensive (Disabling AntiVirus real time scan may speed this step up a bit). Be patient, my lab machine has only one core and it is easy to max it out.

9. Next install Administrative tools on the server, this appears to have replaced the install Topology builder option.

This steps adds Lync Server Topology Builder and Control Panel (LSCP). Deployment wizard and Lync management shell are available even if not installing the Administrative tools.

10. Launch Topology Builder (Start > Program Files > Lync Server 2013 (preview) > Topology Builder) and chose to create a new topology when prompted.

11. Chose a SIP Domain, I will stick with contoso.com

12. I will not be adding any additional SIP domains at the moment so i  will skip the next step and define the first site as follows

13. We will be configuring the First Front-End server as well

14. Chose Standard Edition and specify the hostname of the FE.

15. I am going to install the following features (lots of changes here). The conferencing server feature needs an "Office Web Apps server" see this for more information.

16. I will be adding a PBX gateway later, so collocating Mediation server on the FrontEnd

17. Not adding an edge server at this point as I just want to get as much as possible with just two VMs

18. Since this is a SE, local SQL Server Express Edition will be used

19. Specify the folder we configured earlier.

20. Specify Web Services URLs

21. You should now see the topology builder, notice that there is no Action pane! We now see section for Lync Server 2010, Lync Server 2013 and Shared Components under the Site.

22.  Chose Publish Topology under Actions menu and then specify the local server as the Central Management Server

23. Publish the topology. While publishing it should create the Central Management store for you.

24. Once completed click on Finish and we are done with the topology builder for now.

25. Next we ‘Install or Update Lync Server System’

26. Install local configuration store

27. Retrieve the information from CMS and follow the wizard.

28. Next, we run ‘Setup or Remove Lync Server Components’ and follow the Wizard. See if you can spot the additional components being installed.

29. Now, we need to configure a new certificate for the Standard Edition server. Run Step 3

30. Select ‘Default Certificate’ and select Default Certificate and then click on ‘Request’

31. Just follow the wizard to get the following Subject Name and SAN entries.

32. Follow through the rest of the Wizard and then assign the certificate.

33. We now need to configure a certificate for oAuth TokenIssuer, for more information about oAuth see here

34. I will be using the FE certificate for oAuth as well, so just click on Assign. [You should create a new certificate using the wizard and assign that if you are going to test integration with SharePoint/Exchange in the same lab for oAuth to work]

35. Select the FE certificate issued earlier and follow the wizard

36. Now all that is left is to start the services.

37. If all goes well you will see that all your services should have started up.

38. You can now launch LSCP and enable a new user (you will need to the Silverlight plugin on the machine you are accessing the LSCP from). Don’t forget to add your administrator account to the CSAdministrators group in Active Directory.

RESOURCES

Lync Preview : https://lync.microsoft.com/en-us/Pages/Lync-2013-Preview.aspx

Introduction to Lync 2013 preview: https://technet.microsoft.com/en-us/library/gg398795(v=ocs.15).aspx

Download Lync Server 2013: https://technet.microsoft.com/en-US/evalcenter/hh973393

IIS Prerequisite : https://technet.microsoft.com/en-us/library/gg412871%28v=ocs.15%29

Installing Power Shell V3.0 : https://technet.microsoft.com/en-us/library/jj205328%28v=ocs.15%29

Office WebApps Server : https://technet.microsoft.com/en-us/library/jj204792%28v=ocs.15%29

oAuth in Lync 2013 : https://technet.microsoft.com/en-us/library/jj204817%28v=ocs.15%29
https://technet.microsoft.com/en-us/library/jj204817%28v=ocs.15%29https://technet.microsoft.com/en-us/library/jj204792%28v=ocs.15%29

NOTE: This post is based on my notes when installing Lync Server 2013 for the very first time, there may be many mistakes/missteps. Additionally, these steps are for the preview and they *may* change significantly by the time the product is actually released.

Lync Server 2010 Resource Kit: The Lync Server 2010 Resource Kit is the technical reference for the product. This book extends the product planning, deploying, and managing documentation in the Lync Technical Library. This book serves as a companion to the product documentation to learn how the product works under the hood.`

https://www.microsoft.com/download/en/details.aspx?displaylang=en&id=22644

Lync 2010 Protocol Workload Poster: This poster shows each workload in Microsoft Lync Server 2010 communications software, describing relationships, dependencies, flow of information, and certificate requirements.

https://www.microsoft.com/download/en/details.aspx?id=6797

Lync Server 2010 Videos : These short videos focus on specific tasks and show you how to accomplish them for Lync Server 2010.

https://technet.microsoft.com/en-us/lync/gg430649

Lync 2010 VHD Test Drive: This download comes as a pre-configured set of VHD's. This download enables you to fully evaluate Microsoft Lync Server 2010.

https://www.microsoft.com/download/en/details.aspx?id=26217

Lync Server 2010 Security Guide: The Security Guide provides guidelines for assessing and managing security risks to your Lync Server 2010 deployment.

https://www.microsoft.com/download/en/details.aspx?id=2729

SIP Processing Drilldown:

https://technet.microsoft.com/en-us/library/dd573021(office.13).aspx

Lync Devices :A list of Lync qualified devices categorized by IP Phones, Meeting Rooms, and USB. An image, description, and price estimate.

https://www.windowsphone.com/en-US/apps/bf994e06-9ed8-4e4f-ac84-bae87a69ec87

Lync Protocol and Ports : Windows Phone 7 app to quickly figure out the protocol and port that needs to be open between any of the possible communication paths in the LYNC environment.

https://wp7applist.com/en-US/app/27382/lyncprotocolports

Develop Enterprise Communication with Live Communications Server 2005 and SIP

https://msevents.microsoft.com/cui/eventdetail.aspx?eventID=1032269124&Culture=en-US

Lync CHM: An offline version of TechNet documentation for Lync available online.

https://www.microsoft.com/download/en/details.aspx?id=23888

Network Monitor 3.4 : Tool to allow capturing and protocol analysis of network traffic.

https://www.microsoft.com/download/en/details.aspx?displaylang=en&id=4865

Lync Network Monitor Parsers

https://nmparsers.codeplex.com/

https://www.microsoft.com/download/en/details.aspx?id=22440

The links above should help you get started, and if you are looking for more there is an excellent community resource available in the TechNet wiki here:

Lync 2010 Survival Guide:

https://social.technet.microsoft.com/wiki/contents/articles/7033.lync-server-2010-survival-guide.aspx

C:\Program Files\Microsoft Lync Server 2010\Deployment> bootstrapper /scorch

However that did not work and gave us the following error:

Installing OcsMcu.msi(ASMCU)...failure code 1603

Error returned while installing OcsMcu.msi(ASMCU), code 1603. Please consult log at C:\Users\<user>\AppData\Local\Temp\Add-OcsMcu.msi-ASMCU-[2012_02_19][XX_XX_XX].log

When we went through the Add-OcsMcu.msi-ASMCU-[2012_02_19][XX_XX_XX].log file we found the following :

Product: Microsoft Lync Server 2010, Conferencing Server -- Error 28009. One or more Microsoft Lync Server 2010, Conferencing Server services are still activated. Deactivate these services before removing the server or remove the server using Microsoft Lync Server 2010 Deployment Wizard or Bootstrapper instead.

We were trying different things when my customer commented that he has run this in his lab and the only change that he could see between lab and production was that we had stopped Lync and SQL services while backing up the details.

So we started all Lync & SQL services again and ran Bootstrapper /Scorch and it succeeded!

Hope this may be of help to  someone out there.

This blog entry is no longer updated, please see the Next Hop blog entry for updates released by Microsoft for Lync 2010. As always, you can always refer to the 'Lync Update Resource Center' located at https://technet.microsoft.com/en-us/lync/gg131945 to get the most current patches related to Lync 2010.

Similar to my earlier post about Communicator clients and release versions., this is a quick post with a list of all the Lync 2010 Client versions released till April 2013 :

In Lync 2010 we now have to use either the Lync Server Management Shell  or the web-based Lync Control Panel most of the administrators now have to use two different interfaces for creating users and enabling them for Lync. This is too cumbersome for many admins, especially in situations where almost everyone in an organization has to be enabled for Lync. I have received various requests for automating the process and I thought I will document it here for all. The idea is to schedule a task which will automatically Lync-enable any users in an OU who has not been enabled yet by running a PowerShell commandlet. Here is a quick and dirty way to get it ‘done’.

First we create the script which will enable the users for a specific OU, copy and paste the following two lines in a notepad and save it as “'C:\Program Files\Common Files\Microsoft Lync Server 2010\EnableUsersForLync.PS1” (you can chose any other suitable location):

import-module 'C:\Program Files\Common Files\Microsoft Lync Server 2010\Modules\Lync\Lync.psd1'
get-csaduser -filter {Enabled -ne $True} -OU "ou=Employees,dc=treyresearch,dc=net" | Enable-CsUser -RegistrarPool lyncpool.treyresearch.net -SipAddressType EmailAddress

Let’s break it down line-by-line (since there is just two of them, and I have time to kill), in the first-line we are basically importing the Lync Module into PowerShell, since the Module does not sit in the usual location for PS modules you have to specify the complete path to the file.

The second line is made up of two separate commands, the first part get-csaduser -filter {Enabled -ne $True} -OU "ou=Employees,dc=treyresearch,dc=net" is to search for all users in a particular OU who have note yet been enabled for Lync 2010, the second half enables that user for a particular Pool using Email-Address of the user as their SIP Address.

Now that we have a script, we need to make sure that we can run it on the server. To do so, you need to either “Sign” the script or disable script signing on the server, since this is a “get-it-done” post I chose the easy way by disabling script signing. Just head over to PowerShell and type in the following command:

Set-ExecutionPolicy RemoteSigned

Next, go to Task Scheduler ( Start > Run > taskschd.msc ) and “Create Basic Task…”

And assign a Name and Description and then click on Next.

Choose how often you would like to run the task and Click next (I chose a Daily task)

Choose when you would like to run the task and click on Next.

Select “Start a program” and then click on Next again

Browse to the powershell.exe on your system and provide the script created earlier as an argument (-File “C:\Program Files\Common Files\Microsoft Lync Server 2010\EnableUsersForLync.ps1”)

Click on Finish to complete the wizard.

Links:
Running PowerShell Scripts https://technet.microsoft.com/en-us/library/ee176949.aspx
Configuring Scheduled Tasks https://technet.microsoft.com/en-us/library/dd851678.aspx