Mac Does Stuff

Category: Microsoft

  • Cannot Rename Network Adapter

    I’m feeling a bit … lost. For some reason on one particular machine I don’t seem to be able to rename any Network Interface on Windows 11:

    Image shows the rename dialogue box for renaming a network interface
    NIC Rename Screenshot

    I’ve just tried it on another couple of machines and it’s worked fine – and I’ve obviously managed to rename some previously! So, anyone any idea what’s going on here? I’m sure we can do this with PowerShell though, so let’s do that.

    Fire up PowerShell as an Administrator and use the following command to get a list of your adapters:

    Get-NetAdapter

    Image shows the output of the command Get-NetAdapter
    Get-NetAdapter

    You can see my output above. Next, rename the adapter using the following command:

    Rename-NetAdapter -Name “Ethernet 7” -NewName “HyperV_10Gbpe“

    …obviously use the name of the interface you want to change, and what you want to change it to. Nothing appears to happen, but if you run the get-netadapter again you should see your changes:

    Image shows the renamed network adapter using Get-NetAdapter
    Get-NetAdapter
    Image shows the network connections in Windows 11 after a successful rename
    Network Connections

    If anyone knows why I’ve lost the ability to do this in the GUI I’m all ears – I’ve tried removing all the HyperV vSwitch configuration but that didn’t seem to make any difference.

    No big deal of course, I’m just curious.

  • Backing up all your Windows Drivers

    I was re-installing my Minisforum MS-01 recently as all the stuff I’d been testing on it meant it wasn’t really setup any more how I liked it. Anyway, one of the handy tips I’ve obtained from who knows where is a way to backup all of your device drivers before re-installing, helping to avoid the missing drivers thing in Device Manager.

    It’s pretty easy too. All you need do is:

    -> Create a directory for all your drivers ‘C:\WindowsDrivers’ for example.

    -> Use this command:

    —-> dism /online /export-driver /destination:”C:\WindowsDrivers”

    This will then go and export all your drivers for you. You can see the process and the output below.

    Image shows the process of creating a directory, and running the dism command to export all of your drivers.

    If you look in the directory, you’ll now see all your drivers.

    Image shows the drivers exported to the directory.

    Copy that directory off somewhere else, and you have a copy of all your drivers.

    Now, when you go to re-install the machine, if any drivers are missing you can point Device Manager back to that directory or from a USB stick. In my example below, you can see that my device driver for my network card is missing (this example is from a Windows machine running on Parallels Desktop):

    Image shows Device Manager with the driver missing for the Ethernet Controller.

    You can right click on that ‘Ethernet Controller’ and select ‘Update Driver’ – and from the screen that’s presented, select ‘Browse my computer for drivers’:

    Image shows the update drivers control box.

    What you want to do now is select the folder where you have those exported drivers – or a USB of course. Make sure ‘Include subfolders’ is selected that way you don’t have to find the right specific directory. Then click ‘Next’.

    Image shows the update drivers browser dialogue box.

    What you should see now is that the process has located the driver and installed it for you.

    Image shows the successful installation of a network card driver.

    Now, if we look back in Device Manager, we should see the triangle/exclamation error has now gone.

    Image shows the network card driver present with no errors.

    Quite a handy thing that. I backup my drivers ever so often on my machines really to avoid having to hunt around for things. Anyway, you can also see a video run through here:

  • New Home Lab Beast – Minisforum MS01

    New Home Lab Beast – Minisforum MS01

    I’ve been in the hunt for new home-lab virtualisation servers. I previously used two 2018 Mac mini i7/64GB units. They have been solid units, and have served me well. I used Parallels Desktop for 90% of the virtualisation, with some VMWare Fusion in there too. They’ve lasted YEARS and have been rock-solid…but, their performance against their power consumption has been lacking compared to current offerings.

    So I took a dual approach – for my constant stuff that needed to be on all the time (backups, some video conversion automation, AdGuard type stuff) I bought an Apple M4 Mini. More on this in another article, however it sips power while also being highly capable.

    For my lab stuff – think 90% Windows, 10% Linux – I needed something x86. First, I looked at Geekom and their Mini IT13, and it was disastrous. I actually bought one direct from Geekom, and three from Amazon. All of them after a week or two just wouldn’t turn on.

    Picture shows three orders of the Geekom PC from Amazon.
    Amazon Geekom Orders

    I returned them all – so much so Amazon put me on the returns naughty step so I had to get AmEx involved, who were, as usual, absolutely badass at getting my money back.

    This is when I stumbled on the Minisforum MS-01. The specs on this thing seemed out of this world.

    -> Intel i9 13900H

    -> Dual DDR5-5200 up to 96GB

    -> 2 x USB4

    -> 2 x 2.5Gb Ethernet

    -> 2 x 10Gb Ethernet

    -> HDMI

    Have a look for yourself at all these ports – absolutely mad.

    Image shows the back of the MS-01 including 2 x SFP+, 2 x 2.5Gb LAN, 2 x USB 4, HDMI, 2 x USB
    MS-01 Rear

    Internally, the unit supports up to three NVMe slots. THREE. 1 PCIe 4×4, one 3×4 and one 3×2. Additionally slot 1 can be configured to use a U.2 NVMe too. The graphics are integrated UDH750 I think, but – and here’s something else that amazed me about this unit – it also comes with a half-length PCIe 3×4 slot! With it being half-length you’re limited by what you can put in there, but there’s certainly options out there.

    I was quite blown away when I saw the specs of these units, and couldn’t order one fast enough, and to spec it out. The spec I’ve gone for is:

    -> 96GB RAM

    -> 1 x 4TB NVMe

    -> 2 x 1TB NVMe

    This is connected now over 10Gbe for the main LAN, and 2.5Gb for my HyperV machines. Absolutely bonkers considering its size.

    What’s the performance like? Well, let’s look at the primary SSD to start. This is a Lexar 4TB 4×4 that I already had.

    Image shows the performance throughput of the SSD. 4170MB/s write, 4717MB/s read.
    SSD Performance

    That’ll do. The other two SSD are a bit slower at about 2200MB/s read/write, still really acceptable.

    The Intel 13900H in the MS-01 has a base TDP of 45watts but apparently can boost up to 115watts – it’s a mobile processor of course. By way of example, the desktop i-13900 has a base of 65W and boosts to 219W…but requires significantly more cooling.

    You can see the Geekbench benchmarks for the 13900H here. If you want a bit of a giggle here’s the comparison between the 13900H and the binned M4 Max (I have the unbinned M4 Max). So processor performance is pretty good too – certainly good enough for what I need it for.

    What about power consumption? At idle, the unit seems to average between 25 and 33watts, which is 0.6KwH to 0.8KwH per day.

    Image shows the power consumption of the MS-01 at 32w.
    MS-01 Power ConsumptionScreenshot

    This does seem a little high compared to what some other people are reporting – several are reporting idle figures of 15-30 watts, but I’ve not seen it go that low. Perhaps it’s the spec and of course I have the 10Gbe interface in use.

    What about under load? It seems to peak at about 115-120w but then settles in to about 90w. Assuming 90w consumption that’s 2.2KwH/day (rounded up), which isn’t insignificant, but then how often are you going to have it flat out..?

    Assuming you work it hard for 8 hours a day, but the rest it’s fairly idle, running costs at GBP0.29/KwH would be as follows.]

    Image shows the power costs of the MS-01
    MS-01 Power Consumption

    Just for the purposes of comparison – the M4 Mini I bought for my 24×7 automation stuff (Plex, backups etc.) averages about 5w at idle, and uses 65watts under full load.

    Image shows the power consumption of the Apple M4 Mini
    M4 Mini Power Consumption

    It’s a fairly decent difference isn’t it? Saying that, the M4 Mini can’t do all the x86 virtualisation that I need, but it’s still a reasonable comparison.

    So what do we have at this point? Well, we have a small, powerful PC, with great networking, internal storage, and reasonable power consumption. There must be some downsides, right?

    Well, so far, not too many. I do have some observations however. Firstly, noise. If these units are next to you, you will hear the fans. They seem to spin up even with the slightest of activity. They’re not particularly loud however you will hear them. They don’t bother me at all.

    I also have a weird issue with the networking. Firstly, those two 10Gbe SFP+ ports. If I try use both of them they work for a little while but eventually I start to get problems with disconnections and the performance plummeting. If I had to guess, it’s because I’m using SFP+ to RJ45 connectors in there, and they’re getting heat soaked – so in effect, I can’t use both SFP+ 10Gbe connections at the same time. Not a huge issue given it also has two 2.5Gb ports.

    Next is a weird one, and it sounds like a configuration bottle neck I’m hitting rather than an actual problem with the unit. With HyperV configured to use the 2.5Gbe interface only, and with management etc. on the 10Gbe port, I only get circa 2.5Gb performance not the 10Gbe port. In fact it’s so close to 2.5Gbe it makes me think this is a config issue. If I remove the HyperV configuration I get nearer the 10Gbpe. Something I’ll look into in the future I think, however it’s not that big a deal to me in reality.

    2025-02-25 20:32:04: I’ve now resolved this – it wasn’t just suspiciously close to 2.5Gbps it was 2.5Gbps…but it was reporting as 10Gbps. Essentially I was using a cheap non-managed 10Gb/2.5Gb switch, and an SFP+ to RJ45 converter on the MS-01. I swapped the switch for a 10Gbps QNAP managed switch and what do I see… the port running at 2.5Gbps. Swapping out the SFP+ to RJ45 connector and just using a straight fibre connection I now not only have the 10Gbps connection, it’s also running a lot cooler. I’ll test both 10Gbps connections shortly and see if running them both is workable.

    Image shows a file copy at 10Gbps speeds
    10Gbps File Copy

    What am I running on it? Well, my longer term plan is to configure it as ProxMox unit, for now however it’s running Windows 11 and HyperV. Not a great combination, but good enough for something I’m working on. I mean look what it’s running right now:

    Image shows the MS-01 running several HyperV machines
    HyperV

    That’s not too shabby is it?

    Oh while I remember, the unit also supports Intel vPro for remote management – this allows for remote control, including BIOS level KVM access. How cool is that? Very useful for when trying to manage the unit remotely, and far more like grown up server solutions. It’s pretty impressive.

    Costs

    Now on to the thorny issue of costs. These are not particularly cheap units. Let’s look at this build – although I did have the SSD kicking about already.

    Image shows the cost of the MS-01 built for my lab.
    Lab Build

    NOTE: For my US readers, the above costs include our sales tax (VAT) at 20%.

    So the cost isn’t insignificant, but for the capability I think it’s a bargain?!

    Support

    Now, this is worth being aware of. I’ve seen a few horror stories about dealing direct with Minisforum, and if it was anything like my experience dealing with Geekom I’d be very nervous about buying direct. Buy from Amazon however and any problems you can make their problem, and their returns process is usually excellent.

    What’s Coming

    It’s also worth being aware of the Minisforum MS-A2 that’s due for release circa April 2025. This has an AMND Ryzen 9 7945HX 16 Core/32 Thread processor in it which will be even faster than the i9-13900H, so perhaps it may be worth waiting for that? Then again if you’re always waiting for what’s around the corner you’d always be waiting for what’s around the corner.

    Summary

    I’m very happy with this Minisforum unit. The connectivity is bonkers, its power consumption reasonable, and its performance is certainly good enough for my purposes as a virtualisation lab host. I’d go as far to say as I’d be happy to use it as my every day machine should needs be, it’s that capable. It’s a little pricey – certainly compared to the Geekom, but then so far it hasn’t decided to become a paperweight – and there’s some concern about direct support from Minisforum, but so far, everything has been rosey and I suspect I’ll end up buying another one.

  • Mac vs PC – Really?

    There’s a question I’ve come to dread: ‘Why do you use a Mac?’. It’s always centred on the fact that probably 90% plus of my work is on Windows + networking infrastructure. Very few bits of infrastructure are MacOS based.

    Why do I avoid it? Well, mostly because the person asking it usually has a predetermined position and they’re itching to give it to you. It’s rarely interesting.

    Objectively though – why? Well, my opinion is changing, and my choices are evolving. That is interesting. First, let’s cover why it wasn’t interesting before.

    Primarily it’s because there was nothing you can do on Windows that I couldn’t typically do on my Mac. WAIT you say – Visio? Microsoft PROJECT? OMG OMG. Well. Virtualised I can run both of those things, as well as much other Windows software. It isn’t a key decision point for me.

    What this means is that my reason for using a Mac was subjective. I just liked the operating environment more. Did it make it more productive….? Arguable as to whether it does or not. I just preferred the look/feel and how the apps worked.

    What about hardware? Well, I’m sure there were many better hardware platforms out there – Dell XPS came pretty close for me for example. Again though it’s subjective. I get to use several Windows machines and they’re very capable, and they could have done the day Job. I just subjectively preferred the MacOS environemnt.

    One of the absolute key strengths I really embraced with my Mac was the ability to virtualise so much stuff, so quickly. I would have separate environments on a drive and I could quickly power up Skype or Exchange or many standard environments. On my laptop. It was hugely capable. Was.

    Wait you may think – what about Hyper-V? Or VMWare Workstation? You can do that on Windows. You can, and I’d refer you back to my previous point about subjective preference over actual real objective points. I just preferred it in MacOS. Hyper-V was particularly irritating – it didn’t scale as well on my local machines and I’d often run in to odd issues usually to do with networking. I’d rarely run in to stuff like that on my Mac.

    I ended up using my Mac more like I would an appliance – I just didn’t really get involved in tweaking it, or fighting to get bits working. That sometimes wasn’t my experience on my Windows equivalents. It was a preference choice though – not one that would fundamentally affect my ability to do stuff.

    Now though – well, it’s all change. The Apple move to ARM has removed a big key point of my preference – virtualisation. I’m finding that I’m running stuff on my home systems and connecting to it remotely – which is fine of course, but it’s an extra step and requires planning. I miss being able to quickly just fire up an environment.

    I was today trying to think about then why am I still on a Mac? My main laptop for example is a 10 core 64GB/2TB 16″ ARM MacBook Pro. It absolutely flies. I’ve not got close to using that RAM simply because of the virtualisation restrictions. I don’t think I’ve used such a capable machine with simply ridiculous battery life. There’s an issue though – it no longer really does enough. In reality the real reason I’m still using my Mac laptop rather than switching back to say an XPS, is really Apple Photos, Final Cut Pro and….. familiarty… That’s it.

    Microsoft is now of course (apparently – again) embracing ARM so perhaps things will change in a few years, however for now my MacBook Pro is becoming a media machine, and I suspect my day job will now be XPS driven.

    Weird how things come around isn’t it? It’s interesting to see the fervent arguments each way – I’m not one of those arguers – usually. I just have – had – a preference. The problem is my preference is now making my day job more difficult, in that I have to plan for other methods and other ways of getting stuff done.

    That isn’t cool, and no amount of looks nice or familiarity can overcome that.

  • Renewed Access Edge Certificates Call Connecting

    A very quick one for you today. You may run in to an issue where if you renew your public certificates on your Skype for Business Access Edge Server you may not be able to make calls when connected via your Edge Server (I.e. External).

    You can call out, the phone will ring, and when the user answers you’ll see ‘Connecting’ and then the call drops.

    If you get this, the simple way to fix this is just to restart the Mediation Server Service on the front-ends associated with the pool.

    Why? Well, I think the reason is down to the A/V authentication service – have a look here:

    Stage AV and OAuth certificates in Skype for Business Server using -Roll in Set-CsCertificate

    In particular, note this bit:

    The A/V Authentication service is responsible for issuing tokens that are used by clients and other A/V consumers. The tokens are generated from attributes on the certificate, and when the certificate expires, loss of connection and requirement to rejoin with a new token generated by the new certificate will result.

    There is also a ‘proper’ way to address this, and this is also outlined in the article:

    A new feature in Skype for Business Server will alleviate this problem – the ability to stage a new certificate in advance of the old one expiring and allowing both certificates to continue to function for a period of time. 

    So you can use this new feature – or you can restart the Mediation Server service and from what I can tell it achieves the same thing. You can also just wait – it should start working after the tokens timeout in 8ish hours.

  • Install a previous version of Office365 / Office Professional Plus /Microsoft Office

    If you’re in the tech industry you may find yourself needing to use a specific version of Microsoft Office. Of course if you just install it from the Portal, or use the Office Deployment Tool with its enclosed configurations you’ll end up with the current version. 

    Fortunately, there is a fairly easy way to install a specific version. You do need to use the Office Deployment Tool – see here for details on that.

    Office Deployment Tool

    You can also see how to use it from a previous article I wrote a while ago – see here for that:

    Office 2016 Click to Run

    So, how do you do it? Firstly, find the version you want. You should be able to find the version numbers in here:

    Update history for Microsoft 365 Apps (listed by date)

    Next, you need to modify an XML file to include the explicit version number and platform type that you want. Here’s an example for a specific version:

    Save this as your configuration XML. In my example, I’ve called it ‘This.XML’.

    Next, you need to download the office package. To do that, you do this:

    -> Setup /download This.XML

    It may take a while as it is a couple of Gb.

    You will then want to install it – how do you do that? Like this:

    -> Setup /configure This.XML

    Ta daaaaaa. You can see a real live version below.

  • Skype for Business – Cannot Remove Delegate

    Here’s a quick and vaguely interesting one for you. I was recently trying to bulk update some delegates in Skype for Business Server using SefaUtil. As part of that process, I had to remove existing delegates. I was using a command like this:

    Sefautil David.Hasselhoff@KnightIndustries.com /server:FrontEnd.Consoto.local /removedelegate:Pamela.Anderson@KnightIndustries.com 

    Now, whatever I did, could I get Pamela to go? No, no I couldn’t. After scratching my head a few times I tried to find Pamela in Skype for Business – and bingo, I spotted that Pamela no longer existed. She’d been terminated. There’s an easy way to fix this, fortunately. To do it you will need a test user in Skype for Business – so either use an existing test user (you have one, right?), or setup a new AD Account and use that.

    What you need to do is set that test user’s SIP address to the same as what the person you’re trying to remove was – so in this instance, Pamela.Anderson@KnightIndustries.com. Set that, and wait a while for everything to update, and then re-run the sefautil command as above. You’ll find Pamela has now been removed.

    You can then go through and remove the Pamela Anderson SIP Address from wherever you put it.

    Simple way to fix something I thought I’d have to be diving in to SQL to resolve. Sometimes, lateral thinking things through to a simple conclusion is far easier.

  • Prerequisite installation failed: RewriteModule

    Well – it’s been a while hasn’t it? I don’t really blog much any more. Or rather I seem to have switched to YouTube. Anyway, I’ve been recently configuring some Skype for Business Server 2015 units running on Windows Server 2016, and during the ‘Setup Skype for Business Server Components’ part it keeps failing with a ‘Prerequisite installation failed: RewriteModule’.

    It’s fair to say it was getting a bit irritating. Anyway, after a fair bit of digging it seems to be the value of this key:

    HKEY_LocalMachine\SOFTWARE\Microsoft\InetStp\MajorVersion

    Any number above 7 and it seems to kill the installation. The pragmatic solution? Set it to 7 – do the installation – and then set it back to what it was. In my case it was 10(Hex).

    Hope that helps somebody out there!

  • VMWare Fusion 11.0 – It’s a mess

    The arms race between Parallels Desktop and VMWare Fusion has continued with the recent release of Parallels Desktop 14.0 and even more recently VMWare Fusion 11.0. I use both products – typically VMWare for my server stuff, and Parallels for desktop type setup (Think Office/Outlook/Windows 10).

    I’ve upgraded my Fusion to version 11 – and oh am I regretting it. There’s tons of problems with it:

    • Wow it’s slow compared to Parallels
    • I can’t run ANY virtual machines if I’ve previously run Parallels or VirtualBox
    • The network performance is all over the place.
    • Did I mention how slow it was? Startup/shutdown & Snapshotting.

    I’ve tried this on multiple machines, and all with similar results. The most irritating one is that if I try and use VMWare Fusion after having either Parallels or VirtualBox running, I get an error saying ‘Too many virtual machines running’. The only way I seem to get around it is by rebooting and not using Parallels or VirtualBox at all. It’s infuriating.

    I’m sure VMWare will iron out the issues, but for now it’s going in the bin and I’m going to ask for my money back.

    Video below shows the general performance and issues in more detail.

  • Windows Server 2016 Evaluation Upgrade to Full

    I installed a couple of servers recently on 2016 using the Evaluation as we hadn’t received the correct keys. Now, usually, I’ve found that using this method of setting the correct key, or simply changing the product-key from the properties of ‘My Computer’ worked, however for these units I kept getting this error:

    This Edition Cannot Be Upgraded

    This did not bode well as we’d done a fair bit of work on the deployed servers. Yes, yes I know….

    Anyhow, I did some investigation with the DSIM tool, and it turns out you can actually use that tool to upgrade the license, and it worked just fine.

    Firstly, check to see what versions you can upgrade the license to, or rather check to make sure the version you want is in the list. You can do that with:

    Dism /Online /Get-TargetEditions

    You should get an output similar to this:

    Example Output

    We can use the same tool to set the license key and upgrade it the full version. That command is:

    -> Dism /Online /Set-Edition:ServerStandard /AcceptEula /ProductKey:<key>

    It take about 20 minutes per server to run (so be patient) but it worked out just fine. Anyway, I hope somebody out there finds this useful.

    Example Output

  • Adding multiple users to an Office365 Group

    I was recently trying to set up some security groups in Office365, and I wanted to add a subset of users to that group. Could I work out how to do it? Well, yes, I could….But it took a while.

    I tried the obvious approach of feeding each user to the add-msolgroupuser cmdlet and it just wasn’t having it. Some further google-fu and I worked out that this command doesn’t accept collections….So a different approach was needed. 

    In effect you create a variable with the users you want, and then feed that list of users to the add-msolgroupuser cmdlet. This worked for me anyway – so let’s have a look at how below. I was working with a group for SharePoint in this instance.

    Add your group to a variable

    $group = get-msolgroup | where {$_.Displayname -eq ‘SharePoint Users’}

    Add your users to a variable

    There’s various ways to get your users. In my case it was simply users with a certain domain name so I selected those using:

    $users=get-msoluser -domainname contoso.com|select-object userprincipalname,objectID

    Add the users in the variable to your group

    This is the bit I was struggling with originally. In effect you pipe the content of the users variable to individual add-msolgroupmember commands.

    $users | foreach {add-msolgroupmember -groupobjectid $group.objectid -groupmembertype ‘user’ -GroupMemberObjectId $_.objectid}

    Not as obvious as you’d imagine. Well, as I’d imagine anyway.

    You can have a look at the group members with:

    get-msolgroupmember -GroupObjectId $group.objectid

  • Who owns an email alias in Microsoft 365?

    A quick an easy way today – how do you find out if an email address/alias is assigned to a user in your Office365 tenancy?

    It’s pretty easy really – although not that obvious. 

    For both of these methods, you’ll need to connect to Office365 with PowerShell. To do that, you need to do the following:

    $cred=get-credentials

    At this point, you’ll be prompted to enter your Office365 Admin Credentials

    Then, you connect to the session using those credentials (below may be wrapped – the $session and Import-PSSession are two lines).

    $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $Cred -Authentication Basic -AllowRedirection

    Import-PSSession $Session

    You could then if you wanted export all of your mailbox identities with their email addresses. You can do that with:

    get-mailbox -identity *|select-object Identity, EmailAddresses|export-csv csvout.txt

    This would put all of your mailboxes and associated Email-Addresses into a CSV.

    More specifically, you could just search for the email address you’re interested in – you can do that with this command:

    Get-Mailbox -Identity * | Where-Object {$_.EmailAddresses -like ‘smtp:emailaddress@domain.com‘} | Format-List Identity, EmailAddresses

    Obviously change the ’emailaddress@domain.com’ to whatever you’re looking for. You can use wildcards too, so for example DA*@contoso.com would find any alias beginning with DA and @contoso.com

    Output is similar to this:

    Example Output

    In the words of Heath Ledger…Da Daaaaaa.

  • Windows 10 – Profile is Grey

    I was using one of my Windows 10 Virtual Machines earlier and the profile lost all of its colour. It went grey (or gray…Which to use?!). It looked like this:

    Grey – Wrong

    …instead of:

    Correct Colours

    Just a bit strange I thought. Anyway, after some digging around it turns out Windows 10 has a set of colour filters to assist people who struggle to see certain colours.  Somehow I’d managed to turn it on.

    It’s simple to toggle – simply use Windows Key+ctrl+c and it’ll toggle between the two.

    You can also get to it through the Control Panel – go to ‘Ease of Access’ and you’ll see it in there under ‘Color Filters’. Well you learn something new every day, don’t you?

  • Duplicating Skype for Business Policies

    I’ve had this little tip kicking around in my archives for a little while – and it’s quite a handy one. As far as I know there’s no ‘official’ way of duplicating polices in Skype for Business. For example, you may want to copy the settings from one client or voice policy to another.

    It’s fairly easy to do with an XML export/import process, fortunately.

    By way of example, let’s say I have a client policy called ‘LondonSite1’, and it’s got a ton of configurations in it. I then want to create another site policy for ‘LondonSite2’ that has the same settings, bar a couple of modifications.

    Simple way is to export LondonSite1, modify the XML, and then import into LondonSite2. Here’s how:

    Export the LondonSite1 Policy

    Get-csClientPolicy -Identity LondonSite1|export-clixml -path LondonSite1.XML

    Edit the XML

    Open up the XML in notepad, and look for this line:

    London Site 1 Example

    The important bit is the Identity – the Tag will be whatever your policy name is. Anyway, change the name Tag:policyName to your new policy name. In my example:

    London Site 2 Example

    Create the New Policy

    We need to have the new policy available to import to. So create the new policy with:

    New-csClientPolicy -Identity LondonSite2

    You may already have done this of course.

    Import the Settings

    Now, we’re going to feed the XML settings to set-csclientpolicy with:

    Import-clixml -path LondonSite1.xml|set-csclientpolicy

    As we have modified the ‘Identity’ to the new policy it will import the settings to that policy.

    Works with most policies I’ve tried it with, including the Voice Policies.

    There may be better ways of achieving this – if there are, I’m all ears. 

  • Windows Update Errors (Insider Preview)

    Recently on some of my machines I’ve been getting errors not being able to update Insider Preview versions. I end up with ‘Updates could not be installed’ or similar. Using the Windows Update Fix Tool doesn’t seem to sort it out either. Anyway, I’ve found a process that seems to resolve the issues for me. Have done it a fair few times and it seems to work…So I thought I’d share the process.

    Stop the Services

    Start the Services plug-in – Services.msc (I’m assuming you’ll know how to do this – Windows key+R, enter services.msc).

    Find the Windows Update service – if it’s started, stop it. Set the service to ‘disabled’ for now.

    Services

    Next, fire up an elevated command prompt (I.e. Command from the Start menu, right-click, select run as administrator).

    Run As Admin

    From that command prompt, stop these services:

    net stop bits

    net stop appidsvc

    net stop cryptsvc

    You can copy/paste those in to the DOS prompt if you want.

    Clean up the SoftwareDistribution Folder

    Go in to your Windows folder, and find the ‘SoftwareDistribution’ folder. Rename it to ‘SoftwareDistribution.bak’. Note that if you get an error saying the folder is in use – double check to make sure you’ve stopped the Windows update service. Personally I just normally bin the whole folder – but then most of my units are virtual so I normally snapshot them before doing this.

    Clean up the CatRoot2 Folder

    Go in to your System32 folder in your Windows folder, and find the ‘CatRoot2’ folder. Rename it to ‘CatRoot2.bak’. Now, this can be fussy. This is often locked by the Cryptographic service (cryptsvc) and you’ll find that the CryptSvc often keep starting due to dependencies from RPC and the like. The trick is to wait until you get the ‘This folder is locked’ with the ‘Try again’ button, then type in the ‘net stop cryptsvc’ into the Command prompt, and as soon as it’s finished stopping, hit the try again button. This generally works. May take a few times though – it’s clearer what I mean by this in the video.

    Reset Security Descriptors

    Next, we’re going to reset the security descriptors for BITS and Windows Update. See here for the commands for that. Couldn’t paste them in here – keeps converting some of the stuff to Emoji, and I haven’t worked out how to stop it!

    Reset the Windows Update Service to Manual

    Finally, reset the Windows Update service to ‘Manual’ in the ‘services.msc’ consoler, and reboot.

    You should now be able to re-run Windows Update and hopefully all your updates apply. There’s a quick video of the run through below.

  • Skype for Business inbound Ringtone

    I ran in to an interesting problem a few weeks ago with regards to callers to a Skype for Business platform. Some users were not getting the ‘ring ring’ when dialling in. I.e. The ringtone or ringback as it’s often called.

    What made it harder to locate was the fact that it wasn’t all users, and it wasn’t all of the time. I.e. It seemed random across a user DDI range, and for different callers. It took a lot of logging and reading.

    Here’s the thing. I never did spot a real instance of it actually happening. If you can’t see an event how do you trace it? 

    By a complete fluke I was using my Skype consumer client – and I was logged in to my Australian account, rather than my normal day to day. Guess what – no ringback tone. The experience is dial – hear nothing for a while – person answers.

    This was predictable and reproducible. Also found the issue dialling in from the US.

    This explains the randomness of the event, and made me feel happier about my log-reading skills. 

    So, the scenario is a SIP trunk terminating on a Sonus SBC, and a SIP trunk from the Sonus SBC to a Skype for Business mediation server.

    Investigating a failed call and one that worked however yielded exactly the same call behaviour. You see the 100 trying, the 183 with SDP…and the SIP conversation happens exactly the same way. So it can’t be our end then, right?

    So off to the carrier I go with a list of stuff that isn’t happening. They’re still investigating. 

    In the meantime, there is a way to force ringback on the carrier – I.e. Make sure the carrier is providing it. It’s fixed the issue for us in that all users now always get the ringtone/ringback or whatever you want to call it. So I thought I’d share how to do it – some people may find it useful. 

    Essentially we’re going to change the 183/SDP messages to the carrier to 180 ringing. You can see the full list of SIP response codes here. 

    So, how do we do it? Well, the Sonus can apply message translation rules to routes – so you can change one SIP message to another for incoming calls. In our case, we’re going to change 183’s to 180.

    Let’s have a look at how this was done.

    The first thing we’re going to do, is to define the translation in the ‘Telephony Mapping Tables’. You get to this in the ‘Settings’ part of the Sonus configuration:

    TMR

    Expand the ‘Message Translations’ section and add in a translation. In my configuration, the translation looks like this:

    MTR

    The important bit is the incoming message type, and the outgoing message type. We’re going to convert 183 Session Progress to 180 Ringing.

    Once you have set up the translation, you need to find your incoming route.

    Incoming Route

    We have multiple SIP trunks on this one, from two different providers. Select the one from your provider, and edit it. In there you’ll see the option to select your message translation.

    Edit Routes

    Once you apply it, you should see a change in behaviour on the inbound calls. An example from before the change is shown below – you’ll see the 183 conversation.

    Call with 183

    After you implement the change, you’ll see we send the 180 Ringing. This is causing the service provider to deliver the ringback to the calling party.

    Call with 180

    Now it could be that the service provide will nail why they’re having this behaviour when being called by certain countries – at which point I can take this configuration off.

    If you’re having issues with no ringback however, this brute force approach to asking your provider to deliver may give you a solution.

  • Unified Communications – Why so hard?

    Quite a while ago I wrote an article on why I like working in the Unified Communications field – you can see it here:

    Why UC?

    It was an interesting conversation at the time going through the reasons that the technology kept me interesed. There is also of course a flip side to this – why is deploying a Unified Communications platform so hard? Or rather, why do so many organisations deploy UC platforms and have trouble with the process.

    It’s an interesting question, and one with many answers. In my working life I typically get involved with two types of organisations and deployments, with these being:

    • Organisations who want to deploy the technology, but are not quite sure how to approach as it’s not really in their internal skill set.
    • Organisations that give the technology to existing technology teams and ask them to get on with it.

    (Obviously there’s many other scenarios, usually somewhere between the two mentioned above).

    In effect, you’re either there at the start, or engaged later to pick up the pieces. From a technology perspective, you can understand why organisations take both of these approaches. Some are either a little more risk averse, or simply don’t have the internal time bandwidth for such projects – this tends to be the key feeder for the first scenario in my experience. The second scenario has a more varied set of drivers – the more common one is where an organisation does have a great internal team, and that team is keen to get involved in the newer technologies.

    So why is deploying Unified Communications technologies so hard…? Ask that question from 20 people in the field and you’ll likely get at least 27 different answers. For me, I think the answers seem to be different depending on who is actually answering the questions. Technology type people see it as a learning curve – and an enjoyable one, for much the reasons I highlighted in my article Why UC? The problem is with this approach is that while the needs of the technical teams are being met, the needs of the users are not. You’re deploying front-line tools often using people who are learning on the way. 

    Deploying UC stuff requires an understanding of the technology at a far deeper level than a lot of other user-facing platforms. Let me put it another way – when deploying stuff like Exchange the platform can be a bit more tolerant of configuration issues than a lot of UC platforms. This tolerance is not really a technical one, it’s more around the impact on the users. Get Exchange not quite right and you’ll have some annoyances and feedback from the users about those issues, but in general the platform will operate.

    Get a UC platform wrong (I.e. Telephony etc.) and my, you’ll be in a world of hurt as those users make their frustrations known to you.

    I think the ‘why so hard’ question is an interesting one, and it’s not one specifically answered by the technology itself. The real reason it’s so hard to deploy well is out there in some of reasons to deploy the technology in the first place: Enabling a user to change how they work.

    That may take some explanation. You want to give your workforce modern and enabling tools to get their job done, get it done well, and to, well, enable them to be more successful. The way you do that is implement technologies that enable change the way they work. The problem with this is of course is that if you give them tools that ‘don’t quite work’ you’re not enabling them, you’re putting them at a disadvantage. The next thing you know you’ve got unhappy users that for whatever reason can’t get their screen sharing, or their conference calls (for example), working. 

    Some of the elements of UC platforms that make it great for working on, can also make it difficult to deploy, and to deploy well. Getting the tools out to the users in a way that’s functional, and works well every single time, is absolutely key to a great deployment. A deployment that your user estate will genuinely thank you for deploying. How often does that happen? Going back to the two scenarios I mentioned earlier:

    • Organisations who want to deploy the technology, but are not quite sure how to approach as it’s not really in their internal skill set.
    • Organisations that give the technology to existing technology teams and ask them to get on with it.

    Using the above scenarios, typically I’ll see that one line of engagement results in a positive experience where the users are effectively bought on the journey of the new ways of working. The other one often involves climbing a mountain as the user’s perception of the platform is already tainted.

    UC stuff can be challenging to deploy. Make it work across multiple devices, from anywhere, and in a consistent and repeatable manner requires attention to detail on how platforms are designed to operate. It requires experience – experience such as knowing which certificate providers can cause you issues with other organisations, experience on providing media quality over congested networks for example. Getting input from people that do this as their day job can only be a good thing in my opinion.

    Having to work back through existing deployments that ‘don’t quite work as expected’ is probably around a third of my day job. What’s interesting is it’s always similar problems you see on such sites – similar ones that could be avoided. What kind of things? Well, like misunderstanding how cores work on Lync/Skype is quite a common one. Firewall rules are another. As is not really understanding the roles of QoS and Admission Control.The most common? Probably certificate misconfigurations.

    I’ll finish up by saying that user experience is absolutely at the centre of UC deployments. Lose the users early on, you’ll have an uphill battle on your hands. How do you ensure consistency of the user experience? My best advice would be to have resources at hand who have been there, and understand the underlying technology you’re working on, whether that be Cisco/Microsoft etc.

    Get it right, and your users will love you for it.

  • CertSrv Missing

    Just a quick – ran into an issue on a site today where a Certificate Authority had been configured, but there was no CertSrv directory – so you couldn’t browse to https://server.domain.com/certsrv to issue certs.

    Anyways, there’s a simple way to fix. Start an elevated command prompt and use this command:

    Certutil -vroot

    That’ll create your directories & site for you. Not really sure why it didn’t get created – at a guess they didn’t have IIS installed when they configured the authority? When I have come across this before it’s usually because people have added web services after creating the CA, and have not finished the post-install config in the Server Manager.

    Hey ho.

  • Visio Stencil Shapes Wrong

    This has been driving me slightly bonkers – on a few of my machines my Visio has not been able to display stencils properly. In effect I get some random filled in shapes like this:

    Visio being wrong

    When of course it should look something like this:

    Visio being wrong

    Anyway, you know it’s going to be something simple, right? It was – themes.

    On the design tab, make sure you have ‘No theme’ selected when you import/open your stencil. That way it won’t try and apply the theme to those stencils.

    Visio Theme

    Things like this are enough to drive you to coffee.

  • Access Edge Static Routes

    An age ago I wrote about dual-homing Windows servers, and what you need to do with static routing:

    It’s interesting that even today I still run in to sites that have issues due to incorrectly configured routing on their Access Edge units. The Edge server plays an important role in Lync & Skype for Business – and not just always for the obvious stuff like remote access and federation. It also can get involved in media calls for internal subnets.

    Jeff Schertz has a great article explaining why, linked below. Rather than me make a hash of it, have a read, it’s good stuff:

    Lync Edge STUN versus TURN

    In certain scenarios your internal clients will need to talk to your Access Edge for media – for example if peer to peer communication isn’t possible.

    This brings me on to the point of static routes on the Access Edge – they’re very important! Get them wrong and some subnets may not be able to communicate with the Access Edge, and that’ll lead to all kinds of issues. Of course the obvious ones like remote access etc. but also –  more confusingly – ones like not being able to make a VoIP call between two clients.

    Hopefully your internal network only uses RFC1918 compliant addresses – that is your internal networks are on:

    • 10.0.0.0/8
    • 172.16.0.0/12
    • 192.168.0.0/16

    I usually define static routes on the internal interface for all of the private ranges. It’s easy to do with the following commands:

    netsh interface ipv4 add route 10.0.0.0/8 “InternalNW” 10.100.0.1

    netsh interface ipv4 add route 172.16.0.0/12 “InternalNW” 10.100.0.1

    netsh interface ipv4 add route 192.168.0.0/16 “InternalNW” 10.100.0.1

    You need to replace the ‘InternalNW’ with the name of your internal NIC, and of course 10.100.0.1 with your internal next hop gateway, but it’s pretty straight forward.

    The subnet mask is particularly important – a few sites I’ve seen configure 172.16.0.0 in the wrong way – they’ll use the wrong subnet mask such as 172.16.0.0/255.255.0.0 (172.16.0.0./16)…which is of course wrong, and will miss out a chunk of the private ranges.

    Anyway, that’s my random musing for the day.

  • Outlook 2016 – Cannot delete reminders

    I’ve been running into an issue recently where my Outlook 2016 for Mac would constantly bring up reminders that I had already dismissed. I noticed it seemed to be related to using Outlook on another Mac for the same Exchange account – I.e. As soon as I did it on another Mac, then boom all the reminders were back on *all* machines.

    It’s irritating, but not catastrophically so I guess.

    Anyway, after doing some research there’s a fix that seems to sort it.  Firstly, shut down the Outlook 2016 for Mac client on all of your Macs. 

    Go to the user’s library folder – you can do this by selecting the ‘Go’ menu in Finder, selecting ‘Go to Folder’ and entering ‘~/Library’:

    Go to folder

    Under the home user’s library, navigate to:

    /~Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/Main Profile/Data/Events

    …then just delete all the folders/contents of that directory. Do that on all of your Macs.

    Once done, fire up Outlook and they should stop popping up in such an annoying fashion.

  • Microsoft Lync wants to use the OC_KeyContainer

    Ran into a weird issue on Lync 2011 on my Mac machines (as a side note, how rubbish is this client? Let’s hope the upcoming Skype for Business for MacOS is everything we expected and more… ). It was putting up a prompt saying:

    Microsoft Lync wants to the “OC_KeyContainer_useraddress” keychain

    …and asking for a password. Usual user password doesn’t work. Anyway, after some digging it’s pretty easy to fix if you see it.

    Exit Lync 2011.

    Use Finder to go to the user’s library – you can use ‘Go to folder’ and enter ~/Library

    Library

    In the Library folder, go into the Keychains directory. You’ll see a few files called:

    OC_KeyContainer_useraddress

    For example: OC_KeyContainer_AndyPandy@Contoso.com

    Simply delete them. Once you’ve removed them start Lync 2011 again and it should continue as normal

  • Maximum Network MOS Scores Per Codec

    Placeholder: Not interesting!

  • Protocol Workloads – Skype for Business

    Skype & Lync Server can look very confusing from a protocol and message flow perspective. What connects where, how, what protocol etc. It’s not as complex as you’d imagine – but I would say that as I’m doing this every day.

    Anyway, there’s a great protocol workflow diagram here that shows all the major protocols and flows:

    Skype for Business 2015 Protocol Workloads Poster

    I’ve downloaded the current one, and uploaded here, should the link change in the future.

    From a what goes where perspective, there’s peer to peer and central MCU brokered traffic to think about. I.e. Does the workload go direct client to client, or does all of the traffic go to a central bridge and then out to the clients. The following summarises the protocol flows:

    Where a workload can do both – I.e. Peer to peer or via the central MCU – is typically down to escalation. Take audio for example, that will for the most part go peer to peer (Well, there’s some other scenarios here including the process of STUN/TURN, but this is a quick summary)…..Until you drag in a third party and it becomes a three way audio call. At this point the call escalates from peer to peer to the MCU. Once you’ve gone to the MCU a media session will not go back to peer to peer.

    Other workloads like the Whiteboad/Polls/PowerPoint streaming will always go via the central bridge.

    *EDITED to add there’s another more general set of diagrams and descriptions at the following location:

    Technical diagrams for Skype for Business Server 2015

    *EDITED to add – Jeff Shertz has a more in depth article on the subject here:

    Understanding Lync Modalities

  • DHCP Failover

    DHCP – there’s an ‘interesting’ subject. The older amongst us may remember what a godsend it used to be, after spending an age having to run about setting up IP addresses manually and the like. Anyone else remember that? Anyway, it’s not something usually to get excited about. Managing it’s availability is a subject that does come though. People have taken various routes including failover clusters (yes, really), to split scopes and all kinds of stuff.

    Here’s the thing – Windows Server 2012 has in-built capabilities to deal with failover and load-balancing, and they just make life easier. There’s a decent TechNet article here that describes how it works.

    Understand and Deploy DHCP Failover

    Anyway, it’s an absolute doddle to configure. The hardest part is often defining all the failover relationships if you have many sites. As per many things though, I think the best answer is to keep it as simple as possible. It’ll make your life easier in the long run.

    The video below shows a run through of configuring a basic load-balance DHCP config. Far better than split scopes and all that stuff…And way, way, waaaaay cheaper than setting up a failover cluster.

    You’re welcome.

  • We don’t want Office Web Apps

    It is perfectly possible to implement a Lync 2013 or Skype for Business 2015 platform without implementing Office Web Apps – after all, Web Apps is just used for streaming PowerPoint slides, right?

    Well, yes, it is – but there are some other things to consider, mainly around how you control the user experience.

    What Changed?

    There are major differences between how PowerPoint slide-decks are presented in Lync 2010 and Lync 2013 – and it’s key to understanding the differences when assessing the requirement for Web Apps. In summary, Lync 2010 shares PowerPoint data in-client, whereas in Lync 2013/Skype for Business requires an Office Web Applications server to achieve similar, but far superior functionality.

    In Lync Server 2010, PowerPoint presentations are viewed in one of two ways:

    • For users who run Lync 2010, PowerPoint presentations are displayed by using the PowerPoint 97-2003 format and they are viewed by using an embedded copy of the PowerPoint viewer. 
    • For users who run Lync Web App, PowerPoint presentations are converted to dynamic HTML files then viewed by using a combination of the customised DHTML files and Silverlight.

    This model did have some limitations, namely:

    • The embedded PowerPoint Viewer (which provided a more optimal viewing experience) is available only on the Windows platform.
    • Many mobile devices (including some of the more popular mobile telephones) do not support Silverlight.
    • Neither the PowerPoint Viewer nor the DHTML/Silverlight approach supports all the features (including slide transitions and embedded video) found in the more recent editions of PowerPoint.

    To improve the overall experience of anyone who presents or views PowerPoint presentations, Lync Server 2013 or Skype for Business uses Office Web Apps Server to handle PowerPoint presentations. This is a better model, in that it offers:

    • Higher-resolution displays and better support for PowerPoint capabilities such as animations, slide transitions, and embedded video.
    • Additional mobile devices can access these presentations. That’s because Lync Server 2013 uses standard DHTML and JavaScript to broadcast PowerPoint presentations instead of customized DHTML and Silverlight.
    • Users who have appropriate privileges can scroll through a PowerPoint presentation independent of the presentation itself. For example, while David is presenting his slide show, Karen can scroll through and view any slide she wishes, all without affecting David’s presentation.

    User Experience – It’s Important

    It is important to understand the user experience of having an Office Web server in the architecture. To explain, the following screen shot shows the sharing options of a fully enabled client with an Office Web Applications Server present:

    Web Apps Present

    In the above screenshot, you can see the sharing options for Desktop, Program, PowerPoint, Whiteboard and Polls. This enablement is driven by the conferencing policy assigned to individual users. Selecting the PowerPoint presentation then uploads the presentation to the Lync Data share, and this is then streamed via the Office Web Applications Server.

    With architectures that do not have an Office Web Applications server available to them, users can share PowerPoint presentations using desktop and application sharing – marked out in the screen shot below – they cannot use the ‘PowerPoint’ button. This is different to the Lync 2010 client experience.

    The challenge with the user experience for architectures without an Office Web Apps server is configuring the policy to allow Desktop & Program Sharing, Whiteboard and Polls and removing the PowerPoint button – this is not currently possible.

    The reason for this is that PowerPoint, Whiteboard and Polls are part of the Data Collaboration Policy, whereas Desktop/Program sharing are part of the Application sharing policy.

    Disabling the data collaboration for a user disables the following functions:

    • Office Web Applications PowerPoint uploads
    • Whiteboards
    • Polls

    There is no granular control to just turn off the PowerPoint option. Turning off data collaboration disables all the above functions.

    Summary

    So, yes, you can implement a platform without Office Web Apps, but you just need to consider the other functions that it impacts when you turn it off by policy.

    The thing is, if the server role is just for a Skype for Business or Lync platform, you do not need Web Apps server or CALs…All you need to cover is the operating system to stand up the Web Apps platform, so it’s not particularly heavy duty.

    Anyways, I get asked this a lot, so I thought I’d provide some background.

  • Windows Server Update Services

    Windows Server Update Services – WSUS, WUS, SUS or whatever you like to call it. Possibly one of the daftest names for something I’ve seen in a long time…..Aaaanyway.

    This is the role you can use to cache, download, and deploy Windows Updates out to your estate under your control – I.e you can control both what updates the clients get, and how they get them – I.e. From the Internet or from your servers. The latter bit being a common usage – download to one distribution point, and then distribute out to your estate rather than all the machines downloading over the Internet.

    There’s lots of different architectures out there. The Technet article here is great at explaining them, and what the options are.

    Prepare for Your WSUS Deployment

    Most organisations don’t find this a difficult process or product to deploy – the ones that do, in my experience, have the problems because they try and massively over-complicate the deployment model for WSUS. Keep it simple – keep it working!

    The video below runs through the process of setting up a single server, how to get your clients talking to it, and how to approve/install basic updates. 

    I produced it for a specific request, but I thought it would be useful to share.

    Oh, by the way, if you have Windows 10 machines in your estate ensure your 2012 R2 WSUS server has this update installed. If it doesn’t, your Windows 10 machines will show up as Windows Vista – and nobody wants that.

    Update to enable WSUS support for Windows 10 feature upgrades

    Another thing to watch out for is specifying the servers in your group policy – make sure you put the port in, otherwise I find that the clients just don’t find the WSUS update server, and you never see the clients register.

    This bit – note the port numbers of 8530 and 8531 (http and https respectively), and don’t do what my brain keeps doing which is put 8350 and 8351 and sit there wondering why it’s not working.

    WSUS Settings

    The other piece of advice is that you should be patient once the group policy has applied – it can take a while for the machines to start appearing in the management console. That’s just fact, it takes a while.

  • Bulk Enabling Skype for Business Users

    I’ve been tidying up some of the scripts I use during deployments, so I thought I’d share some of them. This one that I’m about to go through does the following:

    • Takes a CSV of users
    • Enables them for Skype for Business or Lync 2013 (if they’re not enabled already)
    • Applies the conferencing policy
    • Applies the client policy
    • Applies the remote access policy

    These are the most common things you’ll see when working with users in bulk. The script can be modified to apply anything really – if you’re familiar with PowerShell, it’s fairly easy to read.

    Anyway, let’s look at the script. Firstly, you can download it below:

    SkypeEnable Very out of date, so I have removed it.

    Script Pre-Reqs

    You must have the Lync PowerShell modules installed on the machine you’re running this on – simplest way is to use the scripts on your Front End server(s).

    Script Modifications for your Environment

    You need to modify a couple of items to make it apply to your environment. These items are:

    #Update these variables appropriately

    $DefaultPool=”LyncPool.ds.co.uk”

    $LogFile=”.\EnableLOG.txt”

    $UserCSV=”.\EnableUsers.csv”

    They should be pretty obvious.

    • Default Pool: If the CSV doesn’t include a pool reference, then it will default to whatever you set this variable to.
    • Log File: Where do you want the log file to be written to?
    • UserCSV: This is the CSV containing the users you want to work on.

    Source File Requirements

    The script uses a CSV file containing the relevant info for the users that you wish to touch. The minimum data in the CSV is shown below:

    Data for import

    At a minimum, all you need in the CSV if the mail address of the user you want to touch. I alway use the mail address pretty much, as it’s usually unique in the organisation.

    There are other fields you can include too – shown below:

    All Fields

    The other fields that the script uses are:

    • RegistrarPool – the target pool that you wish to enable the users on.
    • SipAddress – what sip Address do you want to use? You can include the sip: prefix if you want – the script checks for its presence, and adds it if needs be.
    • ConferencingPolicy – what conferencing policy to apply.
    • ClientPolicy – which client policy to apply.
    • ExternalAccessPolicy – which external access policy to apply.

    Note that if any of these fields are empty or blank, the following logic applies:

    • RegistrarPool Missing/Blank – use the default one defined the variable I detailed above.
    • Sip Address Missing – use the Email address.
    • Conferencing/Client or External Access Policy missing then don’t touch those policy settings.

    Pretty simple really. If the file has extra columns – say you’ve done an AD Export for example – then they will be ignored. Only the above fields will be used.

    Executing the Scripts

    This is very simple. From an elevated PowerShell environment just execute the SkypeEnable.ps1 script with:

    .\SkypeEnable.ps1

    Note you must have set-executionpolicy unrestricted otherwise the script won’t run.

    The start directory where my scripts are looks like this. You can see the PowerShell script, and my CSV file ‘EnableUsers.CSV’.

    Start Directory

    Running the script results in this output:

    Script Execution

     It even tells you the files & logs to check.

    Script Output

    The script outputs a couple of check files for you to look at so you can make sure everything has gone as expected. I’ve used ‘EnableLog.txt’ for the main log file. In addition, a CSV called ‘UserCheck.CSV’ is also output. Let’s look at each – starting with EnableLog.TXT. This looks like this. The script tells you what it’s doing, and even shows you the PowerShell commands it’s using.

    The UserCheck.CSV contains a CSV export of the users we’ve touched, and includes their relevant policies. For example, have a look here. The CSV file will enable you to check against your original requirements and make sure stuff has applied properly:

    Check

    Can I use the script for anything else?

    Well, yes. If users are already enabled for Skype for Business/Lync, you can still specify Conferencing, Client or External Access policies. The script will then apply those policies to those users.

    Summary

    PowerShell is brilliant at automating common and bulk tasks, it absolutely makes sense to use it. To be fair, I may have over-complicated this script & process – sometimes simpler is easier – however the script process itself can be pretty useful for developing your own stuff. So I hope you find it useful.

    You can see a video run through below.

  • Skype for Business High Availability – Pool Pairing

    High availability and Disaster Recovery in Skype for Business/Lync 2013 is a beautiful thing. Providing always on services, as well as great recovery provisions for DR is core to the product. Looking at it though, you could perceive it requiring a whole heap of hardware and licensing – not the case really. A common misconception is around the pool pairing types. Let’s have a look at that. 

    Before we do however, let’s just qualify some terms for the purposes of this blog:

    High Availability

    For a service to be HA, it automatically survives a failure in the topology, and recovers, without administrative input.

    Disaster Recovery

    For DR, Administrative input is required to ‘push’ services/users to a DR site.

    Other’s have different definitions of the above, but this will do for the purposes of this blog.

    Firstly, for both HA and DR, don’t be quick to dismiss the Standard Edition of the product. It provides great high availability for voice, and easy to implement/low cost DR. Have a read of this to explain why:

    In praise of Lync Standard Edition

    Things seem to get expensive when you want to pair an Enterprise Pool for high availability. Consider the pool pairing requirements from this article:

    Front End pool disaster recovery in Skype for Business Server 2015

    In particular, note the requirements on the pool pairing:

    Pool Pairing

    As a quick side note, have a look at the RTO & RPO for the failover:

    RTO & RPO

    Great RTO and RPO, right? But wait – this is measured on 40 *thousand* active users, with 200 *thousand* enabled users. So, there’s that….

    Anyway, back to HA/DR. So let’s say for example you implement an Enterprise Edition pool as you want High Availability in your primary pool, and you also want to provision Disaster Recovery for the same pool. The configuration I often see proposed is similar to this (click on the image for a larger view):

    Example Structure

    So we put three front end servers in the primary pool, and have an SQL server for the databases. We also have the DR pool of three front end servers, and the associated SQL services at that site. Let’s say you have 3.5k users for example, that’s a lot of  server instances and Skype for Business Server 2015 licenses isn’t it? With that model, let’s assume:

    Primary DC (Active)

    • 2 x SQL Servers
      • 2 x OS, 2 x SQL
    • 3 x Front End Servers
      • 3 x Skype for Business Server 2015 licenses
    • Hardware Load Balancer for Web Services

    Secondary DC (Passive)

    • 1 SQL Server
      • 1 x OS, 1 x SQL
    • 3 x Front End Servers
      • 3 x Skype for Business Server 2015 licenses
    • Hardware Load Balancer for Web Services

    With three servers in the pool you’ll need to load balance the web services between the pool servers as well, usually using a Hardware Load Balancer of some sort.

    In this setup you have done the correct thing according to the supportability rules. Enterprise Pool with Enterprise Pool, virtual to virtual or physical to physical (no virtual to physical pairing), and you’ve used the same OS across the platforms.

    Here’s the thing though – why do you need three Front End Servers in the secondary/passive data centre? Look at the rules – where does it state you need the same number of Front End servers? The answer is – it doesn’t. You can have a differing amount of Front End servers in the paired pools.

    All of a sudden, that architecture is looking smaller. Consider this:

    Example Structure

    In this model, you’d need:

    Primary DC (Active)

    • 2 x SQL Servers
      • 2 x OS, 2 x SQL
    • 3 x Front End Servers
      • 3 x Skype for Business Server 2015 licenses
    • Hardware Load Balancer for Web Services

    Secondary DC (Passive)

    • 1 SQL Server
      • 1 x OS, 1 x SQL
    • 1 x Front End Servers
      • 1 x Skype for Business Server 2015 licenses

    You’ve immediately cut out an extra two servers, and the associated licensing, as well as the requirement for hardware load balancing in the secondary site. This works, and is supported. It’s a good model for when you want to provide HA & DR for users, without having to put a lot of infrastructure in the secondary DC.

    Of course this model only really suits an Active/Passive setup where you have users being provisioned from the primary DC, and the secondary DC is only used in a fail over scenario. If you wanted Active/Active (which is a very credible option), then you’d really need to provide HA in both DCs and provision enough resources for each DC to carry 100% of the load.

    I haven’t included Office Web Apps in the above, however that’s another consideration. You may put a couple of them in the Active DC load balanced – but why would you want multiple in DR? In fact, there’s a question of whether you need them in DR anyway unless you consider it a critical function.

    Anyway, the point of this blog is really just to show that there’s a lot of flexibility in Lync/Skype for Business in terms of HA/DR – put some thought in to it, you’ll find it’s not as difficult/expensive as you’d imagine.

  • Deleting the Skype for Business Address Books

    Quite a while ago I wrote a small VBScript that deletes all of the GalContacts (Skype for Business local Address Books) for you. It’s handy when testing things such as putting new normalisation rules on your Lync or Skype for Business Servers. Combine it with the ability to zero the download delay using the GalDownloadInitialDelay registry setting and it just makes your life a little bit easier. Initial article was here:

    Automatically Deleting the Lync Address Books

    Anyways, a few people now have asked me to update the script from VBScript to PowerShell – because the whole world is going PowerShell (and quite rightly, too!). Anyway, I have updated it, and you can download it here:

    DelContacts Removed as very out of date.

    So what does the script do? It’s quite simple – all it does is scan your own profiler any GalContacts.* files and deletes them. You can then use the Lync/Skype client to download new ones.

    It even logs the output of what it’s doing.

    Anyways, scripts like this, while they may not do an awful lot (but they do make your life slightly easier), are a great way to learn PowerShell. In here you’ll see how I’ve done some logging, called some DOS commands, the whole lot. Sure there’ll be other/better ways of achieving the same thing, there always are.

    Do you need to change anything in the script?

    Line 9 contains the path to the log file you wish to use for the script, so you need to change that to your preferred destination. Mine is usually on the desktop – but you can set it anywhere you have write access to:

    # Set LogPath to the place you want the log files to go

    $LogPath=”c:\DelContacts\DelContacts.TXT”

    How do you run the script?

    Start PowerShell, go in to the directory you have the script in, and use this command:

    .\DelContacts.ps1

    Bear in mind you will need to have appropriately set the set-executionpolicy to allow the script to run. 

    Log File Output

    The log file will tell you what it has done – example output below.

    Can I create a desktop shortcut to it?

    Yes, absolutely. Create a shortcut pointing to:

    Powershell.exe PathToScript\DelContacts.PS1

    For example on my Windows 10 desktop, I have a shortcut pointing to:

    powershell.exe C:\DelContacts\DelContacts.ps1

    ===========================================================================

    Computername : HUGEPC

    User Name : mark_

    Temp Dir : C:\Users\mark_\AppData\Local\Temp

    Profile Path : C:\Users\mark_

    Temp File : C:\Users\mark_\AppData\Local\TempDelContacts.TMP

    ===========================================================================

    Finding files using the command: DIR C:\Users\mark_\GalContacts.* /s /b >C:

    \Users\mark_\AppData\Local\TempDelContacts.TMP

    Temporary file found…

    Deleting files….

    Working on : C:\Users\mark_\AppData\Local\Microsoft\Office\15.0\Lync\sip_ma

    rk.*******@******.com\GalContacts.db

    File deleted.

    Working on : C:\Users\mark_\AppData\Local\Microsoft\Office\15.0\Lync\sip_ma

    rk.*******@******\GalContacts.db.idx

    File deleted.

    ===========================================================================

    Deleting temporary file…

    Temp file deleted.

    ===========================================================================

    Process finished.

  • Microsoft UC & VPN

    As I’ve said previously on my site here I spend most of my time designing Unified Comms systems, now predominantly around Microsoft architectures.

    I also get involved in normalising/rectifying/stablising systems that have already been deployed. With UC platforms it’s not that hard other a solution to 80% deployed and operational with little UC knowledge…and yet it’s that last 20% of deployment that can utterly ruin a user experience.

    Anyway, on that ruining a user experience piece, two networking things that I see a lot of that tends to fly under the radar at the design phases are VPNs, and Proxy setups. Media does not play well with a proxy system…but nor do VPNs. I’ll talk about the Proxy issues in another post, but lets look at VPNs first.

    So, whats the beef with VPNs? It’s really down to the fact that operating over a VPN can seriously degrade media performance to the point that it irritates the users. The reason for it is that the process of pushing traffic through an encrypted VPN tunnel seriously impacts jitter and latency figures for the media connection – mainly through the additional workload of additional encryption and decryption. Lync/Skype traffic is already encrypted – signalling via TLS and media via SRTP. so pushing it through a VPN just means you’re encrypting already encrypted traffic. Hardly efficient.

    Now, Microsoft’s architecture has a model in place for just this scenario – the Access Edge topology. Media relayed through the Edge is designed to provide a high quality experience over uncontrolled networks. 

    The problem is though how do you stop users sending their traffic over the VPN when they want to make a call? It’s not as if you can ask them to disconnect from the VPN to accept or make a call can you? Well, there is a way, but it does take a bit of planning – namely configuring a split tunnel VPN configuration.

    What you want to achieve is all your normal traffic goes via the VPN except any Skype/Lync traffic – you want that to go to the Access Edge servers. Split Tunnel VPNs are not that unusual and most VPN platforms support the capability – there’s something else you need to consider however, and that’s the client connectivity logic.

    Imagine the scenario where you enable split-tunnel on your VPN so that your Lync clients can connect to the Access Edge servers. The problem you’ll run in to is that the Lync client will first check for internal connections to the Front End servers using either LyncDiscoverInternal or other DNS entries – if it find them and the front-end servers then it will connect via the VPN tunnel regardless of the ability to connect to the Access Edge.

    So, how do you fix this? Well, explained simply the way to fix it is to ensure that not only do you allow the split-tunnel for the client but you also block access to the Front End Servers. Essentially you need a firewall rule that blocks:

    Firewall

    There’s numerous ways of achieving this. You can even achieve it using Windows Firewall policies for example, however for the most part it’s easier to configure at either a firewall or VPN platform level. The Windows firewall policies for example wouldn’t apply to Mac users or people using systems that don’t receive those policies.

    VPN configurations are one of those things that add to the quality of experience of using a platform, making the user’s situation stable, repeatable, and positive. Will the product work through a VPN? For the most part, yes – your users won’t thank you for it though.

  • Enabling Extension Number Display in Lync 2013 or Skype for Business

    I’m working on a site at the minute that has disjointed extension/DDI numbers – that is their extension numbers in no way match their assigned DDI. Throw in some routing to legacy PBX platforms…and your dial plan gets ‘interesting’. 

    Anyway, one thing I wanted to do was to turn on the ability to view extension numbers in the Skype client. What do I mean I hear you say – well, consider the normal display when I type in an extension number:

    You’ll see the normalised number – notice how 8622 actually maps to a 5831 number – but it would be useful to see the extension, like this:

    With this set, it displays the extension as well – of course you have to have it normalised like that in your dial-plan and your address book rules for it to appear as above.

    Anyway, how do we achieve this? Well, it’s pretty easy. You can do it in a client policy, like this:

    $x = New-CsClientPolicyEntry -Name “ShowExtensionInFormattedDisplayString” -Value “True”

    $y = Get-CsClientPolicy -Identity Global

    $y.PolicyEntry.Add($x)

    Set-CsClientPolicy -Instance $y

    The above puts it in the Global policy, but you could if you wanted create a new one, and assign that. See here on the processes for adding options to client policies:

    New-CsClientPolicyEntry

    WAIT! What if I want to remove it? Well, again it’s pretty easy.

    $y = Get-CsClientPolicy -Identity global

    $y.PolicyEntry.RemoveAt(0)

    Set-CsClientPolicy -Instance $y 

    The above assume it’s the first policy entry – you’ll need to update it to match the actual entry if you have multiple ones. Note you can clear all of them too using this command:

    Set-CsClientPolicy -Identity global -PolicyEntry $Null

    Fairly simple stuff. This capability was first introduced back with Lync 2010 – see here for info:

    An update is available to display the extension number of non-US telephone numbers in contact cards in Lync 2010

  • Lync 2013/Skype for Business & Virtual Cores

    I’ve been setting up a couple of Standard Edition servers recently, and I wasn’t seeing the performance I expected when importing a fairly large number of users (about 3k) – this was a test lab. It was a bit confusing really, as the servers themselves were very well specified. 8 cores, 32Gb RAM, running on SSDs….albeit the platform being virtualised.

    After playing around with it for a while, I could see that SQL Express only seemed to be executing on a single core, not up to 4 which is what I thought was standard. I.e. SQL Express can use up to four cores. You can see the restrictions in this article here:

    Compute Capacity Limits by Edition of SQL Server

    (2012 version here).

    In particular, pay attention to this bit:

    It’s limited to the less of 1 socket or 4 cores. So, having looked, my VMs were running not with a single socket with 8 cores, but as a server with 8 sockets, each with 1 core. Explained the restriction. Having spoken to the VMWare administrator, this got fixed pretty quickly. Haven’t really looked at how, but there’s a great article here explaining how to allocate cores per processor. As a side note, the memory is still limited to 1Gb for SQLe I believe.

    Setting the number of cores per CPU in a virtual machine

    Anyways, an interesting one, and something to watch out for.

  • Delete the Lync or Skype for Business Address Books

    There’s a lot been written about the Lync or Skype for Business Address Books over the years, so I’ll not go into that whole thing here. What I do get asked about though is clearing down address books on a client and downloading a clean copy. How can we do that automatically?

    Well, firstly, you need to be aware of how those address books get downloaded. Have a read of this article here, it explains the background.

    Downloading the Address Book in Lync 2013

    While the above is for Lync 2013, the process is much the same for Skype for Business 2015.

    Deleting the local copies of the address books involves deleting GalContacts.db and GalContacts.db.idx from the user’s SIP profile directory. For Skype for Business 2015, this is in this location:

    C:\Users\username\AppData\Local\Microsoft\Office\15.0\Lync\sip_sipaddress

    As we know that, it’s pretty easy to automate.

    I’ve written a script that will do this for you. You can download that script here.

    AutoDelAddressBook.rar

    The script also creates a log file of the work that it carries out. The below is an example output from the script:

    ==========================================================================================

    17-Nov-15:2:18:58 PM: Delete GalContacts Script.

    17-Nov-15:2:18:58 PM: Running on workstation: BERKPC

    17-Nov-15:2:18:58 PM: User: *****

    ==========================================================================================

    17-Nov-15:2:18:58 PM: Path root: C:\Users\*****\AppData\Local\Microsoft\Office\15.0\Lync\

    17-Nov-15:2:18:58 PM: Temp Path: C:\Users\*****\AppData\Local\Temp

    ==========================================================================================

    17-Nov-15:2:18:58 PM: Checking to see if TEMP file exists….

    17-Nov-15:2:18:58 PM: Temp file does not exist.

    17-Nov-15:2:18:58 PM: Getting directory of all SIP users…

    17-Nov-15:2:18:58 PM: Command for directory: CMD.exe /c DIR C:\Users\*****\AppData\Local\Microsoft\Office\15.0\Lync\sip_* /b >C:\Users\*****\AppData\Local\Temp\GalContactsDel.TMP

    17-Nov-15:2:18:58 PM: Running command….

    17-Nov-15:2:18:58 PM: Checking to see if TEMP file exists….

    17-Nov-15:2:18:58 PM: Temp file found, directory completed.

    ==========================================================================================

    17-Nov-15:2:18:58 PM: Opening temp file, scanning for GalContacts file in each specified SIP directory…

    17-Nov-15:2:18:58 PM: Working on: sip_***@*****.**.**

    17-Nov-15:2:18:58 PM: Full Path: C:\Users\*****\AppData\Local\Microsoft\Office\15.0\Lync\sip_***@*****.**.**

    17-Nov-15:2:18:58 PM: Could not find GalContacts.db in directory.

    17-Nov-15:2:18:58 PM: Could not find GalContacts.db.idx in directory.

    17-Nov-15:2:18:58 PM: Working on: sip_****@***.***

    17-Nov-15:2:18:58 PM: Full Path: C:\Users\*****\AppData\Local\Microsoft\Office\15.0\Lync\sip_****@***.***

    17-Nov-15:2:18:58 PM: Could not find GalContacts.db in directory.

    17-Nov-15:2:18:58 PM: Could not find GalContacts.db.idx in directory.

    17-Nov-15:2:18:58 PM: Working on: sip_****.********@***.***

    17-Nov-15:2:18:58 PM: Full Path: C:\Users\*****\AppData\Local\Microsoft\Office\15.0\Lync\sip_****.********@***.***

    17-Nov-15:2:18:58 PM: Could not find GalContacts.db in directory.

    17-Nov-15:2:18:58 PM: Could not find GalContacts.db.idx in directory.

    ==========================================================================================

    17-Nov-15:2:18:58 PM: Completed.

    17-Nov-15:2:18:58 PM: Deleting temp file….

    17-Nov-15:2:18:58 PM: Number of profiles scanned: 3

    17-Nov-15:2:18:58 PM: Number of GalContacts.db deleted:0

    17-Nov-15:2:18:58 PM: Number of GalContacts.db.idx deleted:0

    ==========================================================================================

    What the script does is searches a user’s home directory for all of the SIP identities, and then in those identities removes those GalContact files. The script tells you which profiles were scanned, and how many removed.

    So, to use the script, the first thing you need to do is set up a shared directory for all of the log files. In my script currently, the logging directory is set to “\\BerkPC\Logging”. You will need to edit line 16 to reflect the correct path for your logs.

    ‘===========

    ‘Set the LOGPATH Variable to the directory that you want to house the logging output files.

    ‘Note do NOT include a trailing \

    ‘I.e. \\unc\logs is OK \\unc\logs\ is NOT ok

    ‘===========

    LogPath=”\\BerkPC\Logging”

    Once it’s set, you can fire the script at as many machines as you want – there’s various ways of doing that, group policy objects for example. Remember that it needs to be executed under a user context not the machine one, as it’s the user profiles we’re interested in.

  • Changing a SIP Address in Lync or Skype for Business

    I was being asked about changing a SIP address for a user today on Lync 2013 – equally applies to Skype for Business too. What would the effect be on Contact lists? Say for example your login was ‘DerekT@TheForce.co.uk’, and that’s what you were on people’s contact lists as … What would happen if you changed that SIP login to ‘Derek.Trotter@Deathstar.co.uk’?

    Well, the answer fortunately is a positive one. It works. The contact subscriptions are held in the database by a unique identifier created at the time of subscription – this unique ID is not the SIP address. So, change the address, and when people with that user on their contacts list logs out of Lync/Skype and back in, they’ll still see the person on the contact list with presence and everything.

    One thing I’ve found by the way is that if you change the domain – I.e. The bit after the @ – you can see issues with authentication to Lync/Skype. Easily fixed by logging the user out/in again.

    So you can change these addresses. You do need to plan when you change them though – may also be worth deleting and updating the address book files too. Now, this works well enough for contact lists – but one thing you must educate your users is about is that scheduled meetings will break. Users with changed SIP addresses should go back and re-send any meetings they have in their diary, so that they contain the right URLs for the conferences – otherwise the conference joins will fail.

    Anyways, the video here shows the behaviour in action.

  • Skype for Business Click to Run

    Moved – see here.

  • Office 2016 Click to Run

    Moved – see here.

  • Building a Skype for Business Standard Edition Server

    Moved to here.

  • Jabber vs Lync/Skype for Business

    Jabber & Skype – which is better? What a difficult question to answer. I personally much prefer the Lync/Skype experience to that of Cisco Jabber – but why? How do you quantify that? It’s a question that gets asked a lot by businesses now, and certainly ones that are heavily invested in Cisco.

    It’s an interesting fight isn’t it? I saw a comment from a Cisco commentator a while ago asking:

    ‘Do you want an Enterprise Communications Platform that also does Instant Messaging, or do you want an Enterprise Instant Messaging platform that also does some telephony?’.

    I think that’s a little disingenuous really, and doesn’t tell the whole story.

    There’s an (obviously one sided!) document from Microsoft here, that’s worth reviewing:

    Comparing Skype for Business versus Slack, Cisco, and Google Hangouts

    Technical Comparison

    The problem you can often run in to when running a technical assessment of products is a lack of differentiator. How do you choose between say a Mitel PBX and a Cisco one for example – on a list of functional capabilities? The gap isn’t big, if it exists at all. Yet people constantly do, much preferring the Cisco UCM route in my experience.

    It’s more than a list of functions.

    It’s the same with Skype vs Jabber. Look at them from a functional basis and what gaps do you see? Not many really:

    Both products do this in some form don’t they? …and yet.

    Do I need to choose?

    This is another interesting question. Do you have to choose between Cisco & Microsoft? Well, no, is the answer. A Cisco voice platform with Lync/Skype on top is probably one of the most common deployment topologies we see. Some view it as the best of both worlds – leveraging Cisco’s excellent Call manager platform, while utilising Microsoft’s brilliance in the software space. 

    The only comment I’d make on this model is that once a user starts using Skype for telephony, the user won’t care how you’re delivering that telephony from an architecture point of view – they’re a Skype user. Now, with that comes pressure from other users – they look on enviously at the roaming user who gets their services everywhere, and an any device…and they end up wanting it too. If you’re not careful you end up with a large proportion of your estate on Skype, with a smaller Cisco back end just supporting the transport. I’ve seen this happen a lot – you end up re-engineering around the Cisco platform.

    Field Experience

    I’ll be the first to point out this is subjective opinion…..I’ve never seen a site move from Lync to Jabber and the users enjoy the experience. Ever. Yet companies sometimes do this. Often as they’re invested in Cisco, and expanding on their Skype deployment may involve additional costs in product/licenses. Legitimate reasons of course, but it’s not one the users enjoy from my exposure to it.

    Integration

    I think this is where the gap starts to widen. Integration of Microsoft apps into, well, the Microsoft ecosystem is far stronger than Cisco’s (Who knew etc.). Everything from the look and feel – it’s all familiar, it’s all Office.

    Cisco isn’t that far behind to be fair, but the interface isn’t as familiar, and it doesn’t have the integration points that Microsoft has.

    Usage – Switching Modalities

    This is an interesting one – one of the things I love about Skype is the ability to start with one conversation type and quickly move to another. It’s simply how conversations go.

    Start with an IM, jump to voice, share some docs, drag in another person etc. You go from an IM to a full on-line multi-party conference simply and easily. Using different clients to achieve this drops the user’s drive to use them – jumping between Jabber and WebEx for example. You need to plan and have an idea of what you want to use. 

    The Office365 Juggernaut

    If usage is one thing that starts leveraging the difference, I think Office365 is really where value and capabilities start stretching the divide.

    Pretty much all of my clients are on the Office365 roadmap or considering it. Astonishing isn’t it – ALL. I can’t remember the last time I did on on-prem Exchange migration that wasn’t consolidation in expectation of a ‘365 move.

    This is where the Microsoft Value proposition comes in – Skype is in pretty much all of the Enterprise Subscriptions within Office365. It’s there – you buy an E3, and you get it by default. Whether you use it or not is a value choice – but why would you pay for something twice? WAIT – Jabber is free, right? Well, sure, apart from the infrastructure you need to run it on….

    You then take in to account what’s coming with Office365 & Skype for Business – the roadmap. Things such as:

    • Dial in PSTN Conferencing. We’re all familiar with this – dial a number, enter your PIN etc. This will be natively available in Office365 so you won’t need any additional kit on-prem. Even the lines will be provided by Office365, so you don’t even need to worry about channel consumption.
    • Native PSTN Calling. This is the ability to make normal phone calls directly from Skype within Office365 – so again, not requiring any on-prem equipment or lines. All the infrastructure is from Office365.
    • Integration to on-prem PBX. Soon enough you’ll be able to integrate your Office365 Skype users to your existing on-prem PBX. If you should want to.

    I think once you start looking at the value proposition from Microsoft and Office365 – the gap between Jabber and Skype for Business starts to get wider. Quickly.

    What about QoS! I need Enterprise Grade Voice Quality! Well, that’s coming too by way of Express Route. 

    In some respects I think with telephony and voice we are where we were maybe five years ago with Email. Back then the idea of putting all of your corp email into the cloud was a bit wild & crazy. Now – not so much. I suspect large groups of users will start utilising ‘365 for voice as their working model allows it. I would fit the model for example – never in the office, always work from remote sites or home, and never use a traditional desk phone.

    Delivering my telephony natively out of a cloud – why would I care? Truth is of course it’s exactly what I do today anyway – use Skype Consumer as my everyday phone.

    It won’t match for all users – users with more complex requirements will still need a more complete functional delivery…but…the cloud will catch up.

    Summary

    How to summarise without having the hounds of subjectivity after me in the comments section…I think the Skype for Business proposition is a stronger one on every level than Jabber. It’s a nicer environment to use, user’s like it, and the IT Business has a stronger roadmap for delivering better services, more efficiently (I.e. Cheaper) in the future.

    Microsoft have this right.

    Would I be disappointed if I ended up working for somebody who only had Jabber deployed? No, no I wouldn’t. It isn’t a bad platform – if you think I’m saying it is then I’ve obviously not written this in a way that represents my thoughts. I just think the SfB one, combined with the roadmap for ‘365, is a far stronger proposition.

  • Skype for Business Server Documentation

    TechNet documentation for Skype for Business has now landed:

    Skype for Business Server 2015

  • Enabling Administrator users for Lync

    More of a place-holder this one, as I get asked about it a lot. When enabling a user for Lync you get a message like this:

    Insufficient access rights to perform the operation.

    The reason for this can be seen by referring to this article here:

    Lync Server Control Panel returns that error “Insufficient access rights to perform the operation” when attempting a move user or enable user command

    It’s simple to work around – use the Lync Management Console (PowerShell) to enable or move the user, job done.

  • Lync 2013 High Availability

    Moved here.

  • Clearing Storage

    Moved to here.

  • Surface Pro 3 … Hmmm.

    Update 25/5/15

    Where am I now? Well, to be honest, the device rarely leaves my drawer, even after a small positive for a while. I just don’t understand the form factor. It just seems like one big compromise. As somebody who can touch-type (properly), the keyboard is painfully inadequate. I’d rater take a small laptop with me. 

    I found I was carrying the SP3 and my iPad everywhere. What’s the point of that? So as it stands, I’m back to using a small laptop as my travel buddy. Far more capable, keyboard is better, and not so compromised. Ho hum. Let’s see what the SP4 brings.

    Update 29/1/15.

    So, original article below from the end of October 2014. Where am I today? Well, surprisingly, my report back is a positive one! I’ve still the frustrations with Evernote and it’s terrible font size, but then my brain pointed out when I really need it I can use Evernote in a Web browse, and it’s just fine. I’d love them to fix it.

    I’ve got used to the unit, and it’s now more often than not my travel buddy! Even to the point I put some videos on it the other day to watch on the train…and my iPad stayed home. All the surprised.

    I still run in to the challenges of my job requiring power, and then I have to resort to other kit, but the Surface Pro 3 has found a far stronger place in my work life than I ever expected.

    Gone from 6/10 to an 8/10. 

    ====

    So, the Microsoft Surface Pro (3) – interesting concept. Not really a tablet or a laptop, but allegedly brilliant at both. I’ve got my hands on a rather shiny Surface Pro 3 – so I thought it would be an interesting journey to measure my usage over the week. 

    I’m going to try and use it as a replacement for my travel buddy – a 13” Macbook Pro Retina. Now, I get that some people who read my blog think I’m an Apple Fanboy. I honestly don’t think I am – I would say I’m a technology fan. I love stuff that’s cool, fun, and helps me get the job done. And is cool. 

    The last few years for me this has meant a Macbook Pro with Windows 8/8.1 running virtualised. Why? Well, I like Apple’s hardware, it fulfils the cool factor. And I’ve found the combination of the quality of the hardware with things like battery life really hit my technical cool spot. I like the power of the virtualisation capability of OS X – I can fire up anything very quickly, easily, and it just works. Now, before I get the hate-mail I know Windows laptops can do that too….but the oddity is that even though I have access to a wealth of laptops, phones, stuff etc. (for free, too, mostly), I always find myself gravitating to the Macbook Pro.

    So, I plan on logging my journey into using a Microsoft Surface Pro 3 as my travel buddy. I will try to be objective, but of course personal preference will come in. I’ll of course welcome any feedback. Even from you – yes, you – you know who you are.

    Day 1

    Unpacking is an interesting experience. They’ve taken some lessons from Apple – trying to make you enjoy the unpacking. Did they achieve it? Yes, but with some caveats. Firstly, the battery for the pen, and the small stick-on pen holder thing…rapidly disappears across the floor. Detracts from the cool, but ultimately not important. It’s just not quite right – they could do better! Perfection should be pursued in everything, for perfection to be perceived in anything.

    What next? Well, powering up the unit and getting going is no real hardship for anyone who powers up a new Windows laptop. Crap-ware free…apart from the 80+ Windows updates to be downloaded and installed, including one firmware update that reliably informed me that ‘that something had gone wrong’. Nearly two hours that took. Two. Hours. Two hours between taking the shiny out of the box and me being able to use it to appear funny and attractive to women on Twitter.

    Then I started installing all the software I use – of course it takes a while. Takes a while on OS X too, that and updates of course. I hate Windows Update. Hate it. With a passion. 

    So. The Pen. Works really well. I’ll say it functions better in OneNote than the EverNote pen does on the iPad. On the other hand, OneNote is the only app I could really find it worked well in at all. Oh, wow, except for maybe paint.

    This led me to my first twitch. Evernote. I am a big Evernote fan. It’s different to OneNote – Evernote is more like an electronic scrapbook – I put everything in it. Using it on the Surface Pro 3 has been a challenge, but to be clear it’s the inadequacy of the software here, not the platform. The Windows EverNote client is utter tripe compared to the OS X one, so I instantly hit a usability barrier. No Pen Support. Text is TINY compared to OS X – have to expand all the notes. Evernote Touch – well, the less said about that unstable, buggy, terrible POS the better.

    Anyway, the Pen. Works brilliantly in OneNote. Can’t really find anything else worth talking about. Oh, wow, apart from the ‘where do you keep it’ conundrum. You get a stick on pad that you can stick on the keyboard to hold it (Steve Jobs would never have allowed it. Oh. Wait.). Personally I find slotting the pen on to the closed keyboard cover far more convenient. Just feels unfinished.

    What about everything else? Well, I do find the weird mix between the touch environment and the desktop setup a bit weird – but I’m willing to embrace it. So I set all my email accounts up in both the normal Outlook 2013, and the non-Metro Mail client. I.e. use the not-Metro mail client for touch, normal Outlook for everything else.

    I’ve also got 1Password, EverNote (touch and desktop), all set up and ready to go. Also have my OneDrive (for Business and personal) all sync’ed up and working. That wasn’t that hard…as you’d expect.

    So…end of day 1 – where am I at? Well, let’s summarise, in bullets:

    • Ok, we can do this.
    • Wait, touching the screen for desktop apps is really fiddly.
    • Using the pen for desktop apps is clumsy.
    • Oh. Wait. Have a Bluetooth mouse somewhere – Microsoft Wedge – whoop.
    • Daughter: How do I play my videos? What the hell? Plugs in phone, shows phone drive, nothing else. Boggle.
    • Keyboard: Better than I expected! Expected almost spongy interim iPad type keyboard, actually feels just as good as my MBP keyboard.
    • Setup: Ye gods, how many updates.
    • Wait, Ethernet adapter looks like a 5 quid eBay job.
    • Keep touching screen at inappropriate times – desktop apps – getting frustrated and grabbing pen, then resorting to mouse.
    • Performance is ace – to the point that I’m not even sure which one it is I’m using.
    • Hate EverNote on Windows.
    • People use this as a tablet without the keyboard? What?
    • Wait, even more what, you don’t get a keyboard with this?
    • Screen – seems an odd resolution/shape? Looks ace though, as good as my iPad, maybe not quite the quality of my Retina MBP, but not enough to be readily noticeable.

    So, end of Day 1, it’s setup, it’s working…So let’s see what happens. I shall keep you updated.

    Actually, before I stop for day 1, interesting that I haven’t touched on the specs? Almost the same way I wouldn’t consider the specs of an iPad – it works, or it doesn’t. I think that means this works? Anyway, more anon.

    Edited to add an obvious point – I haven’t paid for this device, I’m not even sure of its price point. I shall investigate further and include opinions on that element.

    Day 2

    Ok, firstly, using this thing on your lap is a PITA. I’ve fixed it – using a tray*. So tricky using on the lap. It’s uncomfortable and tiring to try and do productive work with it on your lap. 

    *NSFW comedy language on that link. Quite possibly one of the funniest videos on YouTube though. Honest.

    So today is the first day I’ve tried to use this in anger…and I have to confess I failed and went back to using my MBP. I’ve been editing a lot of stuff today – screenshots, taking bits out of PDFs etc. – and quite frankly I was getting incredibly frustrated doing it on the SP3. To be fair I think it’s because the small Wedge mouse being tiny and not as usable as my main mouse. Now, on that front however I was quite happy editing all the stuff I ended up doing using the touchpad on my MBP? Couldn’t do it on the SP3 without giving myself the rage of frustration.

    So, not  a massively successful day with it truth be told. I will keep trying however, I want to believe.

    In evening I was also attempting to use it just as a tablet – for looking stuff up and consuming. Quite big to do that with, and a little clumsy truth be told. Totally possible however. Of course I miss things like being able to stream stuff to my sound system or my TV – all things that my (Insert Any Apple Device Here) takes in its stride. 

    Day 3

    Today I’ve spent the morning just using the SP3 – forcing myself too as I don’t have my MBP with me. Brave. How am I finding it? Well:

    • On a table it works like a laptop – who knew! A good one – fast, easy to use, getting more use to the touch screen. One thing I have noticed is that I’m one of those fortunate people who is practically ambidextrous so being able to use the mouse with one hand while randomly interacting with the screen on the other has made it far quicker to use than I initially realised.
    • It’s fast. Did I mention that? Not a massive spec this one either – i5 with 4Gb. It’s perfectly quick though to the point that I hadn’t really checked out the technical specifications.
    • Still not convinced by the ‘tablet’ element of it. As a touch screen laptop though – it’s a good one – especially combined with the Pen.

    The pen is interesting – found myself doing something earlier that surprised me. Sat on a conference call using the tablet part only, and the pen, to take notes in OneNotes. Notes I immediately emailed to Evernote of course.

    I think what’s becoming clear to me is that this is a great machine – fast, capable, and good to use…but I think I’ve become very aware of how dependent you are on the apps you use as your daily work-flow. These are often more important than the form factor of the device you’re using aren’t they? For example like I’ve said repeatedly above, I’m a very heavy Evernote user – I use it for everything. The Evernote client on Windows 8 is a challenge, whether you use the touch or the desktop app. I suppose if I were to persevere with the platform the correct thing would be to migrate to OneNote – while I get that OneNote is a great note taking app, it’s not good at what I also use Evernote for which is as an electronic scrapbook for everything that appears on all my devices. I’d not only be looking at changing device then I’d also be looking at changing work-flow.

    It’s amazing how important apps are. I’ve written before about how the only reason I keep with the phone I’m using is because of my investment in the apps on it. 

    How do I feel about this replacing my laptop and my iPad? Well, I think it can replace my iPad yes – except for when I’m out and about and just want to watch videos or read e-Magazines. It’s too big and bulky for that. It can though become my work travel buddy I think – one I take to meetings and work out on the road on.

    Can it replace my MBP and my iPad? No, I don’t think it again. To be clear though I’m not sure that’s down to the form factor or the device itself – it’s down to the way I like to work, and the apps I like to use. I think that makes some of my more complex stuff just harder to produce on the Surface than it is on my Windows equipped MBP? Incredibly subjective that one!

    I’m still utterly undecided. 

    Day 4 (Ok, not counting the weekend)

    I can confirm things are getting better! I actually used it as a tablet at the weekend to arrange some flights and some hotels – it was surprisingly workable. Perhaps I’m getting use to it?

    As a laptop replacement I’m also forcing myself to use it – and I’m slowly starting to get it. Like I point out above however, I think the apps you are use to, and how you work have a real bearing on whether a device like this will work for you. 

    Right now I’m feeling that it can as my travel buddy, but perhaps not as my main weapon of content production choice. Maybe that will change? I am putting the effort in, honest!

    I’ve discovered the MicroSD card slot for example, and now have Bitlocker encrypted File History setup and configured….and I like that. It is worlds apart from the ease of use of TimeMachine however on OS X. I had to dig around and find it for a start.

    The touch screen element is becoming more part of my general working as well, and again, I like that.

    Any issues? Well…..

    I can’t see me taking this out when I’m out for the day doing random (work/non-work) things. Say for media consumption for example. It’s too big. I’d take my iPad Air.

    If I were in the office all day working on a complex design document, I’d probably take my proper laptop. Saying that, my decision is closer than it was – I reckon if I found myself working on such a document and only had the Surface Pro 3 available I wouldn’t be massively overwhelmed.

    I guess where I’m going with this is that I’m struggling to find a place for the SP3. It’s not a replacement for my very powerful laptop (perhaps due to my usage type), and yet it’s a little too heavy to be a general travel ‘consumption’ device. What I can see myself using it for though is a replacement of my travel buddy for meetings and the like – it works well. It’s a great combination of light, powerful and comfortable form factor. Well, unless you want to use it on your lap, then it’s a PITA.

    Day 5, 6 and 7 

    Ok I got ruthlessly distracted by the real world and the Microsoft Decoded event. Where am I at? Well, I like it more than I did on days 1 thru 3 I can tell you that much. I do actually use it in anger now, and I found myself taking notes at the show with just the pen, straight in to OneNote. I was then of course later emailing those notes directly to EverNote where I keep everything else, but hey, it’s starting to work as a thing.

    Did have a bit of SNAFU earlier in the week when getting ruthlessly laughed at by somebody realising I was using my Macbook Pro as a tray so I could use the SP3 on my lap…..

    I stated earlier that I’m struggling to find a place for it – and I think that’s still true, but the statement needs some further qualification. If I had my ‘main’ work machine – whether it laptop, desktop, or whatever – then the Surface Pro 3 could absolutely be my only mobile device for work. Bizarrely though, if I were off out on the Tube (like I am in a bit), it would be my iPad Air that would come with me…for media consumption and web browsing on the go the Surface Pro 3 just cannot compete. It’s too big and clumsy.

    Could my iPhone 6 replace the iPad for media consumption? Well, here’s another little bizarre snippet. When the iPhone 6/6+ came out, I got a 6+…and I hated the size. Just didn’t get it. So I swapped it for a 6. Now, the 6 came with 128Gb of Storage, and that storage combined with the larger screen has changed how I use the unit – all of a sudden using it actively for EverNote (rather than just for reference) has become a reality…and guess what, I’m wishing I’d have stuck with the 6+! I’m certain that if I’d have kept the 6+, then that would be my travel consumption device of choice.

    Complicated isn’t it? Of course my situation is further complicated by the fact that I have access to such a wide range of devices, consisting of a simply spectacular 13” Retina Macbook Pro (I will say that I think is the best laptop I’ve ever used…by a country mile), iPads, phones and some pretty powerful but less mobile kit. It’s because of this choice I think that I’m struggling to find a complete ‘space’ for the Surface Pro 3? 

    So, let’s try and simplify it.

    If I had a Surface Pro 3 as a travel/mobile device, and a more powerful work unit (whether at home or at work), I think it would be a great solution. It would feel a bit compromised in that I think I’d need some form of lighter media/web consumption device – perhaps a larger phone.

    Could it totally replace my travel & work laptops? Not a chance – for me anyway – I suspect my compute demands may be just too high.

    My current perfect working environment? 

    iPad Air – personal media/web consumption

    Surface Pro 3 – general travel and presenting type stuff.

    MB Retina 13” –  ‘proper’ work away from base, so VMs, writing, productivity.

    Work Base – Multiple machines, from a 17” MBP to a Mac Pro.

    This is a fantastically flexible environment…but then…look at the price for all those things! The SP3, a tablet that can replace your laptop? Nah.

    I get this is a confusing piece of writing – but I think that tells a story in its own right doesn’t it?

  • Outlook Advanced Searching

    The company I currently work for is in love with Email. Lots and lots of it. In fact, I’m fairly sure it’s their goal to deliver all the email everywhere.

    Anyway, a side effect of this is that often you know you have some information, from someone, somewhere, about something and it’s hard to track it down.

    Sure, Outlook has search, but hell you can never find anything, right? Well, having watched some people use the Outlook search I can understand why they can never find anything – I suspect people don’t realise exactly how powerful Outlook search is. There are great and simple ways to narrow the scope of your Email searches making it far, far easier to find the stuff you want.

    Simple things like AND and OR. Search for Andy Pandy for example and Outlook will search for messages that contain:

    Andy OR Pandy – and not in that order either. So emails with Pandy Andy will also show up.

    It’s the most common misunderstanding of Outlook search I see, and why people can’t find things. If you wanted something that contained Andy AND Pandy you could search for:

    Andy AND Pandy

    …or search for emails with Andy in, but not Pandy. Guess how we do that?

    Andy NOT Pandy

    You can also of course search for the explicit phrase by searching for “Andy Pandy” (I.e. In quotes).

    There are also some far more powerful search methods such as:

    From: Emails from that person.
    Hasattachment:Yes Only emails that have an attachment.
    Attachments:attachmentname Only emails with that specific attachment – very useful
    Received:=date Items only received on that day
    Received:yesterday Take a guess on that? Also tomorrow/today…
    Received:last week …wild stab in the dark?

    You can of course combine all of them – let’s imagine we want to find an email from Andy.Pandy@contoso.com, that has an attachment, and you received it last week. Well, you could search for:

    From:Andy.Pandy@contoso.com HasAttachment:yes Received:last week

    Boom, there’s your search.

    It’s really worth getting to know the search parameters, it makes finding stuff so, so much easier.

    In fact, Microsoft has made it even easier by listing it all in one cool place for you:

    Learn to narrow your search criteria for better searches in Outlook

    You can see a video run through of how it works, and why it’s so cool, below. This was produced by Webucator, they produce a number of Microsoft Outlook Online and Onsite Training Classes. Must admit I do like video run throughs of stuff – it makes things so much easier to, well, visualise. Always find quite astonishing when some companies ban things like YouTube – how many people now when they want to know how to do stuff would immediately turn to YouTube? I know I do.

  • Enabling PIN Login on Windows 8/8.1

    A lot of people I know have started using Windows tablets of one sort or another – and a question that keeps cropping is why when their machines are members of the domain can they not use the PIN login method?

    By default on the domain this feature is turned off.

    As a side note, it’s interesting the resistance you can run in to enabling the PIN login method….It’s INSECURE shout/rant etc. It may be insecure – but it’s interesting that the same people who shout & moan about this don’t moan about 4 pin locks for people’s phones & iPads, and they arguably can contain very similar data-sets?

    Anyways, where is the Group Policy setting? Under the Computer Policy, go to Administrative Templates\System\Logon.

    Under there you should see the option for ‘Turn on PIN Sign-In’.

    If you open the local group policy editor you can see it here:

    2014-11-21 GPO

    You can also set it directly in the registry at this path (for example if your edition of Windows doesn’t have the Group Policy editor in it):

    HKML\SOFTWARE\Policies\Microsoft\Windows\System AllowDomainPINLogon REG_DWORD

    Set it to 1 to enable, 0 to disable.

  • Managing your Presence – It’s a tool!

    What feels like a long, long time ago I wrote an entry about how people can and should manage their presence – you can see it here:

    The Etiquette of Presence Long gone, sorry!

    Presence isn’t that unusual any more – people are use to it…. that’s not to say people are always using it in the best way however.

    I still see people who the first thing they do when they get in or online is put their Status on busy. So much so you ignore the busy – you IM anyway, are you really busy or just on busy? Hello?

    Of course their response or lack of it tells me whether the busy is real or not…but that’s not very good is it? I may as well just ignore their presence and call whenever I want. What’s the point of that?

    In addition to that it’s obvious to me that some people bang up the times on their inactive and away settings:

    2014-11-03Presence

    They set them so that even when they wander off from the their PC for ages they’re still showing as available. Again, what is the point of that? Trying to IM someone when available only to see them rock in from the sandwich/coffee shop chatting away can be a little frustrating.

    Why do people do that? Why want to appear to be available when you’re not? My guess is it’s down the fear of the ‘Big Brother’ as in oh my, if I’m away for ages people will assume I’m lounging around watching Homes under Hammer.

    The reality of course is that few people do view this in such a way.

    You can also do custom presence states with Lync too – for example I have a few extra on my presence options:

    2014-11-03Presence

    You can see I’ve got a few extra states at the bottom – all designed to help people understand the best way to contact me.

    Mobile clients are also now massively on the rise. Personally for example I tend to leave my Lync client on my phone running all the time – I may logout at the weekends totally, but that’s only if I remember. I’m OK with that – I would get why a lot of people wouldn’t be of course.

    Presence is a great tool if managed and used properly. Constantly on busy – people will ignore it. Constantly available but not, people will ignore it – and get frustrated with you in the process.

  • Disabled in Active Directory, Enabled in Lync

    One common workflow that is often missed in the Lync world is what happens when you disable a user in Active Directory? For example, if a user has left? Well, the user will remain enabled for Microsoft Lync, and in some situations will still be able to logon to Lync as well:

    Disabled AD User Account can still login to Lync

    In reality you need to work in disabling a user for Lync when disabling their Active Directory account as well. Now, fortunately it’s fairly easy to find out who those disabled users are, and to disable them – so let’s have a look at that here.

    How Many Are There?
    Firstly, you may want to know exactly how many Disabled AD Users that are enabled for Lync – it’s pretty easy to find out using this command:

    Get-CsAdUser -ResultSize Unlimited | Where-Object {$_.UserAccountControl -match “AccountDisabled” -and $_.Enabled} | Measure-Object

    Note the above may be wrapped on your browser – it should be entered as a single command. The output of this will show you how many disabled accounts you have – like this:

    2014-11-03DisabledAccounts

    So in the system I’m looking at there’s 461 accounts – quite a few.

    Who are they?
    Next, you’ll want to know who those accounts are? Well, again that’s pretty easy to do with PowerShell – like this:

    Get-CsAdUser -ResultSize Unlimited | Where-Object {$_.UserAccountControl -match “AccountDisabled” -and $_.Enabled -eq $true} | Format-Table Name

    This will give a text output of the disabled accounts – if you want, you can push to a text file by putting >Output.TXT or similar on the end.

    How can I disable them for Lync?
    Again this is very easy with PowerShell – you can use this command. Bear in mind this will disable all of those identified users for Lync. All of them! Consider this for example if you have some AD disabled accounts you use for Synthetic Tests and the like. Anyway, the command is this:

    Get-CsAdUser -ResultSize Unlimited | Where-Object {$_.UserAccountControl -match “AccountDisabled” -and $_.Enabled} | Disable-CsUser

    Summary
    All of the above commands are built in the same way and should be fairly obvious. PowerShell is a fantastic tool for the scaled systems Adminstrator – how people managed without it I don’t know. Well, VBScript I guess? Still a big fan of that for down & dirty quick stuff.

  • In praise of Lync Standard Edition

    Moved to here.

  • Disabled AD User Account can still login to Lync

    There is a certain behaviour with Microsoft Lync 2013 (and 2010 I believe) and authentication that could mean that when you disable an account in Active Directory, the user can still login to the Lync client. This isn’t ideal as the user is able to continue using services on the Lync platform – including Enterprise Voice – for the whole time they are connected, regardless if their account is enabled or not within Active Directory.

    Doesn’t sound great does it! The reasoning behind it is to do with the way that authentication is handled by the Lync client. If a user logs in to their Lync account and selects ‘Save my Password’, Lync will generate a certificate and this certificate will be installed in the user’s certificate store – this certificate is then used to authenticate.

    SignIn

    If you look at the certificate that is generated for the user you can see that it’s often quite a large time period set for its validity:

    Certificate

    In my demo environment for example you can see validity is some 6 months! As long as this certificate is valid the client will still be able to login to Lync regardless of whether their Active Directory account is enabled or not….seems kinda crazy doesn’t it?

    In reality, as part of the administrative process for disabling a user account you should include the step of physically disabling the Lync user account too, either within the Lync Control Panel or with the PowerShell Management shell for Lync. Of course you can also add this option to your Active Directory Users & Computers plug-in and do it all at the same time! Why not – it makes admin far, far simpler.

    For examples on that bit see here:

    Automating Common Administrative Tasks

    The video below shows you the effects of this login process, and why you need to be aware of it. Click here for the hi-def version.