How to Lync enable a Domain Admin

Perhaps you have seen the error message below when trying to Lync enable a Domain Admin in the Lync control panel.

Active Directory operation failed on DomainController.se. You cannot retry this operation:
"Insufficient access rights to perform the operation
00002098: SecErr: DSID-03150BB9, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
".You do not have the appropriate permissions to perform this operation in Active Directory. One
possible cause is that the Lync Server Control Panel and Remote Windows PowerShell cannot modify
users who belong to protected scurity groups (for example, the Domain Admins group). To manage
users in the Domain Admins group, use the Lync Server Management Shell and log on using a Domain
Admins account. There are other possible causes. For details, see Lync Server 2010 Help.

(The comment "You cannot retry this operation" is kind of fun - "Yes I can...")

It is pretty much as harsh as it is described here - you cannot use the Control Panel to fiddle with users who belong to protected security groups. So your options are to either use Powershell as suggested in the error message or you could try this:

1. Open active directory users and computers
2. Enable the advanced features in the view menu
3. Search for the account which is in a protected security group
4. Go to Properties / Security / Advanced
5. Check the following box: Include inheritable permissions
6. Retry what you were doing in the Lync Control Panel

Now this might not be the best "securest" way of solving this issue, but for my lab environments I do not care too much about that, but think twice before doing this in a production system. Probably you should not Lync enable your domain admin accounts at all if you want to stay secure.

40 minutes and 17 seconds of Lync Videos

These videos might be a litte more geared towards North American circumstances, but with a little imagination you will have good use of the examples. Enjoy!

• Deploy Enterprise Voice: Part 1
  (5 min 08 seconds)
• Deploy Enterprise Voice: Part 2
  (5 min 21 seconds)
   
• Simple User Provisioning with Microsoft Lync 2010
  (7 min 23 seconds)
• Flexible Dial Plans with Lync Server 2010
  (5 min 23 seconds)
• Using SIP Trunks with Lync Server 2010
  (5 min 36 seconds)
• Lync Server 2010, more than a PBX
  (5 min 45 seconds)
• Voice Resiliency with Lync Server
  (5 min 41 seconds)

Removing Policies & Warnings

In some cases when listing users in the Lync Control Panel you will see the following annoying message:

"ClientPolicy" with identity "1" assigned to "sip:mattias@kressmark.se" has been removed from configuration store.


This message is caused by deleting a policy which is assigned to one or more users, like this:

Remove-CsClientPolicy -Identity Stockholm

The policy "Stockholm" is currently assigned to one or more users. Assign a different policy to the users before removing this one. The policy is in use.
[Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"): Y

If you do not have another Client policy configured the only option when editing the user is "Automatic". One solution to the problem would be to remove the user from Lync server and then add the user again. But better yet - to reset the Global policy to the user avoiding the annoying message in CSCP you can use the following command:

Grant-CsClientPolicy -Identity mattias@kressmark.se -PolicyName $null

This example used the Client Policy, but I assume this would work the same way for any policy giving the annoying message.

State of Blog and Lync Anno Domini 2012

I have been blogging for about a year now, and it has been fun, so I am going at it for another year. The blog had 33 posts and some 10,000 page views the past year, thanks for the comments, mails and feedback so far!

So let's start off 2012 with some news around Lync!

The biggest news is of course the Lync 2010 Mobile Clients.
It is now possible to run Lync 2010 clients on Windows Phone, iPhone, iPad, Android​ and Nokia Symbian​.

What I hope we will see more of in 2012 is Office 365 and especially Lync voice services through this cloud. Sometime in a distant future my guess is that we will call some VoIP (or other technology) network "PSTN". This might be one of the first little steps: Cloud based Lync Voice Services with BT

Something I been missing for quite some time now - a complete virtual Lync test environment: VHD Test Drive - Lync Server 2010 VHD (Dev)

Another interesting document and technology for the future:
Microsoft Lync Server 2010 Multitenant Pack for Partner Hosting Deployment Guide

For my Swedish readers I can recommend to read in Telekomidag about how
Telia have integrated Lync and MX-ONE with mobile extensions for their customers.

Lync CU4 - one step closer to mobile integration

Lync Server 2010 Hotfix KB 2493736, aka Lync CU4 is now available for download.
It contains quite a few new commands - aimed at configuring mobile clients.
Now we are just missing the clients, minor detail... :-)

A list of the new commands:

Get-CsAutodiscoverConfiguration
New-CsAutodiscoverConfiguration
Remove-CsAutodiscoverConfiguration
Set-CsAutodiscoverConfiguration
New-CsWebLink
Test-CsMcxPushNotification
Get-CsMobilityPolicy
Grant-CsMobilityPolicy
New-CsMobilityPolicy
Remove-CsMobilityPolicy
Set-CsMobilityPolicy
Get-CsMcxConfiguration
New-CsMcxConfiguration
Remove-CsMcxConfiguration
Set-CsMcxConfiguration
Get-CsPushNotificationConfiguration
New-CsPushNotificationConfiguration
Remove-CsPushNotificationConfiguration
Set-CsPushNotificationConfiguration

More details here...

More telephony plugins for Lync?

While I am not a big fan of plugins in the Lync client it seems as more and more traditional voice providers  develop such plugins. To be a bit cynical, I believe that these organizations are trying to "help" their customers to avoid the costly Lync voice licenses (Lync Plus CAL) and instead get voice and such licenses from them. It could be a valid reason for an organization sitting with an existing voice platform wanting to wait before going all-in into Lync or wanting to save a few $.

When it comes to functionality these plugin solutions always becomes a bit messy.
Seriously, would you like to install a little plugin phone into an existing deskphone so that you could... call? or what about a Rebtel plugin into Skype?

Anyhow, here is some new stuff from Avaya:
Avaya Agile Communication Environment (ACE) version 3.0 for Microsoft Lync
that will be out soon, and here is a new blog from VOX covering a lot of Avaya stuff.

It will be interesting to see how popular this Avaya plugin product might become further on.

So far, I only had some experiences with Cisco's Cuci-Moc and Cuci-Lync plugin products, and I do agree with the opinions of Luis Ramos and Justin Morris.

Tools for Lyncfederation

Now there are some tools available on the WWW to find more buddies to federate with.

On a personal level anyone could use:
The WCF (who can federate) Tool will scan through your Outlook contacts and give you a "heads up" on which have public Microsoft Lync or OCS federation enabled. This is a great tool to run for people who do or don't have Microsoft Lync to show them who they could connect with in their own contact list.

A system administrator setting up federation could use:
The Get-LyncDNSSRVRecords.ps1 script that takes a CSV list of domains and checks them for  _sip._tls.domain.com and _sipfederationtls._tcp.domain.com records and writes the results to a text file.

And as usual you can always check the Swedish Lync Federation List