HishamB MSFT

Setting Location in Lync Client

HIshamBa — Wed, 25 May 2011 10:55:41 GMT

You can set the location of your Lync users automatically by binding the network subnets to your office locations using the following commands:

Set-CsLisSubnet -Subnet 192.168.0.0 -Description "Subnet 1" -Location MSFT -CompanyName "Litware" -HouseNumber 1234 -HouseNumberSuffix "" -PreDirectional "" -StreetName 163rd -StreetSuffix Ave -PostDirectional NE -City RIYADH -State RY -PostalCode 99123 -Country SA

Publish-csLisConfiguration

So when a user logs in to Lync client from this subnet: 192.168.0.0, his location will be set automatically to “Location City”

Lync Client on XP Machines

HIshamBa — Sun, 20 Mar 2011 02:16:13 GMT

Please note that if you install the Lync Server on Windows 2008 R2 and some of your clients are running the Lync client on Windows XP SP3. You need to set the following local policies on all your Lync Frontend/Edge Servers:

Make sure that the following values of the policies are set to "No Minimum."

- Network Security: Minimum session security for NTLM SSP based (including secure RPC)

- Network Security: Minimum session security for NTLM SSP based (including secure RPC) servers

Lync Client Policies

HIshamBa — Sun, 20 Mar 2011 02:10:07 GMT

Some of the Lync client settings that I deployed for some of my customers:

Settings	Value	Description
Disableemoticons	True	When set to True, users will not be able to send or receive emoticons in their instant messages; instead they will be see the text equivalent of those emoticons. For example, instead of seeing a graphical "smiley face" users will see the text equivalent: : ) When set to False users will be able to include emoticons in their instant messages, and to view emoticons in instant messages they receive.
EnableURL	False	When set to True, hyperlinks embedded in an instant message will be "clickable;" that is, users can click that link and their web browser will open to the specified location. When set to False, hyperlinks appear in instant messages as plain text. To navigate to the location, users will need to copy the link text and paste it into their web browser.
IMWarning	All Conversations are being monitored by ….	When configured, the specified message appears in the Conversation window each time a user takes part in an instant messaging session. For example, if IMWarning is set to "All information is the property of Litware Inc" then that message will appear in the Conversation window each time a user takes part in an instant messaging session

Settings	Value	Description
EnableIMAutoArchiving	True	When set to True, a transcript of every instant message session that a user takes part in will be saved to the Conversation History folder in Microsoft Outlook. When set to False, these transcripts will not be saved automatically. (However, users will have the option to manually save instant message transcripts.)
EnableCallLogAutoArchiving	True	When set to True, information about your incoming and outgoing phone calls is automatically saved to the Conversation History folder in Microsoft Outlook. (The actual call itself is not recorded. What is recorded is information such as who took part in the call; the length of the call; and whether this was an incoming or an outgoing call.) When set to False, this information is not saved to Outlook.

You can create a new client policy using (new-csclientpolicy http://technet.microsoft.com/en-us/library/gg425949.aspx ) the set the required settings using (set-csclientpolicy http://technet.microsoft.com/en-us/library/gg398300.aspx ) then assign the policy to the required Lync users from control panel

Removing the Public Folder Database in Exchange 2007

HIshamBa — Tue, 08 Feb 2011 02:58:34 GMT

In a mixed Exchange 2007 and Exchange 2010 Environment, after you move all your mailboxes and e-mail services to Exchange 2010 environment you will start decommissioning Exchange 2007 servers starting with the mailbox servers.

You can get an error while trying to delete the Exchange 2007 Public Folder database that it is a new version and cannot be deleted. To solve this issue you can run the following command from Exchange 2010 Management Shell:

Get-publicfolderdatabase –server (Exchange 2007 Mailbox Server) | remove-publicfolderdatabase

LYNC Client Settings

HIshamBa — Fri, 17 Dec 2010 01:53:00 GMT

I just want to share with you three different user/conferencing/telephony policies that you can have in LYNC similar to the meeting policies and group polices settings in OCS.

1- Conferencing Policies:

Like OCS Meeting Polices

To set it using PowerShell à http://technet.microsoft.com/en-us/library/gg425788.aspx

2- Client Policies:

Which let you control things like Emoticons and pictures. To set it use http://technet.microsoft.com/en-us/library/gg398300.aspx

3- Telephony Polices:

It is like Telephony mode in OCS Group Policy with limitations, you can set it in each user properties or use this PowerShell http://technet.microsoft.com/en-us/library/gg398510.aspx

For more information about this go to this URL http://technet.microsoft.com/en-us/library/gg398814.aspx

SCOM 2007 R2: report server cannot decrypt the symmetric key that is used to access sensitive or encrypted data in a report server database

HIshamBa — Sat, 06 Nov 2010 08:52:18 GMT

Currently I was deploying SCOM 2007 R2 reporting server component, the OS of the computer is Windows 2008 R2 and I used SQL 2008 SP1 reporting component on it. (follow this article to install SQL 2008 SP1 on Windows 2008 R2 à http://support.microsoft.com/kb/955392)

The SCOM RS installation did not complete successfully and I have the following error in the event viewer: report server cannot decrypt the symmetric key that is used to access sensitive or encrypted data in a report server database

The solution to this is to uninstall the SQL reporting service and installing it again and choose to run the reporting service under the SCOM DB Reader Account, then install SCOM 2007 R2 reporting component and it will work fine with you.

Difference between Exchange Databases Physical and Logical Corruption

HIshamBa — Sat, 02 Oct 2010 00:28:23 GMT

Physical corruption – when the database from an ESE structure is no longer valid in some way

Logical corruption – when the data within the database is no longer valid, but the structure from an ESE perspective is valid

Physical corruption cannot replicate. It’s simply not possible with Exchange replication process. Exchange performs a multi-step process to validate the healthiness of the log file prior to replay on the passive copies (in fact Exchange even validates a log file after it is closed on the source now in SP1).

Logical corruption can replicate. So how can do you deal with logical corruption?

· You can move the mailbox, thereby deleting the bad data. Useful, especially when logical corruption occurred outside the backup retention window.

· You can use single item recovery and restore the original item. Useful when editing message caused corruption (client app caused corruption scenario).

· You can use the Calendar Repair Assistant to detect and correct inconsistencies that occur for single and recurring meeting items for mailboxes homed on that Mailbox server so that recipients won't miss meeting announcements or have unreliable meeting information.

· You can use New-MailboxRepairRequest which can address corruptions with search folders, item counts, folder views, and parent/child folder issues.

· You can maintain an Exchange backup (VSS backup or lagged copy if backup retention window is between 0 and 14 days).

DNS Forwarders Problems in Windows 2008 R2 DNS Services

HIshamBa — Wed, 01 Sep 2010 22:46:11 GMT

One of my colleagues had this issue when he upgraded from Windows 2003 DC to Windows 2008 R2 DCs:

The DNS queries to other DNS servers configured as a Forwarders sometimes timeout on the Windows 2008 R2 DCs, although it never timed out on the Windows 2003 DCs on the same domain/network.

There was no connectivity issues at all, what we found out this problem happens because of the Extension Mechanisms for DNS (EDNS0) functionality that is supported in Windows Server 2008 R2 DNS and is enabled by default.

To disable it, you can run this command: dnscmd /config /EnableEDNSProbes 0

Some of the problems that you can have while doing FRS to DFSR Migration

HIshamBa — Fri, 27 Aug 2010 09:50:08 GMT

This is the official guide for FRS to DFS Replication Migration http://www.microsoft.com/downloads/details.aspx?familyid=A27008A8-4B28-49CC-80B5-05B867440AF9&displaylang=en

Some of the problems that you might have (for Windows 2008):

http://support.microsoft.com/kb/972105

This problem occurs because the Robocopy process that is used during the SYSVOL migration from the Prepared state to the Redirected state incorrectly sets a NULL System Access Control List (SACL) that propagates to all files. This changes the SHA-1 file hash that is used by DFSR for file comparison between servers and leads to the conflicts.

Typically, the conflict events occur when you run the DFSRMIG.EXE /SETGLOBALSTATE 2 command without first running the DFSRMIG.EXE /SETGLOBALSTATE 1 command.

However, the conflict events may occur when you use the typical steps:

DFSRMIG.EXE /SETGLOBALSTATE 1
DFSRMIG.EXE /SETGLOBALSTATE 2

The unnecessary replication of files, without conflict events, always occurs when the migration reaches the Redirected state.

http://support.microsoft.com/kb/967326

Consider the following scenario: You use the DFS Replication service migration tool (Dfsrmig.exe) to migrate the SYSVOL share from the File Replication Service (FRS) to the Distributed File System Replication (DFSR) service in a Windows Server 2008-based domain.

Some read-only domain controllers (RODCs) exist in this domain.

In this scenario, the Windows NT File Replication Service (NTFRS) subscriptions containers are not deleted on domain controllers in this domain after the migration process. This issue may cause large data loss if all of the following conditions are true:

Active Directory is removed from one of the domain controllers in this domain.

Active Directory is installed on this same domain controller in another domain.

In the new domain, you use the Dfsrmig.exe tool to migrate the SYSVOL share from the FRS to the DFSR replication service. In this case, two junctions point to the same target (%SYSTEMROOT%\Sysvol_dfsr\domain) after the migration.

If an administrator finds the redundancy that is triggered by this scenario and deletes the additional junction, all group policy objects and scripts in the new domain are deleted on all domain controllers after Active Directory service replication.

http://support.microsoft.com/kb/969688

Consider the following scenario: You use the DFS Replication service migration tool (Dfsrmig.exe) to migrate the Domain System Volume (SYSVOL share) on a computer that is running Windows Server 2008.

You try to migrate the SYSVOL share from the File Replication Service (FRS) to the Distributed File System Replication (DFSR) service.

A disjoint namespace is configured in the domain.

In this scenario, the SYSVOL share migration process fails.

Some of Windows 2008/2008 R2 Active Directory Upgrade Compatibility Issues

HIshamBa — Tue, 17 Aug 2010 01:29:12 GMT

Client computers may not work correctly when you add a Windows Server 2008-based domain controller to an existing pre-Windows Server 2008 domain http://support.microsoft.com/kb/946405:

This problem may occur if the security template files for the NoLMHash policy setting on the Windows Server 2008-based domain controller do not match the security template files for the NoLMHash policy setting on the pre-Windows Server 2008-based domain controllers.
When you perform a clean install of Windows Server 2008 and then install the Active Directory directory service on the computer, the security template files are changed to enable the NoLMHash policy.
If you add Windows Server 2008 as the domain controller to an existing domain by using the default domain policy, the NoLMHash policy of the existing domain controller is disabled. Additionally, the NoLMHash policy in Windows Server 2008 is enabled.

The Net Logon service on Windows Server 2008 and on Windows Server 2008 R2 domain controllers does not allow the use of older cryptography algorithms that are compatible with Windows NT 4.0 by default http://support.microsoft.com/kb/942564

This problem occurs because of the default behavior of the Allow cryptography algorithms compatible with Windows NT 4.0 policy on Windows Server 2008-based domain controllers. This policy is configured to prevent Windows operating systems and third-party clients from using weak cryptography algorithms to establish NETLOGON security channels to Windows Server 2008-based domain controllers.

You cannot remotely access encrypted files after you upgrade a Windows Server 2003 file server to Windows Server 2008 http://support.microsoft.com/kb/948690

This issue occurs because special user profiles are not migrated when a Windows file server is upgraded to Windows Server 2008. Therefore, when you try to access the encrypted files, the upgraded file server does not recognize the special profile. Then, the upgraded file server creates a new profile that has new EFS encryption keys. These new keys differ from the original keys. Therefore, you cannot access the previously encrypted files.
When a user encrypts a file that is stored on a Windows file server, the actual encryption of the file occurs on the file server. A special user profile is created on the Windows Server 2003-based file server. This special user profile is used to create and store your encrypting file system (EFS) encryption keys. Afterward, every time that a user accesses the encrypted files on the file server, this special profile is loaded on behalf of the user. The previously created encryption keys are used.

Description of the Outlook 2003 hotfix package (Engmui.msp, Olkintl.msp): February 24, 2009 http://support.microsoft.com/kb/968614

When Outlook 2003 is connected to a domain controller server or to a global catalog server that is running Windows Server 2003, you set a custom address list to be shown first in the Address Book dialog box.
However, if Outlook 2003 later connects with a domain controller or a global catalog server that is running Windows Server 2008, the address list that is shown first in the Address Book dialog box is switched back to the global address list (GAL) unexpectedly.

Note: This problem also occurs when Outlook 2003 first connects with a Windows Server 2008 domain controller or to a global catalog, and then later connects with Windows Server 2003 domain controller server or global catalog server.

Description of the Windows Server 2008 read-only domain controller compatibility pack for Windows Server 2003 clients and for Windows XP clients and for Windows Vista http://support.microsoft.com/kb/944043

You do not necessarily have to apply this update before you can deploy a read-only domain controller. Sometimes, compatibility issues do not affect your deployment. Or, you may be able to use a workaround instead of applying the update.