Colored flags, Apples, and Penguins

TOP 10: Lync Server 2010 PowerShell Commands

2012-01-28T16:11:00.001-07:00

I created this post in response to several requests from clients who wanted a go-to place to find the most commonly used commands and helpful commands for administering Lync Server 2010. In this post I cover the following commands:

1. Create and set up a Lync User
You will need an existing AD account for this command to function. Typically the SIP URI for users will follow their e-mail address. If not, you will need to specify the format to use or simply type it in. See the last help section of this post for more information on how to get effective help!

Enable-CsUser "Jason Shave" -RegistrarPool "poolname.domain.com" -SipAddressType EmailAddress

Next you may want to modify settings of the user such as their phone number (LineURI) or enable them for Enterprise Voice. These can both be set with one command as follows:

Set-CsUser "Jason Shave" -EnterpriseVoiceEnabled:$True -LineURI "tel:+17805551212;ext=1212"

2. Create a Common Area Phone
Common Area Phones (a.k.a. CAP's) are useful because you don't need an AD account to pre-exist as these objects are created as Contact objects in AD with the necessary properties set on them. You don't have to worry about resetting or setting passwords.

New-CsCommonAreaPhone -RegistrarPool "poolname.domain.com" -DisplayName "2FL Reception NE" -OU "OU=CAP,OU=Lync Server,DC=domain,DC=com" -DisplayNumber "+17805551212" -LineURI "tel:+17805551212;ext=1212"

NOTE: I've noticed a sort of bug with PowerShell in that if you specify the LineURI with an ";ext=" command in the string it won't tab-complete any other entries in the window so I typically leave that attribute to the end.

3. View or Assign a Policy/Dial Plan
Once you've created either a new user or CAP, you will need to set various attributes such as a Dial Plan, Voice Policy, Client Policy, Conferencing Policy, External Access Policy and so on.

To view all dial plans by name type:

Get-CsDialPlan | FL Identity
To view a voice policy, type the following: (since "Identity" is the only property beginning with the letter "I" we can use a wildcard character to save time)

Get-VoicePolicy | FL I*

To assign a Dial Plan to a user or set a voice policy to a CAP:

Grant-CsDialPlan "Jason Shave' -PolicyName EdmontonDialPlan1

Get-CsCommonAreaPhone "2FL Reception NE" | Grant-CsVoicePolicy -PolicyName NA-AB-Unrestricted
4. Assign a PIN
A PIN might not be as visibly necessary as you may think. Quickly though, a PIN is required for a non-tethered IP phone sign in, or a user joining a Lync audio conference as a leader from a non-Lync endpoint.

Set-CsClientPin "Jason Shave" -Pin 8675309
It is a good practice to set this PIN however users are able to create/set their PIN via the dialin simple URL accessible through the Lync client or the meeting request dialin phone number page (typically "dialin.domain.com").

5. Revoke a User Certificate
This one is more important than you may think as well. If you disable an AD account, and permit users to save their username/password, they will still be able to use Lync! I find a lot of people don't know this and it creates an interesting discussion with the security teams...

Revoke-CsClientCertificate "Jason Shave"

6. Move a User between pools or to an SBA

Move-CsUser "Jason Shave" -Target "poolname.domain.com"

7. Determine if a DID has been used
A common issue I see in environments where turnover is higher than normal is the recycling of DID's. When a user is disabled in Lync, their LineURI attribute in AD is still taken and cannot be reassigned. To find out the culprit, type:

Get-CsUser | Where {$_.LineURI -Like "*1212"}

The above command will find any LineURI attributes ending in "1212" such as "+17805551212" or "+17805551000;ext=1212".

8. Check CMS replication health
Any change to the CMS database such as a voice route, dial plan, or voice policy will result in the change being propagated to all Lync servers in the topology. Often times a change is made resulting in a test being performed (i.e. fixing a broken route). You will want to validate the change has been replicated to all servers in the topology before testing....and give it an extra 60 seconds after synchronization has been completed too!

Get-CsManagementStoreReplicationStatus

Alternatively if you have a very large topology, you can be more specific as follows:

Get-CsManagementStoreReplicationStatus | Where {$_.UpToDate -ne $True}

9. Determine number of users enabled for Enterprise Voice

(Get-CsUser | Where {$_.EnterpriseVoiceEnabled -eq $True}).Count

Getting more complex, lets try to count the total number of EV users and CAP's and get a combined total. In the following example we use the ";" command in a one-liner to initiate a carriage return. We also store the outcome in a variable called "$str1" and "$str2":

$str1 = (Get-CsUser | Where {$_.EnterpriseVoiceEnabled -eq $True}).Count; $str2 = (Get-CsCommonAreaPhone).Count; $str1 + $str2

10. Getting help from PowerShell
I've found the following tips helpful when trying to find out what PowerShell can do for me...

To get help on a command such as Get-CsUser type:

Get-Help Get-CsUser

NOTE: Use the TAB key on your keyboard when typing in PowerShell to complete long commands. As an example, you wouldn't want to type these comands every time:

Get-CsManagementStoreReplicationStatus
Get-CsUserReplicatorConfiguration
Get-CsEnhancedEmergencyServiceDisclaimer

For example, type "Get-CsMan" for "Get-CsManagementStoreReplicationStatus"

Sometimes you want examples of a command such as "Get-CsUser" so in this case you would type:

Get-Help Get-CsUser -Examples

If you forget a command or want to know all the commands associating with setting a user property, try:

Get-Command Set-CsUser*

Again, you might want to know what a specific parameter for "Set-CsUser" does such as AudioVideoDisabled:

Get-Help Set-CsUser -Parameter Au*

Hope this helps! Feedback is always appreciated so let me know if you note a mistake or would suggest alternative top 10's. Cheers!

HOW TO: Copy Quintum Tenor Gateway Configuration

2012-01-28T14:19:00.001-07:00

This post shows you how to copy the configuration from a Quintum Tenor analog voice gateway for the purpose of either backup or restoration. In my case I used this process in the deployment of several similarly configured gateways at a customer site instead of starting from scratch each time.

First a warning or three....NEVER copy a gateway configuration from a non-like device to another using this method. Be sure you copy the same configuration to the same type of device with the same port configuration every time.

Second, be sure you have updated the firmware of your target device to the same level of your source device.

Third, this method of copying a configuration from one device to another is officially not supported by NET. Use at your own risk!!

STEP 1: Logging into the device
The default login username for the Tenor gateways is "admin" with the password being the same. You can FTP to the device using Windows Explorer or via Command Prompt.

Using Windows Explorer is as easy as typing ftp:// and hitting enter followed by the username and password.

STEP 2: Copying the configuration from a source device
Once you've gained access to the device, double-click the "cfg" folder and then double-click the "db" folder. You should see three files called "hw.txt", "db.txt", and "ipconfig.txt". Simply copy these files (if you're using Windows Explorer use CTRL-C) and paste them (CTRL-V) to a safe location you will remember.

The files are very small and can be stored just about anywhere. Be sure to place them in a directory with a name matching the make, model, and port density.

NOTE: If you want to modify the configuration of these files, please use the command-line or the Tencor Config Manager software. NEVER EVER modify these files while they're on the gateway (in flash memory).

STEP 3: Modify the configuration before deployment
Now you're ready to modify the configuration and prepare the files for deployment to your target device. The most obvious configuration change you will make will be the IP address of the device to prevent a duplicate IP on the network when you deploy the target device. This can be done by opening the "ipconfig.txt" file on your PC (again, never on the flash memory of the target or source device).

Make a copy of your backed up files to a new directory as these will be your working copies. Now, simply open the "ipconfig.txt" file using Notepad and modify the parameters necessary. As an example, please see the image below:

The two "set" commands will change the IP address and subnet mask while the "change" command highlighted above will change the default route (default gateway ip). To modify the DNS settings for the device you need to open the "db.txt" file and modify the following settings:

Once complete, save the file(s).

STEP 4: Copy the configuration to your target device
If you still have an open connection to your Tenor device, close it and open a new connection to your target device using the correct username and password. Since the new device may be new out of the box, you can use the Tenor Config Manager software to locate it or else use a console cable to determine the IP address.

As you can imagine, the process for copying is the same as you would any other file to a Windows folder. Copy/Paste the files into the /cfg/db location of the target device and overwrite the files.

Now you can safely reboot your target device and attempt to connect to it via FTP using the new address.

Lync Server 2010: Building redundancy into your dial plans

2011-12-20T12:38:00.000-07:00

We've had quite a bit of discussion lately about the behaviour associated with Lync Server 2010 call routing when a gateway is "down". The discussion was prompted by a customer outage scenario in which a voice gateway was used to connect a Nortel CS1000 PBX to Lync Server 2010. A single T1 interface was used to provide PBX to Lync calling and Lync to PSTN for certain dialing scenarios. The Nortel CS1000 implementation was vast and contained several H.323 trunks connecting various remote sites together for toll bypass and short digit dialing patterns.

The customer had an issue with one of the H.323 connections in the Nortel world which resulted in an outage to Lync Server. Looking deeper into the issue we discovered the dial plan in Lync Server had multiple phone usages with routes matching the same dialing pattern. For example, a user has a voice policy with two phone usages (see below):

Phone Usage	Route	Matching Pattern	Gateway
NA-AB-Usage1	NA-AB-PBX-Route1	\+1	vgw1.contoso.local
NA-AB-Usage2	NA-AB-SIP-Route1	\+1	siptrunk1.provider.com

Given the above, I assumed Lync Server would match on the first usage, fail....then not use the second usage even if the pattern matched the route for the call. In certain situations this is correct while other situations is isn't. For example, if the gateway returns a 5xx level response to the Mediation server or if it's marked as "down", we will use the next phone usage matching the called number. If the gateway returns a 4xx level response to the Mediation server we will NOT try the next phone usage resulting call failure.

So what happens if we have a single phone usage with multiple routes?
In this case, the same behaviour would be experienced. A 5xx level SIP response to the Mediation server would permit a call to the second route in the same usage however a 4xx level response would result in a call failure. Adding multiple gateways to a route only causes them to be used in a round robin fashion and doesn't protect us from a 4xx level response. Below is an example of a phone usage with multiple routes:

Phone Usage	Route	Matching Pattern	Gateway
NA-AB-Usage1	NA-AB-PBX-Route1	\+1	vgw1.contoso.local
	NA-AB-SIP-Route1	\+1	siptrunk1.provider.com

Let's take a slight detour for a moment and talk about what happens when a gateway is down, how long it stays down for, and when or how long it takes for service to be restored.

How are gateways marked as "down"?
The Mediation Server sends a SIP OPTIONS request to the next hop gateway which can be viewed by running NetMon or Wireshark on the interface bound to the IP used by that service. If no reponse, or an invalid reponse is returned we raise event ID 25051, then increment a counter. Once the counter reaches five we raise event ID 25061 and 25052 thus marking the gateway "down". Subsequent failure events after this point will not be logged as described in event ID 25052.

Event ID 25051: First failure up to five attempts...

Event ID 25052: Tried five times, won't log it anymore...

Event ID 25061: Taking the gateway out of service (down)...

How long do they stay down for?
A gateway taken out of service by Lync Server will be re-tried every 1 minute which means we will put a gateway back in service very quickly once we receive a successful OPTIONS request. We follow this up by creating event ID 25062.

Event ID 25062: Back in business...

Even though the gateway is back in service from the Mediation server's perspective, Lync's OutBound Routing (OBR) logic may take up to 20 minutes to add it back as a viable call path. This is because the Lync OBR doesn't have access to the SIP OPTIONS status and will run an exponential back-off algorithm which is capped at 20 minutes.

What happens if the gateway is "unhealthy"?
When I use the word unhealthy I'm referring to a SIP response code in the 4xx range which would cause and OBR failure within Lync and ultimately a failure for the end user. Let's say given the original problem stated above we receive back a "SIP/2.0 488 Not Acceptable Here" from the gateway. Using Lync Server PowerShell commands we can create a new response code translation for the 488 message on that gateway as follows:

New-CsSipResponseCodeTranslationRule -Identity "PstnGateway:10.0.0.6/Rule488 -ReceivedResponseCode 488 -TranslatedResponseCode 503

In the above example, Lync's OBR logic will retry the next route or phone usage if the pattern matches the called number.

What other useful examples are there?
Let's say you have a single T1/PRI and a SIP trunk at a location. The SIP trunk is used as an overflow for outbound calls if all ports on the T1/PRI are used up. Again, it wouldn't matter if you had multiple phone usages with the independent routes to the PRI or to the SIP trunk. The response code from the gateway will be a "SIP/2.0 486 Busy Here" when no channels are available. If we map the 486 response code to a 503, OBR will retry the next route or phone usage.

New-CsSipResponseCodeTranslationRule -Identity "PstnGateway:10.0.0.6/Rule486 -ReceivedResponseCode 486 -TranslatedResponseCode 503

The exception to the above scenario would be if you were using a certified Lync Server gateway. A certified gateway will return a "SIP/2.0 503" instead of the "SIP/2.0 486".

So there you have it, you can use Lync Server to build out recovery scenarios based on certain responses from the gateway.
TechNet reference: http://technet.microsoft.com/en-us/library/gg413041.aspx

NextHop post about video resolution

2011-11-08T08:25:00.003-07:00

Check out my NextHop post for a method of determining video resolution of a Lync call.

http://blogs.technet.com/b/nexthop/archive/2011/11/07/determining-the-video-resolution-of-a-call.aspx

Cheers...

SUCCESS! Install WIndows Server 2008 R2 on Lenovo W520

2011-10-01T20:21:00.003-06:00

In my new job I received an amazing Lenovo W520 laptop as my primary device for doing business. The integrated 160GB SSD wasn't enough space for my liking and since I wanted to take advantage of the 16GB of memory, I decided to purchase a few goodies for it. My primary goal here by the way is to run Hyper-V and a few VM's for testing/demo purposes. Installing from the DVD isn't an option since I replaced the drive with a high capacity HDD.

First, I removed the DVD drive and installed a drive caddy (http://www.newmodeus.com/shop/index.php?main_page=product_info&cPath=2_7&products_id=400) along with a Seagate 750GB laptop drive from Memory Express.

Next, since my default install image of Windows 7 was missing a few drivers and key software components, I went to the Lenovo web site and downloaded their system update software which managed to get all relevant drivers and conveniently placed them on C:\drivers\win.

The next step was to format the 750GB drive with enough space to hold my Windows Server 2008 R2 installation along with some basic software. I then located my 8GB Patriot USB stick and began to format is as follows:

Within Windows 7 open an Administrative command prompt and type diskpart
Then list disk which will show you the available drives. You should see your USB drive and select it by typing select disk ##
Type clean
Then create partition primary
Then active
Next you need to actually format the USB key. You can choose FAT32 or NTFS and since my WIM install file is customized I chose NTFS as follows format fs=ntfs quick
Then assign and finally quit the diskpart utility. You now have a bootable USB drive.

Next you need to copy the Windows Server 2008 R2 source media to the USB drive making sure to copy all files (its best to just use xcopy with /s /e /f /h switches).

Now you should be able to boot into Windows Server 2008 R2 with this USB device but MAKE SURE TO PLUG IT INTO THE REAR SLOT of the laptop. If you try any other slot I found it impossible to make Windows find the suitable drivers to proceed with setup.

BONUS: Install drivers from (C:) for the W520 onto USB (E:)

From C:\Windows\System32 type Dism /Get-WimInfo /WimFile:E:\Sources\Install.wim. This will show you all images within the WIM file.
Next, you need to extract the image you want to install the drivers into. Type Dism /Mount-Wim /Wim-File:E:\Sources\Install.wim /Name:"Windows Server 2008 R2 ENTERPRISEFULL" /MountDir:C:\jcstemp\offline
Next we want to load the drivers recursively as follows: Dism /Image:C:\jcstemp\offline /Add-Driver /Driver:C:\drivers\win /Recurse
Finally we need to close out our image back into the USB drive as follows: Dism /Unmount-Wim /MountDir:C:\jcstemp\offline /Commit

Now when you install Windows Server 2008 R2 you'll have all the necessary USB 3.0, Video, and chipset drivers to get going!

Cheers!

HOW TO: Configure AD RMS with Exchange; Soup to Nutz

2011-06-20T11:35:00.002-06:00

It's been a while since I've posted anything related to Exchange and in the time between exam taking and projects I've been working on trying to get Active Directory Rights Management Services (AD RMS) to work with Exchange 2010.

Some of you may be asking yourself why this is important information or you might even be wondering what AD RMS is all about? Well it wasn't until recently that I became interested in this topic and consequently learned the ins and outs of rights management solutions. The topic came to mind when a colleague at work mentioned someone outside the organization had asked them for one of our internal documents. At first I thought "wow, that's some nerve!". Then I began to think about how an organization might attempt to protect this information from 'leakage'; (not this type of leakage). It wasn't the first time I encountered this type of situation but at the time the world of rights management and information leakage was blurred and convoluted. I can't say a lot has changed on this topic but at least Microsoft has started building native support for IRM/AD RMS into their applications such as Exchange Server 2010 and Office 2010.

Some of the challenges I've seen in the other documentation out there seem to exclude the configuration steps necessary to provide an end to end solution with respect to certificate auto-enrollment or AD RMS template configuration. So I'll try...

First off, you want to build up a VM just for the purpose of configuring AD RMS. You can collocate this role on another DC or server but just to make things 'cleaner' I chose to do it this way. In a production environment you may want to do the same.

Next, you'll configure Exchange, then your certificate infrastructure. Finally, we'll finish up with TMG publishing of the AD RMS infrastructure so everything works for your Internet facing employees and customers.

Step 1: Deploy AD RMS

Using the Add Roles Wizard in Server Manager, add the Active Directory Rights Management Services role to your new VM.
Select just the Active Directory Rights Management Server service and leave OFF the Identity Federation Support option.
Accept the default to create a new AD RMS cluster.
Choose to use an Internal Database.
Create a Domain User account and assign it to AD RMS (i used "adrmsuser").
Set the AD RMS Key storage location to be centrally managed.
Set the AD RMS Cluster Key Password.
Configure AD RMS to use an HTTPS connection by typing in the URL (i.e. adrms.contoso.com).
Choose to use an existing SSL certificate if you have one already. If not, get one!
Accept all remaining defaults.

At this point AD RMS will be installed into your Active Directory domain and a Service Connection Point (SCP) will be created. Exchange 2010 will use this SCP to discover the AD RMS cluster in the environment so the actual amount of configuration necessary is very little.

Step 2: Permit Exchange 2010 access to AD RMS

From your AD RMS server, navigate to %systemdrive%\Inetpub\wwwroot\_wmcs\Certification.
Right-click the ServerCertification.asmx file and click Properties.
Click the Security tab.
Click the Edit button.
In the Select User, Computer, Service Account, or Group dialog box, click Object Types, select Computers and click OK.
Type the names of the Exchange 2010 servers in your environment and click OK.
Grant Read & execute and the Read check boxes and click OK.

NOTE: Also check to make sure the local group on your AD RMS server called AD RMS Service Group exists here with the same permissions as outlined above.

Step 3: Configure AD RMS Super Users Group

Create a Universal Group (Distribution Group) in AD with a name like "ADRMS-SU" then mail enable it (i.e. ADRMS-SU@contoso.com).
Log onto your AD RMS server and open the Active Directory Rights Management Services console.
Expand Security Policies then click Super Users.
Click Enable Super Users.
In the results pane, click Change Super User Group to open the Super Users property sheet.
In the Super User group box, type the e-mail address of the designated super users group (ADRMS-SU@contoso.com), or click Browse to navigate through the defined users and groups in the directory then click OK.

Step 4: Configure Exchange 2010

Open an Exchange Management Shell window.
Type Set-IRMConfiguration -InternalLicensingEnabled:$True

Step 5: Configure automatic AD RMS Client certificate distribution

Run this command: schtasks /Change /TN "\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)" /ENABLE

NOTE: This will enable automatic checking of templates at logon and at 3:00AM each day. To deploy this to all PC's in a domain, consider creating a GPO with a Startup script to run it (due to UAC in Vista and Windows 7, you may not be able to deploy a GPO with a Logon script).

IMPORTANT: You must add the following registry entry to the local system (can also be done via GPO) so that the IRM-enabled clients can find the template files.

HKCU\Software\Microsoft\Office\14.0\Common\DRM

Name: AdminTemplatePath
Type: REG_EXPAND_SZ
Data: %LocalAppData%\Microsoft\DRM\Templates

If you encounter a situation where the Outlook client can't find the templates, you will only see the default "Do Not Forward" template when you select one from the Permissions button on the ribbon. My suggestion here would be to create a GPO using the 2008 user preferences functionality. Create as many entries as you require to target certain operating systems and versions of Office. For example, you may want to create a single GPO where you populate the registry with values for both Office 2007 and 2010 (just in case). This makes it easier to maintain one GPO than separate ones....or simply use the Item Level Targeting feature of the GPO to determine when and where to apply it.

Step 6: Configure User Certificate Template

Log into your Certificate Services server.
Open the Certification Authority MMC.
Expand the server name in the console, right-click on Certificate Templates and choose Manage.
Right-click on the User template and choose Windows 2003 Server, Enterprise Edition.
Give the template a name such as "User Template Auto Enrollment".
Set the validity period to something acceptable.
Click the Request Handling tab and turn off Allow private key to be exported.
Click the Security tab and make sure Authenticated Users and Domain Users have Read, Enroll and Autoenroll enabled.

Step 7: Configure Auto Enrollment

Log into your server used to manage GPO's.
Create a new GPO and link it to an OU or to the Domain.
Create a User Configuration setting under Policies\Windows Settings\Security Settings\Public Key Policies.
Double-click the Certificate Services Client - Auto - Enrollment object.
Set the Configuration Model to Enabled.
Turn on Renew expired certificates, update pending certificates, and remove revoked certificates.
Turn on Update certificates that use certificate templates.
Turn on Expiration Notification then click OK.
Close your GPO editor.

At this point your users should automatically enroll their User certificate at logon to any machine matching the GPO you've created in step 6 above. Validate this by logging out and back in, then opening the certmgr.msc file and checking your Personal store.

Step 8: Define your external URL for AD RMS

Log into your AD RMS server.
Log onto your AD RMS server and open the Active Directory Rights Management Services console.
Click on the server name and choose Properties.
Click the Cluster URL's tab.
Turn on your Extranet URL's and specify an external DNS name (i.e. adrmsext.contoso.com) then click OK.

Step 9: Configure Microsoft Threat Management Gateway to access AD RMS

NOTE: Due to issues with my TMG environment I haven't been able to publish the rest of this article. I'll be back soon to finish it but for now we'll have to wait.

SIP Trunking with Lync Server 2010 and reliability issues (calls only last 51 mins)

2011-05-05T13:07:00.002-06:00

I recently worked on a project for a customer who was interested in working with a local SIP trunk provider (ITSP) who is listed on the Microsoft OIP page for Lync Server 2010. We offered four connectivity methods to the client which consisted of the following:

Full IP NAT connection to ITSP
Public IP connection to ITSP
Site-to-site IPSEC VPN connection to ITSP
Layer 2 PVC using ISP link

The customer decided to go with option 1 which meant we provisioned a new public IP and created a NAT to a private IP which was bound to the Lync server. Appropriate firewall rules were set up to permit SIP and RTP/RTCP packets between the two and for the most part everything worked really quite well.

Incidentally, calls made to, or coming from the PSTN (ITSP) are using G.711 as a codec and if you have a reasonably reliable connection with low delay and jitter, you can expect good results.

This particular customer had an interesting issue which resulted in their calls being dropped after being active on the phone for 51 minutes and 30 seconds (typically a conference call). After a series of funny looks asking if anyone else has seen this issue, I decided to dig into the Lync Server 2010 trunk configuration settings to see if we can fine tune something. The theory on why this was happening appeared to be related to the RTCP packets being blocked from the ITSP. Unfortunately I didn't have any evidence of this to share here but it makes sense. Looking at the default options for a Lync trunk connection, the following areas of interest are what I focused on:

EnableSessionTimer ($true | $false)
RTCPActiveCalls ($true | $false)

RTCPCallsOnHold ($true | $false)

The default option for a trunk in Lync Server 2010 is:

EnableSessionTimer = False

RTCPActiveCalls = True

RTCPCallsOnHold = True

Session timers will apply to a connection even if the trunk setting is "False" (this can occur when the remote side uses them). RTCPActiveCalls refer to the method of sending RTCP packets to determine if the call is still 'alive' or not. If these packets cease, the call is terminated after 30 seconds. The purpose of determining a valid call this way is because the SIP signaling for the call could traverse another path, such as Media Bypass, and/or become interrupted (brief network/device). The same applies to RTCPCallsOnHold but in a slightly different manner. Historically a call on hold without MOH will cease sending RTP packets and drop the peer (some of you may recall this being an issue on SNOM or Cisco sets).

If my theory of RTCP packets being blocked (inbound) or not sent at all, I would think the call wouldn't last very long at all (i.e. no more than about 30 seconds). I attempted to set "EnableSessionTimer" to True but this didn't seem to make a difference. I had to set RTCPActiveCalls and RTCPCallsOnHold to False as well for the issue to go away. Again, in the end, the configuration I went with looks like this:

EnableSessionTimer = True

RTCPActiveCalls = False

RTCPCallsOnHold = False

Calculating number of Mediation Servers and Lines required for Lync Server 2010

2011-05-04T21:25:00.001-06:00

I generally hate doing something I don't fully understand or haven't been taught so I've taken some time to try and grasp the mind bending, eye crossing, fascination that is capacity planning with respect to voice systems.

It all goes back to our Microsoft Certified Masters training for Lync Server 2010 in March/April of this year. Some of the pre-study content prescribed to us touches on what an "Erlang" is and why it's important to understanding voice systems design. In addition to this, the MCM program has us learn about applying factors such as Busy Hour Traffic (BHT) measured in Erlangs against real world capabilities of Lync Server 2010.

So let's start with the basics. What is an Erlang? Well, if you look up the Wikipedia definition it states:

"The erlang (symbol E^[1]) is a dimensionless unit that is used in telephony as a statistical measure of offered load or carried load on service-providing elements such as telephone circuits or telephone switching equipment."

Basically, an Erlang represents one voice path, or one channel, or one line in constant use (sorry Adam). The reason an Erlang is important is because we need to eventually determine the number of concurrent channels required for sizing T1/E1 capacity or even determining the number of Mediation servers we need.

The other important concept we need to understand is the Busy Hour Traffic (measured in Erlangs). BHT is the number of hours of call traffic during the busiest hour of the day. Said another way, BHT represents the maximum concurrent channels used during the busiest hour.

In addition to understanding line usage, we need to grasp the idea of a blocking percentage. This means the likelihood of a call being denied (blocked) due to insufficient channels or lines (capacity). When planning for capacity you need to determine the acceptable blocking percentage for an organization. Some will permit only 1% which means 1 out of every 100 calls will be blocked due to insufficient line capacity. Other organizations are willing to accept 2.5% or more.

The last concept we need to cover is the Busy Hour Factor, represented in a percentage. The Busy Hour Factor is the percentage of minutes which are offered during the busiest hour of the day. The default is typically 17% for most businesses open during an 8 hour work window. We use the Busy Hour Factor to calculate the Erlangs based on a certain volume of minutes in a day.

Now that we have these concepts down, let's look at the following scenario:

You are introduced to a customer who is looking to move to Lync Server 2010 and migrate from an existing PBX with 2 T1's. Rumors of an acquisition come true and the company plans to integrate more telephony capacity. You're given the phone statistics for both companies which works out to 37,000 minutes per day.

What is the Busy Hour Traffic (BHT, measured in Erlangs)?

What is the Busy Hour Factor (default is 17%)?

What is the Blocking Percentage?

How many T1's do you need?

How many Mediation servers do you need?

We actually can't answer these questions unless we have an "Erlang B" calculator which can be found here: http://www.erlang.com/calculator/erlb/. But first let's solve what we can. For those of you who wish to solve without assistance, the formula is:

To calculate Busy Hour Traffic, we can multiply the Busy Hour Factor of 17% by the total number of minutes (37,000) then divide that by 60. The calculation looks like this:

37,000 * 0.17 / 60 = 104.8 BHT (Erlangs)

Since the scenario didn't specify a blocking percentage, let's assume 1%. With this assumption and the calculated BHT value, we now have enough information to put into our "Erlang B" calculator to determine the number of lines or channels we need.

This produces 122 lines.

Knowing a T1 can handle 23 lines of voice traffic, we get 5.3 T1's being required. Now you can't have .3 of a T1 so maybe the client is willing to accept a higher blocking percentage to squeeze the traffic into 5 T1's. You can use the "Erlang B" calculator to determine what the blocking percentage would be in this case.

5 T1's can carry 115 channels and with 104.8 BHT this produces a blocking percentage of 2.7%.

Acceptable? Maybe...maybe not. It really depends on the customer.

Now there are other clever ways of squeezing out a few more channels. NFAS is one way in which you can forgo the D-channel on each T1 if you've trunked several of them together. For example, 3 T1's would typically have 3 D-channels whereas with NFAS, you can get away with 1 D-channel between the group of three. This gives you two more B-channels for voice. Multiply that by 5 T1's and you get four more B-channels increasing your capacity from 115 to 119. Using the "Erlang B" calculator again....

This produces a blocking percentage of 1.6%

Not bad at all!

Okay, so bringing things back to reality, we have a recommendation to the customer about how many T1's they need to plan for which is 5 using NFAS. The next question we need to answer is how many Mediation servers we need so let's look at some capacity numbers:

Stand-alone Mediation server with quad 1Gb NIC with dual quad-core CPU's = 950 - 1200 concurrent calls.

Collocated Mediation server with Front-End server = 226 concurrent calls.

Based on our Busy Hour Traffic number of 104.8 Erlangs, even a single collocated Mediation server on a Front-End server can handle all the traffic.

Anyway, I hope this helps some of you understand the importance and complexity of sizing voice channels and servers. Microsoft has done an amazing job at increasing the capacity of concurrency with Lync Server 2010. Comments welcome.

Cheers.

Can't sign into Lync phone over the Edge server using PIN authentication

2011-04-21T09:29:00.000-06:00

Well I'm back from Lync Masters in Redmond. I'll have more on that in another post coming very soon.

For those of you wondering if you can sign into a Lync "Aries" phone (un-teathered) outside your network, the answer is....'well sort of'.

The phone does need to sign in on the LAN successfully at least once so that it 'learns' the path to the web ticket service in order to get a client certificate. The client certificate will permit authentication to Lync if AD is down and plays into the branch survivability story quite well (with a few exceptions). Once the device has it's valid client certificate it will attempt to sign into a registrar by looking up the SRV record in DNS. It only does this one time if it finds a suitable registrar pool to register against. This is an important fact to remember. I'll say it again another way....the phone will NEVER go back to SRV lookup if it has been successfully authenticated against a registrar and signed in.

The phones are designed to cache this information to reduce the burden on the network and to provide a survivable experience. This means if your pool name is "pool01.contoso.com" and the phone signed in against a front-end server, it will try to find that pool by name when you connect it at home or some other remote (outside the LAN) location. Again, the phone will NEVER go back to looking to DNS for the SRV record. If you perform a trace of the traffic you'll see this happen. The phone also caches the web services fqdn and will attempt to connect to it (if you have it published through ISA/TMG).

So how do I make it work?
Well it's simple really....use the name "sip.contoso.com" as your internal host name for your "_sipinternaltls._tcp.contoso.com" record. This name will match your external Access Edge fqdn IP and you should be able to sign in. Now I wouldn't recommend this approach. Just because it can be done doesn't make it a good idea.

If the phone is signed in using a "common area phone" ID, then make sure you use the "Grant-CsExternalAccessPolicy" command to ensure the account can log in remotely.

Watch out!
Be aware of rogue devices leaking out of your network if you set it up to permit this activity. The certificate authentication mechanism will permit the phones to sign in EVEN IF THE AD ACCOUNT IS DISABLED. You must run a "Revoke-CsClientCertificate", disable the AD account for Lync, and disable the AD account to be safe.

Cheers.

RESOLVED: Lync Monitoring Reports are empty

2011-03-03T13:49:00.001-07:00

Recently I deployed an Enterprise pool topology where the client added monitoring and archiving shortly afterward. I had a fully functional Lync environment with all the workloads and capabilities working just great. When we added the monitoring/archiving server I knew to also add the dependent roles/features such as MSMQ because these were always required.

I later deployed the monitoring pack and had a few issues. First, the name of the account used by Lync to access SQL Reporting Services was typed in using the client's domain FQDN (i.e. contoso.local\lyncqoe). This resulted in an error indicating the deployment of the report pack couldn't grant "ReportsReadOnlyRole" and also threw: "Exception calling "Create" with "0" argument(s):".

As it turns out the Lync report pack deployment wizard didn't like the format I used for the username which was "domainfqdn\username". Looking at the username format under the Logins section of SQL Management Studio I noticed it was using the NetBIOS domain name format instead. After running it again and using the legacy NetBIOS style name format, it worked (i.e. contoso\lyncqoe).

The next issue was that the reports weren't showing any data. The services were all started on my Monitoring server and everything appeared to be working fine. There were no errors in the Monitoring server and I couldn't figure out what was wrong. It turns out the Enterprise Edition Front-End server also needs to have MSMQ with Directory Services integration installed to complete the message chain between the FE and Monitoring server.

Once I installed this feature the reports were showing data immediately.

I suppose my feedback to the Lync product team would be that the topology publishing wizard should have failed with an indication that these features were missing on the front-end and that monitoring wouldn't function at all until they were there. There is a hard stop on the Monitoring server role installation wizard....but nothing for the FE servers.

Microsoft Certified Master: Lync

2011-02-15T18:52:00.001-07:00

Here we go....I just received my acceptance into the Microsoft Certified Master program so I'm off to Redmond in March/April for the second Lync 2010 Masters course in Washington.

I'll be sure to post what I can from time to time and illustrate the process and share as much information about the course as possible.

See you on the other side!

Lync Server 2010 (and client) updates are out!

2011-01-21T07:42:00.001-07:00

The first update rollup for Lync 2010 client and server. Click the link below and sort by date (newest first):

http://www.microsoft.com/downloads/en/results.aspx?freetext=Lync+2010&displaylang=en&stype=s_basic

HOW TO: Use Call Admission Control to actually control a call in Lync Server 2010

2011-01-20T14:17:00.003-07:00

So you may have done some reading on what Call Admission Control (CAC) in Lync Server 2010 does and how it can add value in a distributed environment. There are several guides out there on the terminology and overview of CAC but I've found a slight gap in the practical application of it.

Throughout reading the Microsoft documentation on Lync Server 2010 including the CHM file, I've stitched together what I believe is a reference design for CAC and the steps necessary to get it to actually work.

First, you need to make sure you've configured CAC network regions, sites, subnets, policies, links and routes. If you haven't done your reading yet, buckle down and understand the concepts using this link: http://technet.microsoft.com/en-us/library/gg398842.aspx.

At a high level, it looks like this:

Create a CAC Policy Profile (a.k.a. Bandwidth Policy).
Create a Region and make sure you enable the "Enable audio alternate path" option.
Create your Sites, link them to a Region, and assign your Bandwidth Policy (a.k.a. Policy Profile).
Create your Subnets and assign them to a Site.
Optional: If you have multiple Regions, you need to do two things. First, you need to create a Region link stitching together both Regions (i.e. Canada_to_USA_Region_Link). Second, you must create a Region Route even if you have only one Region Link....more on this later.

Enable audio alternate path in your Region

Once you have the network configuration portion complete, you need to make sure you've configured a voice policy for your users which permit rerouting of phone calls and finally enable CAC in your global network configuration.

Enable call admission control in your Global network configuration

Enable PSTN reroute on your voice policy for your users

So with all this configured, let's talk about what happens when you call someone over a link which is bandwidth constrained, has a CAC policy, and doesn't have enough bandwidth. Here's the story:

Jason is in Edmonton where he has a Branch Survivable Gateway.

Anton is in Calgary where he sits next to the Front-End server, Mediation Server, and a Direct SIP connection to Cisco Call Manager.

Both Edmonton and Calgary are connected by a WAN link which is limited to 10Mb.

Jason has a voice policy with the "Enable PSTN reroute" option set to 'enabled' and the "Enable bandwidth policy override" option set to 'disabled'.

Jason calls Anton using his Lync 2010 client.

Both users are in the "Canada" Region which has the option for "Enable audio alternate path" enabled.

The Canada Region contains both the Calgary and Edmonton Site.

The Edmonton site has a bandwidth policy which, based on current bandwidth consumption, is fully consumed. This would normally prevent the call from proceeding.

Instead of the CAC policy stopping the call or sending it to Anton's voicemail, the call is rerouted out Jason's local PSTN gateway as configured in his Lync Server topology.

Nice eh?

Well what happens if "Enable PSTN reroute" isn't turned on in Jason's voice policy? Well the call would end up being answered by Exchange UM or simply denied with a message being displayed to the user.

What if Jason's voice policy has "Enable bandwidth policy override" turned on? Well the call would proceed over the WAN without obeying the CAC policy. You may want to enable this option for special voice policies tied to certain staff members.

What if Anton's voice policy doesn't have the "Enable bandwidth policy override" turned on and Jason calls him and his IS turned on? Well the call will be denied as CAC works both ways. The only way for the call to proceed is if Jason's policy permits PSTN reroute.

Now I'm still learning the underlying framework here and a lot of the "how it works" along with answers to questions in my head remain unanswered. I'll update this post with more detail as it becomes available.

Cheers!

p.s. This ain't your momma's CAC....

RESOLVED: The WS-Management service cannot process the request. The user load quota of 1000 requests per 2 seconds has been exceeded. Send future requests at a slower rate or raise the quota for this user. The next request from this user will not be approved for at least Z milliseconds.

2011-01-17T11:59:00.000-07:00

I did some digging around for this one and found a few crafty articles about adjusting throttling policies using PowerShell and making changes through ADSIEdit (http://reidablog.blogspot.com/). However, none of these seemed to fix my issue.

We had a newly built Exchange 2010 SP1 server which was ready to go into production but kept throwing the error when attempting to use PowerShell. Two other servers appeared to be running fine.

The server had recently received a new SSL certificate using the Exchange 2010 certificate provisioning and assignment process in the GUI. Unfortunately the IIS service hadn't been restarted yet and the URL used for remote PowerShell was using a certificate which wasn't trusted or valid anymore.

A quick "IISRESET" on the server resulted in my fix.

Cheers!

HOW TO: Change default Lync Server 2010 meeting entry and exit announcements

2011-01-15T08:05:00.001-07:00

Back in OCS 2007 R2 when you joined an audio conference as a PSTN participant the server would sound off with a "bong" when a person joined or left the meeting.

With Lync Server 2010 you don't get an audible notification of participants at all. As a meeting organizer you can configure entry/exit announcements using the Online Meeting Options page:

However, when you do this, the conference changes from using your assigned conference ID to a random ID each time you book a meeting. Additionally I've noticed the meeting plugin has a bug where the formatting is lost on a change of any kind using the meeting options. Hopefully this is changed soon.

Instead of messing about on the client side, you can modify the Global policy to turn on these announcements or create separate pool or site-based policies. You can configure these using the "Set-CsDialInConferencingConfiguration" command as follows:

"Set-CsDialInConferencingConfiguration -Identity Global -EntryExitAnnouncementsEnabledByDefault:$True"

You can also create different policies depending on each site, for example:

"New-CsDialInConferencingConfiguration -Identity Site:Edmonton -EnableNameRecording:$False"
"New-CsDialInConferencingConfiguration -Identity Site:Calgary -EntryExitAnnouncementsType ToneOnly"

Well that's all for today.

Cheers.

HOWTO: Change video settings in Lync Server 2010

2011-01-14T10:39:00.001-07:00

Previously with OCS 2007 R2 the Administrator had the option of setting the maximum video resolution on a 'per pool' basis. This was done by right-clicking the server or pool and choosing the properties of the front-end server.

BEFORE (OCS 2007 R2)

With Lync Server 2010 this setting is now only accessible through PowerShell. To view the media configuration for Lync, run "Get-CsMediaConfiguration".

AFTER (Lync Server 2010)

You'll notice from the above screenshot that mine is set to use HD video; the default in Lync Server 2010 is VGA quality. To change this, use the "Set-CsMediaConfiguration -Identity Global -MaxVideoRateAllowed Hd720p15M". Possible options are Hd720p15M, VGA600K, and CIF250K.

You can also create new media configurations on a per site or per service. For example, "New-CsMediaConfiguration -Identity Site:Edmonton -EnableQoS:$True".

Just remember that you need two quad core PC's to do HD video! For a complete list of requirements, visit: http://technet.microsoft.com/en-us/ff536101.aspx

HOWTO: Grant a dial plan to a common area phone in Lync Server 2010

2011-01-13T15:41:00.006-07:00

I suppose you have to read between the lines sometimes. I found this to be extremely frustrating.

To create a new Common Area Phone:

New-CsCommonAreaPhone -LineURI "tel:+17805551212;ext=5001" -RegistrarPool "pool01.contoso.com" -DisplayName "Common Area Phone" -SipAddress "sip:commonphone01@domain.com" -OU "OU=Common Phones,OU=Lync Objects,DC=contoso,DC=com"

I typically like to set the SIPURI in the command so it shows a human readable name instead of a long GUID.

Create a new Common Area Phone client and voice policy as follows:

New-CsClientPolicy HotDeskPhonesPolicy -EnableHotdesking $True -HotdeskingTimeout 00:30:00

New-CsVoicePolicy -id CAPvoicepolicy -AllowSimulRing $False -AllowCallForwarding $False -Name CAPVoicePolicy -EnableDelegation $False -EnableTeamCall $False -EnableCallTransfer $False

Create a special conferencing policy for the phone as follows:

New-CsConferencingPolicy -id CAPconferencingpolicy -AllowIPAudio $False -AllowIPVideo $False

Now, after you've been though all this.......you can't dial numbers which need to be normalized. Do fix this, perform this step below. Personally I'd create a special dial plan for these phones but you can reuse an existing one if you wish.

Get-CsCommonAreaPhone "Common Area Phone" | Grant-CsDialPlan -PolicyName "CAPDialPlan"

To validate the phone indeed has this policy:

Get-CsCommonAreaPhone "Common Area Phone" | Select DialPlan

There seems to be a step missing in the Microsoft documentation which leads a person to believe you're done when you set the policies to the object you've created. Also, when you view the common area phone object through the "Get-CsCommonAreaPhone | FL" command, it doesn't show anything about a dial plan like the "Get-CsUser | FL" does.

VIDEO: How to enable call park and set music on hold

2011-01-12T16:19:00.014-07:00

Greetings,

Here is a quick video on how to enable call park in Lync Server 2010. Couple of things to note:

When using WMA files, they need to be version 9 format encoded at 44khz, 16-bit, mono, CBR, 32kbps.
When configuring a call park range, don't create a dial plan to normalize the numbers. Simply type in the range you want and the Lync client/server will understand what you're trying to call.
You can use Microsoft Expression Encoder 4 (http://www.microsoft.com/downloads/en/details.aspx?displaylang=en&FamilyID=75402be0-c603-4998-a79c-becdd197aa79) to record or re-encode files you want to upload for both call park and the announcement service.

Cheers.

Want to see more videos? Let me know and I'll do my best to post them.

Troubleshooting steps: No audio, video, or desktop sharing with Lync Server topology

2011-01-11T09:17:00.001-07:00

We recently stood up our Lync 2010 Edge server and found a problem with audio/video functionality. The issue appeared to be related to firewall ports but we had recently swapped out our OCS 2007 R2 Edge for the Lync 2010 Edge server and none of the firewall port requirements have changed.

We ended up doing a trace using the Lync Server 2010 Logging Tool. Here are the step-by-step instructions for troubleshooting it:

Install the Lync Server 2010 Resource Kit if you haven't already (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=80cc5ce7-970d-4fd2-8731-d5d7d0829266)
From the Lync Server 2010 Edge, open the Logging Tool.
Enable S4, set the Level to "All", and turn on "All Flags" for the Flags section.
Enable SIPStack and set the Level and Flags to the same as above.
Get ready to place a call and be sure you have one test subject inside your network (behind the Edge server) and another person outside the organization (in front of the Edge server).
Click the Start Logging button.
Place the phone call or start a sharing session.
Wait for it to fail and then click the Stop Logging button
Click the Analyze Log Files button
Click the Analyze button

You should now have a capture of the SIP messages which will tell you how the call was trying to be established.

In the search window at the top, type in "INVITE" and hit Enter.
Click on the INVITE sip:
in the trace and scroll down the window on the right.
Locate the area in blue where it states "a=candidate". You should see a 'candidate' entry for each IP bound to your local PC along with the Edge server's audio/video conferencing IP.

The Lync client will attempt to 'nail up the audio' between the path of least resistance. For example, if someone was on the same subnet (172.16.130.x) then a direct connection would be made between the two of us for audio/video and desktop sharing. If not, the next IP is tried. If you have your Edge server configured properly you should see the public IP. In my case I did not. My issue stemmed from a topology configuration which was incorrect.

When building the topology for your Lync Edge server, you'll be asked if your public IP is using NAT. In the section where this is discussed, other options are available which lead a person to believe the public IP they're talking about has to do with the Access Edge role and not A/V Edge.

My SIP trace showed the INVITE with a candidate IP of my Access Edge role which lead me to realize the issue and change it. Specifically I had to open Topology Builder, expand the Edge Pool section, click on the Edge server, then click Edit Properties. The top section has a checkbox for "NAT enabled public IP address used". This is very poorly worded and should be changed for future builds. The text should read "Use NAT for your Audio/Video Edge public IP" or "Enter the public IP for your Audio/Video Edge role if you're using NAT".

Thinking about it more and more I understand why there is only one entry for a public IP and not one for Access Edge or Web Conferencing Edge. It's just not very clear.

Anyway, I hope this helps a few of you out there with Lync Server 2010 Edge implementations.

Cheers.

Unable to sign into Lync with MOC client (Windows XP and 7)

2011-01-11T08:06:00.000-07:00

I came across an interesting problem recently where some Windows XP and Windows 7 clients running Communicator 2007 R2 couldn't sign in over a Lync 2010 Edge server. We had migrated our environment from a 2007 R2 Edge to a Lync Edge server and all Lync 2010 clients were fine.

After making a few calls and doing some research I found this article: http://blog.tiensivu.com/aaron/archives/1917-OCS-2007,-NTLM,-and-Edge-server-login-problems.html

As it turns out we had to disable the requirement for 128-bit encryption on the Edge and Front-End Lync 2010 servers for it to be resolved. No reboot was required. See the above link for instructions on how to do so.

No audio, video, or desktop sharing in Lync Server with OCS 2007 R2 Edge

2011-01-05T09:39:00.001-07:00

Recently I built up our own internal Lync 2010 Server and thought I had done all the necessary configuration changes to integrate the product with our OCS 2007 R2 platform.

After moving my account over to the Lync 2010 environment and performing a few tests I could quickly see there were a few features which didn't work. I did remember to set the Federation Route at the site level but missed a step at the server level.

If you're running into an issue with remote audio/video and desktop sharing, this might be the fix for you:

Open Lync 2010 Topology Builder
Expand the section containing your Lync 2010 server (standard or enterprise)
Click on the server you want to modify and choose 'Edit Properties' from the right side of the console
Scroll down to the associations section and make sure you have a checkbox in the 'Associate Edge pool (for media components)' section.

If you don't have an option to choose anything for the Edge pool, you haven't specified the OCS 2007 R2 edge server when you merged your topology. If you haven't merged your topology at all, you're reading the wrong article. Go here: http://technet.microsoft.com/en-us/library/gg413057.aspx

Cheers.

Lync 2010: The following UM IP gateways did not respond as expected to a SIP OPTIONS request.

2010-12-17T12:00:00.000-07:00

I recently set up Lync 2010 at our offices and ran into a snag with Exchange 2010 SP1 UM voicemail integration. The symptom was the following error in Exchange 2010:

The following UM IP gateways did not respond as expected to a SIP OPTIONS request.

...along with the Lync client not being able to call voicemail or users being able to leave a message for the Lync user.

Turns out the UM IP gateway in Exchange 2010 which is set up by running the ExchUCUtil.ps1 script doesn't have a port listed in the configuration. This can be viewed by running: Get-UMIPGateway | fl

To resolve it, run Set-UMIPGateway -Port 5061

Cheers!

Junk Mail settings in Exchange 2010?

2010-11-25T07:37:00.001-07:00

In a recent project I was facing a difficult challenge of trying to sort out how Exchange 2010 handles junk/spam mail. Previous versions exposed GUI features to fine tune "spam confidence levels" (SCL) to avoid issues with false positives, or too much real junk.

In Exchange 2010 this appears to be handled mostly at the Edge server level: http://technet.microsoft.com/en-us/library/bb123559.aspx

There is one setting however in the "Organizational Configuration" which needs to be tweaked particularly if you're using a hosted spam filtering solution like many of us do today.

To change the SCL level in the organization use PowerShell:

Set-OrganizationConfig -SCLJunkThreshold n

The default is a level of 4. Valid ranges are from 0 to 9. The lower the number the more likely you'll get false positives. So if you're finding legitimate mail ending up in the Junk Mail folder with Exchange 2010, try to increase the value to something like 7 or 8.

Cheers.

Outlook 2003 clients see folders at root of mailbox with Exchange 2010

2010-10-27T07:35:00.000-06:00

I recently found an interesting but equally strange issue at a client site where we did an Exchange 2010 deployment. The first part of the user migration involved people who all had cached mode turned on for Outlook 2003. The second, and much larger portion of the project involved migrating users who didn't use cached mode (a.k.a online mode).

After migrating a few users over in a pre-pilot, we noticed some people complain about folders appearing at the root of their mailbox folder structure. When viewed in OWA, they weren't there. The project had undergone a Symantec Enterprise Vault 'un-vaulting' process so we quickly assumed it had something to do with that task which caused this abnormality. To make things more troublesome we noticed that if you closed Outlook and re-opened it, a different set of folders would appear, sometimes a larger or smaller set.

After doing some research internally at Microsoft I found several cases of users reporting this issue with a resolution stating it was fixed in SP1 for Exchange 2010. So here is my brief synopsis:

SYMPTOM:

Outlook 2003 users in non-cached mode (a.k.a. “Online mode”) show nested subfolders in the root of the user’s mailbox. Closing an re-opening Outlook produces mixed results with some cases the view having a different set of folders showing up. This appears to not affect Outlook 2003 clients in cached mode, 2007/2010 clients, and OWA users.

CAUSE:

An issue exists with Exchange 2010 RTM (pre-SP1).

RESOLUTION:

Resolved in Service Pack 1 for Exchange 2010.

Cheers!

Catch me at Microsoft TechDays 2010!

2010-09-13T16:17:00.002-06:00

Hope to see some of you there this year. You can catch me involved in the Vancouver, Edmonton, and Calgary sessions!

http://www.techdays.ca/speakers/jason_shave

Microsoft "Lync 2010" and "Lync Server 2010"?

2010-09-12T07:39:00.006-06:00

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=1772A5AD-9688-4861-8387-EC30411BF455

Now when you read the above link information it's clear that a product called "Microsoft Lync Server 2010" is on it's way. What could this be? I'll give you a hint....check the Microsoft web site tomorrow (September 13th, 2010).

UPDATE 1: If you type in www.microsoft.com/lync it points you to a web page (but with an error): http://www.microsoft.com/en-us/lync/default.aspx

UPDATE 2: It's official! Microsoft Lync 2010 is now on the web site http://www.microsoft.com/lync

Cheers!

Outlook profiles don't update when you move a mailbox (Exchange 2010)

2010-09-04T09:43:00.001-06:00

So consider this....

You're performing a migration from a previous version of Exchange Server to the new 2010 platform. You move a mailbox, the person opens Outlook and poof......the profile gets updated. Now let's say the server you've just migrated the account to is an Exchange 2010 all-in-one (hub/mb/cas) server and you move the mailbox to another all-in-one server in a different site. No problem right? Well in the words of a well known Kazakhstan wiseman.......not so much!

Here's the problem. Your Outlook clients will NEVER update their profiles again as long as they can reach the Exchange 2010 CAS role they were moved to originally. This applies to all current Outlook clients including Outlook 2010!

So here's my story:
We were working on a client project where we completed a cross-forest migration from Exchange 2003 to 2010. We built a 3 server all-in-one Exchange 2010 in Canada which would eventually be the final location of the USA mailboxes. To make the move from the USA to Canada possible we set up a local Exchange 2010 server first. This allowed us to perform a cross-forest move locally first, then an online mailbox move over time. The online mailbox move feature in Exchange 2010 worked great. We used the "-SuspendWhenReadyToComplete" switch so we wouldn't interfere with end user connections and resumed the move request at night which flipped the mailbox over. Well we didn't get far before someone noticed Outlook wasn't pointed at the new environment in Canada.

Prior to the migration of any data, we set up our CAS Array in Canada and made sure the RpcClientAccessServer property of each database in the DAG pointed to the new FQDN we created. One would think the Outlook client would check this attribute on first connect to see which CAS server they should connect to but it does not.

Here are a couple ideas to resolve this issue which failed:

1. Running a script to update the Outlook profile using a ".prf" file. Unfortunately this causes the Outlook client running in cached mode to re-cache their mailbox. For an organization with slow WAN links and large mailboxes this can be disastrous. No dice.

2. Create a host entry on the servers in Canada pointing them to the IP of the USA server then updating the DNS record used by clients to have them point to the CAS array. This was less desirable due to the 'jiggery pokery' of meddling with DNS. It didn't work anyway...

3. Disable MAPI clients for a user using "Set-CasMailbox -identity -MAPIEnabled:$false". Have the user launch Outlook. Enable MAPI. Done! That worked.....but impossible to do for several hundred users individually.

I contacted a few Microsoft Exchange team individuals and quickly found out there was only one way to fix this. For Outlook 2003 clients you need to update the profile manually or run a PRF file to update it (causing a re-sync of the OST). For Outlook 2007/2010 clients, a "Repair" of the profile will cause it to wake up and talk to the right server.

So here we have it. Not the greatest solution. We currently have a high severity case open with Microsoft on the issue (as do others). I'll update my post as I know more.

Crap.

Communications Server 14 Voodoo (Aastra phones)

2010-09-01T08:28:00.002-06:00

I come across these interesting tidbits which I like to share with the 800 or so visitors I get weekly.

Aastra sent me a pair of IP phones to help with a customer demo and I've had a few issues setting them up. I suppose it helps if you read the #$@#$ manual but working with beta software/hardware doesn't always yield the same easy to read, or readily available docs.

Anyway, here are a few tidbits to help you along the way:

DHCPUtil.exe: This utility will help you configure your DHCP options for the Aries (Wave 14) IP phones. You need to configure several new DHCP options in order for the phone to work properly. You will find this utility in the \support folder of your W14 media. Using the following syntax, the utility will configure the options for you (highly recommended): DHCPUtil.exe -sipserver -webserver -RunConfigScript

NOTE: You need to run the above utility on your Windows DHCP server. If it's not an x64 OS, you need to install the "vcredist_x86" from the W14 media.

How to do a hard reset: Hold down the "#" + "4" + backspace keys and plug in the phone. Keep them held down until you see a screen asking if you want to reset the phone.

How to test the phone's bootstrap process: On your Communications Server front-end server, open PowerShell and run: "Test-CsPhoneBootStrap -PhoneOrExt -PIN .

Cheers.

Can't move active mailbox database copy (failed content index catalog)

2010-08-27T12:59:00.001-06:00

I've noticed the RTM version of Exchange 2010 suffers from corrupt search catalogs every now and then. You'll notice this by Event ID #123 in the Application log of the server hosting a 'passive' copy of a database. This can be further validated by running:

Get-MailboxDatabaseCopyStatus -server "SERVERNAME"

From the output of the above command you will notice the ContentIndexState shows "Failed" for the database copy. The end result here is that you can't mount the database unless you update the search catalog from another healthy copy in the DAG. If you try to activate the copy you will see an error such as:
"An Active Manager operation failed. Error: The database action failed. Error: An error occurred while trying to validate the specified database copy for possible activation. Error: Database copy 'DB01' on server 'Server01.contoso.com' has content index catalog files in the following state: 'Failed'.

To resolve this, run the following PowerShell command and be sure to specify the database name and servername hosting the failed copy:

Update-MailboxDatabaseCopy "DATABASE"\"SERVERNAME" -CatalogOnly

To confirm the catalog index has been fixed, re-run the Get-MailboxDatabaseCopyStatus command again. Notice the state is now "Healthy". Try the Move-ActiveMailboxDatabase command again and it should work.

What if I only have one copy and I need to activate it?
If this is the case, you can issue the following command to move the database copy and make it active without validating the content index:

Move-ActiveMailboxDatabase "DATABASE" -ActivateOnServer "SERVERNAME" -SkipClientExperienceChecks

I encountered the above situation when performing a DR datacenter switchover at a customer site and this resolved not being able to mount the database.

Cheers!

Event ID: 36885 and the Trusted Root Certificates (OCS2007/CS2010)

2010-08-23T16:05:00.003-06:00

Some of you may have needed (or wanted) to install the latest Root Certificate Update from May 2010 on your OCS Edge server and noticed afterward you can't communicate with the outside world or you've seen intermittent issues with connectivity (Audio/Video/Desktop Sharing/Live Meeting/etc).

May 2010 Root Certificate Updates: http://www.microsoft.com/downloads/details.aspx?familyid=E4F9B573-66D7-4DDA-95D5-26C7D0F6C652&displaylang=en

The latest update adds quite a few new issuers to your local trusted certificate store of the OS. This causes issues with applications like OCS because there appears to be a limit with the number of certificates sent by the server. The remaining list is truncated and if your issuer is on the remainder, you get no connectivity, or in some cases, connectivity with some partners and none with others.

Am I affected?
Enable logging for 'schannel' events as follows:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel

Value name: EventLogging
Value type: REG_DWORD
Value data: 0x3

Look for EventID: 36885 in Event Viewer. The description should read as follows:

"When asking for client authentication, this server sends a list of trusted certificate authorities to the client. The client uses this list to choose a client certificate that is trusted by the server. Currently, this server trusts so many certificate authorities that the list has grown too long. This list has thus been truncated. The administrator of this machine should review the certificate authorities trusted for client authentication and remove those that do not really need to be trusted."

How do I fix it?
There are two ways to resolve this issue:

Method 1: (recommended)

Click Start, click Run, type regedit, and then click OK.
Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
On the Edit menu, point to New, and then click DWORD Value. Type SendTrustedIssuerList, and then press ENTER to name the registry entry.
Right-click SendTrustedIssuerList, and then click Modify.
In the Value data box, type 0 if that value is not already displayed, and then click OK.
Exit Registry Editor

Method 2:

Click Start, click Run, type mmc, and then click OK.
On the File menu, click Add/Remove Snap-in, and then click Add.
In the Add Standalone Snap-in dialog box, click Certificates, and then click Add.
Click Computer account, click Next, and then click Finish.
Click Close, and then click OK.
Under Console Root in the Microsoft Management Console (MMC) snap-in, expand Certificates (Local Computer), expand Trusted Root Certification Authorities, and then click Certificates.
Remove trusted root certificates that you do not have to have. To do this, right-click a certificate, click Delete, and then click Yes to confirm the removal of the certificate.

NOTE: Use caution when removing certificates here. Some certificates are required by Windows. Use the above recommended method if you don't know what to remove. Be careful!

Microsoft Reference: http://support.microsoft.com/kb/933430

Error occurred in the step. Approving object (Exchange 2010 RTM)

2010-08-16T11:32:00.002-06:00

I recently came across a scenario where I needed to bulk import PST's into various user's mailboxes. Since the client wasn't running Exchange 2010 SP1 I had to run through the typical hoops of installing Outlook 2010 on one of the servers.

I was able to import PST's into most of the user's mailboxes except a few. The error was:

"An error occurred in the step. Approving object".

This error coincided with the "Microsoft Exchange Mailbox Replication" service crashing over and over again. I tried one of the two paths below to resolve it however in some cases the error came back.

First, I found out that if the active copy of the database wasn't on the server that had Outlook 2010 installed it didn't work. Quickly moving the active copy to the server hosting Outlook resolved the issue.

Secondly I ran the command "FIXMAPI" which resolved it in one case too.

Sadly this didn't resolve the issue for many of my customer's PST files. A call to Microsoft revealed a private hotfix which was installed on one of the Exchange 2010 RTM servers. The mailbox import command was issued again but this time with the "-MRSServer" switch which pointed at the server which had the hotfix installed. This prevented the MRS service from crashing on the import but resulted in a failure to import the data.

Even with SP1 on the Exchange 2010 servers we've encountered many issues with PST files. Here are some examples of the methods used:

Tried native "Import-Mailbox" cmdlet.
Ran a "SCANPST.EXE" to repair any corruption and try step 1 again.
Use the "Import-Mailbox" cmdlet and use the "-MRSServer" switch to point it at a CAS server with the mailbox server role which is also hosting an active copy of the mailbox and try again.
Run the "FIXMAPI" command at the command prompt on the CAS/MB server hosting the active copy of the mailbox and try again.
If all the above fails, try to open the PST in Outlook 2003 or 2010 and grant yourself full access to the mailbox. Importing the PST file into the mailbox this way can often result in success.
We used Lucid8's "DigiScope" product if step 5 didn't work.
If all else failed we gave up on the effort and informed the user their data wasn't importable.

Cheers!

Unable to set AlternateWitnessServer to $null

2010-08-04T10:05:00.002-06:00

I was working on a project for a client recently where I wanted to use the two Exchange 2010 values called "AlternateWitnessServer" and "AlternateWitnessDirectory" to be a file share and server in a DR facility. I later found out that these settings aren't supported in the RTM version of Exchange 2010 even though they can be populated.

So being the tidy person I am I tried to remove them, or rather set them to a "$null" value as follows:

Set-DatabaseAvailabilityGroup -Identity -AlternateWitnessServer $null -AlternateWitnessDirectory $null

I was met wtih an error message which I don't have at the moment. I later found out that this is a bug in both the RTM and SP1 builds of Exchange 2010. The bug has been pushed off to a post SP1 fix sometime later this year.

If you happen to set these values by accident, the guidance in the mean time is to make them equal to the primary FSW. In other words, make these values the same as the regular WitnessServer and WitnessDirectory entries.

In Exchange 2010 SP1 you can set these values but only when the DAG is configured in DAC mode.
Cheers!

Unable to save all attachments in Outlook 2003/2007 when using Exchange 2010

2010-07-22T10:35:00.000-06:00

Just a quick update here. If you're using Outlook 2003 or 2007 with Exchange 2010 you may have noticed you don't have the ability to save all attachments in a mail message. Rumors about the subject seem to indicate a fix for Outlook 2007 is coming in early August 2010 in the form of a rollup or a "CU". For those of you using Outlook 2003.....sorry to say you're out of luck.

A fix for this issue will not be back-ported to Office 2003.

An exception occurred and was handled by Exchange ActiveSync (Multi-hop Proxying)

2010-07-20T11:34:00.001-06:00

I came across some interesting yet conflicting information about how to set up a multi-site Exchange 2010 environment with an HQ location and branch office. In my scenario I have a branch office server hosting CAS/HT/MB roles in Exchange 2010. My HQ office has a multi-site DAG with 3 Exchange 2010 servers also hosting CAS/HT/MB roles.

In the HQ site I have a CAS Array established 'outlook.contoso.com' where I point all my autodiscover services for each server in the organization.....or so I thought. As it turns out, the Microsoft article (http://technet.microsoft.com/en-us/library/bb310763.aspx) does a great job of outlining not only the settings you need for non-internet facing CAS servers, but HOW it all works. I had been given advice from a reputable source who indicated the non-internet facing CAS server (branch server) needed to have the Exchange ActiveSync virtual directory set to the CAS Array fqdn and not the server name. This turned out to be incorrect and resulted in the following error:

Clients were unable to sync their devices after making the change. It took a while to figure out but I did have to re-trace my steps on what changes I had made.

So, just remember, for your non-internet facing CAS servers, keep the virtual directory URL's set to the server's fqdn.

For reference, this can be changed using PowerShell as follows:

Set-ActiveSyncVirtualDirectory -Identity "name" -InternalURL https://.contoso.com/Microsoft-Server-ActiveSync

Cheers!

Why I hate the Google Nexus One

2010-05-22T17:30:00.000-06:00

I suppose it's my own fault. I was crossing the river on my quad and had my iPhone in my pocket when i broke through the ice, flipped onto my back, and sunk up to my chest in freezing cold water. My iPhone was in the pocket of my waterproof pants which unfortunately had a sizable hole permitting the icy cold Athabasca water to penetrate and destroy the one techno-toy I can't live without.

After a few days of trying to dry out the phone and seeing nasty water marks under the screen I was finally able to boot it and get to the home screen. I quickly found out everything worked! Well except for the home button. Now if you think about it, the home button holds a significant place on the iPhone; try living without it!

So off I went in search of a new phone. The smartphone market in Canada is rather bland. We often have to wait months and sometimes longer (in the case of the iPhone) to get what the USA can. I read Engadget from time to time and see all sorts of wonderful prototypes and interesting phones we can't get here. After reading a few reviews of the Android OS and stopping by the Google site I noticed that day that the Nexus One had been released for customers on the Rogers network here in Canada. Woooohoooo! So on a Wednesday afternoon I stepped through the quick order process and even tagged the back with my name and company to see how the quality was. I did read up on the hardware specifications and support for ActiveSync which appeared to be fully supported. By late late Friday I received the phone.

Nice packaging. They've obviously modeled the hardware and packaging after the iPhone. Copy cats.

I charged the phone and quickly began to configure my Google account. The phone locked up solid after 10 minutes. Shit. What the? Okay, take out the battery. Boot the phone again. Everything is good for another 30 minutes until I start to configure ActiveSync. Now I've never seen this done before but Google seems to have forgotten to finish what they started when it comes to support for ActiveSync on the Nexus One. No Calendar or Global Address List support. Are you kidding me? $550+ bones for a phone that pushes email and my personal contacts? No way. I've just been had!

Okay, maybe I'm demanding too much from Google here but I hardly think so. This is Android 2.x already. Get with it. I have to say I was seriously pissed off. To be a corporate mail user and not have access to my Calendar and GAL? I'm lost without it. The 3rd party add on applications you have to buy to get full ActiveSync support are garbage too. I've tried the Google Calendar Sync application which by the way doesn't work with Outlook 2010....unless you have a hacked EXE copy....which I do....and it still sucks. I only get syncing for new calendar items. I'm missing meetings all the time. I can't view, create or accept meeting invitations at all.

So what about the rest of the phone? Well the screen is terrible viewing it in sunlight. When you press an image on the screen like a letter on the soft keyboard or an icon, it's almost as if the image on the screen should be higher up. If they literally shifted up the touch sensor or shifted down the image on the screen, things would line up better. I hate typing on it. The iPhone uses a predictive typing and touch proximity adjustment algorithm to help you NOT press the wrong key when spelling a word. It actually makes the sensor area around english spelling characters bigger so you have a better chance of hitting the right key all on the fly as you type. The Nexus One does not. I'd have to say this single feature is almost as much of a killer for me as is the ActiveSync half-support rubbish.

I own a new Ford vehicle with the Microsoft Sync system which works pretty good most of the time. I was able to sync my wife's iPhone and my own just fine. There are the odd scenarios in which the software on either side has a few bugs but nothing too bad. With the Google Nexus One, if it connects via Bluetooth for hands-free it will magically start to play music. I can see the icon on the phone show a 'play' symbol which is confirmed if I change the input on my stereo to the media feature. I can't understand why my phone thinks I want to play music when I'm not asking it to or when I'm on the phone. This really kills the battery by the way.....more on this later. So I turn off my truck and all of a sudden the Google Nexus One starts blaring music out the external speaker! Then the phone locks up again....while playing music. So I'm now fiddling with buttons and the back cover to take out the battery. I'm just about to chuck it across the parking lot when I realize I have several emails to check up on and phone calls to make. Now as funny as this may seem, it really pisses me off. This is clearly a software issue and should have been well tested and resolved in version 1.0.1 of the platform.

The phone is unresponsive to touch sometimes. The battery is lucky to last an 8 hour day with me placing 2-3 calls and receiving 3-4 calls per day. With the Bluetooth issues mentioned above I almost always turn it off which gives me maybe another hour or two in the day.

Hardware and software issues aside, Google has a lot of catching up to do. Apple has iTunes which offers movie rentals (in Canada too!), music downloads (and yes they have the Dead Milkmen!), and an amazing app store with an interface which offers over the air downloads and previews, etc. The Nexus One has Amazon MP3. I almost laughed myself out of my plane seat when I tried several times to find a few of my favorite albums. No other platform in the world has mastered the integration between online media services and hardware devices like Apple. They've done an amazing job here and all others will be judged in comparison to their success.

So my recent trip to Redmond, WA was fun. I managed to track down an HTC HD2. More on this one later but for now I'm carrying two phones and still feeling like combined they're years behind the iPhone.

Favorite Exchange 2010 SP1 features - Part 1

2010-05-09T18:19:00.001-06:00

There is much to talk about but only so much we can say at this point. Exchange Server 2010 Service Pack 1 adds a few nice to have features people have been asking for. Some are nice to have while others are imperative to operating a large-scale mail environment.

In this post I'll talk about a few of the optimized visual enhancements in Outlook Web App 2010.

THEMES:

In previous versions of OWA you could customize the look slightly by changing the color to a few simple selections. In Exchange 2010 SP1 you have quite a few built-in themes to meet the needs of just about anyone. Here are a few samples:

The themes are selectable through the Options button in the top right corner and don't require switching screens or clicking through multiple menus. The themes apply instantly and change text color along with the top banner image to give Outlook Web App the style you're looking for.

IMPROVED UI:

Outlook Web App SP1 now simplifies the reading pane and action buttons so the user can see more of the content and less wasted white space. The end result is a better viewing experience on size constrained displays such as Netbooks.

PERFORMANCE:

Improvements to performance have been made all over. Moving from message to message, deleting content, viewing calendar data give OWA 2010 SP1 a fresh feel. Official performance improvement numbers haven't been released yet but the general feel is quite positive.

Well that's all I can say for now. Check back again soon for more.

DSC_E_NO_SUITABLE_CDC error with Exchange Server 2010 (SACL right)

2010-04-21T10:28:00.003-06:00

I'm in the middle of a project at a client site where we've completed both the initial preparation tasks and installation of various server roles for an Exchange 2010 implementation. Somewhere between last Tuesday and Friday our three server Exchange 2010 stopped working. The symptoms included:

Booting the server would take anywhere from 30 minutes to 1 hour while waiting for "Applying Computer Settings" to finish.
Once the CTRL-ALT-DEL screen was available and you authenticated, it would take anywhere from 30 minutes to 1 hour while waiting for the "Applying User Settings" screen to go away.
The Microsoft Exchange Information Store service would be stuck in a "starting" state.
The Microsoft Exchange Transport service would also be stuck in a "starting" state.
The event viewer would show MAD.EXE with an error code of 0x80040a02 (DSC_E_NO_SUITABLE_CDC).

Event Viewer would also show MAD.EXE. All Domain Controllers in use are not responding.
Event Viewer would show MSEXCHANGEADTOPOLOGYSERVICE.EXE. Topology discovery failed.

As it turns out the organization may have modified their Default Domain Controllers GPO. The modification was in a setting under Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment. The setting they've changed is "Manage auditing and security log" which contained the global group called "Exchange Enterprise Servers" among others. The key issue here is that it DIDN'T contain the "Exchange Servers" Universal Group.

Over time the DC's will re-apply GPO's and overwrite the security put in place by the setup.com /prepareAD process during setup. I was able to replicate this issue in my lab environment by removing the Universal Group, breaking Exchange 2010, then adding it back to the GPO, and fixing it. The Microsoft TechNet article which discusses the AD preparation tasks http://technet.microsoft.com/en-ca/library/bb125224.aspx shows the process making a change to the "Manage Audit and Security Log" value on the very last bullet on the bottom of the page.

One of the things you can do to determine if you have the same issue is to look for Event ID 2080. This event will show up in a healthy or unhealthy environment and will show you if the SACL right attribute is equal to "1" which is necessary.

The following image shows a "healthy" Event ID 2080 where the SACL right property on the first DC it found is equal to 1. If you count backward from the OS Version, Netlogon, Critical Data attributes (1, 7, 1, then you find the 1 assigned to SACL right).

In an unhealthy situation you will see a zero (0) in the SACL right column.

A word about IPv6 and Exchange Server 2007 and 2010

The biggest red herring I found when troubleshooting this one from articles others had posted was related to IPv6. I see quite a few people suggesting IPv6 is required for Exchange 2007 and 2010. This is NOT true. As a matter of fact, if the server hosting Exchange 2007 or 2010 is a DC, then IPv6 must be enabled otherwise simply uncheck the checkbox in TCP/IP properties on all connected interfaces. You don't need to buggar with the registry to "really disable it"....just uncheck the checkbox.

Cheers.

Load balancing Exchange 2010 OWA

2010-03-25T10:38:00.001-06:00

In a recent post: http://jasonshave.blogspot.com/2010/03/i-been-spending-much-of-my-time-la.html I talked about how to load balance an array of Exchange 2010 CAS servers using a Citrix NetScaler VPX.

In this post I wanted to take a step back and offer a more simple configuration for those of you wishing to load balance basic HTTP/S traffic between your Exchange 2010 CAS servers. One of the primary reasons for this is to provide high availability for internal (or external) clients. The types of connectivity you can expect the NetScaler to see includes both direct and indirect traffic. Direct traffic would be a user opening a web browser and navigating to your load balanced OWA servers. Indirect traffic would be Outlook 2007 or 2010 connecting to the Autodiscover service connection point (SCP).

STEP 1: Setting up HTTP Services
If you followed my previous article on how to set up servers and services, then this should be easy for you. If you haven't, go back and read those steps.

Create a service for each server you wish to load balance to. I've given mine a name of "svc_http_jcsexchcal" for my Calgary server and "svc_http_jcsexchedm" for my Edmonton server and so on.
The service should have HTTP as the protocol and 80 as the port number.
The monitor can be left at TCP for now.

STEP 2: Setting up HTTPS Services

You'll need to perform the same steps for the SSL services with a few differences.

When you create the service use the same naming convention but alter it accordingly (i.e. svc_https_jcsexchedm).
The service should have a protocol of SSL_BRIDGE and a port of 443.
The monitor should have both TCP and HTTPS.

STEP 3: Setting up an HTTP Virtual Server (redirect)
You may be asking yourself at this point why I need HTTP services? You'll need them for your redirect from HTTP to HTTPS. You want to make sure a person is redirected to the SSL site when they type in the base URL.

Create your virtual server with the same IP as your CAS array if you wish and give it a proper name such as "vs_http_webmail".
Set your protocol to HTTP and port to 80.
Add your HTTP services (i.e. svc_http_jcsexchedm and so on)
Click on the Advanced tab and type in the full path of OWA into the redirect URL (i.e. https://webmail.lvsedmtest.ca/owa)
Click on the Disable button to make sure the vserver is in a "down" state. You want to do this because the redirect won't work otherwise.

STEP 4: Setting up an HTTPS Virtual Server

This is the virtual server actually accepting connections, both direct and indirect.

Create another virtual server with the same IP as your CAS array and HTTP vserver.
Give it a proper name such as "vs_https_webmail".
Set your protocol to SSL_BRIDGE and port to 443.
Add your SSL_BRIDGE services to the vserver (i.e. svc_https_jcsexchedm and so on).
Click on the Method and Persistence tab and be sure to set the LB Method to Round Robin and your Persistence to SOURCEIP with a timeout of 15min and mask of 255.255.255.255.

At this point you should have your two new services with the vs_http_webmail service in a "out of service" state. This is normal. The effective state will be "down". Your vs_https_webmail service should be "up" and "up" for both state and effective state. Try it out by browsing to your OWA URL and see how things work. Try disabling services, pausing VM's, and disconnecting network cables to simulate various failures. Record your results and convey the expectations to management and your user community. They will ask the questions anway....."what happens if......".

STEP 5: Setting up Exchange 2010
We need to make changes to AD and Exchange 2010 so clients can find your newly created vserver(s). First we need to modify the SCP's for each CAS server and make sure all the internal URL's point to the NetScaler's VIP.

The services we're going to modify include:

Autodiscover
Exchange Web Services
Offline Address Book
OWA Virtual Directory

Autodiscover:

Run the following on your E2010 server using PowerShell (Get-ClientAccessServer |fl auto*). This will spit out the Service Connection Point (SCP) settings which probably point to the server fqdn.
As an example run (Set-ClientAccessServer jcsexchedm -AutoDiscoverServiceInternalUri https://webmail.lvsedmtest.ca/autodiscover/autodiscover.xml). You can run the Get-ClientAccessServer command again to view the changes.
Run the above command for each CAS server you have.

Exchange Web Services:

Run the following on your E2010 server using PowerShell (Get-WebServicesVirtualDirectory |fl Server, InternalUrl). This will spit out the defined URL for each CAS server.
As an example, run (Set-WebServicesVirtualDirectory -identity jcsexchedm\ews* -InternalUrl https://webmail.lvsedmtest.ca/EWS/Exchange.asmx)
Repeat for each CAS server.

Offline Address Book:

For this one I just leave things as is. You don't typically need to load balance the OAB. If you run a (Get-OABVirtualDirectory |fl Server, InternalUrl) you'll notice the default is to use HTTP and not HTTPS. I typically leave each server hosting the OAB.

OWA Virtual Directory:

This is key to Outlook Web App when you have an environment with a mixed environment of Exchange 2007 and 2010. These settings help with redirection and proxy connections coming from OWA clients. For example, if you have an Exchange 2007 environment with users homed on it and you've installed your first E2010 CAS server you should be pointing them to the new box. You should also have a legacy URL for your 2007 CAS servers (i.e. legacy.domain.com). Using PowerShell you would modify the InternalUrl parameter to be "https://legacy.domain.com/owa" for each 2007 CAS server so that your E2010 CAS servers know where to send users with a 2007 mailbox to when they authenticate through OWA.

Run (Get-OwaVirtualDirectory |fl Server, InternalUrl) to see how things are set up in your environment. Following the same logic here you want to make sure all the URL's for each object on each server point to the same name.
You need to switch things up here a bit and add the -identity parameter to the PowerShell command ensuring your modifying the servers you actually want to change. As an example run (Set-OwaVirtualDirectory -identity JCSEXCHEDM\* -InternalUrl https://webmail.lvsedmtest.ca/owa).
Repeat for each E2010 CAS server you have.

One thing to note here is that we've only configured the InternalUrl parameter for the various services. Each of them have an ExternalUrl parameter as well with the exception of Autodiscover. If you're using ISA or TMG to front your OWA/EWS/Autodiscover connectivity (which you SHOULD be doing), then be sure to modify the ExternalUrl's as well. Quick example: Set-OwaVirtualDirectory -identity JCSEXCHEDM\* -ExternalUrl https://webmail.lvsedmtest.ca/owa. In my environment the "webmail.lvsedmtest.ca" name resolves to my NetScaler's vserver VIP when I'm inside the network and the same name resolves to my public IP bound to my TMG server. This is called "split horizon DNS" and is essential if you don't want to confuse your users with different URL's for inside vs. outside connectivity.

Anyway, that's enough for now. Enjoy.

Can't see call logs or voice mail on Tanjay (CX700) with Exchange 2007 and 2010?

2010-03-16T09:41:00.001-06:00

We had an issue with our Exchange 2010 and 2007 environment recently where some users were migrated to our Exchange 2010 servers and activated for Unified Messaging and their call logs and voice mail weren't showing up on the Polycom CX700 (Tanjay) phones.

During our involvement with the Exchange 2010 TAP program we implemented a single all-in-one server. In order to keep everything working and reduce the potential for outages we decided to keep our 'autodiscover.domain.com' record pointing at the existing Exchange 2007 environment. Everything seemed to work fine except the CX700's. It turned out to be resolved by pointing the Autodiscover record at our Exchange 2010 environment which didn't cause an issue for our UM users on 2007 with CX700's either.

This was pretty much our own fault since the deployment guidance from Microsoft suggests migrating to a 2010 CAS server out of the gate. Anyway, live and learn....

Load balancing Exchange 2010 CAS servers (CAS Array)

2010-03-03T09:59:00.003-07:00

I've been spending much of my time lately working on Exchange 2010 designs for customers here in Canada. One of the common design scenarios we propose is a multi-server DAG with all roles collocated on the same server. When installing multiple Exchange 2010 servers you'll notice that each collocated (MB/HT/CAS) server has a default database. I typically remove the database and create my own with it's own name and file location rather than moving and renaming the default....personal preference. Either way, when you create a database or use the default database on an E2010 MB server there is an attribute called "RPCClientAccessServer" tied to the database which needs some special attention if you intend on load balancing the CAS server role. I'll come back to this in a few moments...

You may know by now that the CAS server in E2010 actually takes on a more critical role than before. In previous versions of Exchange (2007-) the CAS role basically handled IIS (web) traffic for Outlook Web Access users and that's about it. Now with E2010 the CAS role actually handles MAPI/RPC traffic. This means your Outlook 2003/2007/2010 client traffic on the LAN will not connect directly to the database server, but rather the CAS server. Where this becomes more of an impact in deployments is when you want to provide redundancy and DR capabilities to Outlook clients. The clients are configured to "talk" to a specific server initially....and if you have lets say three all-in-one E2010 servers with users in mailboxes on each system, their client settings in Outlook are going to show the specific name of the E2010 server hosting their mailbox. So what if that server goes down? Will the client connect to another server hosting a replica of the database? The answer is no....because you haven't created an RPC Array or set up anything else.

First off if you're wanting to load balance between multiple collocated servers in a Database Availability Group (DAG), you need a hardware (or virtualized) load balancer. Personally I prefer the Citrix NetScaler VPX since it works with VMWare vSphere 4 and the basic model is free and downloadable as a virtual appliance. You can't use NLB since the DAG is using Windows Clustering components and collocation of those technologies isn't supported.

Setting up your hardware load balancer

Let's walk through the setup of the load balancer first. With your hardware load balancer you're going to define a name and IP used by clients to connect to E2010....let's say "webmail.lvsedmtest.ca". This name needs a DNS record on your corporate DNS server and you need to pick an IP address.....let's say 10.10.10.252. Once you've created your DNS host record for the name, we need to configure the load balancer. In my example I'm load balancing to 4 all-in-one servers (see image). Each server and the IP address has been defined in the NetScaler VPX UI.

First, create/define your servers and IP's. These will be later linked to your services which are then bound to the Virtual Server.

Now I need to create a monitor to keep track of the RPC services for each server. Later I'm going to bind this monitor to each RPC service for each server. I use the format of "mon_" for monitor, "rpc_" for the type of monitor, then "cas" for what I'm monitoring. The monitor name is "mon_rpc_cas" and has no specific IP....but rather it has port 135 listed as the port to check to determine if it's operational (up) or not (down).

Now I'm going to create RPC services for each server I need to load balance to. Each service name contains the format of "svc_" then the type "rpc_" then the server name "jcsexchcal" so the entire name looks like "svc_rpc_jcsexchcal". The first service name I've created is linked to the "jcsexchcal.lvsedmtest.local" server (defined earlier) and has both a PING monitor but also the mon_rpc_cas monitor tied to it. This step is critical otherwise your services won't operate in an up/down state properly. You need to repeat this step for each server/service you want to load balance to.

Next I need to create a "Virtual Server" which contains all my services, the IP address, and load balancing attributes (i.e. round robin vs. least connection). I've chosen the name of "vs_" for virtual server, then "rpc_" for the type of data I'm load balancing, then "webmail" for the DNS host name I'm load balancing so the entire name looks like "vs_rpc_webmail". My IP address is 10.10.10.252 which is linked in DNS to "webmail.lvsedmtest.ca". Each service in the UI should show "UP" in the state column by this time by the way! You will want to make sure you click on the "Method and Persistence" tab to set the timeout value to 15min to ensure connections persist with the same CAS server. This will prevent odd re-login issues with OWA.

Great. Now you have a load balanced RPC cluster that can serve up traffic for Outlook clients. Now back to Exchange since we're not quite done there yet.

Setting up the Exchange CAS Array

The CAS Array is a new feature in E2010 which needs some PowerShell hands-on to create and configure. When you define the CAS Array a "site" parameter is specified which is used to determine which CAS servers are a member of the array. You don't actually pick the CAS servers when you create the array. I use the "New-ClientAccessArray" command as follows:

New-ClientAccessArray -fqdn webmail.lvsedmtest.ca -site Default-First-Site-Name -name "CAS Array 1"

At this point if you create any new databases on CAS servers in that site, the "RPCClientAccessServer" attribute will be set to the CAS Array fqdn. I mentioned this at the beginning as an important point because any existing databases you create or databases created during Exchange setup will have the attribute set to the server in which they were created. You will need to change this attribute using the following PowerShell command:

Set-MailboxDatabase database01 -RpcClientAccessServer webmail.lvsedmtest.ca

To view the RPCClientAccessServer attribute currently set on all databases:

Get-MailboxDatabase |fl rpc*,name

This means if you have users within the database you don't have to move them....just update the attribute to be "webmail.lvsedmtest.ca" and their Outlook clients will update too.

Performing a connection status on Outlook will show a TCP/IP connection (not RPC/HTTPS) to the fqdn of your CAS Arrray!

Cheers!

Issues using DPM 2010 with an Exchange 2010 DAG

2009-11-27T10:43:00.002-07:00

I've been "playing", well not really. I've been testing....ya that's it....testing Microsoft's beta version of System Center Data Protection Manager 2010 in conjunction with Microsoft Exchange Server 2010. The tests I've been conducting involve backing up and restoring Exchange servers in a Database Availability Group (DAG). I've also been trying to break the DAG replication by pulling the network cable from a server and watching the outcome. For the most part everything is working quite well however I did come across an interesting issue which deserves discussion.

Exchange 2010 Setup: 4 server DAG with 3 database copies and 1 "lag" copy.
DPM Setup: 1 DPM 2010 server protecting the active copies of my 3 databases in the DAG.
Test procedure: Moved active copy of "Database01" from one server to another (waited about 1-2 minutes) then unplugged the network cable from the server hosting the active copy.

I noticed first off that my lag copy of the database was in a "suspended" state. I've seen this once before but wasn't sure what or why this happened.

(Database "suspended")

I logged into my server hosting the lag copy and looked into Event Viewer. I found an Event ID 117 which stated "the copy of Database01 on this server experienced an error that requires it to be reseeded".

(Database needs to be reseeded)

A few lines down I found Event ID 3145 which stated there was a missing log file which has caused the incremental reseed to fail.

(reseed is required due to missing log file)

I decided the only way to get back on track is to perform an "update database copy" command through the EMC.

I then selected my source server...

I now have a healthy copy of my database....buy why did this happen?

My only rational thought on this one is that DPM ran a synchronization which truncated the logs on my server hosting the active database (jcsexchvan). When I perfomed a "move active database" as part of my tests, it moved to my other server (jcsexchcal). I then performed a physical failure of that server and my 3rd server (jcsexchedm) picked up the active copy. Somewhere in this transition the log file truncation process kicked off on "jcsexchedm". It was at that point my lag copy database on server "jcsexchtor" tried to pull the necessary log files and couldn't find them because the last "Active Manager" in the DAG told it to get them.

This scenario seemed to be a bit of a "perfect storm" case which I was happy to capture. However, during the writing of this article I've tried it again (move active copy, then fail that server) and I get the same result!!

I'd like to get to the bottom of this so if anyone has any insight I'd appreciate feedback. The only thing I can say for sure here is that you'd better make sure you have some form of monitoring software like System Center Operations Manager 2007 R2 to catch these events otherwise you could be in serious trouble.

Cheers.

Little known fact about load balancing OCS 2007 R2 Edge servers...

2009-11-08T20:53:00.000-07:00

I spent some time helping a team member recently with an issue relating to OCS 2007 R2 Edge servers and F5 Neworks load balancers. The effort involved troubleshooting Live Meeting connectivity to remote users. The behavior was such that the remote user would connect to the Live Meeting briefly, then disconnect.

A call to Microsoft support resulted in the engineer indicating port 8057 shouldn't be load balanced. Upon posting to an internal Microsoft forum site, I was informed that this is in fact true. Also, the Microsoft employee indicated the way you should be configuring the web conferencing edge server configuration is to list the actual server names in the internal fqdn entry of the properties of OCS. To do this follow these steps:

Right-click your Enterprise Pool and choose Properties, then Web Conferencing Properties.
You need to add entries for each web conferencing Edge server in your environment. Click the Add button and type the name of the server in the internal dialog box (i.e. serverA.dmz.contoso.com). Then type the external load balanced "shared name" (i.e. webconf.contoso.com).
Repeat the same process for each Edge server you're load balancing to making sure the internal name represents the actual server name.

Now thinking about this setup you would assume the certificate bound to the internal interface should represent the "shared name" of the internal load balanced virtual IP right? Well I'm told the answer is no. If your Edge servers' internal interface fqdn is "ocsedge.contoso.com", you don't need subject alternative names for each server along with it. What strikes me as odd here is that I've just spelled out the need for specifying the Edge server's fqdn within the pool server yet you don't have to "line up" the name in the certificate.

If you investigate the documented firewall rules on the Microsoft web site, port 8057 over MTLS is used. I'm still puzzled as to how you can have MTLS working without the certificate names matching the name(s) defined in the pool settings.

Another poorly documented configuration is the firewall rule required to make Live Meeting work with hardware load balancers and multiple Edge servers. Yes, you need to permit port 8057 from "any" to the DMZ but don't send it through your load balancer. Make sure the rule permits 8057 traffic from the LAN to the internal interfaces of each Edge server.

That's all for now.

Cheers.

WARNING about KB974571 and Event ID 12290 -updated

2009-10-13T20:49:00.002-06:00

!!UPDATED!! Please see below....

We've found that the update released by Microsoft today (October 13, 2009) to fix CryptoAPI issues will cause OCS services to fail.

The server will log event ID 12290 which says:

"The evaulation period for Microsoft Office Communications Server 2007 R2 has expired. Please upgrade from the evaluation version to the full released version of the product."

The server will then log event ID 12299 with the error code:

"C3E93C23 (SIPPROXY_E_INVALID_INSTALLATION_DATA)"

The KB article can be found at: http://support.microsoft.com/kb/974571

~~To fix the issue, remove the patch and restart the server.~~

UPDATE (October 26, 2009) a new update has been released which resolves this issue. It can be found at: http://support.microsoft.com/kb/974571

Exchange 2010 - Archiving and Compliance

2009-10-05T22:21:00.002-06:00

There have been a number of discussions I've been in lately which surround the compliance and archiving requirements of customers as they pertain to email, specifically Exchange Server. Many organizations who require messages to be retained and searchable for legal reasons resort to 3rd party technologies such as Symantec's Enterprise Vault platform. These add-on applications provide enhancement to the base functionality offered by Microsoft Exchange (and other email software), but often do so at the expense of the end user....and the pocketbook of the company implementing them.

Let's talk about compliance first...

In previous versions of Exchange you were at the mercy of 3rd party tools to provide a half-baked solution to the legal and regulatory requirements for mail retention and ease of search. One of the most concerning "holes" in Exchange was the ability for a user to send/recieve a message then delete it (soft [deleted items] or hard [shift+delete]), then open the "Recover Deleted Items" feature (a.k.a. the "Dumpster") and purge the messages. If you performed this task before a backup, the message(s) were never retained. If the user's mailbox was moved, the Dumpster information is not retained.

If you were a compliance officer and needed to search a mailbox for content, the process wasn't easy. There were security issues, and knowledge of PowerShell was required. If you needed to search data which had been archived to tape the process could be cumbersome and very time consuming.

Along comes "Dumpster 2.0" in Exchange 2010. Now messages that are purged from the Dumpster end up in a folder called "Purged" which is hidden from view. The user thinks the message has been purged however it remains. A compliance officer can now search the mailbox and discover the data. Since the Dumpster (including the purged items) are part of the user's mailbox now, they move when the mailbox moves and data is always preserved.

Using the new multi-mailbox search tools in Outlook Web Access, a compliance officer can now be assigned a role for discovery (using RBAC) of data and use a familiar, easy to use interface, to perform searches.

Moving along to archiving...

This one has been a hot topic lately. Archiving in Exchange 2010 consists of enabling the "archive" mailbox for a user either using PowerShell or the EMC which resides on the same disk as the primary mailbox. I know when I was in Dallas for Exchange Ignite earlier in 2009 there were a lot of people who were disappointed to hear about the technical details of archiving in Exchange 2010 (including myself....initially). Over time though I've looked back at what our customers are looking for strictly from a requirements perspective and what problems we were attempting to solve. Unfortunately in the process you sometimes trade one headache for another which is commonly the case with 3rd party tools and add-ons.

Looking strictly at why we recommended these tools in the past, the reasons were primarily to overcome issues with performance, stability, data retention, and compliance. In other words it was more about providing a solution to several problems than simply "archiving" for the purpose of recovery. So let's look at these requirements in more detail:

Archive because of PERFORMANCE: Sure, back in Exchange 2003 (and possibly in 2007) it made sense to move mail off of "expensive" fibre channel SAN disk and onto less expensive SATA disk. This also helped with memory management in that Exchange was limited to a 4kb page size; less data to cache, better performance.

The Exchange 2010 answer...don't archive because of performance. You can now run your primary and archive mailboxes on the same disk with the improvements in database schema and disk I/O. Also, the long sync time for Outlook clients no longer becomes an issue since the locally cached copy of the data contains only the data from the primary mailbox and not the archive. You can still access the archive data while "online" through Outlook Anywhere or OWA as well. The biggest misconception here though was that if you removed the data, the problem was solved. Well perhaps it helped due to the page size limitations however it's more about "item count" than actual message size. A folder with 1000 items will suffer long delays when sorting and searching no matter how large each message is. When the count increases, so does the delay. These delays are caused by high IOPS against the ESE and disk.

Archive because of STABILITY: Again, back in previous versions of Exchange you could have users with very large mailboxes and with a very very large number of items per folder. You may have even run up against the 10,000 item count limit in Exchange 2007. Mailbox corruption was a concern and the idea of reducing the size gave the corporate world the sleepy pills to rest with ease.

The Exchange 2010 answer...don't archive because of stability. Mailbox corruption has pretty much been eliminated; and I say pretty much because I've never come across it with 2007 and I've never heard of it....but then again I'm not "all seeing and all knowing"....yet. Item count in Exchange 2010 has been increasaed to 100,000 and the underlying features to help with corruption extend to the various layers from the page entry to the item level. If you've implemented Exchange 2010's new Database Availability Group feature you have multiple levels of corruption protection and self healing.

Archive because of DATA RETENTION: Ah-hah! Now we're onto something. If you need to retain data for longer periods of time you might want to save this information for quite some time. For some organizations this data is an asset up to the first day past the seventh year, then it becomes a liability. You may have deployed an archiving solution to preserve (and purge) data according to your company's retention policy.

The Exchange 2010 answer...Not much different other than the message would be to keep as much mail in Exchange as you can or want to. Use the new retention tags/policies in Exchange 2010 to manage the mailbox size over time.

Archive because of COMPLIANCE: Due to the lack of any sane method of e-discovery in previous versions of Exchange, you would typically install a tool to enhance this portion of the product. These tools often give someone the ability to perform searches using a web interface and will return data in the database. Remember, you won't always get an accurate representation if the user purged the data.

The Exchange 2010 answer...Don't archive because of compliance. Exchange 2010 includes a web interface for e-discovery and using role based security, you can assign permissions to do these tasks.

The four concerns I have with 3rd party tools are as follows:

The cost. These tools are not cheap. Maintenance alone can eat you alive and in times of cost cutting, you could easily win the employee of the month coupon for saving some dough here.
Interoperability. Have you ever been blocked from upgrading to a service pack or new version because the integrated software isn't compatible? These types of blockers can be a real pain for the IT department and could put the organization at risk.
The user experience. This one is the most concerning. You shouldn't implement a platform which changes the user's method for searching and dealing with messages which have been archived. You lose out on existing, and new features such as message preview, the reading pane, and conversation view. Even more annoying is the inability to search/retrieve messages on your mobile phone! Don't degrade the user experience!
Administration. All IT staff are gods anyway so this one doesn't hold much water. The boundless nature of one's brain is truly astounding. Seriously though, another tool, more training....yadda yadda. Junk it!

So that's all for now. I'm tired. Need sleep.

Cheers!

Messaging Records Management (MRM) in Exchange 2010

2009-10-03T16:48:00.008-06:00

I've been reading up qutie a bit the last few days about some of the new features in Exchange 2010 when it comes to managing messages in an organization. I'm happy to say that there is finally a viable solution for enterprise customers who want to implement a retention and archiving policy, complete with logging and the ability to adhere to a compliance policy.

I wanted to write a post about the new features and to have this as a reference for myself and others. There are some new concepts which make up MRM in Exchange 2010. Microsoft's Technet web site does a great job of outlining step-by-step procedures for enabling them...but it does take some time to read.

Overvivew

The MRM features of Exchange 2010 consist of Mailboxes, which have Retention Policies assigned to them. Within the Retention Policies there are Retention Tags which define the rules for managing items.

Retention Tag

A Retention Tag is the at the core of your MRM strategy. The tag contains several variables such as it's name, the folder it will take action on (i.e. Deleted Items folder), how long before the policy is applied (i.e. 90 days), and what action will be taken when the time limit is reached (i.e. move to archive). To create a new retention tag using PowerShell:

New-RetentionPolicyTag "RT-FIN-90-DeletedItems" -Type DeletedItems -AgeLimitForRetention 30 -RetentionAction PermanentlyDelete

New-RetentionPolicyTag "RT-FIN-365-Default" -Type All -AgeLimitForRetention 365 -RetentionAction MoveToArchive -IsPrimary $true

NOTE: Don't forget to add the "-IsPrimary $true" to your tag if it's assigned to a new retention policy since the policy needs a default tag. If the primary tag value isn't set, it isn't a default retention tag and the policy creation will throw an error.
Retention Policy
The policy contains the tags you define. You can add and remove them to suit your needs. A retention policy can be assigned to a mailbox or distribution group (maybe even a database but I'm not sure yet). To create a new Retention Policy and assign tags to it:

New-RetentionPolicy "RP-Finance" -RetentionPolicyTagLinks "RT-FIN-90-DeletedItems", "RT-FIN-365-Default"

To add tags to the policy:

Set-RetentionPolicy -Identity RP-Finance -RetentionPolicyTagLinks "RT-FIN-90-DeletedItems","RT-FIN-365-Default","RT-FIN-180-Voicemail"

NOTE: When you add tags to a policy, be sure to "Get-RetentionPolicy | FL" first so you don't accidently forget to assign a previous tag. In other words, when you apply the tags to a policy it will overwrite the settings.

Finally, add the policy to a mailbox:

Set-Mailbox "JasonShave" -RetentionPolicy "RP-Finance"

Seeing it in action...
When you've created your tags, assigned them to a policy, and linked the policy to a mailbox. You can run the Exchange Managed Folder Assistant manually to see how the policy affects the mailbox. The command for this is:

Start-ManagedFolderAssistant

(custom tag called "Tag-DeletedItems")

TIPS

Work with your organization's HR, Security, IT teams, etc. to define the requirements for retention and archiving.
Create a naming convention for your tags and policies.
Test the policies on a mailbox with non-critical data first!

My only complaint thus far is that a GUI hasn't been built for most of the new records management features. For example, you can't create/edit/delete retention tags or policies using the Exchange Management Console or the Exchange Control Panel. This is a great step in the right direction overall though.

Cheers!

Microsoft XMPP Gateway - released!

2009-10-01T13:05:00.002-06:00

Greetings,

Microsoft has released their XMPP gateway software today which will allow OCS users to communicate with other XMPP-based IM platforms. The two platforms currently missing from the Public IM stack are Google Talk and Jabber.

The XMPP gateway software acts like an Edge server (install on a separate box) and will likely support some form of hardware virtualization.

Here are some notes to keep in mind:

Only plain text is supported.
Presence is supported.
You need to be running Communicator R2 as a client (can be connected to an R1 pool).
You can run either R1 or R2 OCS (not LCS).
Custom notes in Communicator are not handled.
Conferencing isn't supported -yet ;-)

Built on industry standard protocols, this software is a welcome addition to Microsoft's UC platform. You can download it here today: https://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=aa560bfe-9960-473a-bfb8-53bff678cec4

Logitech Quickcam Pro 9000 hangs Live Meeting

2009-09-30T16:31:00.000-06:00

Just a quick post today. I've noticed lately that I've been having issues with Live Meeting. When I try to change the audio device used for the meeting it simply hangs the application. What's changed recently is that I've been plugging in my Logitech Quickcam Pro 9000 lately. I have all the latest drivers and the camera works great in Live Meeting or Communicator. It's when you go to change the settings where things go south.

Anyway, to resolve it I simply unplugged the camera (since I have an embedded one in the monitor).

HANDS ON: Tandberg Precision HD USB webcam -updated

2009-09-25T10:56:00.005-06:00

Well I picked up a Tandberg Precision HD webcam yesterday and thought I'd share my experiences with it. The device is "optimized" to work with Microsoft's Office Communications Server platform and offers HD quality video (720p/24f).

Specifications for the webcam are as follows:

16:9 wide format HD video
1270x720 resolution at 30fps (MS only supports 24fps as per R2 TAP docs [this may have changed recently])
All glass optics
Auto focus and auto light adjustment
Ultra wideband mic
Privacy shutter
F-stop of 1.7

The camera's requirements are:

Windows XP or Windows Vista (also works ootb with Windows 7)
USB 2.0 interface

Overall first impressions are that the camera is well built. The hardware has that "Tandberg" quality feel to it. The glass optics make the device much heavier than a traditional webcam but if you're looking for a "1700 MXP experience" with native OCS/MOC and Windows, this is as close as you can get for a fraction of the cost. The USB cable is quite short and I would have liked to see at least a six foot cable attached. If your PC case is far from your monitor you'll need a USB extension cable guaranteed.

Image Quality, etc.

Since my laptop at work isn't a quad core CPU, OCS won't flip on the HD capabilities of the MOC client. With VGA quality video being my only option I have to say that the overall picture quality is quite good. The lighting and color representation is better than your typical home user's webcam. My comparison webcam is a Logitech Quickcam Pro 9000 which also supports HD (2MP). I have found that the Logitech is washed out and doesn't provide the same color depth.

In terms of field of view, I prefer a camera which shows more background. The Tandberg Precision HD webcam is quite tight and needs to be positioned in such a way that you're not cutting off your head in the image. The Logitech is completely opposite and shows everything from top to bottom.

Conclusion
If you have the cash to spend on an executive-style webcam this is an amazing unit. As for the HD quality in OCS, I was finally able to test it. The difficult part though was capturing the image on the other side since my tester was in another city. He was kind enough to snap a digital photo of his TV (also used as a PC monitor). Check it out and see for yourself...

(Click on the image for a larger version)

As you can see there is a great amount of detail in the image. The focal length of the camera is noticable here as well with the foreground image in focus but the background blurred. Very very nice!

Get your Cisco 7941 to work with OCS with SmartSIP

2009-09-24T08:58:00.002-06:00

I posted recently about a product from Evangelyze Communications (http://www.evangelyze.net/) called SmartSIP. In this post I'll talk about how to get your Cisco IP phone to work with OCS and SmartSIP.

Contrary to popular belief I prefer the Cisco phone to many others out there. The overall look and feel of the handset, base, buttons, and display are well thought out and provide some interesting and easy to use features.

For my lab setup I have my OCS Mediation server and SmartSIP collocated on the same virtual machine. By the way, don't use VM's for production; they're not supported and performance can be terrible. I have a Cisco 7941 IP phone and have downloaded the latest SIP firmware from the Cisco web site (you need to have a valid SmartNET contract to get the code).

NOTE: Be sure to get the Cisco SIP firmware as the SCCP (skinny) won't suffice here.

After installing SmartSIP you will need to activate it and configure it as follows:

Change the gateway listening IP address on your Mediation server to 5070. You need to change the port here because SmartSIP needs to use 5061 for SIP Trunk service providers connecting inbound.
Change the port for the next hop PSTN gateway to 5055. Again, this port is changed because 5061 is used for SIP trunking.
Open the SmartSIP diagnostics application from the START menu
Click on the Config (Web UI) tab and select the Microsoft tab
Enter the IP address for your OCS server in the OCS SIP Listening Profile

Example:
data="ocs_rtp_ip=10.10.10.127"

data="ocs_sip_ip=10.10.10.127"

Click the Save button

Now you need to create a specific location profile for SmartSIP to use when routing calls. What I like about this process is that it leverages the UI in OCS to complete the digit manipulation (with normalization rules). You then route numbers based on the normalized (or de-normalized) numbers. If you're using a SIP Trunk to a carrier such as Thinktel they will accept E.164 formatted numbers so you shouldn't need to change much. If you're sending the call to a voice gateway via IP, you can route numbers that have been pre-configured within OCS. Here's how:

Create a new Location Profile in OCS and call it something like "ss_test_1"
Create a new normalization rule for a number you want SmartSIP to route. For example if I wanted to de-normalize a number before routing to my carrier, I would actually use:

Pattern match: ^\+?1780(\d{7})$
Translation: 780$1

After you save this rule, go back into your SmartSIP WebUI and click on the Trunks tab.
Locate the smartsip_dialoptions_trunks and smartsip_locations_trunks tags and change the value to match your OCS location profile. For example:

data="smartsip_dialoptions_trunks=ss_test_1:sip_cid_type=pid"
data="smartsip_locations_trunks=ss_test_1:ss_test_1"

Now click on the General section below and expand it.
Change the gateway name to reflect your location profile such as:

gateway name="ss_test_1"

In the same section, be sure to enter the IP address of your next hop gateway or SIP provider in the "realm" and "proxy" tags.

Configure the Cisco phone...
Now that you have SmartSIP, OCS, and your voice normalization configured, we can move onto the phones. SmartSIP includes a TFTP server built in which permits your IP phones to download firmware and configuration data for automatic provisioning.

For the phones to find the SmartSIP server you will need to add "option 66" to your DHCP server. I found that on my Cisco 871 router I needed the following syntax in the DHCP pool settings:

option 150 IP 10.10.10.127

Log into your Mediation/SmartSIP server and locate the TFTP directory.
Populate the directory with your firmware data for the "Cisco 79xx" phone.

You should have something like this (minus the Desktops dir and dialplan.xml)

The Cisco phones need 2 files to operate properly. They are equally important so be sure to pay close attention to the next few steps.

SEP[MAC].cnf.xml
This file is your base configuration file for the phone. It contains information about where the phone needs to connect, what dialplan to use, etc. SmartSIP uses variables in the form of tags to replace the XML values in the file. For example, [USER] and [SERVER_IP] correspond to the extension and SmartSIP server IP. Consult the SmartSIP documentation for more information about what tags are available to you.

Over at Greenwire IT they have a great outline of a basic SEP[MAC].cnf.xml file: http://www.greenwireit.com/blog/2009/09/cisco-7961-and-7941-sip-configuration-sepmac-cnf-xml/

If you're stuck and need a copy of the XML, just let me know. I spent hours and hours trying to get the phone to sign in and provision itself only to find there were invalid values in the sample XML given by default.

Dialplan.xml
This file contains your dial plan for the Cisco phones. You can visit: http://sipx-wiki.calivia.com/index.php/HowTo_configure_Cisco_SIP_phone_with_sipX for a great sample. Be sure to place this in the "Cisco_79xx" directory.

Putting it all together...
Please please please be sure to install Wireshark on your Mediation/SmartSIP server if you haven't done so already. This will provide to be the most critical tool you will ever use. You're probably asking by now, "how do I assign a phone to a user?". The easiest way is as follows:

Open Active Directory Users & Computers.
Locate your OCS user and click on the Telephones tab of their account.
Type in sip:[MAC]@smartsip.local (where [MAC] is the MAC address of the Cisco phone)

Click Ok and close out the changes.
SmartSIP has a default 5 minute refresh on AD data so you can either wait or simply open the WebUI, click on the Users tab, then click the Update Directory button.
Now, open Wireshark and start a trace.
Plug in the Cisco phone to a PoE port.
Watch for TFTP requests in Wireshark to make sure the phone is at least talking to the server.

Now if you've done everything correctly, SmartSIP will see the request for TFTP data from a MAC address matching a user in AD. It will swap out the [MAC] tag in the SEP[MAC].cnf.xml file along with all the tags within it so they contain the user's name and extension (or DID). You can actually watch the Wireshark trace data to see the file being sent to the phone along with the correct data within it.

The dreaded "UNPROVISIONED" error...
The phone will show a message of "unprovisioned" if your CNF.XML isn't configured correctly. You can typically browse to your phone via http (i.e. http://10.10.10.12/) to view the phone logs. Pay special attention to the phone's log data as it will show you what's wrong. Edit your XML file appropriately to resolve the error.

BONUS: Configure wallpaper on the phone

Create a "Desktops\320x196x4\" directory below the "Cisco_79xx" directory included with SmartSIP.

Get a copy of the image you want to edit, open Microsoft Paint (Windows 7 works best) and format the image to a size of 320x196.
Save the image as a PNG file (again Windows 7 has MS Paint that does this well now).
Create a "list.xml" file as follows:

The list.xml file contains a list believe it or not, of images available to the phone.
To choose an image hit the Settings button on the phone, select "User Preferences" then select "Background Images". The phone should contact the TFTP server for the data (again Wireshark is the best tool to watch for this).

That's all for now. Cheers!

Polycom CX300 (codename "Oak")

2009-09-22T09:43:00.002-06:00

Polycom is getting ready to release the Polycom CX300 USB phone which works with Office Communications Server 2007 R2 (QFE2). The handset comes with a more comfortable handset, a 2 line OLED display, and an upgraded speakerphone.

General availability will be at the end of October 2009 and MSRP is suggested to be around $199.00 USD.

I've had the opportunity to work with the beta version of the phone (called the "Oak) for the past six months and I'm happy with the overall quality and feature set. Similar to teathering a Tanjay (Polycom cx700) to your PC, your actions on the phone apply to the MOC client and vice versa. For example, if you place a call with the CX300 phone your MOC client will show the call being placed. Basic phone features such as mute are available from the handset as well.

I'm particularly happy with the overall button feel and handset. This is a big step in the right direction for Microsoft and the end users. I forced myself to use the handset for a 2 hour call the other day and didn't have an issue with fatigue.

Considering the price point and feature set, I can't imagine anyone purchasing the CX200 anymore.

If you get your hands on one of these units make sure you upgrade to QFE2 (July 28th patches). I haven't seen these available on Windows Update yet so you can get them manually from here:

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=b3b02475-150c-41fa-844a-c10a517040f4

Cheers!

SmartSIP fills the gap and more

2009-09-15T20:16:00.010-06:00

I spent some time in Redmond recently and had the pleasure of finally meeting Mike Stacy from Evangelyze Communications (http://www.evangelyze.net/). Like many other relationships formed with the power of Microsoft's Unified Communications platform, it was great chatting and talking over Communicator but being there in person has it's benefits as well.

Mike introduced me to a software application called SmartSIP which is the focus of my post today. I'll be posting a lot more in the coming months about this product's capabilities so be sure to check back frequently.

I want to start off by talking about some of the limitations within OCS today. Some of these are truely "deployment blockers" for some of our clients. I'll then talk about how SmartSIP can solve some of these.

The Mediation Server role in OCS can only have one "next hop relationship". This means that if you have a voice gateway connected to a PRI and a SIP Trunk from a provider like Thinktel (http://www.thinktel.ca/), you need two Mediation Servers.
An OCS user can have only one LINE URI (phone number).
Mirosoft's solution to "branch office survivability" is to install an OCS/Mediation server locally.
There is only one IP phone solution available from Microsoft's list of "optimized devices".
You can't connect other IP phone solutions to OCS and there are no OIP certified solutions that support RCC/DF.
The solutions available for shared phone situations often involve the use of a Polycom cx700 IP phone which is not only expensive, it's impracticle for many situations. You wouldn't want to install a cx700 in an elevator or have one in a lunch room. The phone is an "executive style" touch screen IP phone that has great purpose on the desk of a UC enabled user.

SmartSIP isn't a gateway, it isn't an IP PBX, and it isn't easily classified. You install SmartSIP on your Mediation server (or a stand-alone server) and now you're open to all kinds of new solutions:

You can send calls to one Mediation server and have multiple routes (primary or failover) to various IP endpoints. For example, a call made past the Mediation server can end up with SmartSIP deciding where to send the call based on the number dialed or if the next hop(s) are up.
If you want to assign alternate numbers to an OCS user, you simply define them in the AD user account properties (click the "other" button in the telephone field). SmartSIP has tight integration with Active Directory so it knows that a call to an alternate extension or DID should be sent to an endpoint.
In the case of an outage to OCS, your local IP phones (except the cx700) can talk/register directly to SmartSIP and use it as the routing engine for outbound calls. This means you have a branch office survivability solution without the need for an OCS server.
If you can load a SIP stack on an IP phone you can probably use it with OCS. I'm particularly happy about this feature since many customers may want to leverage the benefits of OCS but don't want to lose the investment in their existing IP phones.
If you want presence on your IP phone you can have it. Actually you can get presence on your TDM phone too with the use of a Portico TVA gateway.

I've posted in the past about how SNOM (http://www.snom.com/) has come up with a brilliant solution for OCS deployments with their firmware that signs into AD/OCS. It isn't without it's challenges as well. For example, you end up with a user's id/password in the phone....so what happens when they change their password? The phone won't work.

The better way to use the SNOM phones is to have them register with SmartSIP using the regular, non-OCS firmware. Also, SmartSIP has a TFTP server built in and will support automatic provisioning of the phones!!

Okay, that's enough for today. Stay tuned for more soon...

Cisco Unified integration with Microsoft Office Communicator (CUCiMOC) - take 2

2009-08-28T21:29:00.008-06:00

NOTE: This post has been removed.

OCS and the iPhone, now we're talking!

2009-08-25T14:03:00.003-06:00

If you have an iPhone and have been frustrated about the solutions available to link up with Office Communications Server 2007 R2 (OCS) then wait no longer (video link below). Modality Systems has created iDialog in the Apple App Store for you at a price of $9.99. While many are shocked at the initial cost, if you weigh the options available from other vendors, it seems somewhat reasonable.

http://www.modalitysystems.com/idialog/

If you have an OCS 2007 R2 Communicator Web Access server you're all set. Typically when we set up these systems we have a split horizon DNS infrastructure so the server URL is the same if you're on the LAN via WiFi or over 3G.

In terms of feature set, most of it is there; just no conferencing (IM), application sharing, or voice callback. The buttons on the bottom of the application show "Contacts", "Chats", "Me", and "Settings".

The Contacts section shows your groups and takes about 5-10 seconds to appear. Each contact is selectable and will show Activity (presence), Calendar, email address, Title, Company, and various phone numbers based on your access level with them. You can tap to IM the person from the same screen. You can also tap a phone number and have the iPhone call them directly.

The Chats section shows any existing IM conversations you're having with people. It is important to note that when you hit the home button, the application doesn't stay running in the background and any conversations will be lost.

The Me section shows your Activity (presence), Note, Location, and phone numbers.

Lastly, the Settings section allows you to enter or correct your authentication settings. You need a domain\username, a password, and the URL to your CWA server.

So far I've found a few bugs with the grouping of IM contacts. Some contacts from other groups show up where they don't belong. Not bad for version 1.0.0 though :)

VIDEO: http://files.me.com/jasonshave/n10xuf (taken with an iPhone 3GS)

OCS 2007 Caller ID (name) almost there....

2009-08-04T18:51:00.010-06:00

...but not quite yet.

I've been waiting for this feature for quite some time as a lot of our customers see the lack of caller ID being a deployment blocker. Early on in the projects we heard different stories from end users who were frustrated with not having this feature. Some of them wanted inbound to work while others wanted outbound and to have the ability to mask their name.

With the latest OCS 2007 R2 updates on July 28, 2009 we now have caller ID inbound, and outbound can be enabled via the following MS KB article: http://support.microsoft.com/?kbid=972721.

So why "not quite yet"?

First, what you'll notice on a missed call or a voicemail is that the email you recieve doesn't have the name; just the number. I suspect this is due to Microsoft Exchange Server not knowing what to do with the name. Furthermore, I would assume the Exchange team is preparing a hotfix to accomodate the missed call/voicemail with name.....I hope.

Second, I've just finished updating my Tanjay phone to the 3.5.6907.35 firmware and unfortunately it doesn't pass caller ID. Grrrr! Also, if you're not getting caller ID on your MOC client and you have a Tanjay paired with your PC, unplug it and it should work again. It seems as though the Tanjay prevents the MOC client from displaying the name.

If you've ever wondered how it all works, I had a great escalation engineer in India provide me with an explanation.

A PSTN call comes in and goes "ring no answer"; the call hangs up without leaving a message.

OCS communicates with the Exchange UM server using a new "INVITE" command and relays the original information from the "INVITE" that came from the 'gateway' side of the Mediation server. As a side note, many people today are creating special Location Profiles for the Mediation Server so that inbound calls are normalized. This works well for calls that end up reaching users....but again, a missed call will only have the original number, not the normalized one.

The UM worker process performs a lookup in the user's personal contacts to see if it can resolve the number to a name. If successful, a message is generated by the UM server and submitted to the Hub Transport server for delivery to the user's mailbox.

From what I recall at Exchange Ignite earlier this year, there are improved methods for looking up and determining caller ID (name) on onbound calls. As I learn more about this I'll post an update here.

Cheeers!

CUCiMOC .... what a crock!

2009-08-02T17:26:00.012-06:00

Sorry this post has been removed.

Improving call quality with Dialogic gateways

2009-07-29T17:21:00.003-06:00

I've implemented my fair share of Microsoft OCS Enterprise Voice projects and each one has it's own nuances around voice quality. I've gathered a list of the common issues encountered with Dialogic gateways and their fixes which have worked well for me.

_______________________________________________________

Tanjay phone doesn’t produce “comfort noise”

Description: When a user from a “Tanjay” phone calls a PSTN user across a voice gateway such as a Dialogic, the PSTN user doesn’t hear the white noise (comfort noise) typically present on traditional phone conversations. The PSTN user assumes the line has been disconnected and often will say “hello, are you still there?”.

Resolution (Dialogic): Typically you don’t want to enable VAD (Voice Activity Detection) on the gateway however this feature fixes this issue. From the voice gateway click on VOIP then Media and set the VAD to “on”.

_______________________________________________________

Audio levels rise and fall through conversation

Description: When an OCS user calls a PSTN user through a voice gateway, the audio levels rise and fall as though something is adjusting volume. Also at the beginning of a phone call the audio is lower than normal.

Resolution (Dialogic): Set the Automatic Gain Control (AGC) for both IP to TDM and TDM to IP calls to “off”. The reason for this change is that in R2 they included AGC as part of the base application. Levels are automatically adjusted at the client device (and server).

_______________________________________________________

The ringback tone continues to play after the caller picks up

This issue is caused by the gateway not accepting “early media”. With the release of OCS R2, “early media” is a feature which permits OCS devices to complete the call setup quicker. The Dialogic gateway must be set to “Always” for this to function properly.

_______________________________________________________

I hope this helps some of you out there.

Cheers!

Undocumented ports for load balancing OCS 2007 R2?

2009-07-15T20:24:00.003-06:00

Well it might not be "undocumented" exactly if you're reading the right documentation. Download the .chm file from Microsoft (http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=e9f86f96-aa09-4dca-9088-f64b4f01c703) and you'll be okay whereas some of the online documentation I've seen seems to leave out a few critical ports. For those of you load balancing OCS 2007 R2 Enterprise Edition pools, here is the difinitive port list:

5060 (Client to server SIP communication over TCP. Not required typically.)
5061 (Client to Front End Server SIP communication over TLS)
5065 (Used for incoming SIP listening requests for application sharing over TCP)
5069 (Used by QoE Agent on Front End Servers, needs to be open only if this pool sends QoE data to Monitoring Server)
5071 (SIP requests to Response Group service)
5072 (SIP requests to Conferencing Attendant)
5073 (SIP requests to Conferencing Attendant Announcement Server)
5074 (SIP requests for Outside Voice Control)
135 (To move users and perform other pool level Windows Management Instrumentation (WMI) operations over DCOM)
444 (Communication between the internal components that manage conferencing and the conferencing servers)
443 (HTTPS traffic to the pool URLs)
80 (Used by Tanjay update process. This port is undocumented but required.)

Also the following attributes/settings must be in place:

The load balancer must provide TCP-level affinity. This means that the load balancer must ensure that TCP connections can be established with one Office Communications Server 2007 R2 in the pool and all traffic on that connection destined for that same Office Communications Server 2007 R2.
The load balancer must provide a configurable TCP idle-timeout interval with a maximum value greater than or equal to the minimum of the REGISTER refresh or SIP Keep-Alive interval of 30 minutes.
The load balancer should support a rich set of metrics (round robin, least connections, weighted, and so forth). A weighted least connections-based load balancing mechanism is recommended for the load balancer. This means that the load balancer will rank all Office Communications Servers 2007 R2 based on the weight assigned to them and the number of outstanding connections. This rank will then be used to pick the Office Communications Server 2007 R2 to be used for the next connection request.
The load balancer must be able to detect Office Communications Server 2007 R2 availability by establishing TCP connections to either port 5060 or 5061, depending on which is active (often called a heartbeat or monitor). The polling interval must be a configurable value with a minimum value of at least five seconds. The load balancer must not select an Office Communications Server 2007 R2 that shuts down until a successful TCP connection (heartbeat) can be established again.
Every Office Communications Server 2007 R2 must have exactly one network adapter. Multihoming an Office Communications Server 2007 R2 is not supported.
The network adapter must have exactly one static IP address. This IP address will be used for the incoming load-balanced traffic.
The computer must have a registered FQDN. The IP address registered for this FQDN must be publicly accessible from within the enterprise.

Cheers!

Don't collocate CWA with OCS...but if you want to, read on....

2009-07-15T17:54:00.009-06:00

So I've come across this several times before.....the client is starting to frown when you say that CWA needs to be installed on a separate server and the 'village of servers' begins to grow. The following steps will illustrate how to install CWA on the same server as OCS. There are a few key steps necessary so be sure to read in detail:

Before I get into the specifics, CWA is not officially supported in a collocated configuration. Now onto the meat.....the 2 primary things you need to watch out for is the multitude of IP's you need on the server and how DNS will react to this. Ultimately you're binding as many as 3 IP's to the same NIC which will accept connections to the OS for port 443 among other things. To avoide collision you need to separate OCS from CWA logically as follows:

Install OCS as you normally would (Enterprise or Standard; it doesn't matter).
If you're setting up CWA for both Internal and External clients you will need 2 additional IP addresses. Add these IP's to the same NIC used for OCS. Oh and if you're using NIC teaming, you may as well undo the team and go back to one card as this isn't a supported configuration (Audio/Video issues will be seen with teamed NIC's).While you're in the TCP/IP properties of your NIC, be sure to uncheck the DNS registration option.

If you added the IP's before disabling automatic DNS registration you may need to go back into your DNS server and remove all the A records corresponding to your server. If not, simply remove the single A record for your server. Then, manually add the A record back in to ensure it isn't 'expired' from the DNS server.

Now you're ready to modify OCS:

Open the OCS Admin tool.
Expand the pool (or server node if you're using Standard Edition) and right-click the node and choose Properties, then Front End Properties.
On the General tab, double-click the Addresses section and change the address to reflect the same one you entered in DNS for the server name (pool IP).
Next, click the IM Conferencing tab and change the IP address drop-down to the pool IP.
Next, click the Telephony Conferencing tab and do the same then click OK to close the window.
Right-click the server name again in the OCS Admin tool, navigate to Properties, then Web Conferencing Server properties.
Change the IP address to reflect your pool IP then click OK to close the window.
Right-click the server again and choose Properties, then A/V Conferencing properties.
Change the IP address to reflect your pool IP then click OK to close the window.
Right-click the server again and choose Properties, then Application Sharing properties.
Change the IP as you've done above.
Finally, open IIS and set the port 80 and 443 listeners for the Default Web Site to the pool IP.
Reboot your OCS server and make sure all services start properly.

You're now done with the OCS portion and need to begin on the CWA preparation and installation.

Create your DNS entries for CWA. If you have a split horizon DNS you'll want to create an internal A record entry (i.e. cwa.contoso.com) pointing to the second IP of the OCS server. Then you'll want to create another A record entry (i.e. cwa.contoso.com) pointing to the public IP being NAT'd to the third IP of the OCS server. What you end up with is something like:

10.1.1.10 = ocsserver.contoso.com
10.1.1.11 = cwa.contoso.com
215.123.154.222 NAT'd to 10.1.1.12 = cwa.contoso.com

Install CWA and create two sites (one for Internal, one for External) and assign each IP to the proper site. For more information about issues relating to Integrated Authentication with CWA, visit this post: http://jasonshave.blogspot.com/2009/01/communcator-web-access-error-0-1-492.html

That should be it. Now you have IIS bound to specific IP addresses hosting different web sites (Web Components for OCS, CWA for Internal, and CWA for External).

Cheers!

Passed OCS voice exam!

2009-07-03T08:34:00.002-06:00

I finally passed this one. I wrote the beta exam some time last year and failed it by 1 or 2 questions. The beta exam was based on R1 features and had quite a few spelling mistakes and poorly worded questions. I was surprised to notice this exam I just wrote had the same content (R1 and not R2) along with the same mistakes.

Anyway, for those of you wishing to write this exam, brush up on your OCS R1 technologies including the old method of updating Tanjay phones through SharePoint....

Cheers!

Rethink the way you implement OCS Enterprise Voice

2009-06-06T13:21:00.013-06:00

I'd like to start off this post by thanking Mike Stacy at Evangelyze for opening my eyes to this new way of thinking about number normalization and routing. This article discusses the options available to OCS voice implementations surrounding the use of E.164 numbers and the plus sign (+) in your dial plan.

I called Mike a month or so ago and we were talking about how to handle click to call on missed call notifications via email. I noticed Microsoft's missed calls were normalized into E.164 and couldn't figure out how to make this happen. Even if you create a location profile for your Mediation server to handle a 10 digit inbound number transformed into E.164, Mike indicated the missed call is generated with the raw number from the SIP INVITE. The only way I can figure Microsoft makes this happen is at the gateway. They prefix the number with a "+1" on inbound 10 digit numbers. After testing this on my own, it works. However, this brought up the question......why am I adding digits on inbound calls and stripping them on outbound?

This began a debate about what value the plus sign (+) is now that you don't need it in R2. Yes, that's right....you don't need a plus sign in your TEL URI or your normalization rule(s). So you might be asking yourself, why would I care? Why not just add a plus sign to everything?

There are two reasons for this but first I need to explain the difference between a number with a plus sign (+) and one without. When OCS sees a number with a plus sign it treats it as a "global number" and doesn't attempt to normalize it. Rather, it has already been normalized so it will attempt to find a route and call it. This is the most important concept to grasp here which I'll elaborate more on later.

I had a lengthy discussion with a senior escalation engineer at Microsoft recently about the need for the plus sign in OCS voice. The Microsoft engineer indicated I wasn't using E.164 formatting with my OCS solution and that what I was trying to do wasn't supported. So I asked him how you would possibly represent a non-DID such as "extension 2112"? He indicated you could use one of two formats as follows:

Either: +2112
Or use the DID with the extension: +17805552000;ext=2112

Jochen Kunert has an excellent blog about this scenario: http://blogs.technet.com/jkunert/archive/2008/08/19/ocs-2007-dialplan-using-non-did-numbers.aspx

I explained to him that "+2112" isn't an E.164 number. He disagreed. I pointed him to: http://en.wikipedia.org/wiki/E.164 and explained that simply having a plus sign in front of a series of digits didn't mean it was an E.164 number.

When it comes to using the full number with the extension (+17805552000;ext=2112) this creates it's own challenges. First, Exchange UM doesn't like to try and call people by saying their name (when you use the Auto Attendant). Second, there are gateways out there that don't like this format and can't handle digit manipulation. Lastly, I've seen issues when you try to forward your phone to a non-DID in this format (OCS drops the extension number but keeps the "+17805552000"); likely a bug for now but still a pain in the butt.

So back to the crux of the issue and why this is a problem for us....

1. For click to dial scenarios which include missed calls or clicking someone's name in your organization (or federated list), you want to be able to click on a number and have your own organization's normalization rules kick in. If you have a plus sign in the number, it won't be normalized. I mentioned this earlier....OCS will treat these numbers as "global numbers" and it will skip client-side normalization. The end result is that you need to have rules in your gateway to strip the "+1" on outbound local calls.

2. If you normalize all numbers to E.164 with a plus sign, you can't distinguish between local or long distance numbers easily. Here in Alberta we have a 780 area code which has overlapping local and long distance calling zones. This isn't that uncommon really. In order to restrict users from placing calls to 780 numbers which are long distance, we would have to create elaborate routes for all NXX values which are local to the user's phone policy, phone usage record, and route.

Let's humor this scenario quickly. If you have very specific routes for local numbers such as ^\+1780([966])(\d{4})$ you still need to build rules in at your next hop to remove the "+1" because the phone company needs 10 digits on a local call. So now you have twice as much complexity built out in OCS and your gateway(s). Too much to manage....

A better way to design this would be to follow these simple rules:

1. Normalize numbers to a format people would normally use when trying to place a phone call. For example, if somone wants to call a 10 digit local number, don't add a "+1" to it. Also if someone wants to dial a 4 digit internal number you can normalize it to a DID (i.e. 7805551212) or a non-DID (i.e. 2112).

2. Create a catch-all normalization rule to format 10 digit North America numbers with a "1" in front of it.

3. Don't add a plus sign to normalized numbers. This includes your numbers in Active Directory. You want client-side normalization to handle all possible scenarios for dialing. You can put numbers in their 11 digit format (i.e. 17805551212) but leave them as is.

4. At the gateway keep it simple. You shouldn't need to populate your gateway with many inbound or outbound rules. The only exception to this would be for click to dial scenarios where you click on a federated contact who has their number shown as E.164.

So I encourage discussion on this topic as I have spent a lot of time thinking about the pros and cons of this way of designing voice solutions.

Cheers!

Jason

Auto client update in OCS 2007 R2

2009-05-28T07:18:00.008-06:00

I have to give Aaron Tiensivu credit for this entry today. The ability for the OCS server to deliver a new version of the MOC client is an interesting method for keeping your client machines up to date however it does have its own drawbacks as well.

Aaron's blog explains how to set this up and I have included my concise steps below as well:

http://blog.tiensivu.com/aaron/archives/1865-Demystifying-the-Office-Communicator-2007-R2-Client-Auto-Update-feature-and-how-to-setup-it-up.html

Download your Communicator patch file (.msp)
Log into your OCS server, run the admin tool and right click your server (for standard edition) or your pool name (for enterprise edition) and choose Filtering Tools then Client Version Filter.
Click the Add button
Set the User Agent Header to OC
Populate the version numbers to coincide with the version you want to update. For example, if you have clients at 6907.0 and you want to patch them to 6907.9 then type in the values as per the image below:

Set the remaining options as shown above. One difference here is that I like to set the folder name to be equal to the patch I'm upgrading to (i.e. 6907.9).
Next, if you're running Standard Edition, create the folder structure show in the image above exactly. For example, on Standard Edition use: C:\Program Files\Microsoft Office Communications Server 2007 R2\Web Components\AutoUpdate\Files\6907.9\x32\fre\1033.
If you're running Enterprise Edition use your shared file location you specified for your Client Update share: \\servername\client_update\Files\6907.9\x32\fre\1033.
Now that you have the file structure in place, copy your msp file to the 1033 folder.
Your clients should now update properly. You can right-click on the Communicator icon in the system tray and choose Configuration Information to view the update status.

So here is what I don't like about this process....

1. The user needs to have the right to install software. This update process is not much good to organizations with typical security measures in place.

2. These patches should be managed through the companies patch management strategy. Microsoft now offers patches to the MOC client through Windows Update so my suggestion would be to leverage that method instead.

Oh, and by the way....be sure to install the latest May update (6907.22) because previous versions apparently have a bug which prevent them from contacting the update server process.

Rock solid Tanjay update!

2009-05-21T16:17:00.005-06:00

I've found a fool proof way to update the Tanjay phones with or without signing in.

If you want to update an R1 phone without signing into it:

Add a DNS A record called "ucupdates.domainname.com" where "domainname.com" is the fqdn of your pool name. Point the A record at your Enterprise pool server or Standard edition server. Also add a static WINS entry called "ucupdates" and key in the same IP you did for the DNS record.

If you want to update an R2 phone:

Add a DNS A record called "ucupdates-r2.domainame.com" where "domainname.com" is the fqdn of your pool name. Point the A record at your Enterprise pool server or Standard edition server. Also add a static WINS entry called "ucupdates-r2" and key in the same IP you did for the DNS record.

Cheers!

Jason

New layout!

2009-05-20T11:32:00.001-06:00

I was getting tired of trying to decipher which text was bold and found the old layout to be too 'skinny' :)

Install pre-requisites for OCS - the easy way

2009-05-19T08:38:00.002-06:00

Thanks to Tom Pacyk in Portland for this tip...

One of the more annoying installation pains we often feel when we install OCS 2007 R2 on Windows 2008 Server is the multitude of requirements which need to be met. Even when you think you've installed them all (IIS in particular), you inevitably find out there are more and more to install.

Tom's information here: http://www.confusedamused.com/notebook/ocs-2007-r2-front-end-server-2008-requirements-made-easy/ shows you how easy the installation can be when you leverage an XML file for installing pre-requisites.

Thanks Tom!

Cheers,

Jason

Microsoft Unified Communications Reference Guide: Part 2 (IM)

2009-05-16T13:51:00.011-06:00

This post will cover the basic requirements for Instant Messaging features and will outline all the components you will need to install/configure/support the environment.

To get started, lets build out a scenario first. A company has less than 5000 users who need Instant Messaging for both internal and external employees. Connectivity to federated users and Public IM is necessary. The company would like to report on both the usage of Instant Messaging but also be able to archive and extract historical conversations. High availability isn't a requirement today but may become important in the near future.

What infrastructure you need:

Office Communications Server 2007 R2 Enterprise Edition
Monitoring Server (collocated with OCS pool server)
Archiving Server (collocated wtih OCS pool server)
Edge Server
SQL Server database server (for OCS/CDR/Archive DB)
File Server or SAN (for shared file data)
Existing PKI infrastructure
Firewall with two DMZ networks ("OCS Internal" and "OCS External")
Split-horizon DNS infrastructure

For collocation information please see the following Microsoft article: http://technet.microsoft.com/en-us/library/dd425201(office.13).aspx.

The above article suggests you can collocate all the above server roles with the exception of the Edge Server on the same system. It isn't typically recommended that the OCS Server and Archiving Server roles be collocated, however given today's powerful servers I'm more inclined to put it all together.

From a physical server perspective you need:

1 - Dual proc/quad core server with 8GB RAM for OCS/Monitoring/Archiving
1 - Single proc/quad core server with 4GB RAM for Edge (must have dual NIC's)
1 - Single proc/quad core server with 4GB RAM for SQL database (unless you have one already)

You will be building an Enterprise Edition environment which has a defined "pool" name. This name is used by clients when they connect and is important to determine before you begin installing.

My guidelines for creating a pool name are quite simple. I typically ask the customer what their SMTP domain is. Let's say it's "contoso.com". I then ask what their NetBIOS domain name and domain fqdn are. The reason for this is that I need to determine if the domain fqdn is different from the SMTP domain (i.e. Domain fqdn=contoso.local, SMTP domain=contoso.com).

When you create your Enterprise pool name, the setup application will attempt to suggest a pool name by combining your domain fqdn with the name you've given the pool. I always override this because a pool name of "pool01.contoso.local" is of no use to us if we attempt to create SIP URI's with a "contoso.com" suffix. There is a GPO you can set whereby the OCS client application won't deny a logon if the SIP URI suffix is different from the pool fqdn. This is very important as you can't change it easily once you've created the pool name.

DNS Requirements:

1 Internal A record for the pool name = pool01.contoso.com pointing to the IP of the Enterprise Edition server.

1 Internal SRV record _sipinternaltls._tcp.contoso.com pointing to the pool name (i.e. pool01.contoso.com). Set the port to 5061, the priority and weight as default.

1 External SRV record _sip._tls.contoso.com pointing to sip.contoso.com. Set the port to 443, the priority and weight as default.

1 External A record for the Edge server's Access Edge role = sip.contoso.com which should point to the public IP for this service.

Certificate Requirements:

1 Internal PKI certificate with a subject name of pool01.contoso.com and a subject alternative name of server01.contoso.local, and sipinternal.contoso.com.

1 External public CA certificate with a subject name of sip.contoso.com.

IP Address Requirements:

1 IP for the pool server
1 IP for the database server
2 IP's for the Edge Server (1 internal/1 external)

NOTE: If you're NAT'ing the external IP for the Edge server then you should have a public IP as well as a private IP.

File Share requirements:

Meeting Content Share: file://server/meeting_content
Meeting Metadata Share: file://server/meeting_metadata
Application Data Share: file://server/app_data
Client Update Share: file://server/client_update
Address Book Share: file://server/abs_store

Service Accounts:

RTCService
RTCComponentService
RTCGuestAccessUser
RTCEdgeUser (often times a local user if no perimeter domain exists)

Database Requirements:

RTC (persistent user data/contacts/allow & block lists/etc)
RTCConfig (global/pool/computer-level settings)
RTCDyn (transient user data)
LCSLog (used by Archiving Server for IM data)
RTCCDR (used by Monitoring Server's call detail recording and IM stats)
QOEMetrics (used by Monitoring Server's quality of experience data)

Firewall requirements:

Permit 443/TCP from any to Public IP of Edge Server
Permit 5061/TCP from any to Public IP of Edge Server
Permit 5061/TCP from Internal IP of Edge Server to IP of the pool server
Permit 5061/TCP from pool server IP to Internal IP of Edge Server

Now that we have most of the base requirements for the infrastructure, let's talk about the Edge servers. When I first began installing an Edge server I was perplexed at the idea of an "internal" vs. "external" interface and how these would sit on two different networks. After reading some of the OCS documentation I found that you can actually set the Edge server up in three different configurations.

First, the Edge servers can be set up so the external and internal network interfaces are on completely separate networks from the "internet" network and the "lan" network. This means your external interface is on a DMZ network protected by a firewall and using NAT (or not). This also means your internal interface is on a DMZ network protected by the same (or another) firewall.

Q: So how can you have two network interfaces each on separate networks with two default gateways?
A: Well you can do this but I wouldn't advise it. If connectivity is lost for a certain duration, you may have all traffic routed through the wrong NIC. This is due to a feature called "dead gateway detection" and is enabled by default. Read this link for more: http://support.microsoft.com/kb/159168/EN-US/. My suggestion would be to set your default gateway on your external interface and add a static route for any internal networks you need to get to (i.e. pool server, etc.).

Second, you can have both "internal" and "external" physical interfaces on the same network segment. Again, the external interface will hold the default gateway and a static route is required for all traffic destined for the LAN (i.e. your pool server(s)).

Third, you can get away with a single NIC but this isn't supported by Microsoft.

Another interesting case I run into with each project is an over zealous IT administrator wanting to team every NIC he can find. I really don't get this as I've only seen one network card ever fail in my 15 years of working in IT. Often times the network throughout isn't redundant and the team of NIC's are not connected to different switches, etc. etc.

Q: So what about NIC teaming in general for OCS?
A: Well I've had a few Microsoft support cases with Jithendranath Reddy and he is a smart guy! Check this post of people "having no issues" with NIC teaming: http://social.microsoft.com/Forums/en-US/communicationsserversetup/thread/f3dd11d0-a108-4dad-bcbd-976f08bc765b. My response is much the same. Leave it out....don't confuse the design by adding this complexity as it will almost always cause more work than it is worth!

Well this is enough for now. Keep checking back for updates to this post for the latest information.

Cheers,

Jason

Microsoft Unified Communications Reference Guide: Part 1 (Architecture)

2009-05-16T08:44:00.003-06:00

Greetings,

This part will cover the overall architecture of Microsoft's Unified Communications platform.

One of the reasons I appreciate working with this platform is the truely unified nature of the application stack. We're dealing with two server products (for the most part) when it comes to Microsoft UC; Office Communications Server 2007 R2 and Exchange Server 2007.

Office Communications Server 2007 R2 is available in two versions; Standard and Enterprise. The same goes for Exchange Server. So the first question is:

Q: What is the difference between Standard and Enterprise for OCS and Exchange?
A: It has to do mostly with your requirement for High Availability. Do you need HA? If so, then use Enterprise for both platforms.

The Standard Edition of both OCS and Exchange do not support high availability at all. In fact with OCS you don't get the choice of where to install the database and shared components; it will install SQL Express locally.

It should be worth mentioning that the server edition software is independent of the client licensing platform. For example, you can have an Enterprise OCS and Exchange CAL for your users who connect to a Standard Edition OCS/Exchange environment (and vice versa).

Q: What is the difference between the Standard OCS CAL and Enterprise?
A: The Microsoft web site has a great page which talks about this.

Q: What is the difference between the Standard Exchange CAL and Enterprise?
A: Again the Microsoft web site explains this well.

When you license both Exchange and OCS with 'all the trimmings' you get the following high-level features:

OCS Features

Presence/Instant Messaging
Web Conferencing (Live Meeting)
PC to PC and voice/video
IP Telephony (VoIP)
Audio dial-in conferencing
Group chat

Exchange UM features

Unified Messaging
Outlook Voice Access
Auto Attendant

As a best practice I like to design OCS solutions so they include some additional Microsoft UC platforms such as:

Microsoft OCS Monitoring Server (for QoE/CDR)
Microsoft OCS Archiving Server (for IM logging)
Microsoft OCS Edge Server (for remote IM/Voice/Video/Federation/etc)
Microsoft OCS Mediation Server (for VoIP/PSTN features)
Microsoft OCS Communicator Web Access (for dial-in conferencing and web-based IM)

Q: When do you need a Monitoring Server?
A: I like to include the Monitoring Server role in just about every implementation for two reasons. First, the Quality of Experience technology is key to understanding the Mean Opinion Score (MOS) of your voice conversations. The MOS score is given to a voice call and is a simulated subjective analysis of voice quality on a per call basis. The QoE data is invaluable when troubleshooting voice quality issues and has improved significantly from the R1 release. Second, the CDR data rolled up into the SQL reports contains excellent information when it comes to determining how many IM conversations, PC to PC calls, or conferences were conducted in a certain time frame. You can use this data to gauge relative interest in the technology or for capacity planning.

Q: When do you need an Archiving Server?
A: If you have a requirement to log Instant Message conversations.

Q: When do you need an Edge Server?
A: If you have a requirement to communicate with other companies running OCS (Federation), you want to enable users to have public IM capability (Yahoo!/AOL/MSN), or you simply want to enable remote access (anonymous or authenticated). One of the primary reasons for an Edge Server is to permit people to join your hosted Live Meeting sessions.

Q: When do you need a Mediation Server?
A: If you wish to enable Voice over IP and use OCS to place phone calls. The Mediation server performs a few tasks. First, it does basic protocol conversion from Microsoft's "RTAudio" codec to a more industry standard "G7.11" codec. Second, it performs encryption or decryption on voice traffic. Many vendors today offer this server in an appliance configuration where the Mediation Server is combined with a voice gateway; this is often called a "Hybrid Gateway". One vendor called "NET" www.net.com has a gateway called the VX1200 which can perform both tasks without the need for a Windows operating system. The conversion is performed "on chip" and the integration with AD means you can implement OCS voice with one less server! Last, the Mediation Server performs inbound number normalization for PSTN calls (more on this later).

Q: When do I need a CWA Server?
A: If you want to provide dial-in audio conferencing or web-based IM.

That pretty much covers the high level components for now.

Cheers,

Jason

Microsoft Unified Communications Reference Guide: Part 0

2009-05-16T08:35:00.002-06:00

Greetings,

I'm creating this guide since my colleagues and I often ask the same questions over and over again when implementing Microsoft UC solutions such as:

What databases are used by OCS and how big are they?
What type of certificate do you need for Unified Messaging and what subject name/subject alternative names should it have?

This guide will cover all aspects of implementing both Microsoft Office Communications Server 2007 R2 and Microsoft Exchange Server 2007 with Unified Messaging.

One of the most interesting topics of late is the need for E.164 formatted phone numbers. This means more than simply having a "+" sign in front of the digits. The use of this format, or more interestingly the use of a plus sign, has been debated by many in the industry along with Microsoft's internal product group. This guide will cover my theory behind using E.164 numbers, DID's and non-DID's.

Please feel free to email me or post your questions/comments/etc.

Cheers,

Jason

To "9" or not to "9", that is the question

2009-05-10T13:50:00.006-06:00

I know, terrible title....

Anyway I have a quick post today about normalizing numbers with a "9" prefix (or without) using one line rather than two rules. This tip comes from Mike Stacy.

....edited on May 28, 2009....

I've come across a nasty case where the MOC client normalizes the number but just doesn't want to dial it. I originally posted the fact that you could use a "?" following a number such as "9" so the input of that value is optional. As it turns out, this isn't the case.

The following format does work:

^(?:91|9|1|)(780\d{7})$
$1

This will normalize the following numbers:

97805551212
17805551212
7805551212

...all into the following:

7805551212

No need to create two rules to handle the 9, 1 or nothing in front of your numerical value.

Cheers!

ZANTAZ (EASOWA) ISAPI Filter causes a 2007 CAS to fail with "Object Expected"

2009-05-08T11:38:00.003-06:00

Again, another odd issue I've come across this week....

While installing an Exchange 2007 CAS server at a client site (getting ready for a 2003 to 2007 migration) we encountered a case where Outlook Web Access produced the following error:

"Object Expected"

A refresh of the page resulted in a white page with no formatting and some odd looking buttons. Exchange 2007 CAS server is supposed to proxy the client requests to either a 2003 or 2007 mailbox depending on where it "lives". During the implementation of of the CAS server we tested moving a user's mailbox to a 2007 server and logged onto the CAS just fine.....no issues. It was when we attempted to authenticate a user who had a 2003 mailbox where things went sideways.

We tested navigating to the 2003 front-end server and directly at the 2003 mailbox cluster with no issues. I noticed a plug-in was installed when I visited the OWA site which lead me to ponder the possibility of it interfering with the proxy request. A call to Microsoft support confirmed this.

The 2003 mailbox server had an ISAPI filter on the IIS web site used for OWA. The plug-in is called "EASOWA" and is used by the ZANTAZ software (for email archive). We removed the ISAPI filter and it worked immediately.

Since the migration will be short, there will be no workaround for the issue and an EASOWA plug-in for 2007 is being tested as I write this.

Troubleshooting this issue was particularly difficult in that a direct connection to the 2003 FE or MB server worked fine. The 2007 CAS server also worked fine when connecting to the 2007 MB server. It was the process of proxying the link where things broke down. I was convinced it was the 2007 CAS server at the time but obviously I was wrong. Hmmm....that's twice now.

Cheers!

Jason

Exchange Update Rollup 7 blows up EWS/UM/AD

2009-05-08T11:09:00.002-06:00

Well I spent a few hours with Microsoft support today throubleshooting an issue with Exchange Web Services, Unified Messaging, and Autodiscover. It appears that the web.config file contains a variable called %ExchangeInstallDir% which is invalid. The web application can't interpret what this variable is because it isn't set on the OS anywhere.

The issue is visiable in two ways:

1. Try to navigate to https://serverfqdn/ews/exchange.asmx (it will fail)
2. Try to run the "Test-OutlookWebServices -Identity user@domain.com fl" and it will show you all kinds of errors.

The fix was to open the web.config files at:

C:\Program Files\Microsoft\Exchange Server\ClientAccess\exchweb\ews
C:\Program Files\Microsoft\Exchange Server\UnifiedMessaging\WebService

...and replace the %ExchangeInstallDir% with C:\Program Files\Microsoft\Exchange Server\

Restart IIS using "IISRESET" and you should be okay.

Cheers!

Microsoft Communicator Phone Edition (Tanjay) and wildcard certficiate

2009-04-30T08:20:00.005-06:00

I spent quite a bit of time troubleshooting the interaction of Tanjay to Exchange CAS server recently only to find out from Jens that wildcard certificates are not supported.

So, for those of you out there who have a wildcard certificate (*.domain.com) on your CAS server, you must re-issue it before implementing OCS/UM with Tanjay phones.

I typically use the following command when creating the request:

New-ExchangeCertificate -DomainName mail.domain.com, autodiscover.domain.com, mbxserver1.domain.local -FriendlyName Exchange_CAS_SAN_Cert -GenerateRequest:$True -Keysize 1024 -path c:\exch-san.req -privatekeyExportable:$true

Having the "autodiscover" name in the SAN is also required for the Tanjay phone to connect to the CAS server. Don't forget to create an "A" record as well for these names.

Cheers.

AudioCodes gateways and TDM to TDM routing...

2009-04-26T20:43:00.005-06:00

I came across an interesting issue with a gateway (Mediant 1000) I was setting up for a client today. If you follow the quick installation guide for OCS you probably won't have this issue but if you've bypassed the guide and have forgotten to set up your SIP Proxy IP then read on.

The gateway we were setting up was going inline of the PBX and PRI. The previous configuration was:

PSTN--->PRI--->Nortel--->Gateway--->OCS

The new configuration is:

PSTN-->PRI-->Gateway-->OCS

Nortel

If you don't set the SIP Proxy IP address then everything will work fine except TDM to TDM routing for outbound calls. It took 6 hours to figure this out and it didn't make sense but the call flow for Nortel to PSTN resulted in the call being sent to OCS always. Calls from OCS to PSTN worked fine. Also, more maddening was that PSTN to Nortel worked fine.

So, remember......the quick installation guides are still a good reference for you and can save you a LOT of time and frustration for those key settings you may forget to change.

I'm tired....

Normalizing inbound calls and solving the "9" prefix dilemma

2009-04-25T19:06:00.003-06:00

I don't believe it is actually written anywhere but I've found out recently that the location profile you specify on your mediation server is actually used for normalizing inbound calls. Seems straightforward but it isn't always clear what these options and settings are used for.

This post is designed to bring awareness to this process first of all but more importantly I talk about the dilemma of including normalization rules for "9" prefix calling.

First off, if you're performing digit manipulation in the gateway for inbound calls you're probably doing the work of OCS anyway. Remove any digit manipulation you have in the voice gateway (or equivalent, i.e. Call Manager).

You want to create a normalization rule and include the name of the mediation server in it so you can easily keep track of which location profile is for what server. For example, if your mediation server is called "abedmocsm01" then create a LP called "abedmocsm01.domain.com".

Include the most common rule for North America calling as follows:

^(\d{10})$ which translates to +1$1

Follow suit by adding rules for your DID's and non-DID ranges. If you have a main number with non-DID's behind it then it would look something like:

^5(\d{3})$ which translates to +17805551212;ext=5$1

Now that you have that sorted, you'll notice that you don't have a rule for something like:

^9780(\d{7})$ which translates to +1780$1

The above rule wouldn't apply since the PSTN (or PBX) would never send a 9, then digits. Using this "split Location Profile" type scenario allows you to get away with not having both of these rules:

^9780(\d{7})$

^780(\d{7})$

I hope his is some value to those out there.

Cheers,

Jason

Communicator Phone Edition April 2009 Update

2009-04-24T10:00:00.003-06:00

Quick post today......

There is an update to the Tanjay phone firmware (Communicator Phone Edition R2) for April which fixes a few things and adds new functionality:

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=565595be-6cf3-4a61-a1e4-12555749ca64

-Users will now see their own phone number displayed on screen at all times. The number shown is the 'work' number (the number in the General tab of the user account properties in AD).

-If you called a user's alternate number, that number is now stored as the called number in the call log.

Cheers!

Jason

Great tools for building .NET regular expressions

2009-04-23T18:02:00.002-06:00

If you're like me and have trouble deciphering .NET regular expressions for tasks like creating normalization rules for OCS and the Address Book Service, look no further. I've included my favorite 'cheat' tools here for you to to evaluate.

RegexBuilder: The first one I'll start with is free and can be downloaded and run without an installation routine. It allows you to type or paste in your expression and test against it on the fly. This tool is great for performing simple validation of an existing string but you really need to know how to write one before you start with this tool. There are no 'helpers' to assist you with wondering the difference between "\d*" and "\d+", which by the way, I still don't know the difference. ;)

Download location: http://renschler.net/RegexBuilder/

Expresso: This has to be my favorite tool thus far. It can be downloaded for free and by simply filling out their online registration form, they will send you a registration code. What I like about this product is that they give you examples and show you what each character means (even though \d* and \d+ are still not clear to me). The GUI interface allows testing of multiple strings and their translations so you could take a copy of your ABS normalization text file and paste it directly into the 'Test Mode' screen to verify your results.

It can be downloaded at: http://www.ultrapico.com/Expresso.htm

RegexBuddy: If you have a few bucks lying around and want to give this application a spin, it certainly does the trick and more. This might be a good place to start for the beginner since the interface is much more helpful than the other two. At $39.95 USD it appears to be a pretty good deal however in the context of doing dial plans for OCS, I'm certain you can get what you need out of the other two combined.

That's all for today.

Cheers,

Jason

Microsoft Office Communicator & Live Meeting April updates

2009-04-12T11:46:00.002-06:00

Greetings,

A quick post today...

Microsoft has released a few new updates to the trio of OCS client applications:

Office Communicator 2007 R2: http://www.microsoft.com/downloads/details.aspx?FamilyID=515d6dba-4c6a-48bb-a06a-d99c5742676d&displaylang=en

Live Meeting 2007: http://office.microsoft.com/en-us/help/HA101733831033.aspx

Microsoft Office Conferencing Add-Ins: http://office.microsoft.com/en-us/help/HA102368901033.aspx

Cheers!

Jason

OCS Address Book Service Normalization

2009-04-05T20:16:00.008-06:00

Recently I was working at a customer site where we were trying to come up with a normalization string for numbers in their AD forest that could handle the varying array of number formatting. I find this to be a common issue for many organizations with multiple people typing phone numbers into user accounts.

Some examples of these are:

780.555.1212
(780) 555-1212
780-555-1212
1 (780) 555-1212

The address book service performs a nightly scan of Active Directory and attempts to build a database of users and phone numbers. If the normalization rules in the "Company_Phone_Number_Normalization_Rules.txt" file can't normalize the numbers you will get a list of them outlined in the "Invalid_AD_Phone_Numbers.txt".

NOTE: The information in the "Company_Phone_Number_Normalization_Rules.txt" file is incorrect (yes, still in R2). The txt file suggests you rename the file to "Company_Phone_Normalization_Rules.txt" (which is missing the word "Number"). If you follow these instructions in the txt file it won't work. Just remove the word "Sample_" from the file name and don't forget to uncheck it as a read-only file.

Now, back to the Address Book Service and AD number normalization...

The 'universal' normalization rule I use is as follows:

(\d+)([\s()\-\./]+(\d+))([\s()\-\./]+(\d+))([\s()\-\./]+(\d+))?([\s()\-\./]+(\d+))?([\s()\-\./]+(\d+))?[\s]*

+1$1$3$5$7$9$11

This above normalization rule will work for just about any North American phone number someone types in. To make this easy to decipher and modify I will also remove all the text from the default file and begin with this one rule.

To test a number:

Open a command prompt and navigate to C:\Program Files\Microsoft Office Communications Server 2007 R2\Server\Core.
Type in "abserver.exe -testPhoneNorm " and view the result

If you wish to force the Address Book Service to scour AD again, type in "abserver.exe -regenUR" and "abserver.exe -syncNow". Be sure to open Event Viewer between these two commands and look for an event suggesting the system was successful.

The bottom line is that all numbers in your AD environment should be formatted as e.164 numbers (+17805551212).

Cheers!

Use any IP phone with OCS?

2009-04-05T19:40:00.002-06:00

Well if the folks at Evangelyze (http://www.evangelyze.net) have their way, the SmartSIP product will allow support for generic SIP devices. This means you could potentially connect any IP phone (Cisco to MITEL) to OCS through this gateway style software.

From what I've been told, the IP device linkage isn't quite completed yet but stay tuned for more information as I test this software with OCS when it becomes ready.

Cheers!

Off to Exchange 14 Ignite!

2009-04-05T19:30:00.002-06:00

Well I'm packing this evening for a first time trip to Dallas, Texas to attend 4 days of Exchange 14 Ignite training. The event is being held at various locations across the USA this year in preparation for the next release of Microsoft Exchange Server which has yet to be given an official name (or has it?).

The event will consist of:

Setup and deployment
Planning and sizing
Client Access Server changes
Federation
Transport and Routing
Compliance: Information leakage protection and control
Archiving and retention
Unified Messaging
HA and storage
Online services

I'm looking forwarding to the nice weather and opportunity to hear from the experts about this latest version of Microsoft's messaging platform.

Well I'd better get packing...

Tanjay won't update (Polycom CX700)

2009-04-01T09:22:00.005-06:00

Greetings,

We've done our fair share of troubleshooting with the Tanjay phones lately as we have internally and at client sites various beta phones with the original firmware, R1 firmware and R2 firmware versions. I wanted to write a quick entry about how to update these phones.

First off, read this article to get an understanding of how the process works: http://blogs.technet.com/ucspotting/archive/2009/03/11/troubleshooting-ocs-2007-r2-device-update-service-for-communicator-phone-edition.aspx

Second, if you have a SIP URI and SMTP domain which is different than the fqdn of the domain (i.e. contoso.com for SMTP/SIP and contoso.local for AD) and you don't have WINS deployed then you will likely have an issue with the entire process.

You MUST MUST MUST deploy a WINS server and point your Domain Controller at the server so it registers the domain in WINS. You also need to add a static entry called "ucupdates" which points to your R1 update server.

If you're updating an R1 phone in an R2 pool and you have the above mentioned issue with the domain fqdn being different from your SIP URI domain, then add a static WINS entry called "ucupdates-r2" which points to your R2 front-end server.

If you're updating a beta firmware phone this MUST be done in an R1 environment first before logging into R2.

We worked with Microsoft extensively on this issue troubleshooting it by capturing Wireshark traces through the second network port on the phone. You can see the requests for WINS entries going out and if you don't have WINS running properly in your environment, this won't work at all.

NOTE: You may need to perform a hard reset on the phone once you update the beta firmware to R1. If you sign into an R2 pool an expect the phone to update and it doesn't, reset the phone and wait 5 minutes.

Hope this helps!

Jason

OCS WMI access denied 0x80041003, Windows 2008

2009-03-31T16:54:00.006-06:00

Just a quick post today. Super busy...

If you get this error when modifying the WMI properties on Windows 2008 for something like removing the "+" sign out of the Mediation server, simply run WBEMTEST by doing the following:

1. Either open a command prompt by right-clicking the icon and choosing "run as administrator"

or

2. Disable UAC

Cheers!

Jason

OCS R2: Conferencing Attendant & E.164

2009-03-08T16:04:00.004-06:00

I recently griped about the new feature in OCS 2007 R2 called the Conferencing Attendant to my local Microsoft TSP. The issue I had was that the voice prompts for joining a meeting asked you to type in your phone extension to join as an 'authenticated user'. Since we have a mix of users with DID's and non-DID numbers, how could the user type in their extension (which is actually their TEL URI) if it followed the e.164 format of:

+17805551212;ext=5555

As it turns out the Conferencing Service uses normalization rules as well. So if the user types in "5555" as their extension, it will normalize to the above number and they will pass the TEL URI authentication.

Prior to writing this article I was convinced that using a TEL URI of "+5555" is the best option when using the Conferencing Attendant service. Now, once again I'm a supporter of the ';ext=' format.

There are however two outstanding issues with this idea:

1. The AudioCodes Mediant 2000 voice gateway (version 5.6 firmware) doesn't like the the non-numerical values such as ';ext=' when performing digit manipulation. As you are well aware, if your user doesn't have a DID, they'll require the voice gateway to manipulate the digits to prepend the +17805551212;ext= value before their extension number. When you save this type of manipulation into the AudioCodes gateway it wipes out all, YES ALL of your manipulation rules. I'm waiting for a fix at the moment :(

2. When you type in the e.164 formatted number into the "Telephone" field of a user's account in Active Directory, and try to perform a lookup using an Exchange Auto Attendant, it will fail. Apparently Exchange doesn't know how to handle the ';ext=' value either. Also, when building number masks for these types of numbers, the ';ext=' value is not something Exchange will accept. Seems odd doesn't it? Well give it a try. It doesn't work :(

The so called 'workaround' for issue 1 is that you shouldn't reboot the gateway and a saved config file will have the values stored in it so if you must reboot, reload the config file. To get around issue 2, you need to change the Telephone field to the users extension only and make sure you have a normalization rule in OCS to handle the 4 (or 5) digits Exchange will toss at it.

Now, the question is.....to e.164 or not?

Recording voice prompts for OCS 2007 R2 IVR and Exchange UM

2009-02-24T07:34:00.003-07:00

Now that Windows Vista and Windows 7 lack the ability to record WAV files which are required for the OCS 2007 R2 IVR features and Exchange 2007 UM, I've been using a 3rd party program to record.

The application is called Audacity and can be found at: http://audacity.sourceforge.net/

I simply record my voice file, use the cut/copy/paste to modify what I need from my various takes, and click File, then Export as WAV. I've found Exchange UM to be very picky when it comes to the type of WAV file it uses and Audacity seems to work out of the box without issue.

Click to dial with OCS 2007 R2 using a '9' prefix

2009-02-24T06:50:00.008-07:00

I've been working with OCS dial plans for a year and half now and have always wondered how you would perform click to dial on numbers in OCS which need a '9' prefix to be normalized. For example:

I type in: 917805551212 which normalizes to +17805551212

I have this normalization pattern for two reasons. First, to duplicate the dialing experience for users who are used to a legacy phone system. Second, to eliminate overlapping dial plan numbers. An example of the overlapping dial plan is as follows:

If I allowed the user to type: 7805551212 it could in some cases normalize to +7805 if my dial plan was set up to allow 4-digit dialing (i.e. ^7(\d{3})$ or ^(\d{4})$).

So back to the '9' prefix issue.....if I don't normalize numbers without a '9' prefix, how do we perform click to dial from contacts in Outlook or numbers normalized through the Address Book Service?

The trick I've found is with the Windows dialing rules in Control Panel.

Set up your location and dialing rules including the prefix you need to type to get 'out' to the PSTN.

I haven't found any documentation on this case to date.....then again there is a lot of information to go through in OCS. :)

Exchange Unified Messaging Auto Attendant calling issue from OCS R2

2009-02-20T21:16:00.002-07:00

Greetings,

I recently found that for some reason with OCS R2 clients they can't call an Exchange UM Auto Attendant if the name has spaces in it. To correct the problem I needed to recreate my AA objects in AD using the OCSUMUTIL.EXE application and remove/recreate the AA in the Exchange Management Console.

The error from the client was "ID:1" which doesn't tell you much. Also, a SNOOPER trace within OCS shows an error of "408: Bad Request".

Cheers!

Jason

Communcator Web Access (error 0-1-492)

2009-01-22T07:23:00.005-07:00

I recently had the pleasure of working with a senior Microsoft escalation engineer who helped us resolve this error message and thought it would be helpful to share my experiences with how it was resolved.

Apparently there is a bug with CWA and Windows 2008 where the Service Principal Name (SPN) isn't created for the FQDN of your CWA site. The result is the following error when you attempt to sign in with integrated Windows authentication:

Cannot sign in because your computer clock is not set correctly or your
account is invalid (error code: 0-1-492)

When I created our 'internal' and 'external' CWA web sites on our web server I set up two IP addresses so that each site could have a unique IP with the same certificate bound to it. We use the same FQDN for both the internal and external CWA site (i.e. https://cwa.contoso.com/). ISA Server 2006 is used to direct external clients to the IP bound to the external CWA site and vice versa. The key difference is that the internal site uses both forms-based authentication as well as Windows authentication.

The Windows authentication site will fail with the error if your site is running on Windows 2008 Server while the other site will work just fine. We limped along for a while by setting the IP address of the internal site to be the external site until this fix came along.

HOW TO FIX IT:

You need to add an SPN matching the FQDN of your internal site (cwa.contoso.com) to the user account you assigned in AD for CWA.

Open ADSIEDIT and navigate to the OU where your CWA service account is stored.
Locate the CWA service account (mine is called 'CWAService') and right-click then choose Properties.
Turn on the checkbox to 'Show only attributes that have values' and scroll down to an entry called 'servicePrincipalName'.
Click the Edit button.
Type in the SPN using the following format (http/). For example, if your site is called "cwa.intel.com" then type in "http/cwa.intel.com". NOTE: Do NOT type http://.
Click OK and you're done!

Depending on your topology and the location if your web server to a DC, replication may need to occur.

Cheers!

Exchange Voice Mail for iPhone users

2009-01-21T16:35:00.004-07:00

A great co-worker of mine found this PowerShell command which allows you to change the codec for voicemail on each user rather than the entire dial plan.

set-UMMailbox useralias -CallAnsweringAudioCodec GSM/PCM/WMA

I haven't tested which codec works for sure (yet) but I seem to recall GSM does and its a nice manageable size.

Cheers!

Removing the plus "+" sign from a SIP INVITE in OCS R2

2009-01-17T18:36:00.005-07:00

Recently I was asked to help get our Cisco Call Manager environment connected to our OCS environment since we have both Cisco and Microsoft phones in the company and we wanted to have 4digit dialing between the two environments.

Well now that OCS R2 has the ability to remove the + sign from outgoing SIP INVITE commands via WMI, I thought I would share with you the process for making this happen.

Click on the START menu and click Run
Type 'wbemtest' and click OK
Click the Connect button and make sure it says 'root\cimv2' then click Connect
Click the Enum Classes button and click OK (don't type in anything into the text box)
Scroll down until you see 'MSFT_SIPMediationServerConfigSetting' then double-click it
Click the Instances button then double-click the single object (this looks very similar to the previous screen)
Scroll down to the bottom and double-click on 'RemovePlusFromRequestURI'
Type in 'TRUE' and click Save Property
Click the Save Object button then the Close button
Restart your Mediation Server service

Now when you make outbound calls you can trace the SIP messages and should see your e.164 numbers without a + sign.

Cheers!

Microsoft Office Communications Server 2007 R2 install/removal

2008-12-21T16:01:00.002-07:00

Greetings,

I recently attempted to remove RC code from a semi-production server this weekend and noticed I was getting errors from the 'Web Components' and 'Core' installation bits. The errors indicated there was a permission issue which wasn't much help.

Eventually I figured out that UAC in Windows 2008 was preventing me from removing OCS and I quickly turned it off on all my servers. This raised another issue though....

When attempting to install and activate the various OCS R2 components afterward I noticed the pre-requisite checker had indicated items such as 'Prepare Active Directory' where listed as 'Complete' however no checkmark appeared next to the words like it normally does. It was also greyed out.

The fix took a few minutes to figure out but at the root of this issue is the fact that the OCS setup page is an HTA (application) and Microsoft's Internet Explorer Enhanced Security was getting in the way. After disabling this feature I was able to continue installing the RTM code for OCS R2 :)

Hope this helps someone else out there!

Cheers!

Jason

You can't call UM users on a different dial plan --NOT!

2008-11-10T18:51:00.004-07:00

Well its been a few weeks of troubleshooting and help from Microsoft PSS but I think I've finally figured out how UM handles calls on both DTMF and voice activated auto attendants.

Our client's setup is a MITEL 3300 which is connected to both OCS and Exchange UM using two distinct paths. All inbound calls are supposed to route to the Exchange server which has a simple auto attendant set up to direct calls off to extensions local and remote to the MITEL as well as OCS. Since we were concerned about a single T1 between the voice gateway and the MITEL being used up for both OCS calls and auto attendant calls, a SIP trunk was created.

We quickly had an issue with voice activated dialing where you would say the person's name but the call would go directly to voice mail. A SIP trace from Exchange UM revealed ZERO packets leaving the server. This was quite odd since keying in the DTMF codes for the extension worked fine. The calls to Microsoft were originally met with "you can't call between dial plans" to which I responded......"um, WHAT???". If you could imagine a fully deployed UM environment with multiple geographic locations all with different dial plans (for language purposes) on the same server......it is possible......read on....

The fix was simple but finding out how UM initiates a voice activated call wasn't. Since a SIP trace wasn't possible, it was up to Microsoft to provide some insight. Even with the help from Microsoft it wasn't until we dug around testing various accounts that I noticed some of them produced different results.

After opening my own test account I noticed the General tab of my account properties didn't have a "telephone" number listed.....it was blank. I entered my extension number and it worked the first time! I had made a grave mistake assuming the UM server was pulling my TEL URI field from OCS on the name match when I used the auto attendant. As a matter of fact the UM server explicitly uses this field for calling the user.

Now that we have that one fixed we're off to deploying phones and finishing the call tree for UM!

Tanjay phone firmware -version 2009

2008-10-22T12:54:00.003-06:00

Just a quick update on what's coming with the new Tanjay phones:

Full integration with the PC via USB (existing port)
When a call is made on the Tanjay, the MOC client will also show that you're in a call. Call control from the MOC client affects the Tanjay and vice versa. This means that if you put a call on hold with the PC, it will do the same for the phone. Also when you lock/unlock your PC, the Tanjay does as well.
Redial!!! We now have a redial button on the screen.......finally!
The icons for the contacts show you quickly which type of call (PSTN or Communicator) that will be made if you click to call via the touch screen. This was a big complaint for many people who expected to to a PC call by clicking and assuming the phone would be "intelligent" enough to make sure the call went out via the cheapest method possible.
...and much more to come!

Office Communications Server 2007 R2: Communicator Attendant

2008-10-20T07:55:00.004-06:00

The following video demonstrates the new Communicator Attendant feature in OCS 2007 R2. The video shows how the new console will allow call queuing and handling of many incoming phone calls from both internal and PSTN-based users.

What I find most impressive is how they've thought of every angle in terms of how the caller and callee know about where the call is going and where it came from. By adding presence information, Microsoft has improved the overall experience for the person handling the call.

Video provided by Microsoft. More available at http://edge.technet.com

Microsoft Office Communications Server 2007 R2

2008-10-16T07:38:00.005-06:00

Well it has been publicly released.....well maybe not yet....but Microsoft has given us a glimpse into the next version of their next version of OCS 2007.

Highlights of OCS 2007 R2:

All server roles will be based on 64-bit code meaning you will be able to scale to more users and more roles per server with less hardware.
Conference bridge capability! This will allow an internal or remote user to call an OCS conference bridge resulting in a substantial cost savings. To expand on this more, Microsoft has done a fantastic job of making the experience easy to use and seamless to the end user.
A new version of the MOC client will allow application (and desktop) sharing which is similar to MSN Messenger today. This is a welcome feature as the previous version required you to install the Live Meeting 2007 client to share apps/etc.
Support for Mac/Linux via web interface
A completely new feature is the ability to set up and participate in "Persistent Group Chat" sessions. These seem somewhat similar to IRC-style chat sessions where you can invite others and collaborate in a persistent real-time chat environment. This could be perfect for those "SWAT" teams that get called together in critical situations to solve a production issue (both IT and non-IT staff). The chat sessions are searchable and can be filtered as well.
For those people who manage incoming calls such as administrative assistants a new "Attendant Console" gives the power of call routing, managing conferences, and setting up workflows for high volume call environments.
Direct "SIP Trunking" is a long awaited feature which eliminates the need for a physical voice gateway. In my blog I talk about using a similar SIP trunk connection for my software PBX and OCS but this is officially supported now. Apparently there won't be a method for authentication so the SIP trunks would typically be for organizations who have a dedicated MPLS link to a telco. This opens up new possibilities for branch survivability in that you could route traffic through an ISP in case a site VPN link went down.
A long awaited feature is the ability to define "hunt groups" and set basic call routing features for a collection of users. This is called a "Response Group" in OCS 2007 R2. This feature is similar in nature to an ACD in a legacy PBX. Basic features should include Music on Hold, ring-no-answer to voice mail (Exchange UM/etc), and call routing/escalation. I've heard they have included the same Microsoft Speech Server engine in Exchange UM into OCS R2.
If you're a Nokia, Motorola, or Blackberry user you may now be in luck when it comes to the Office Communicator Mobile client. Support for these phone manufacturers is coming with a new "single number reach" feature. More on this to come...

So that's it for now....there is even more to come but I can't say much other than this!

Cheers!

Moving the OCS database

2008-10-16T07:32:00.001-06:00

I couldn't have written it any better: http://technet.microsoft.com/en-us/bb936638.aspx

And now for something completely different....

2008-10-07T18:55:00.004-06:00

I've enjoyed listening to Metallica for many years now but stopped some time after high school (in 1992). I wasn't alone and most of my friends agreed the new self titled album was rubbish....well most of it was. The next decade was dissapointment over and over again until only just recently.

Fast forward to the fall of 2008 and the guys from Metallica along with Rick Rubin have put together a masterpiece. Death Magnetic is as close to the 'real' Metallica we've all grown to love.

Maybe it was the death of the hair metal bands of the late 80's and early 90's that caused them to re-think their format but someone smarter than me knows for sure. All I know today is that this latest album freakin' rocks.

So far my favorite track has to be All Nightmare Long.

OCS Update Server

2008-09-20T17:50:00.005-06:00

Just a quick post about quick links for using the OCS update server (i always forget them):

Management Console: https://servername.fqdn.com/mgmtconsole

The Management Console is used for posting updates to phones such as the Tanjay and RoundTable.

UC Update Server Site: https://servername.fqdn.com/sites/UCUpdateServer

This site can be used to check logs of test devices defined on the Management Console link (above).

OCS document for deploying Update Server: http://www.microsoft.com/downloads/thankyou.aspx?familyId=83ef9159-e446-4d13-b05f-7e328b3cb4ad&displayLang=en

pbxnsip.com & inphonex.com

2008-09-20T15:47:00.002-06:00

Well its about time I wrote about my experiences with www.pbxnsip.com as a software based PBX and www.inphonex.com as an online SIP provider.

First off, I can't say enough about the support from pbxnsip so far! I was new to the VoIP world when I started investigating options for my lab environment where I wanted to build out something more than an IM and web conferencing solution. After working through many of the issues with my OCS Edge servers, I finally had an environment I could prove out all my scenarios and began looking for a software PBX.

Going back some time though, I had started with the "3CX" free PBX software as it seemed to have some ability to talk to things like Exchange 2007 Unified Messaging (even though you needed to buy a license to get it to work). My trouble soon began when I tried making outbound calls and realized 3CX couldn't handle e.164 phone numbers prefixed with a plus sign "+". I posted my concerns along with others on the forum and wasn't able to get much assistance other than a few pointed questions as to why we would want to implement OCS and digs on how Microsoft's SIP implementation is non-standard, etc. etc.

Somewhere along the way I found a post about pbxnsip and their work with Microsoft Office Communications Server. I quickly checked the compatibility guide for IP-PBX's and noticed they were already listed on the Exchange 2007 UM site: http://technet.microsoft.com/en-ca/library/cc164342.aspx#supIPPBX

So this was good news!

Even though they're not on the tekVizion list of certified PBX's for OCS --yet, this was a viable option. Thanks as well to their wiki page on the subject: http://wiki.pbxnsip.com/index.php/Office_Communications_Server.

So this is what I needed to get all the software bits in place, now it was time to find a SIP trunk provider. I asked around and did some digging online and found www.inphonex.com which I think is based in Miami, FL, USA. They were able to provide me a DID based in Edmonton, Alberta, Canada and their rates were decent. So far I've been happy with their service even though the odd time I call my DID I get a busy signal....but not to bad for a lab environment.

For those of you who are looking for an alternative to www.inphonex.com, check out www.voiphiway.ca as they seem to have slightly better prices and have a more "trusting" web presence.

Cheers!

SNOM OCS Edition...

2008-09-20T12:15:00.014-06:00

SNOM OCS Edition firmware (Contact tk@snom.com)

I recently purchased two SNOM VoIP phones, a 320 dual line display and a 370 hi-res LCD unit. My goal is to connect them in various configurations to my software based PBX solution (pbxnsip) and my Microsoft Office Communications Server 2007 lab environment.

Tim Koehler of SNOM in Germay was kind enough to respond to my request for their latest firmware which supports OCS. The firmware update allows registration, SRTP, and directory lookup from Active Directory along with basic presence information.

Both phones use similar firmware and support the same basic features:

Create a call from OCS to SNOM or SNOM to OCS
Call transfer (attended/unattended/blind)
Hold/Unhold
TLS Encryption
Basic Presence (in a call/available)

The instructions on how to configure the phones are quite good however they are missing one or two steps (http://www.snom.com/en/products/software/how-to-configure-the-snom-ocs-edition/).

Step 4 shows the setting "Register HTTP Contact:" as "Off" however the instructions don't specifically indicate to make this setting. My firmware on both phones had this set to "On" which resulted in an error when registering "Invalid Contact Information".

Also, when the phone attempted to register using the IP or FQDN as suggested (i.e. 192.168.1.100;transport=tls), it would fail with the error "Registration Failed". When searching event viewer logs on the OCS server I found several error messages such as:

A significant number of invalid certificates have been provided by remote IP
address 192.168.1.70 when attempting to establish an MTLS peer. There have been
10 such failures in the last 20 minutes.
Certificate Names associated with
this peer were
snom VoIP Phone
The serial number of this certificate
is
00.
The issuer of this certificate is snom VoIP Phone
The specific
failure types and their counts are identified below.
Instance count - Failure
Type
10 800B0109

So for some reason the phone is attempting to use MTLS to connect to the OCS server. To resolve this I created a new inbound connection object on my front-end server. I set it to use the same IP, port 5066, and TLS as the transport. I then configured the registration parameter in the phone to: "192.168.1.100:5066;transport=tls" and it worked!

So now the phones can be registered with OCS. I can call back and forth between MOC, Tanjay, and SNOM without issue.

In order for presence information to be conveyed I had to set the "Report Machine State" value to "On". Now when I pick up the handset the presence shows "In a call".

This solution isn't without significant issues though and deploying these units as is would be impossible in just about every environment.

So here are the current issues:

1. When I call in from the PSTN my DID goes to my Exchange UM server where the Auto Attendant picks up the call. I type in the extension of my now-signed-in SNOM phone (+8021) and it rings! I pick up the phone and NO AUDIO comes through.

I can call from OCS to OCS (SNOM) and it works great.
I can call from OCS (SNOM) to OCS and it works great.
I can call from OCS to my Exchange UM AA and transfer to the OCS (SNOM) and it works great.
I can call from OCS (SNOM) to PSTN and it works great.

!!UPDATE!! You need to change the dial plan in Exchange UM to "SIP Secured" for this to work.

2. When I place a call on hold using the OCS (SNOM) unit, the other party shows the call being held. When I pick up the call again it drops the call. I've tried this many different ways and think this is a genuine bug.

!!UPDATE!! This appears to be resolved with the above fix ("SIP Secured" setting).

3. When I try to call my Exchange UM AA from my OCS (SNOM) unit, I get an error "unsupported media type" on the phone and Exchange produces an error:

'The SDP media description received from the remote SIP peer could not
be parsed.'

!!UPDATE!! You need to change the dial plan in Exchange UM to "SIP Secured" for this to work. Also, change the "RTP Encryption" setting to "off" in the user registration, RTP settings.

4. I'm not 100% sure how to bring up the directory but I've found that hitting the "0" key once or twice usually works. I've programmed the Directory button to do this for me so I suppose its working

That's all I have for now...I'll post again as I find out more.

Cheers!

Wild goose chase with Windows 2008

2008-08-26T13:27:00.004-06:00

So I'm trying to add a Windows 2008 DC which has been a domain member for a few months and I keep getting the error:

Missing DNS SRV record "_ldap._tcp.dc.domainname"

I searched for it in DNS and even ran an NSLOOKUP....which lead me to my discovery....

My NSLOOKUP was defaulting to a server called "::1". After changing it in the command line I noticed I was able to find the SRV record. As it turns out IPv6 is enabled and set to "automatically obtain address". This causes the primary client DNS to be "::1" if you don't have IPv6 set up in your network.

By unchecking IPv6 in the network properties the IPv4 DNS IP's took affect and POW!!! It worked.

I chased this one down and ran in circles for a while before figuring it out. :S