Skype for Business Announced

We finally know what the next iteration of Lync will be. Today Microsoft announced Skype for Business. A decade ago Skype brought down the barriers by making it easy to talk to someone anywhere in the world. A few years later, Microsoft bought Skype and introduced a lot of speculation about what that would mean.

Microsoft has now fully merged Lync and Skype, enabling what should be near seamless communication between the two. Skype for Business will be launched the first half of 2015. Existing Lync on-prem customers will be able to upgrade to the new Skype for Business server, and Office 365 customers will be automatically updated.

For more information, click here for the blog or here for the YouTube promo.

~ brad

"While only one day of the year is dedicated solely to honoring our veterans, Americans must never forget the sacrifices that many of our fellow countrymen have made to defend our country and protect our freedoms." ~Randy Neugebauer

Unable to Schedule Online Meetings

The Scenario
I recently had a user that was unable to Lync 2010 Online Meetings from Outlook 2010. He didn't even have the button to create one. Otherwise his Outlook worked fine, no problems sending or receiving email, or scheduling meetings.

Fixing the Issue
My first thought was the Conferencing Addin was disabled. When I looked into his settings it was, but the Conversation History Addin was active. For some reason the Online Meeting Addin would not enable though. I ran a repair on the Lync client, no change. I had my Service Desk uninstall and reinstall the client thinking something was still corrupted with the install. No change.

Then one of the guys fixed it. Somehow the user had corrupted his Navigation Pane view. To fix this, click Start and in the search/run box type outlook.exe /resetnavpane

After this was done, we could enable the Online Meeting addin and schedule meetings.

Hope this helps!

~brad

Fun Fact:
There is no definitive history about how the word “barbecue” originated – or why it’s sometimes used as a noun, verb, or adjective. Some say the Spaniards get the credit for the word, derived from their “barbacoa” which is an American-Indian word for the framework of green wood on which foods were placed for cooking over hot coals. Others think the French were responsible, offering the explanation that when the Caribbean pirates arrived on our Southern shores, they cooked animals on a spit-like devise that ran from “whiskers to tail” or “de barbe a` queue.”

Smilies as Links

I ran into an interesting bug/fluke the other day. This happened to one of the guys working on our Service Desk. Jonatan (our Service Desk hero) is homed on one of my 2013 pools and is using the 2013 client. Dana is one of our end users, and is homed on a 2010 pool and uses the 2010 client.

While they were on IM working through an issue, every link that Dansa IM's came across on Jonatan's client as a smiley. We do have links enabled, and it didn't matter if it was an email address or URL.

In Dana's chat window, and in Jonatan's Conversation History everything appeared normal. Links other users would send him would appear and work fine. Restarting Jonatan's Lync client didn't resolve the issue either.

This is the first time I have had this reported. I'm still not sure what caused this to happen, but figured I would share anyway.

~ brad

Fun Fact:
During the initial compilation of the Oxford English Dictionary, the largest contributor of more than ten thousand words was Dr. W.C. Minor, an American Civil War veteran who was an inmate in an asylum for the criminally insane.

PowerShell: Disabling Lync Accounts

When you use certificate authentication with Lync, a user can still use Lync for up to 6 months by default. You can change this setting using the Set-CsWebServiceConfiguration -MaxValidityPeriodHours XX cmdlet. Even when we change this setting, once a user's AD account has been disabled we don't want them signing into Lync and using the system. In my environment when the user's account is disabled, the Lync account is disabled that night. Rather than adding to the Service Desk's task list, I automated the process.

This script searches AD for disabled accounts, checks to see if the account is still enabled for Lync and if so Lync disables it. It also removes the account from the AD Lync groups that we have. It then sends an email report of the accounts disabled and what the Conferencing Policy was.

Email report

** I'm posting the script here for you to review, but the display can mess with some of the HTML code I have included in the script. If you waould like to use it, I would recommend you download it from here.

#******************************************
#
#   DESCRIPTION:  Disables Lync accounts after the AD account has been disabled and removes from Lync AD groups
#   VERSION:  1.0
#   UPDATED: 
#   AUTHOR: Brad Roberts
#   CONTACT: brad@thatucguy.com
#   BLOG: http://www.thatUCguy.com
#   BLOG ENTRY:  http://www.thatucguy.com/2014/06/powershell-disabling-lync-accounts.html
#
#   DISCLAIMER: You running this script means you won't blame me if this breaks your stuff. This script is provided AS IS and is not guaranteed to work perfectly in your environment. Testing is always a good idea. Any risk in running this script is entirely on you.
#
#******************************************

#******************************************
#
# Variable Definitions
#
#******************************************

$strComputerName = gc env:computername
$strSMTPServer = "smtp.thatucguy.com"
$strToEmail = "lync.admin@thatucguy.com"
$strFromEmail = "no-reply@thatucguy.com"
$strSubject = "Lync User Disablement Report"
$dtTimeNow = get-date

#******************************************
#
# Load Required PS Modules
#
#******************************************

if ((Get-Module ActiveDirectory) -eq $null){Import-Module ActiveDirectory}
if ((Get-Module Lync) -eq $null){Import-Module Lync}

#******************************************
#
# Prepare HTML for email
#
#******************************************

$strScriptInfo = "


Script Info
Script Name:  " + $MyInvocation.MyCommand.Definition + "
Time:  " + $dtTimeNow + "
Run From:  " + $strComputerName

$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""

$strHTMLFooter = $strHTMLFooter + $strScriptInfo
$strHTMLFooter = $strHTMLFooter + ""
$strHTMLFooter = $strHTMLFooter + ""

#********************************
#
# Look for AD accounts that are disabled but still enabled for Lync
# Remove from Lync AD groups
# Generate report of accounts to disable in Lync and disable them
#
#********************************

$strResults = $strResults + "
Lync User Disablement Report
"
$DisabledUsers = Get-CsAdUser | ?{$_.UserAccountControl -match "AccountDisabled" -and $_.Enabled -eq $true}
if ($DisabledUsers) {
 $DisabledUsers | Disable-CsUser
 Remove-ADGroupMember -Identity "Lync-2010-Users" -Members $DisabledUsers.samaccountname
 Remove-ADGroupMember -Identity "Lync-2010-Silver" -Members $DisabledUsers.samaccountname
 Remove-ADGroupMember -Identity "Lync-2010-Gold" -Members $DisabledUsers.samaccountname
 Remove-ADGroupMember -Identity "Lync-2010-Platinum" -Members $DisabledUsers.samaccountname
 $DisabledUsers = $DisabledUsers | Get-CsUser | Select-Object DisplayName,SamAccountName,SipAddress,ConferencingPolicy | ConvertTo-Html -fragment
 }
else {
 $DisabledUsers = "There is no one to disable."
 }
$strResults = $strResults + $DisabledUsers

#********************************
#
# Create email body
#
#********************************

$strHTMLBody = $strHTMLHeader + $strResults + $strHTMLFooter

#********************************
#
# Send email report
#
#********************************

$msg = new-object Net.Mail.MailMessage
$smtp = new-object Net.Mail.SmtpClient($strSMTPServer)

$msg.From = $strFromEmail
$strToEmail | foreach {$msg.To.Add($_)}
$msg.subject = $strSubject
$msg.IsBodyHtml = $true
$msg.body = $strHTMLBody
$smtp.Send($msg)

~ brad

"Good communication is as stimulating as black coffee, and just as hard to sleep after." ~ Anne Morrow Lindbergh

Case Study: Government of the US Virgin Islands

There is a new case study that has been released for the Government of the US Virgin Islands and their switchover to Office 365. While it is not the most detailed since it is a cloud-based solution it is a good promotion for collaboration and consolidation of disparate systems.

You can see the full blog post here, and the case study here.

Serving the people of the US Virgin Islands (USVI) is behind everything I do as the Chief Information Officer of the Government of the US Virgin Islands. It’s a big challenge. There are significant obstacles to providing efficient government services to constituents across our four main islands (St. Croix, St. John, St. Thomas, and Water Island) and the other islands that make up our territory. When I joined the USVI, the Governor had issued a mandate to improve services throughout its 23 agencies. We needed to reduce bureaucracy and red tape. I believe IT can play a big role in transforming our processes to achieve more citizen-centric services and demonstrate that we are putting taxpayers’ money to good use. So my mission became to change the culture of computing at USVI by incorporating innovative technology solutions to facilitate the business of government. I selected Office 365 to help me accomplish this goal.

~ brad

"You are the sum total of everything you've ever seen, heard, eaten, smelled, been told, forgot - it's all there. Everything influences each of us, and because of that I try to make sure that my experiences are positive."  ~ Maya Angelou, Interview from the April 2011 edition of O, the Oprah Magazine (2011)

Powershell: Lync User Report

When I first started in my current position, we were positioning to roll out Lync to all of our users company wide. My boss wanted a way to track how many users we actually had enabled. Rather than giving him a simple number of users by running (Get-CsUser).Count, I wanted to be able to provide him more information. In addition I could easily see how well my pools were balanced. This is actually part of a larger report that I have set up as a daily scheduled task. I decided to break it into two pieces for the blog and will post the combined script after that.

Basically this script collects user counts based on registrar pool and Conferencing policy, puts it into a couple nice tables, and emails the report to me. This script provided here looks at two registrar pools and three Conferencing policies. You should be able to modify this as needed for your environment.

I have run this on my Lync 2010 and 2013 Front End servers.

Download the script here. Some of the HTML code included in the script doesn't show up correctly in the preview below.

#******************************************
#
#   DESCRIPTION: Email Report of Lync users based on Registrar Pool and Conferencing Policy
#   VERSION: 1.0
#   UPDATED: 
#   AUTHOR: Brad Roberts
#   CONTACT: brad@thatucguy.com
#   BLOG: http://www.thatUCguy.com
#   BLOG ENTRY: http://www.thatucguy.com/2014/04/powershell-lync-user-report.html
#
#   DISCLAIMER: You running this script means you won't blame me if this breaks your stuff. This script is provided AS IS and is not guaranteed to work perfectly in your environment. Testing is always a good idea. Any risk in running this script is entirely on you.
#
#******************************************

#******************************************
#
# Variable Definitions
#
#******************************************

$strSubject = "Lync User Report"
$strSMTPServer = "smtp.thatucguy.com"
$strToEmail = "lync.admin@thatucguy.com"
$strFromEmail = "no-reply@thatucguy.com"
# Registrar Pools
$poolAmericasFQDN = "lync-pool-americas.thatucguy.com"
$poolAmericas = "Americas Users"
$poolEMEAFQDN = "lync-pool-emea.thatucguy.com"
$poolEMEA = "EMEA Users"
# Conferencing Policies
$ConfSilver = "Lync-Conferencing-Silver"
$ConfGold = "Lync-Conferencing-Gold"
$ConfPlatinum = "Lync-Conferencing-Platinum"

#******************************************
#
# Load Required PS Modules
#
#******************************************

if ((Get-Module ActiveDirectory) -eq $null){Import-Module ActiveDirectory}
if ((Get-Module Lync) -eq $null){Import-Module Lync}

$blnDebug = $false

#********************************
#
# Get User counts, total and for each pool
#
#********************************

$counttotal = (Get-CsUser -OnLyncServer).count
$countamericas = (Get-CsUser -filter {registrarpool -eq $poolAmericasFQDN}).count
$countemea = (Get-CsUser -filter {registrarpool -eq $poolEMEAFQDN}).count
$usercount = $usercount + "
Lync User Report
"
$usercount = $usercount + ""
$usercount = $usercount + "

Total Users
$poolAmericas
$poolEMEA
$counttotal
$countamericas
$countemea
"

#********************************
#
# Get User counts by Conferencing Policy
#
#********************************

$countSilver = (Get-CsUser -filter {ConferencingPolicy -eq $ConfSilver}).count
$countGold = (Get-CsUser -filter {ConferencingPolicy -eq $ConfGold}).count
$countPlatinum = (Get-CsUser -filter {ConferencingPolicy -eq $ConfPlatinum}).count
$ConfCount = $ConfCount + "
Lync User Report by Conferencing Policy
"
$ConfCount = $ConfCount + ""
$ConfCount = $ConfCount + "

Silver Users
Gold Users
Platinum Users
$countSilver
$countGold
$countPlatinum
"

#********************************
#
# Create and send email
#
#********************************
$strComputerName = gc env:computername
$dtTimeNow = get-date
$strScriptInfo = "


Script Info
Script Name:  " + $MyInvocation.MyCommand.Definition + "
Time:  " + $dtTimeNow + "
Run From:  " + $strComputerName
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""

$strHTMLFooter = $strHTMLFooter + $strScriptInfo
$strHTMLFooter = $strHTMLFooter + ""
$strHTMLFooter = $strHTMLFooter + ""

$strHTMLBody = $strHTMLHeader + $usercount + $ConfCount + $strHTMLFooter
$msg = new-object Net.Mail.MailMessage
$smtp = new-object Net.Mail.SmtpClient($strSMTPServer)
$msg.From = $strFromEmail
$strToEmail | foreach {$msg.To.Add($_)}
$msg.subject = $strSubject
$msg.IsBodyHtml = $true
$msg.body = $strHTMLBody
$smtp.Send($msg)

Hope this helps!

brad

Fun Fact:
Louisiana is the first state to have an Official Crustacean and it is the crawfish.

Lync Team Blog is finished

As of 1 May 2014 the Lync Team Blog is finished. This blog is being consolidated into the Microsoft Office Blog.
I'm not sure if this is going to be a good move or not, but there is a Welcome blog entry here to show you how to only get updates for the products you are interested in. When you apply your filters you can get a custom RSS link for your reader.

Managing Users with Default Policies

User Management is always fun. The longer you have Lync installed, the more policies seem to build up and overlap. Frequently I will pull and manage users based on the policies that they have assigned. This can be done through the Console, but it does get slow the more users you are trying to manage.

While I do have all of my Global policies configured, I prefer to keep specific policies assigned for the major policies. Like I mentioned above this can be slow and tricky in the Console. Finding users who already have a policy assigned is pretty easy using a command like:

Get-CsUser -filter {ConferencingPolicy -eq "Lync-Conferencing-Gold"}

This will pull up all the users with the specified policy name, and can easily be piped to another command such as Grant-CsMobilityPolicy.

Finding the users that are inheriting the default Global policy is a little trickier. Running the command

Get-CsUser -filter {ConferencingPolicy -eq "Default"}

will give you the following error.
   "Get-CsUser : Cannot bind parameter 'Filter' to the target. Exception setting "Filter": "Policy "Default" is not a user policy. You can assign only a user policy to a specific user."

In order to find all the users with the default policy assigned you will need to use a command like:

Get-CsUser -filter {ConferencingPolicy -eq $Null}

~brad

Fun Fact:
In a short period of ten years Van Gogh made approximately 900 paintings.

Changing a User's SIP Domain

One of the big projects that we have been working on is re-branding with a global image. This project started with migrating all of our users to have the same email domain and SIP domain. When Lync was initially installed the decision was made to support two SIP domains.

I was lucky and we only had a handful of users that needed to be changed to out primary SIP domain and could make the changes manually. To change a lot of users you could use a script like this. I have not tested this script, so test it first.

$UserList = Get-CsUser -Filter 'SipAddress -like "*olddomain.com"'
foreach ($User in $UserList)
{
   $oldAddress = $User.SipAddress
   $newAddress = $oldAddress -replace "@olddomain.com", "@newdomain.com"
   Set-CsUser -Identity $User.Identity -SipAddress $newAddress
}

Once you change all of the users, you will want to update the Lync and Exchange address books. The changes will update eventually depending on your replication time and when Address Books are scheduled to rebuild, but we want to have as little impact on the users as possible. I ran all of the PowerShell commands just to be on the safe side.

To update the Lync address book:
     Update-CsAddressBook

To update the Exchange address books:
     Update-GlobalAddressList
     Update-OfflineAddressBook

Impacts to the User

• When the change is made, the user will be logged off Lync, and they will need to log in with the new SIP address.
• Internal contacts should update the SIP address automatically – no action required.
• External contacts will have to re-add the user to their contact list.
• Lync Online Meetings will now be scheduled using the new meet web address. Any existing meetings will need to be rescheduled. There will be a delay between the changing of the SIP address and the ability to schedule meetings with the new address. Once you have updated the Exchange Address List and Offline Address Book the users will need to close and relaunch Outlook for this change to be picked up.

~ brad

Fun Fact:

The MS 150 is a two-day, 180-mile fund raising cycling ride organized by the National Multiple Sclerosis (MS) Society: Lone Star chapter. This ride is the largest event of its kind in North America taking in about 13,000 riders each year with a goal of raising $18 million towards finding a cure for MS.
This year's 30th Anniversary ride is scheduled 12-13 April 2014.

Lync Architecture Poster

In case you haven't seen it yet, Microsoft has updated the Lync Workload poster for 2013. They have also added a few new posters. These are helpful to any Lync administrator, new or experienced.

Links to all of them can be found on TechNet.

Lync Server 2013 On Premises Architecture
     Architectural guidance

Lync Call Quality Methodolgy
     Help find and eliminate call quality issues

Key Health Indicators: The Foundation for Maintaining Healthy Lync Servers

     Metrics for server monitoring
Lync 2013 Platform Options

     Shows various platforms options - Online, Hybrid, Onsite and Hosted
Microsoft Lync 2013 Protocol Workloads
     How Lync workloads are processed

~ brad

"Books may look like nothing more than words on a page, but they are actually an infinitely complex imaginotransference technology that translates odd, inky squiggles into pictures inside your head." ~ Jasper Fforde

Lync Client Version Numbers

Here is a list of all the CUs that have been released for the Lync Client. Lync Server version numbers can be found here.

Last Updated 13 June 2014

Lync Client 2010

CU #	Release Date	Version	Link
CU1	January 2011	4.0.7577.108	http://support.microsoft.com/kb/2467763
CU2	April 2011	4.0.7577.253	http://support.microsoft.com/kb/2496325
CU3	May 2011	4.0.7577.280	http://support.microsoft.com/kb/2551268
CU4	July 2011	4.0.7577.314	http://support.microsoft.com/kb/2571543
CU5	November 2011	4.0.7577.4051	http://support.microsoft.com/kb/2514982
CU6	February 2012	4.0.7577.4072	http://support.microsoft.com/kb/2670326
CU7	June 2012	4.0.7577.4103	http://support.microsoft.com/kb/2701664
CU8	October 2012	4.0.7577.4356	http://support.microsoft.com/kb/2737155
CU9	March 2013	4.0.7577.4378	http://support.microsoft.com/kb/2791382
CU10	April 2013	4.0.7577.4384	http://support.microsoft.com/kb/2815347
CU11	July 2013	4.0.7577.4398	http://support.microsoft.com/kb/2842627
CU12	October 2013	4.0.7577.4409	http://support.microsoft.com/kb/2884632
CU13	January 2014	4.0.7577.4419	http://support.microsoft.com/kb/2912208

Lync Client 2013

CU #	Release Date	Version	Link
CU1	February 2013	15.0.4454.1509	http://support.microsoft.com/kb/2812461
CU2	July 2013	15.0.4517.1004	http://support.microsoft.com/kb/2817465
CU3	November 2013	15.0.4551.1005	http://support.microsoft.com/kb/2825630
CU4	December 2013	15.0.4551.1007	http://support.microsoft.com/kb/2850057
CU5/ SP1	February 2014	15.0.4569.1503	http://support.microsoft.com/kb/2817430
CU6	April 2014	15.0.4605.1003	http://support.microsoft.com/kb/2880474
CU7	May 2014	15.0.4615.1001	http://support.microsoft.com/kb/2880980

Lync for Mac 2011

CU #	Release Date	Version	Link
CU1	October 2011	14.0.1	http://support.microsoft.com/kb/2634523
CU2	April 2012	14.0.2	http://support.microsoft.com/kb/2690036‎
CU3	August 2012	14.0.3	http://support.microsoft.com/kb/2726395
CU4	February 2013	14.0.4	http://support.microsoft.com/kb/2778095
CU5	June 2013	14.0.5	http://support.microsoft.com/kb/2844274
CU6	October 2013	14.0.6	http://support.microsoft.com/kb/2888920‎
CU7	December 2013	14.0.7	http://support.microsoft.com/kb/2909662
CU8	April 2014	14.0.8	http://support.microsoft.com/kb/2952672
CU9	June 2014	14.0.9	http://support.microsoft.com/kb/2963369

Hope this helps!

~ brad

"The most likely way for the world to be destroyed, most experts agree, is by accident. That's where we come in; we're computer professionals. We cause accidents."  ~ Nathaniel Borenstein

Lync Server Version Numbers

Here is a list of CUs released for Lync Server. Lync Client version numbers can be found here.

Last Updated: 20 March 2014

Lync Server 2010

CU #	Release Date	Version	Link
CU1	January 2011	4.0.7577.108	http://support.microsoft.com/kb/2467775
CU2	April 2011	4.0.7577.137	http://support.microsoft.com/kb/2500442
CU3	July 2011	4.0.7577.166	http://support.microsoft.com/kb/2571546
CU4	November 2011	4.0.7577.183	http://support.microsoft.com/kb/2514980
CU5	February 2012	4.0.7577.190	http://support.microsoft.com/kb/2670352
CU6	June 2012	4.0.7577.199	http://support.microsoft.com/kb/2701585
CU7	October 2012	4.0.7577.203	http://support.microsoft.com/kb/2737915
CU8	March 2013	4.0.7577.216	http://support.microsoft.com/kb/2791381
CU9	July 2013	4.0.7577.217	http://support.microsoft.com/kb/2860700
CU10	October 2013	4.0.7577.223	http://support.microsoft.com/kb/2889610
CU11	January 2014	4.0.7577.225	http://support.microsoft.com/kb/2909888

Lync Server 2013

CU #	Release Date	Version	Link
CU1	February 2013	5.0.8308.291	http://support.microsoft.com/kb/2781547
CU2	July 2013	5.0.8308.420	http://support.microsoft.com/kb/2819565
CU3	October 2013	5.0.8308.556	http://support.microsoft.com/kb/2881684
CU4	January 2014	5.0.8308.577	http://support.microsoft.com/kb/2905048

Hope this helps!

~ brad

"A computer will do what you tell it to do, but that may be much different from what you had in mind."  ~ Joseph Weizenbaum

Persistent Chat Settings Disappear

One of the best new features in Lync 2013 is the built-in Persistent Chat role. This is a new role for me and lately we have been piloting the feature in my environment. Everything is working great, but a couple of my pilot users complained about the notification settings in the client not being retained. After some testing, I found that the 2013 client would hold the settings on a simple log out, log in; but if you did a full restart of the client or rebooted the machine that settings would revert back to default of no notifications.

Doing some research, I didn't find much. These settings don't appear to be stored in the registry as the values don't change when settings are changed.

The Persistent Chat policy in Lync is very basic, basically one setting to turn persistent chat on or off for the user base. By default a Global policy is created when you enable Persistent Chat in the topology. Like most Global Policies that are assigned by default, when you look at a user in PowerShell the field shows up blank.

Global automatic policies are a great idea, but in this case appears to only partway work. It does enable users to use Persistent Chat but doesn't save their settings related to it.

As a workaround, I created a new pool policy for the pool my account is in. A few minutes later I was able to exit the client and relaunch it, and my settings remained.

The Technet article for New-CsPersistentChatPolicy doesn't mention a pool policy, but it is available through the Control Panel.

~brad

“What we now want is closer contact and better understanding between individuals and communities all over the earth, and the elimination of egoism and pride which is always prone to plunge the world into primeval barbarism and strife... Peace can only come as a natural consequence of universal enlightenment...” 
~ Nikola Tesla

Lync Conference: Securing External and Mobile Access in Lync

Here are the notes for another session I attended at the conference.

Unlocking Lync Mobile Deployments

Francois Doremieux (Microsoft)

Rui Maximo (Lync-Solutions)

Authentication in Earlier Mobile Versions

• To Lync server
  • Through Reverse Proxy
  • NTLM only
  • Re-authorize every 8 hours
• To EWS
• For voice mail, meetings, UCS in 2013
• NTLM only
• Authorization is required for each query

Recent Improvements

• Improvement Principles
  • Reduce or remove AD credential exposure
  • Two options for initial authorization
    • NTLM
    • Passive Authentication
  • Dissociate subsequent re-authorizations - personal Lync certificate issued by Lync server
  • No solution for EWS yet
    • Remains NTLM for every query
    • Can remove/disable EWS dependent capabilities
• Lync Certificate Authorization
  • Client obtains certificate on initial authorization
  • Method has been used for awhile with other clients (desktop, phone)
  • Admin can revoke a user's certificate at any time
  • Certificate lifetime and auto-renewal interval manageable by Lync admin
  • Certificate is scoped only to Lync - can't be used to gain access to anything else on the network
  • Sign-out, deleting client, upgrading client required intial sign-in again
• Initial Authentication
• NTLM
• Used to obtain web ticket from web ticket service

• Protecting AD Credentials
  • New policy to disable password storage
    • Set-CsMobilityPolicy -AllowSaveCredentials
  • Disable EWS
    • Set-CsMobilityPolicy -AllowExchangeConnectivity
    • Voicemails will still be in email, Meeting links in calendar
• Passive Authentication
• • New auth method introduced in Q1 CY2013
  • Lync server gets out of authentication
    • Server delegates authentication to trusted Security Token Service
    • STS serves custom authorization web page rendered in Lync app
    • Uses form entries in Trident page - not possible to use cert on device or smart card but can support forms based multifactor (password + OTP or SecurID)
    • STS passes token to client which it presents to Lync server
  • Set up server side
    • Can't be client policy as client would only get it after authentication
    • Server Policy - scope per pool, affects all users and all client types
    • Enable Passive, disable kerberos and NTLM
  • Experience - pop up window to authenticate

• 
  

  • • Not quite ready for all clients

  
  

  Other questions around mobile security

  • MDM discussion
    • Lync Mobile does not support MDM
      • No path to distribute
      • Rich, real-time behavior of app does not lend itself to complex integration
      • Distribution through App Store is most efficient way to get current release
    • What we endeavour instead
      • Why should app security depend on MDM?
      • Improvement on policies, authentication, protection of data at rest
      • Open to feedback toward closing possible remaining gaps
  • What does Lync mobile do for data security
    • Data transfers
      • Authenticated, encrypted at similar grade as encapsulating solutions
    • Data at rest
      • Very little data at rest
      • Not accessible to other apps
      • No local storing of address books
  • Pre-authentication in DMZ
    • All authentication done in network
    • Third party solutions available where Lync Mobile traffic is intercepted at reverse proxy

  
  Incremental capabilities through third party solutions

  • Lync-Solutions Security Filters
  • Modular security solution
  • Not just mobile but external access
  • Intercepts login traffic in DMZ, deep packet inspection and validation
  • Prevention of DoS and Brute Force attacks
  • User-device affinity
  • Logging, monitoring, alarming

  

  
  

  

  
  

• • • Authentication mechanism
      • kerberos contrained
      • Passive authentication
    • Addresses customer asks
      • Pre-authentication and validation in DMZ
      • Device restriction - enables verification of device used by user, can be combined with policies, alarming, etc

    
    

    
    

    
    
  • Random Trivia: 

  
  

  The Hoover Dam is made of enough concrete to make a two lane highway from New York to San Francisco, that’s around 4000 miles (2500 kilometres).

Lync Conference: Video- What In The World Are You Doing To My Network?

The videos from all of the various breakout sessions should be available soon. In the mean time, here are my notes from some of the sessions I attended.

Video- What in the World Are You Doing To My Network?

Jeff Schertz, Polycom

Foundational Concepts

• Video codecs in 2013
• RTV
• H.264 Scalable Video Coding
• Hardware acceleration 
• More resolutions up to 1080p
• Multiple panorama resolutions
• Temporal Scaling - mult frame rates in single encoded stream
• UCConfig mode - look at Jeff's blog for more info
• Client can send up to 5 possible concurrent streams per video source
• Very unlikely though
• Client can receive multiple streams as well

Disecting the Video Experience

• Views available in the Client
• Gallery view
• Speaker view
• Video Spotlight - presenter can lock view to his camera
• Compact view - Not showing any video
• Lync will selectively start/stop participant video as needed during conference if no one is viewing their stream to save on bandwidth/computing
• Smart Framing - This is basically smart cropping based on facial tracking
• Cropping - There is no square resolution in Lync, the client hides the edged for real estate
• Video is encoded and sent in full resolution
• Video Resolution - more is less - resolution goes down for each stream as more streams are shown 
• Pixel depth more important than screensize
• Unique experiences
• Dual monitors
• Lync room system - span 2 monitors
• Panoramic

Doing the Math

• Don't forget about audio!!
• Include payload and RTCP payload (5-15 Kbps)
• H.262 SVC - lot more options/resolutions, much cleaner display at any resolution
• Lync Bandwidth Calculator
• Conference calls typically use less bandwidth
• Default video stream is 320x240 15Kbps
• Have to manually resize vdeo for higher resolutions
• Controlling bandwidth
• Get-CsConferencingPolicy | fl *video*
• AllowIPVideo
• EnableP2PVideo
• MaxVideoConferenceResolution
• To disable gallery view
• AllowMultiview
• EnableMultiviewJoin
• Conferences with over 75 participants switch to only display active speaker automatically
• Limiting bit rates
• Default limit 50 Mbps for sent video
• Total receive default 50 Mbps
• Must be at least 420 Kbps to support gallerey view, may get weird behavior below this
• Bit rate is measured per video source - webcam, roundtable, etc

Actual Usage

• Usage at Microsoft
• Daily 6,000 minutes peer to peer
• Daily 226,000 minutes conferencing
• 11 million minutes of video in November 2013
• Users tend to keep default resolutions
• No bandwidth or CAC policy constraints in place

Summary

• Factors for growth
• Age - Younger workers like video as they tend to have grown up with it
• Ubiquity - Video is looking better than it ever has, much more common
• Culture
• Experience - As they use it, they want to use it more
• Importance of the Video modality
• Audio is the Pinnacle
• Content is King
• Video is a love/hate relationship

Lync Backups with PowerShell

** EDIT: After running this script more, I noticed that running from a Scheduled Task was hit or miss on copying files to the DFS share. I have cleaned up the robocopy command and added some basic error checking to this portion of the script. **

Backups of any production system are always a good idea. SQL backups and vmdk backups of the virtual machines are all great, but may not be the solution you need.

Microsoft has posted the following recommendations for Lync backups.
2010 Backups
2013 Backups

Since I have an environment that contains Lync 2010 and 2013 I wanted one script that would back up my entire environment. The script I have written backs up all the core settings (topology, LIS, voice data, policies, etc) and user information for both Lync 2010 and Lync 2013. It backs the information up locally to the server and then copies the information to a DFS fileshare. The backups are kept for 30 days and then deleted.

To backup the 2010 user data, I copied dbimpexp.exe locally to the 2013 server. Since the output xml file is quite large in my case, I zip the file and delete it before copying everything to the fileshare.

Once the backup and copy are complete a basic email report is sent out.

I have the script set up as a Scheduled Task that runs twice a week. Make sure whatever account you schedule this with has Full Control of the Lync share.

You can download the script here. *Please note there is currently a compatibility issue with IE and some of the code is not displaying here. Please download the script or load it in another browser.*

#############################
#
#   Export Script for Backup 
#   Written by Brad Roberts
#   Backs up user data for 2010/2013, config data - copies to $drFolderPath below
#   Updated 27 February 2014
#
#############################
 
Function Add-Zip{
 Param([string]$ZipFilename)
 If(-Not (Test-Path($ZipFilename))){
  Set-Content $ZipFilename ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
  (Dir $ZipFilename).IsReadOnly = $False 
 }
 $ShellApplication = New-Object -COM Shell.Application
 $ZipPackage = $ShellApplication.NameSpace($ZipFilename)
 ForEach($File in $Input){ 
  $ZipPackage.CopyHere($File.FullName)
  Start-Sleep -Milliseconds 15000
 }
}
 
### Import Lync Module 
Import-Module "C:\Program Files\Common Files\Microsoft Lync Server 2013\Modules\Lync\Lync.psd1"
 
### Variables To Set 
$folderPath = "C:\Backup" 
$lengthOfBackup = "-30" 
$drFolderPath = "\\thatucguy.com\Lync\Backup" 
$poolFQDN = "lync-2013-pool.thatucguy.com"
 
### Production – Delete Older Than x Days 
get-childitem $folderPath -recurse | where {$_.lastwritetime -lt (get-date).adddays($lengthOfBackup) -and -not $_.psiscontainer} |% {remove-item $_.fullname -force }
 
### Production – Delete Empty Folders 
$a = Get-ChildItem $folderPath -recurse | Where-Object {$_.PSIsContainer -eq $True} 
$a | Where-Object {$_.GetFiles().Count -eq 0} | Remove-Item
 
### Production – Get Date and Create Folder 
$currDate = get-date -uformat "%a-%m-%d-%Y-%H-%M" 
New-Item $folderPath\$currDate -Type Directory
 
### Delete Older Than x Days – DR Side 
get-childitem $drFolderPath -recurse | where {$_.lastwritetime -lt (get-date).adddays($lengthOfBackup) -and -not $_.psiscontainer} |% {remove-item $_.fullname -force }
 
### Delete Empty Folders – DR Side 
$a = Get-ChildItem $drFolderPath -recurse | Where-Object {$_.PSIsContainer -eq $True} 
$a | Where-Object {$_.GetFiles().Count -eq 0} | Remove-Item
 
### Message Out 
Write-Host -ForegroundColor Green "Backup to server in progress"
$strTranscript += "
Backup to server in progress...
"
 
### Export CMS/XDS and LIS 
Export-CsConfiguration -FileName $folderPath\$currDate\XdsConfig.zip 
Export-CsLisConfiguration -FileName $folderPath\$currDate\LisConfig.zip
 
### Export Voice Information
Get-CsDialPlan | Export-Clixml -path $folderPath\$currDate\DialPlan.xml
Get-CsVoicePolicy | Export-Clixml -path $folderPath\$currDate\VoicePolicy.xml
Get-CsVoiceRoute | Export-Clixml -path $folderPath\$currDate\VoiceRoute.xml
Get-CsPstnUsage | Export-Clixml -path $folderPath\$currDate\PSTNUsage.xml
Get-CsVoiceConfiguration | Export-Clixml -path $folderPath\$currDate\VoiceConfiguration.xml
Get-CsTrunkConfiguration | Export-Clixml -path $folderPath\$currDate\TrunkConfiguration.xml
 
### Export RGS Config 
Export-CsRgsConfiguration -Source "service:ApplicationServer:$poolFQDN" -FileName $folderPath\$currDate\RgsConfig.zip
Write-Host -ForegroundColor Green "XDS, LIS and RGS backup to server is completed." 
$strTranscript += "
XDS, LIS and RGS backup to server is complete."
 
### Export User Information 
# Export 2013 data
Export-CsUserData -PoolFqdn $poolFQDN -FileName $folderPath\$currDate\Lync2013UserData.zip
$strTranscript += "
Export of Lync 2013 user data complete."
# Export 2010 data
C:\Admin\Software\dbimpexp /hrxmlfile:"$folderPath\$currDate\Lync2010UserData.xml" /sqlserver:sql-01
$strTranscript += "
Export of Lync 2010 user data complete."
 
#Create new zip file
Get-ChildItem $folderPath\$currDate\Lync2010UserData.xml | Add-Zip $folderPath\$currDate\Lync2010UserData.zip
Remove-Item $folderPath\$currDate\Lync2010UserData.xml
 
### Copy Files to DR Server 
robocopy $folderPath\$currDate $drFolderPath\$currDate /mir /S /tbd
# Check for last file written
if (Test-Path $drFolderPath\$currDate\* -include XdsConfig.zip) {
   $strTranscript += "

Files copied to $drfolderPath\$currDate"
   }
else  {
   $strTranscript += "

Files were NOT copied to $drfolderPath\$currDate. Please validate backup."
   }
 
### Email Transcript
$strSMTPServer = "smtp.thatucguy.com"
$msg = new-object Net.Mail.MailMessage
$smtp = new-object Net.Mail.SmtpClient($strSMTPServer)
 
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
 
$strComputerName = gc env:computername
$dtTimeNow = get-date
$strScriptInfo = "


Script Info
Script Name:  " + $MyInvocation.MyCommand.Definition + "
Time:  " + $dtTimeNow + "
Run From:  " + $strComputerName
$strHTMLFooter = $strHTMLFooter + $strScriptInfo
$strHTMLFooter = $strHTMLFooter + ""
$strHTMLFooter = $strHTMLFooter + ""
#$strTranscript = Get-Content $logpath
$strHTMLBody = $strHTMLHeader + $strTranscript + $strHTMLFooter
 
$msg = New-Object System.Net.Mail.MailMessage 
$msg.From = "no-reply@thatucguy.com" 
$msg.To.Add("lync.admin@thatucguy.com") 
$msg.Subject = "Lync Backup Report - " + (Get-Date -format D)
$msg.IsBodyHtml = $true
$msg.body = $strHTMLBody
$smtp.Send($msg)

You can download the script here.
Remember to always test your scripts first in your environment. I cannot be held responsible for any adverse affects.

Hope this helps!

~ Brad