1. Trying to attach a file to an entity.

The spinner keeps spinning under Attachments section and cannot not find that attachment in Azure Storage.

2. A file can be attached, then when you go to the attachment section and try to retrieve it and you will see the below SQL Server error

3. Go to “Reports and Admin” on the Azure Attachment Storage and you might see the below error. 

Resolution

Make sure all the 3 Actions which are a part of the Attachment Management solution are activated.

Navigate to Settings->Customizations->Customize the System->Processes and activate Compressed Notes, EmailAttachmentData and ReportAndAdminData

]]> https://docs.microsoft.com/archive/blogs/niran_belliappa/error-when-updating-the-dynamics-crm-outlook-client-with-the-8-2-1-update Tue, 06 Feb 2018 04:50:37 GMT https://blogs.msdn.microsoft.com/niran_belliappa/?p=155 Issue: You will run into the below issue when you are try to push update 2.1 on CRM 2016 Outlook client

Error| Install exception.System.Exception: Action Microsoft.Crm.UpdateWrapper.InstallTelemetryServiceForCrmClient failed. ---> Microsoft.Crm.CrmException: Unable to Query service status.

Cause: This is known issue with the 2.1 update

Resolution: Install the 8.2.2 update from here https://www.microsoft.com/en-us/download/details.aspx?id=56131 ]]> https://docs.microsoft.com/archive/blogs/niran_belliappa/dynamics-crm-failed-to-delete-audit-data-from-one-or-more-of-the-specified-partitions Mon, 09 Oct 2017 14:56:27 GMT https://blogs.msdn.microsoft.com/niran_belliappa/?p=125 Issue

Exception information:

    Exception type: CrmException 

    Exception message: Failed  to delete audit data from one or more of the specified partitions.

The error in the event log is:

Failed to drop Partition  on AuditBase. Exception message ALTER TABLE SWITCH statement failed. There is no identical index in source table 'Orgname_MSCRM.dbo.AuditBase' for the index  'ndx_ObjectId' in target table 'Orgname_MSCRM.dbo.NonPartitionAuditTable' .

Cause

You will see this error if there is a mismatch in the structure of 'ndx_ObjectId'  index from what is shipped OOB. You will have to revert it back to the OOB structure for delete partition to succeed. 

The stored procedure creates a temporary non-partitioned table (to switch the oldest audit partition) with all OOB index schemas hard-coded. If there are any additional indexes added/ columns on existing indexes modified, the partition switching step will fail.

Solution

Disclaimer: Take a backup of your CRM databases before making any changes 

Script out the ndx_ObjectId index from the environment  and compare it to the index definition shipped OOB

CREATE  NONCLUSTERED INDEX [ndx_ObjectId]  ON [dbo].[AuditBase] 

( 

      [ObjectId]  ASC )WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, SORT_IN_TEMPDB = OFF, DROP_EXISTING = OFF, ONLINE = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) 

GO

Drop the Index and recreate it

Current key (KeyType : CrmWRPCTokenKey) is expired.  This can indicate that a key is not being regenerated correctly

This issue happens when there is an issue with async maintenance job service  causing key renewal to fail and to temporarily fix it async restart would work. As this cleanup had not happened in the past to remove incorrect records, it never got fixed permanently.

More details about this key

CRM ticket keys are automatically generated and renewed and then distributed, or deployed, to all computers running Microsoft Dynamics CRM or running a specific Microsoft Dynamics CRM Server role. These keys are regenerated periodically and, in turn, replace the previous keys. By default, key regeneration occurs every 24 hours.

Web remote procedure call (WRPC) token key: This key is used to generate a security token, which helps make sure that the request originated from the user who made the request. This security token decreases the likelihood of certain attacks, such as a cross-site request forgery (one-click) attack.

https://technet.microsoft.com/en-us/library/hh699824(v=crm.6).aspx

Resolution

Quick fix to this issue would be to add the IgnoreTokenCheck registry key so that this check do not happen. On the front end servers under HKLM\Software\Microsoft\MSCRM you can add a 32 bit DWORD “IgnoreTokenCheck”  and set it to 1.

To get to the root cause run the below script and see how many CrmWRPCTokenKey keys are listed.

use MSCRM_CONFIG

select * from CrmKey where keytype ='CrmWRPCTokenKey' order by CreatedOn

You might find expired keys which we can delete by running the below script.

Disclaimer: Take a backup of your CRM databases before making any changes.

--Script to clean up all CrmWRPCTokenKey entries that are no longer required

declare @MostRecentKeyId uniqueidentifier

declare @CurrentActiveKeyId uniqueidentifier

--Get most recent CrmWRPCTokenKey

set @MostRecentKeyId =

(select top 1 id from CrmKey

where KeyType = 'CrmWRPCTokenKey'

order by CreatedOn desc)

--Get the current ActiveKeyId

set @CurrentActiveKeyId =

(select ActiveKeyId from CrmKeySetting

where

ActiveKeyId <> '00000000-0000-0000-0000-000000000000'

and KeyType = 'CrmWRPCTokenKey'

and IsConfigurationRow = 0)

--Make sure the most recent CrmWRPCTokenKey = current ActiveKeyId

if @CurrentActiveKeyId <> @MostRecentKeyId

begin

update CrmKeySetting

set ActiveKeyId = @MostRecentKeyId

where KeyType = 'CrmWRPCTokenKey' and IsConfigurationRow = 0

end

--Delete CrmWRPCTokenKey entries that are no longer required

delete from CrmKeyProperties

where id in

(

select distinct ckp.id

from CrmKey ck

inner join CrmKeyProperties ckp

on ckp.Id = ck.id

and ck.KeyType = 'CrmWRPCTokenKey'

and ckp.id <> @MostRecentKeyId

)

delete from CrmKey

where KeyType = 'CrmWRPCTokenKey'

and id <> @MostRecentKeyId

Once you perform the cleanup on crmkey table, you can remove the IgnoreTokenCheck registry entries from CRM application servers and test it.

Hope this helps]]> https://docs.microsoft.com/archive/blogs/niran_belliappa/error-when-trying-to-configure-the-crm-2015-outlook-client Tue, 07 Jul 2015 11:30:35 GMT https://blogs.msdn.microsoft.com/niran_belliappa/2015/07/07/error-when-trying-to-configure-the-crm-2015-outlook-client/ Error: CrmSqlCeConnection::ExecuteInNewConnection() Unexpected Exception: System.ServiceModel.FaultException`1[Microsoft.Xrm.Sdk.OrganizationServiceFault]: Therre must be one and only one Organization record (Fault Detail is equal to Microsoft.Xrm.Sdk.OrganizationServiceFault).

Cause: This can be caused because of a duplicate Organization entry in the OrganizationBase table in the OrgDB
If you have imported an organization from within the same deployment this could happen.

Resolution:
Run the query to find out if there are more than 1 record on the OrgnizationBase table.
/* Replace Orgname with your Organization name */
Use Orgname_MSCRM
Select * from OrganizationBase

Ideally there should be only 1 row. We need to delete the incorrect one. Query the ConfigDB to find the right Organization ID for your CRM org.
SELECT [DatabaseName],[FriendlyName] ,[Id]  FROM [MSCRM_CONFIG].[dbo].[Organization]

Delete the unwanted record from the OrgnizationBase table in the CRM Organization database
/* Replace Orgname with your Organization name */
Use Orgname_MSCRM
Delete from Organizationbase where OrganizationId != 'Paste the correct OrganizationId here'

Disclaimer: Take a backup of your CRM databases before making any changes.

Cause:The user does not have the required permissions.

Solution: Provide Full Control permission for the user running the setup.

Full Control on the Reporting Group
Full Control on the PrivReporting Group
Full Control on the SQLAccess Group
Full Control on the PrivUser Group

Error: Check SqlServerAgentValidator : Failure: SQLSERVERAGENT (SQLSERVERAGENT) service is not running on the server

Cause: The user who is running Setup does not have local administrator permissions for the computer on which Microsoft SQL Server is running.

The SQLSERVERAGENT service is not running on the specified computer where SQL Server is running.

Solution:
Add user to the local Admin group on the SQL Server
Start SQL Agent service
Add the user in SQL Server and give sysadmin role

Microsoft Dynamics CRM 2013 Email Router hardware requirements

*Actual requirements and product functionality may vary based on your system configuration and operating system.

Microsoft Dynamics CRM 2013 Email Router software requirements

https://technet.microsoft.com/en-us/library/hh699689(v=crm.6).aspx 

Install the Email Router

1. Download the CRM 2013 Email router from here and run the Setup

2. On the Welcome to Microsoft Dynamics CRM 2013 Email Router setup page, select whether you want to update Email Router setup. We recommend that you click Get updates for Microsoft Dynamics CRM. Then, click Next

3. On the License Agreement page, review the information and if you accept the license agreement, click I accept this license agreement, and then click I Accept.

4. If required components are missing, the Install Required Components page appears. If this page does not appear, all required components are installed, and you can skip to the next step in the installation procedure

5. On the Select Router Components page, select either or both options, and then click Next.

6. On the Select Microsoft Update Preference page, select how you would like Install the updates.

7. On the Select Install Location page, either accept the Default file installation directory or Browse to indicate a different location, and then click Next.

8. The System Checks page appears. This page is a summary of all system requirements for a successful Email Router installation. Verification errors must be corrected before the installation can continue.

9. The Ready to Install page appears. Review the installation selections that you have made. Click Back to change your selections, or Install to install now.

10. After Email Router Setup is finished installing files, click Finish.

Configure the Email Router

1. Open the Email Router Configuration Manager

2. Create the Incoming Profile

a. Click Configuration Profiles and then click New.

b. In the E-mail Router Configuration Profile dialog box, type a profile name. For example, type Incoming Profile.

c. For Direction, select Incoming.

d. For E-mail Server Type, select ExchangeOnline.

e. For Location, you could either check AutoDiscover or you could type the Exchange Web Services URL.

https://outlook.office365.com/EWS/Exchange.asmx

f. Under Access Credentials, notice that the only option is Other Specified.

For User Name and Password, enter the credentials that the E-mail Router will use to retrieve e-mail messages from the Exchange Online mailbox to which this profile is mapped. The credentials can be either those of the Exchange Online mailbox or those of the Exchange Online tenant administrator. Enter the user name in the username@fulldomain format.

3. Create the Outgoing Profile.

a. Click Configuration Profiles and then click New.

b. In the E-mail Router Configuration Profile dialog box, type a profile name. For example, type Outgoing Profile.

c. For Direction, select Outgoing.

d. For E-mail Server Type, select ExchangeOnline.

e. For Location, you could either check AutoDiscover or you could type the Exchange Web Services URL.

https://outlook.office365.com/EWS/Exchange.asmx

f. The value for Access Credentials is automatically set to Other Specified

g. Select the User Type. Your choices are User and Administrator.

Select User if you want the E-mail Router to connect to the Exchange Online mailbox of the user whose mail it will route. The E-mail Router will authenticate by using that user’s e-mail address, which it obtains from the Primary E-mail field of the user record that is stored in Dynamics CRM.

Select Administrator if you want to use a single set of credentials to process multiple mailboxes, or if you want to provide a different set of e-mail credentials to process individual mailboxes. If you select Administrator, the E-mail Router will use the specified credentials to connect to any mailbox within the Exchange Online tenant to send e-mail messages.

h. If you select Administrator as the user type, select either Delegate Access or Send as permission as the access type.

Delegate Access causes e-mail to be sent as "Send on behalf of" messages.

Send as permission causes e-mail to be sent as "Send As" messages.

i. Save the configuration profile by clicking Publish

4. Configure the Microsoft Dynamics CRM deployment

a. Click the Deployments tab.

b. Click New to create a new deployment.

c. Make sure that the Deployment option is set to Microsoft Dynamics CRM Online.

d. For Microsoft Dynamics CRM Server, type the URL address of Microsoft Dynamics CRM Online. This could vary depending upon the region of the world in which you are located.

North America- https://disco.crm.dynamics.com/OrgnanizationName

EMEA - https://disco.crm4.dynamics.com/OrgnanizationName

APAC - https://disco.crm5.dynamics.com/OrgnanizationName

To find out the OrgnizationName in CRM Online you can navigate to Settings and expand Customization. On the Customization page, click Developer Resources. The OrganizationName is displayed below the Organization Unique Name label.

e. Notice that Other Specified is automatically specified for Access Credentials.

f. For Incoming configuration profile, select the incoming profile that you created

g. For Outgoing configuration profile, select the outgoing profile that you created

5. Set e-mail access type to E-mail Router in Microsoft Dynamics CRM

Before users can send and receive e-mail by using the Microsoft Dynamics CRM E-mail Router, you must configure each user for this functionality.

a. Click Settings, click Administration, and then click Users.

b. Double-click the user’s name to open the user record.

c. Select Server- Side Synchronization or E-mail Router in the Incoming and the Outgoing Email Delivery Method.

6. Test and publish the new profiles and deployment

a. Click the Users, Queues, and Forward Mailboxes tab.

b. Under Select a CRM Deployment to view users and mailboxes, select the deployment that you created.

c. Click Load Data. This displays the Microsoft Dynamics CRM users who are configured to use the E-mail Router.

If an error appears when you click Load Data, verify that the correct organization name is listed under Select a CRM Deployment to view users and mailboxes.

Clicking Load Data displays only users with approved e-mail addresses, regardless of the e-mail settings of those users.

7. Click Test Access. The E-mail Router Configuration Manager performs tests on selected users for both the incoming and the outgoing profile. A successful test displays a "Succeeded" message in green text.

Click Publish

Hope this is useful.

This blog shows you the steps you have to perform to Upgrade from CRM 2011 to CRM 2013

Warning: Following these steps may cause significant application downtime if issues occur during the upgrade. Instead of using an upgrade option that may affect the production deployment, we recommend that you migrate your deployment to Microsoft Dynamics CRM 2013.

Note: We strongly recommend that you back up your existing Microsoft Dynamics CRM data, including all reports and customizations, before you run Setup.

Complete a full backup of all production configuration and organization databases and transaction logs.

Only Microsoft Dynamics CRM 2011 Update Rollup 6 (version 05.00.9690.1992) or Microsoft Dynamics CRM 2011 Update Rollup 14 or later update rollup versions can be upgraded to Microsoft Dynamics CRM 2013.

The user who is running Microsoft Dynamics CRM Server Setup to upgrade an existing Microsoft Dynamics CRM deployment must be a member of the Deployment Administrators group. Additionally, the user must have db_owner permission on the Microsoft Dynamics CRM 2011 databases and have sysadmin permission on the SQL Server.

Tasks to perform before the upgrade

· We recommend that you apply the latest Microsoft Dynamics CRM 2011 updates and hotfixes before you start the upgrade.

. Check if the current customizations will be compatible with Dynamics CRM 2013. You can use the Legacy Feature check and Custom Code Validation Tool to do that. https://blogs.msdn.com/b/crmindia/archive/2013/09/20/legacy-feature-check-and-custom-code-validation-tool-demos-for-upgrade-to-crm-2013.aspx 

· Meet all requirements as specified under Microsoft Dynamics CRM Server 2013 hardware requirements and Microsoft Dynamics CRM Server 2013 software requirements in the Planning Guide.

· Log on to your domain as a user who has administrator-level permission.

· SQL Server replication isn’t supported with Microsoft Dynamics CRM. If you run SQL Server replication, disable it.

· Make sure that the Microsoft Dynamics CRM server that you’re upgrading is connected to the Internet. If you don’t have Internet access on that server, see KB article: How to obtain the setup updates for Microsoft Dynamics CRM 2013.

· Uninstall Microsoft Dynamics CRM Connector for SQL Server Reporting Services if it’s installed on the same computer where Microsoft Dynamics CRM Server 2011 is installed.

Run the upgrade

1. In the folder where the Microsoft Dynamics CRM files are located, go to the Server\amd64 folder, and then double-click SetupServer.exe.

2. On the Welcome to Microsoft Dynamics CRM Server 2013 Setup page, we recommend that you select Get updates for Microsoft Dynamics CRM, to make sure that Setup has the most recent installation files. Click Next. After Setup is done checking for updates, click Next again.

3. On the Product Key Information page, type your product key in the Product key boxes, and then click Next.

4. On the License Agreement page, review the information and if you accept the license agreement, click I accept this license agreement, and then click I Accept.

5. If Setup detects that components are missing, the Install Required Components page appears.

· If you have already installed the required components, this page won’t appear.

· If you haven’t installed the required components listed, you can install them now. Click or tap Install. When the components are installed, the status column changes from Not Installed to Installed, and you can click Next to continue.

If you’re prompted to restart the computer, do so, and then start Setup again.

6. On the Upgrade to Microsoft Dynamics CRM 2013 page, you can select an organization to upgrade or leave the choice <None> so that no organizations will be upgraded during Setup. Before you select an organization, consider the following:

· By default, during an organization upgrade, every base and extension table will become merged. For large organization databases that are highly customized the merging may take several hours to complete. For more information, see Run the base and extension table merge as a separate operation.

· New indexes will be added during organization upgrade, which can potentially overwrite existing custom indexes or indexes added by installing a solution. For more information, see Upgrade issues and considerations.

· Notice that any organization not upgraded will become disabled after the upgrade is complete. To upgrade organizations, use Deployment Manager.

Click Next to upgrade Microsoft Dynamics CRM.

7. On the Specify Service Accounts page, Setup will add the service accounts used for the Microsoft Dynamics CRM Server 2011 services. You can use the existing service accounts or specify new ones. Additionally, there are two new service accounts for the VSS Writer Service and the Monitoring Service that you must specify.

8. On the Specify E-mail Router Settings page, in the Email Router server name box, type the name of the computer where the Email Router will be installed. This computer will route Microsoft Dynamics CRM email messages. If you will not use the Email Router you can leave this box blank. However, to use the Email Router you must add the computer where the Email Router Service is running (part of the Asynchronous Service) when you use Network Service, or if you use a domain user account, the account to the PrivUserGroup security group. Click Next.

9. If you aren’t using Microsoft Update, on the Select Microsoft Update Preference page, you must select either of the following options.

· Use Microsoft Update when I check for updates (recommended). By selecting this option, Microsoft Dynamics CRM Server 2013 will use the Microsoft Update settings on the computer.

· I don’t want to use Microsoft update. You should only select this option if the computer uses another method to install updates such as by using Windows Update Services.

10. The System Checks page appears. This page is a summary of all requirements and recommendations for a successful installation. Errors must be resolved before installation can continue. If no errors, or only warnings appear, you can continue with the installation. To do this, click Next.

11. The Service Disruption Warning page appears. This page lists all services that will be stopped or restarted during Setup.

12. Review the Ready to Upgrade the Application page, and click Back to correct any errors. When you are ready to continue, click Upgrade.

When Setup completes successfully, the Microsoft Dynamics CRM Server Setup completed page appears. If the Reporting Server instance that you specified during this Setup points to the local computer where Microsoft Dynamics CRM is installed, Setup provides an option to invoke Microsoft Dynamics CRM Reporting Extensions Setup.

13. For a full server deployment running on the Microsoft SQL Server Reporting Services computer, select the Launch Microsoft Dynamics CRM Reporting Extensions Setup check box to install Microsoft Dynamics CRM Reporting Extensions. Click  Finish.

14. Welcome to Microsoft Dynamics CRM Reporting Extensions Setup

Select whether you want to update Microsoft Dynamics CRM Server Setup. We recommend that, if updates are available, you let Setup download the latest version.

To do this, click Get updates for Microsoft Dynamics CRM, wait until the update process is complete, and then click Next

15. Review the information and, if you accept the license agreement, click I accept this license agreement, and then click I Accept.

16. If you are using the default instance of the SQL Server, enter the name of the computer that is running SQL Server and contains the Microsoft Dynamics CRM configuration database that is named MSCRM_CONFIG, and then click Next.

17. Select a Microsoft SQL Server Reporting Services instance that will be used for Microsoft Dynamics CRM reporting, and then click Next.

18. Click Browse, and select a path where you want to install CRM Reporting Extensions, and then click Next.

19. This page is a summary of the requirements for a successful CRM Reporting Extensions installation. Errors must be corrected before installation can continue. All errors must be resolved. If no errors or only warnings appear, you can continue with the installation. To do this, click Next

20. This page lists all services that will be stopped or restarted during Setup

21. Review this page, and then click Back to correct any errors. When you are ready to continue, click Install.

22. Click Finish

At step 6 if you had left the choice to <None> so that no organizations will be upgraded during Setup and you want to manually upgrade each organization  you can do it through the deployment manager using the Upgrade Organization Wizard

In this blog I will walk you through the steps you have to follow to setup CRM 2013 in a NLB mode.

My Infrastructure Details

Before you go about the setup I would suggest you go through the below articles for the best possible configuration.

Network Load Balancing Deployment Guide

Checklist: Preparing to Implement the Cluster

Network Load Balancing Best practices

Network Load Balancing Manager Properties

Step 1: Enable network load balancing

Step 2: Configure Active Directory

Step 3: Install Microsoft Dynamics CRM servers

Step 4: Configure NLB for the deployment

Step 5: Test it out

Step1: Enable network load balancing

1. On CRM1 and CRM2 Add the Network Load balancing feature through the Server Manager.

2. Open Network Load Balancing Manager, click Server Manager, click Tools, and then click Network Load Balancing Manager. You can also open Network Load Balancing Manager by typing Nlbmgr at a command prompt.

3. Right-click Network Load Balancing Clusters, and then click New Cluster.

4. To connect to the host that is to be a part of the new cluster, in the Host text box, type the name of the host, and then click Connect.

5. Select the interface that you want to use with the cluster, and then click Next. (The interface hosts the virtual IP address and receives the client traffic to load balance.)

6. In Host Parameters, select a value in Priority (Unique host identifier), and provide a Initial host state.

The Priority (Unique host ID) parameter specifies a unique ID for each host. The host with the lowest numerical priority among the current members of the cluster handles all of the cluster's network traffic that is not covered by a port rule. You can override these priorities or provide load balancing for specific ranges of ports by specifying rules in the Port rules tab.
If a new host joins the cluster and its priority conflicts with another host in the cluster, the host is not accepted as part of the cluster. The rest of the cluster will continue to handle the traffic. A message describing the issue is written to the Windows event log.

The IP address parameter specifies this host's unique IP address, which is used for network traffic that is not associated with the cluster .This IP address is used to individually address each host in the cluster, and it should be unique for each host. The dedicated IP address should always be entered first in TCP/IP properties.

The Initial host state parameter specifies whether NLB will start and whether the host will immediately join the cluster when the operating system is started. For example, you might want to start other services manually and in a specific order before starting NLB. Hosts can be commanded to join and leave the cluster dynamically by using the Start and Stop commands in NLB command-line control.

If the Retain suspended state after computer starts check box is selected, when the host is shut down while in a suspended state, the host will remain suspended when Windows is started.

7. In Cluster IP Addresses, click Add and type the cluster IP address that is shared by every host in the cluster. NLB adds this IP address to the TCP/IP stack on the selected interface of all hosts that are chosen to be part of the cluster.

8. In Cluster Parameters, select values in IP Address and Subnet mask. Type the full Internet name that users will use to access this NLB cluster.

The Cluster operation mode parameters specify whether a multicast MAC address should be used for cluster operations.

If multicast is enabled, NLB converts the cluster MAC address that belongs to the cluster adapter into a multicast address. It also ensures that the cluster's primary IP address resolves to this multicast address as part of the ARP protocol. The adapter can now use its original, built-in MAC address that was disabled in unicast mode.
In multicast mode, you can also enable Internet Group Management Protocol (IGMP) support, which limits switch flooding by limiting traffic to Network Load Balancing ports only. That is, enabling IGMP support ensures that traffic intended for an NLB cluster passes through only those ports that are serving the cluster hosts and not all switch ports.
If you select unicast support, NLB automatically instructs the driver that belongs to the cluster adapter to override the adapter's unique, built-in network address and to change its MAC address to the cluster's MAC address. This is the address used on all cluster hosts. You do not need to manually configure the network adapter to recognize this address. (Note that some network adapters do not support changing their MAC addresses. If you experience this issue, you must install a network adapter that does.)

9. On the Port Rules page, click Edit to modify the default port rules if you need advanced rules. Otherwise we recommend that you use the following port-rule settings

• Port range. Leave the default range, which is from 0 to 65535.
• Protocols. Both
• Affinity. Single

10. Click Finish to create the cluster

11. To add more hosts to the cluster, right-click the new cluster, and then click Add Host to Cluster.

12. Type the name of the host, and then click Connect

13. Select the interface that you want to use with the cluster, and then click Next.

14. Specify the priority, Initial host state and click on Next

15. On the Port Rules page, click Edit to modify the default port rules if you need advanced rules. Otherwise we recommend that you use the following port-rule settings

• Port range. Leave the default range, which is from 0 to 65535.
• Protocols. Both
• Affinity. Single

16. Click Finish

Now your NLB cluster is ready.

Setup IIS on both the machines by adding the WebServer role in Server Manager.

Step 2: Configure Active Directory

Configure Active Directory by creating an account to run the CRMAppPool service and use a Service Principal Name (SPN). Active Directory uses the SPN for mutual authentication of a service instance, which enables the service instance to correctly authenticate when a user attempts to access resources that are located on other domain-member computers.

Create SPN’s

1. Open Active Directory Users and Computers.

2. Create a user account to run the CRMAppPool application pool in IIS. To do this, we recommend that you use a name that describes what the account will be used for, such as CRMService.

3. Provide the password and then finish the wizard.

4. Close Active Directory Users and Computers.

5. Click start, type adsi edit, and then press ENTER.

6. Expand the domain, expand the node that begins with DC=, and then expand CN=Users.

7. Right-click the user account that you created in the previous step, such as CRMService, and then click Properties.

8. In the Attribute list, scroll down, select servicePrincipalName, and then click Edit.

9. In the Value to add box, type HTTP/CRMNLBName. FQDN and then click Add. Where, CRMNLBName, is the NLB cluster name and FQDN is the fully qualified domain name

10. Click OK  and exit ADSI Edit

Important

If IIS is configured to use kernel mode authentication, you must configure IIS to use the Web application pool’s identity for internal virtual directories used by Microsoft Dynamics CRM. You can do so by modifying the windowsAuthentication element for the default Web site on the Web site where Microsoft Dynamics CRM is installed.

To configure useAppPoolCredentials using the ApplicationHost.config file open the ApplicationHost.config file in a text editor. By default, this file is located at %windir%\system32\inetsrv\config\.

For all folders under the Default Web Site location path, set the value of the WindowsAuthentication element and the useAppPoolCredentials attribute to true.

For example:

<system.webServer>
   <security>
      <authentication>
         <windowsAuthentication enabled="true" useAppPoolCredentials="true" />
      </authentication>
   </security>
</system.webServer>

You can also do this within the IIS Manager by going to IIS Manager-> Configuration Editor and setting the useAppPoolCredentials attribute to true

Step 3: Install Microsoft Dynamics CRM servers

Install the first instance Microsoft Dynamics CRM on CRM1:

1. Run Microsoft Dynamics CRM Setup on server CRM1. For step-by-step guidance see the blog below  

https://blogs.msdn.com/b/niran_belliappa/archive/2013/11/05/step-by-step-installing-dynamics-crm-2013-on-windows-server-2012.aspx 

2. On the Specify Deployment Options page, select the instance of SQL Server that will be used for the Microsoft Dynamics CRM databases. Then, select the Create a new deployment option. Click Next and continue Setup.

3. On the Specify Security Account page, select the domain user account (for example, CRMService) created previously.

4. Continue to run Setup until the installation is completed.

Install the second instance Microsoft Dynamics CRM on CRM2:

1. Run Microsoft Dynamics CRM Setup on server CRM2.

2. On the Specify Deployment Options page, enter or select the name of the computer that is running SQL Server where the Microsoft Dynamics CRM databases are stored (from the installation of CRM1), and then click Connect to, and if necessary, upgrade an existing deployment. Click Next.

3. On the Specify Security Account page, select the domain user account (for example, CRMService) created previously.

4. Continue to run Setup until the installation is completed.

Step 4: Configure NLB for the deployment

After the Microsoft Dynamics CRM Server 2013 installations are complete, run Deployment Manager to configure NLB for the deployment.

Verify or change the Web addresses

1. On the Microsoft Dynamics CRM server, start Deployment Manager.

2. In the console tree, right-click Microsoft Dynamics CRM, and then click Properties.

3. Click the Web Address tab and make sure that the virtual cluster name, such as crm.contoso.com:80 appears.

Set NLB for the deployment

1. On the Microsoft Dynamics CRM server, start Deployment Manager.

2. In the console tree, right-click Microsoft Dynamics CRM, and then click Properties.

3. Click the Web Address tab and then click Advanced.

4. In the NLB and SSL Header Information dialog box, specify if you are using network load-balancing (NLB) and the header for the Secure Sockets Layer (SSL) offloading system.

   To make Microsoft Dynamics CRM aware of the NLB cluster, you must select The deployment uses an NLB option. Selecting The deployment uses an NLB sets Microsoft Dynamics CRM to configure Windows Identity Foundation (WIF) to use the encryption certificate to encrypt, decrypt, and sign the Microsoft Dynamics CRM session authentication cookies. The encrypted cookies can then be processed by any server in the NLB cluster.

5. Click OK and then close Deployment Manager.

Step 5: Test it out

Browse https://crm.contoso.com and you should see the CRM Page appear.

I hope this article has been helpful.

Before we proceed here are a few details of the environment.

CRM Server 2013 Installed on Windows Server 2012

ADFS 2.1 on a separate box on Windows Server 2012

Important:

With AD FS 2.0, you had to download and install the AD FS 2.0 software to deploy your AD FS server infrastructure.

ADFS 2.1 was released to Windows Server 2012 as part of the operating system and therefore can be installed as a Role from Server Manager.

Prerequisites

1. Install and configure Dynamics CRM 2013
2. Install and configure IIS on the ADFS Server
3. Purchase the appropriate certificates for the IFD configuration
You will need to choose the type of certificate that will work best in your environment. Most people have chosen to use a wildcard for their external domain so in my example it would be *.fabrikam.com so I can use it for all the URLs. If you were to get a SAN certificate you would need to know all of your URLs now and future (if you were going to add more orgs)
4. If ADFS will be on the same server as CRM, ADFS will need to be on the default website using the default port so CRM will need to use something else.

I will break down the entire process into 5 major sections.

Section 1: Binding Certificates

Section 2: Setup ADFS

Section 3: DNS Configuration

Section 4: Configuring CRM server for claims based authentication

Section 5: Configuring CRM server for IFD

Alright, let’s get this started.

Section 1: Binding Certificates

After you have obtained and installed a certificate, the certificate must be bound to the default Web site before you can use AD FS

On the ADFS Server

Step1: Open IIS Manager and in the Connections pane, expand the Sites node in the tree, and then click the Default Web Site

Step2: In the Actions pane, click Bindings.

Step3: In the Site Bindings dialog box, click Add. 

Under Type, select https.

Under SSL certificate, select your SSL certificate and then click OK and then Close

On the CRM 2013 Server

When enabling claims-based authentication, the Dynamics CRM Server 2013 Web site must be accessible via HTTPS. You must bind your SSL certificate to the Dynamics CRM Server 2013 Web site.

Step4: Open IIS Manager and in the Connections pane, expand the Sites node in the tree, and then click the Microsoft Dynamics CRM Web site

Step5: In the Actions pane, click Bindings.

Step6: In the Site Bindings dialog box, click Add. 

Under Type, select https.

Under SSL certificate, select your SSL certificate and then click OK and then Close

Step 7: The CRMAppPool account and the Microsoft Dynamics CRM encryption certificate

The CRMAppPool account will need to have rights to the certificate being used for the CRM website. If the application pool is running as Network Service as in the example then you will need to give Network Service read rights to that certificate.

You can use IIS Manager to determine what account was used during setup for the CRMAppPool account. In the Connections pane, click Application Pools, and then check the Identity value for CRMAppPool.

Launch the MMC console and go to File menu and select Add-Remove Snap In

Select Certificates from the available snap-ins and click Add

Select Computer Account and click Next in the Certificates Snap-In window.

Click Finish on the next window and then click Ok

Expand Certificates->Personal->Certificates ->Right click on Manage Private keys

Add the identity which is running the CRM application pool and give it read permissions and then Ok

In my case its Network Service.

You are now done configuring the certificates.

Section 2: Setup ADFS

Step1: Launch Server manager and click on Add roles and features

Step2: Click Next on the first page in the wizard

Step3: Select Role-based or feature based installation and click Next

Step4: Select a server from the server pool and click Next

Step5: Select Active Directory Federation Services

Step6: Click on Add Features and then click Next

Step7: Continue to click on Next until you reach the Confirmation page and then click Install.

Now that we have installed ADFS, lets go ahead and configure it.

Step8: Launch Administrative tools and then select ADFS management.

Step9: Click on ADFS Federation Server Configuration Wizard and on the welcome page select Create a new Federation Service

Step10: Select Stand Alone or Farm Deployment.

Depending upon your requirement you can choose the appropriate option. The wizard explains each of the options.

I will choose Stand-alone federation server.

Step11: Specify the Federation Service Name

Step12: Shows you the summary of what is about to be installed. Click Next to continue

Step13: Wait for the configuration process to complete and click the Close button.

Section3: DNS Configuration

You should configure your domain records in DNS so the various Dynamics CRM Server endpoints resolve correctly.

Step1: Open DNS Manager by clicking Start, pointing to Administrative Tools, and then clicking DNS.

Step2: Expand Forward lookup Zones and then select the <Domain name>.com and create the below CNAME records.

Here is a screen shot of all the DNS records created

You must also set your firewall to allow inbound traffic on the ports used for Dynamics CRM Server 2013 and AD FS 2.1

Section 4: Configuring CRM server for claims based authentication

Once ADFS is setup and the certificate/s are bound to the websites, you will need to prepare CRM for Claims Authentication.

On The CRM Server

Step1: Set Microsoft Dynamics CRM Server 2013 binding to HTTPS and configure the root domain Web addresses

Start the Deployment Manager=>Actions pane=>Properties=>Web Address tab=>Binding Type select HTTPS.

You can now enter your internal URL for CRM. This will be the URL that users can use if they want to access CRM within the network without being prompted for credentials. Click on 'Apply'

Step2: In the Deployment Manager console tree, right-click Microsoft Dynamics CRM, and then click Configure Claims-Based Authentication. Click Next on the Welcome page

Step3: On the Specify the security token service page, enter the Federation metadata URL, such as https://adfs.fabrikam.com/federationmetadata/2007-06/federationmetadata.xml.

This data is typically located on the Web site where the Active Directory Federation Services (AD FS) 2.1 is running. To verify the correct URL, open an Internet browser by using the URL to view the federation metadata. Verify that no certificate-related warnings appear.

Step4: On Specify the encryption certificate page, specify the encryption certificate

Step5: On the System Checks page, review the results, perform any steps required to fix problems, and then click Next.

Step6: On the Review your selections and then click Apply page, verify your selections, and then click Apply.

Step7: Click View log file and scroll to the bottom and copy the Federation metadata URL to avoid typos

You will need to use the federation metadata URL that was created during Claims-Based Authentication configuration in CRM to setup the Relying Party Trust in ADFS 2.1

On The ADFS Server

After enabling claims-based authentication, the next step is add and configure claims provider trusts and relying party trusts in AD FS 2.1

Step8: Start AD FS 2.1 Management. In the Navigation Pane, expand Trust Relationships, and then click Claims Provider Trusts. Under Claims Provider Trusts, right-click Active Directory, and then click Edit Claims Rules.

Step9: In the Rules Editor, click Add Rule, In the Claim rule template list, select the Send LDAP Attributes as Claims template, and then click Next

Step10: Create the following rule

Claim rule name: UPN Claim Rule (or something descriptive)

Attribute store: Active Directory

LDAP Attribute: User Principal Name

Outgoing Claim Type: UPN

Click Finish, and then click OK to close the Rules Editor

After you enable claims-based authentication, you must configure Dynamics CRM Server 2013 as a relying party to consume claims from AD FS 2.1 for authenticating internal claims access.

Step11: Start AD FS Management. On the Actions menu located in the right column, click Add Relying Party Trust. In the Add Relying Party Trust Wizard, click Start.

Step12: On the Select Data Source page, click Import data about the relying party published online or on a local network, and then type the URL you copied earlier from the log file. So that will be https://internalcrm.fabrikam.com/FederationMetadata/2007-06/FederationMetadata.xml. Verify that no certificate-related warnings appear by opening it in the browser.

Step13: On the Specify Display Name page, type a display name, such as CRM Claims Relying Party, and then click Next.

Step14: On the Choose Issuance Authorization Rules page, leave the Permit all users to access this relying party option selected, and then click Next.

Step15: On the Ready to Add Trust page, click Next, and then click Close.

Step16: If the Rules Editor appears, click Add Rule. Otherwise, in the Relying Party Trusts list, right-click the relying party object that you created, click Edit Claims Rules, and then click Add Rule.

Step17: In the Claim rule template list, select the Pass Through or Filter an Incoming Claim template, and then click Next.

Step18: Create the following Rule #1

Claim rule name: Pass Through UPN (or something descriptive)

Incoming claim type: UPN

Pass through all claim values

Click Finish.

Step19: In the Rules Editor, click Add Rule, in the Claim rule template list, select the Pass Through or Filter an Incoming Claim template, and then click Next

Step20: Create the following Rule #2

Claim rule name: Pass Through Primary SID (or something descriptive)

Incoming claim type: Primary SID

Pass through all claim values

Click Finish

Step21: In the Rules Editor, click Add Rule. In the Claim rule template list, select the Transform an Incoming Claim template, and then click Next.

Step22: Create the following rule #3

Claim rule name: Transform Windows Account Name to Name (or something descriptive)

Incoming claiming type: Windows account name

Outgoing claim type: Name

Pass through all claim values

Click Finish, and when you have created all three rules, click OK to close the Rules Editor.

So now we have claims setup for CRM.

In both Servers (ADFS and CRM) go to IE -> tools -> IE options -> security-> local intranet -> sites -> add internal URL and ADFS URL (https://internalcrm.fabrikam.com and https://adfs.fabrikam.com ) This would have to done on any machines that are accessing the internal access points so that ADFS and CRM can pass those Kerberos tickets without being prompted for credentials.

Type the internal url in CRM server: https://internalcrm.fabrikam.com see how it hits the ADFS and then launches the CRM page.

Section 5: Configuring CRM server for IFD

Now you are ready to configure Internet-Facing Deployment within the Microsoft Dynamics CRM 2013 Deployment Manager.

On The CRM Server

Step1: Start the Deployment Manager. In the Deployment Manager console tree, right-click Microsoft Dynamics CRM, and then click Configure Internet-Facing Deployment. Click Next.

Step2: Enter the URLs for the Web Application Server Domain, Organization Web Service Domain and the Discovery Web Service Domain and click on the Next button.

Important things to consider

. Specify domains, not servers.

· If your deployment is on a single server or on servers that are in the same domain, the Web Application Server Domain and Organization Web Service Domain will be identical.

· The Discovery Web Service Domain must be a resolvable host name and not a root domain. For example: dev.fabrikam.com.

· The Discovery Web Service domain must not match an organization's fully qualified domain name (FQDN). For example, the Discovery Web Service Domain should not be: orgname.fabrikam.com.

· The domains must be valid for the SSL certificate's common name or names.

· The domains must be set to resolve correctly in DNS to your Microsoft Dynamics CRM servers holding the server roles.

· The domains can be in a different domain than the domain which the Microsoft Dynamics CRM servers reside.

Step3: In the Enter the external domain where your Internet-facing servers are located box, type the external domain information where your Internet-facing Microsoft Dynamics CRM Server 2013 servers are located, and then click Next.

The domain you specify must be a sub-domain of the Web Application Server Domain specified in the previous step. By default, "auth." is pre-pended to the Web Application Server Domain.

Important things to consider

· The external domain is used by the AD FS server when retrieving the Microsoft Dynamics CRM IFD federationmetadata.xml file.

· The external domain must not contain an organization name.

· The external domain must not contain an underscore character (“_”).

· The external domain must be valid for the SSL certificate's common name or names.

· The external domain must be set to resolve correctly in DNS to your Microsoft Dynamics CRM server holding the Web Application Server role.

Step4: On the System Checks page, review the results, fix any problems, and then click Next.

Step5: On the Review your selections and then click Apply page, verify your selections, and then click Apply and Finish

Step6: Run the following command at a command prompt: iisreset

On the ADFS Server

After you have enabled IFD on the Microsoft Dynamics CRM Server 2013 you will need to create a relying party for the IFD endpoint on the AD FS server.

Step6: Start AD FS Management. On the Actions menu located in the right column, click Add Relying Party Trust. In the Add Relying Party Trust Wizard, click Start.

Step7: On the Select Data Source page, click Import data about the relying party published online or on a local network, and then type the URL to locate the federationmetadata.xml file. This federation metadata is created during IFD Setup.

For example, https://auth.fabrikam.com/FederationMetadata/2007-06/FederationMetadata.xml.

Type this URL in your browser and verify that no certificate-related warnings appear.

Step8: On the Specify Display Name page, type a display name, such as CRM IFD Relying Party, and then click Next

Step9: On the Choose Issuance Authorization Rules page, leave the Permit all users to access this relying party option selected, and then click Next.

Step10: On the Ready to Add Trust page, click Next, and then click Close.

Step11: If the Rules Editor appears, click Add Rule. Otherwise, in the Relying Party Trusts list, right-click the relying party object that you created, click Edit Claims Rules, and then click Add Rule

Step12: In the Claim rule template list, select the Pass Through or Filter an Incoming Claim template, and then click Next.

Step13: Create the following rule#1

Claim rule name: Pass Through UPN (or something descriptive)

Incoming claim type: UPN

Pass through all claim values

Click Finish

Step14: In the Rules Editor, click Add Rule, and in the Claim rule template list, select the Pass Through or Filter an Incoming Claim template, and then click Next

Step15: Create the following rule#2

Claim rule name: Pass Through Primary SID (or something descriptive)

Incoming claim type: Primary SID

Pass through all claim values

Click Finish

Step16: In the Rules Editor, click Add Rule. In the Claim rule template list, select the Transform an Incoming Claim template, and then click Next.

Step17: Create the following rule #3

Claim rule name: Transform Windows Account Name to Name (or something descriptive)

Incoming claim type: Windows account name

Outgoing claim type: Name

Pass through all claim values

Click Finish, and when you have created all three rules, click OK to close the Rules Editor.

Test external claims-based authentication

You should now be able to access Microsoft Dynamics CRM Server 2013 externally using claims authentication. Browse to your Microsoft Dynamics CRM Server 2013 Web site's external address (for example: https://orgname.fabrikam.com). You should see a screen like the following

Sign in and verify that you have external access to Microsoft Dynamics CRM Server 2013

tada….

You have successfully configured Internet facing deployment for Dynamics CRM 2013.

Hope this article was useful.