Azure Engineering team will fix it in next release, while an effective workaround is to configure PIP for the VM.

Please refer to this article for detailed steps: How to add an ILPIP to an existing VM: https://azure.microsoft.com/en-us/documentation/articles/virtual-networks-instance-level-public-ip/

Who made this lovely change and where it being controlled? The trick is here. The PowerShell icon in your task bar actually pointing to a startup script, by default it's like this:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoExit -ExecutionPolicy Bypass -File "C:\Program Files (x86)\Microsoft SDKs\Azure\PowerShell\ServiceManagement\Azure\Services\ShortcutStartup.ps1"

Open the startup script, search for $VerbosePreference, you may see someone changed the default value:

$VerbosePreference="Continue"

Change it back to the default:

$VerbosePreference="SilentlyContinue"

All set. Now PowerShell no longer working like nuts:

*Note: You will need to run the editor with elevated privilege. Run as Administrator, or it may not able to be saved.

ADFS failed to authenticate with current credential:

Then "bad request":

Resolution is simple. Reset IE and erase all your personal settings, the ADFS working happily with new IE.

Brief Introduction

=================================

We already have plenty of articles describing how to share Free/Busy across forests and how to enable Lync in a multi-forest scenario. But what about an Exchange-Lync combination in this cross forest scenario? I'm writing this blog trying to provide you some hints on it.

Scenario: Customer got two forests, one for global system and one built & maintained by subsidiary.

Diagram: Lab Topology:

Forest-A: got Exchange 2007 and Lync 2010 deployed. (Contoso.com)

Forest-B: only runs Exchange 2007. No Lync schema extension nor any Lync deployments here. (Fabrikam.com)

Goals:

1. Sync GAL between the two Exchange organizations

2. Share Calendar information with each other

3. Enable Lync for Forest-B users, leveraging the Lync servers deployed in Forest-A

Note: FIM is running on another forest independently, to prove it's not relying on any source/destination forest memberships.

Solution Design

=================================

Configuration Steps

=================================

The basic idea is:

1. Prepare FIM 2010

Login to USFIM01, install SQL Server and FIM 2010 Synchronization Service.

Download Lync Server Resource Kit: https://www.microsoft.com/en-us/download/details.aspx?id=21165. Install & copy the entire C:\Program Files\Microsoft Lync Server 2010\ResKit\LcsSync folder to FIM Server (C:\Program Files\Microsoft Forefront Identity Manager\2010\Synchronization Service\Extensions)

Edit the lcsmvschema.xml file. Two incorrect attributes defined (otherHomePhone and otherTelephone), we got to correct them. By default the thumbnailPhoto attribute is not being included in the FIM metaverse for "person" object, if you want to sync photos, add it into the schema as well.

Open Synchronization Service, navigate to Metaverse designer, Action, Import Metaverse Schema, import the updated lcsmvschema.xml.

2. Create MA for Domain-A

Open Synchronization Service, navigate to Management Agents

Properties page: Create, Choose "Active Directory global address list (GAL)", give MA a name, Next

Connect to Active Directory Forest page: Specify forest name, credential, Next

Configure Directory Partitions page: Select the partition, click on "Containers", Next

Configure GAL page: Assign source and destination OU/Container, specify SMTP suffix (must start with @), check the "Support cross-forest delegation (Exchange 2007 or 2010 only)", Next

Configure Provisioning Hierarchy page: Next

Select Object Types page: Next

Select Attributes page: Check "Show All", make sure "msRTCSIP-OriginatorSid", "msDS-SourceObjectDN" and "thumbnailPhoto" checked, Next

Configure Connector Filter page: Next

Configure Join and Projection Rules page: Next

Configure Attributes Flow page: Under "User -> Person" flow, add an import "thumbnailPhoto -> photo", this will read Domain-A user photo into FIM Metaverse. Under "Contact <- Person" flow, add three exports: "thumbnailPhoto <- photo, allow null", "msRTCSIP-OringinatorSid <- objectSid", "msDS-SourceObjectDN <- Ms-DS-Source-Object-DN, allow null", this will read photo, objectSID and DN from Metaverse and write to Domain-A.

Configure Deprovisioning page: Next

Configure Extensions page: Select "Exchange 2007" in the drop-down menu, Finish.

3. Create MA for Domain-B

Open Synchronization Service, navigate to Management Agents

Properties page: Create, Choose "Active Directory global address list (GAL)", give MA a name, Next

Connect to Active Directory Forest page: Specify forest name, credential, Next

Configure Directory Partitions page: Select the partition, click on "Containers", Next

Configure GAL page: Assign source and destination OU/Container, specify SMTP suffix (must start with @), check the "Support cross-forest delegation (Exchange 2007 or 2010 only)", Next

Configure Provisioning Hierarchy page: Next

Select Object Types page: Next

Select Attributes page: Check "Show All", make sure "msRTCSIP-OriginatorSid", "msDS-SourceObjectDN" and "thumbnailPhoto" checked, Next

Configure Connector Filter page: Next

Configure Join and Projection Rules page: Next

Configure Attributes Flow page: Under "User -> Person" flow, add two imports "thumbnailPhoto -> photo" and "<dn> -> Ms-DS-Source-Object-DN", this will read Domain-B user photo and DN into FIM Metaverse for "Person" objects. Under "Contact <- Person" flow, add an export: "thumbnailPhoto <- photo, allow null", this will read photo from Metaverse and write to Domain-B.

Configure Deprovisioning page: Next

Configure Extensions page: Select "Exchange 2007" in the drop-down menu, Finish.

4. Import, Sync and Export

- Import both of the MA, now we have Metaverse in FIM database
- Sync
- Export MA for Domain-A, we should be able to see contact objects being created, with msDS-SourceObjectDN(A) from DN(B), msRTCSIP-OriginatorSID(A) from objectSID(B), thumbnailPhoto(A) from thumbnailPhoto(B)
- Export MA for Domain-B, we should be able to see contact objects being created, with thumbnailPhoto(B) from thumbnailPhoto(A)

5. Enable Lync for syched contacts in Domain-A

Unfortunately, contact object can't be managed by Lync Control Panel. We must use Enale-CsUser cmdlet to enable Lync for Domain-B users.

Example:
Get-CsAdContact '4 li' | Enable-CsUser -SipAddress sip:li4@domainb.com -RegistrarPool cnly01.domaina.com

6. Configure Exchange Calendar Sharing

On CAS server in both domain, modify the registry to allow untrusted certificate:

HKLM\System\CurrentControlSet\Services\MSExchangeOWA\AllowInternalUntrustedCerts = 1
HKLM\System\CurrentControlSet\Services\MSExchangeOWA\AllowExternalUntrustedCerts = 1

On CAS server in Domain-A, add address space for Domain-B:

Add-AvailabilityAddressSpace -ForestName "fabrikam.com" -AccessMethod PerUserFB -UseServiceAccount $true
Get-ClientAccessServer | Add-AdPermission -AccessRights ExtendedRight -ExtendedRights "ms-exch-epi-token-serialization" -User  "FABRIKAM\Exchange Servers"

On CAS server in Domain-B, add address space for Domain-A:

Add-AvailabilityAddressSpace -ForestName "contoso.com" -AccessMethod PerUserFB -UseServiceAccount $true
Get-ClientAccessServer | Add-AdPermission -AccessRights ExtendedRight -ExtendedRights "ms-exch-epi-token-serialization" -User  "CONTOSO\Exchange Servers"

All done. Hopefully this post helps you to understand and configure multi-forest scenario with Exchange & Lync Servers.

My first guess would be simple: select "Repair your computer" before clicking "Install now" button, enter command prompt to load the disk driver & prepare disk with DISKPART.

But soon I realized installing & booting from disk larger than 2TB is not as easy as "pre-create partitions on a GPT disk in advance".

Short Answer

====================

After couple of unsuccessful attempts I finally made it. The secret is UEFI boot.

References

====================

• Windows support for hard disks that are larger than 2 TB

• Overview of FAT, HPFS, and NTFS File Systems

• Frequently asked questions about the GUID Partitioning Table disk architecture

• UEFI Firmware

Key Info

====================

• GPT vs MBR: GPT for disks larger than 2TB is a must. Disks using MBR partitioning table can only support up to 2TB address space.

• BIOS vs UEFI: All versions of Windows support BIOS firmware. On modern mainboards, UEFI became an standard option.

• 2TB is NOT a limitation defined by NTFS. Actually NTFS can support up to 2^64 bytes which is 16 Exabyte.

• Support Matrix:

DISKPART?

====================

Unfortunately preparing partitions with diskpart.exe to is NOT a feasible option because:

• Windows will automatically convert it back to MBR if it’s a GPT disk without partition;

• or refuse to install on a GPT disk with one or more partitions.

Using Linux utilities such as gparted is all the same. Windows setup program simply incompatible with BIOS+GPT combination.

Resolution

====================

The correct solution is to enable UEFI boot support in BIOS setting and setup with modern Windows ISO such as Windows 8.1.

Note: if running on Hyper-V, UEFI is only available for Generation 2 VM on latest hypervisors:

Simply select the empty disk & hit “Next”

Here comes the wonder!

Tricks

====================

If you see this in UEFI boot, it means the ISO is corrupted, even if it works with BIOS boot. Try to download a new ISO (or copy the entire \efi folder from a working ISO. Unverified.).

If you can’t see the prompt while booting with setup CD,

Then do some tweak to the ISO. Navigate to \efi\microsoft\boot, swap file names:

Sometimes Secure Boot prevents boot on older ISO such as Vista/Win7. Uncheck it:

Wish it’s useful for you.

We can constrain algorithm used by Kerberos by GPO. It's located at:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Configure encryption types allowed for Kerberos

 The actual registry key is located at:

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\parameters\SupportedEncryptionTypes 

You can find the detailed bit flag explanation on MSDN:

Where the bits are defined as:

But how to understand this bit flag table and how it's implmented on a real Windows client? Let's do some test & observation.

1. Open GPMC on Windows 2008 R2, navigate to Computer Configuration, Policies, Windows Settings, Security Settings, Local Policies/Security Options, Network security: Configure encryption types allowed for Kerberos, enable all option except "Future encryption types".

2. Apply this GPO to a machine, check the reg key HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\parameters\SupportedEncryptionTypes. It's 31, which is binary 11111. Referring the table from MSDN, this means enable option A/B/C/D/E, aka DES-CBC-CRC, DES-CBC-MD5, RC4-HMAC, AES128-CTS-HMAC-SHA1-96, AES256-CTS-HMAC-SHA1-96. RSOP confirmed the same thing:

3. Now enable the option "Future encryption types". How do you expect the new value for SupportedEncryptionTypes reg key? Well, it's now 2147483647. Convert to binary and you get 1111111111111111111111111111111. Wow, plenty lot of "1"s! Now you may get the idea: by setting all possible bits to 1, we instructed client OS to enable every single encryption option it supports on current build. Simple?

Wish this post helped you to understand the SupportedEncryptionTypes reg key. And thanks Jianwei Zhao from Norch China PFE team who raised the discussion and doing tests with me!

Reference:

Supported Encryption Types Bit Flags

https://msdn.microsoft.com/en-us/library/ee808210.aspx

Network security: Configure encryption types allowed for Kerberos

https://technet.microsoft.com/en-us/library/jj852180(v=ws.10).aspx