Oh Certificate where art thou

A few days back i had to replace the external certificate on an edge server with a new third party certificate. I created a new certificate request (with private key) and mailed it to the guy who was responsible for requesting the certificate with VeriSign. Moments later i received my SAN certificate.

I logged on to the edge server and opened the Lync Deployment Wizard to import the certificate using the GUI. I select import new certificate and browsed to the path where i placed the certificate. Clicked import, and verified that the command completed successfully.

In the same window I now ran the assign new certificate wizard, to assign the newly imported certificate to the external interface of the edge server. To my surprise I could only select one of the old certificates. The newly imported certificate could not be seen.

I wondered if something went wrong during the import, so I opened the local computer certificate store. Well nothing wrong to see here, the certificate is nicely imported in the local personnel certificate store of the computer. Clicked the Refresh button in  the deployment wizard, ran the assign new certificate again, but still no luck.

Damn, what is going on here? Ghost in the machine? You know what, i will start all over again. So  removed the certificate from the local certificate store. Opened the deployment wizard, imported the certificate using the wizard. Again the wizard told me the certificate imported successfully. But the greater was my disappointment, when i discovered that the certificate was still not present.

Ok, had it using the GUI, will use Powershell this time, that will always work. Imported the certificate using powershell, and tried to assign. No, still no certificate available. Ok, this is really the Ghost in the machine, you know those days when you cant seem to achieve anything.

Tried all over again, but this time i checked the html files which are created in the temp folder by lync (%userprofile%\appdate\local\Microsoft\temp). Although the wizard reported that the command completed successfully, I could see that the certificate was not imported. As reason the log file logged the following: Certificate already present or could not process the private key.

Opened the local computer certificate store, and now saw something fishy. The old certificate, which was generated by the internal CA, had a key displayed in the icon for the certificate. The new certificate, although present did not display that key. The picture below displays a certificate which has a valid private key.


That convinced me that there was something wrong with the private key of the certificate. I have seen this situation in Exchange, and has been widely documented on the internet, but never saw it in Lync before. Nevertheless we are talking about certificates no matter where they are applied to. So this made me decide to use the same sollution, which is repairing the certificate using Certutil.

Opened the certificate, clicked the Details tab and copied the serial number of the certificate.

 Then opened a dos-box in administrative mode, where i used following command:
[Code]
Certutil -repairstore my "xx xx xx xx xx xx xx" (where x is the serial number of the certificate).
[/Code]
Which gave me following result:

Open the deployment wizard and could successfully assign the certificate this time. You see experience comes in handy ;) !

Discovered a bit later that the friendly name was missing from the certificate when i opened the certificate wizard (Deployment Wizard). You can also assign a friendly name to the certificate using certutil.

Required steps:
First you need to create a inf file that contains the friendly name you wish to assign to the certificate. Open notepad and insert following text:

[Version]
Signature = "$Windows NT$"
[Properties]
11 = "{text}Friendly Name" 

Adjust Friendly Name to the friendly name you wish to assign to your certificate. Save the notepad as an INF file in certain directory. I used C:\Temp\FriendlyName.inf.

Second, open the command prompt in administrative mode, and type following command:
[Code]
Certutil -repairstore my "xx xx xx xx xx xx xx" (where x is the serial number of the certificate) C:\Temp\FriendlyName.inf
[/Code]

Reassign the certificate in the certificate wizard and you will see that the certificate now displays the friendly name you have defined in the inf file.




         

Lync Location Policy

 
This is the second article in the article series about policies in Lync 2010. The policies we are going to discuss are the location policies. The whole idea and wherefore it is designed is to provide an indication of where the user is located when calling 911. The E.911 solution has been in place for many years for hard phones, but soft phones or IP phones where not covered by the traditional E.911 system.

Enhanced 911, E-911 or E911 in North America is one example of the modern evolution of telecommunications based system meant as an easy way to link people experiencing an emergency with the public resources that can help. The dial-three-digits concept first originated in the United Kingdom in 1937. It has spread to continents and countries across the globe. Today other easy dial codes including the 112 that was adopted by the European Union in 1991 and others like it have been deployed to provide free-of-charge calling to those who need help during emergencies. The Emergency telephone number article contains comprehensive information regarding other emergency dialing codes for countries outside North America. (Source:http://en.wikipedia.org/wiki/Enhanced_9-1-1)

In Lync 2010 Microsoft incorporated a location mechanism to provide location awareness for Llync clients and Lync client phones.

I not going going to blog about the complete E.911 implementation on Lync, because this has already been done numerous time on other blogs, and there is no point in reinvented hot water over and over again. The most complete article i have ever read on the subject, is an article from Mark King which you can find on following location: http://blog.unplugthepbx.com/2011/07/06/lync-e911-deployment/.
It gives a thorough understanding of what E.911 is in Lync and how to implement it.

What we will be focusing on is the policies that come with the E.911 implementation in Lync. One thing i do need to point out is that the Enhanced 911 implementation is only supported in North America. For the rest of the world you can configure it, but there are no agencies that verify the location, so all location are unverified.

Which brings us to custom, suggested and validated locations.

Custom:
Custom locations are when you allow the users to configure there own location in the client. This information is stored in the PersonalLisDB.cashe file, which is located in the user profile on the computer. When the computer recognizes the location of the user, it will reuse the information stored in the local LIS db. The location is recognized on the Mac address of the default gateway. The locale database can store up to 10 locations.

Suggested:
Suggested locations are locations that have been set by the Location Information Service database stored on the Lync Back-end server. This database is build up by the Lync administrators where he/she defines certain parameters required to build location awareness. These parameters are:

• Subnets
• Switches
• SwitchPorts
• Wireless access points

So to recap, a suggested location is a location that has been derived from the information stored in the central Location Information Service database stored on the Lync Back-end infrastructure, which has not been validated by an organization that validates and represents Master Street Address Guide.

Validated:
Validated locations are locations that have been derived from the location parameters stored in the LIS database on the Lync Back-end infrastructure. The location is verified and validated by MSAG, but as noted before is only supported in North America.

Note: Europe will probably be working on a similar solution for the near future.

Central Database:
The location information is stored in location database which is called LIS.mdf on the Lync back-end server.

Policy:
When we search for location in the Lync Management Shell, we get following result:
Get-command "*Location*"
CommandType     Name                            Definition
-----------     ----                            ----------
Cmdlet          Get-CsConfigurationStoreLoca... Get-CsConfigurationStoreLoca...
Cmdlet          Get-CsLisLocation               Get-CsLisLocation [-Unrefere...
Cmdlet          Get-CsLocationPolicy            Get-CsLocationPolicy [[-Iden...
Cmdlet          Get-Location                    Get-Location [-PSProvider Cmdlet          Grant-CsLocationPolicy          Grant-CsLocationPolicy [-Ide...
Cmdlet          New-CsLocationPolicy            New-CsLocationPolicy [-Ident...
Cmdlet          Pop-Location                    Pop-Location [-PassThru] [-S...
Cmdlet          Push-Location                   Push-Location [[-Path] Cmdlet          Remove-CsConfigurationStoreL... Remove-CsConfigurationStoreL...
Cmdlet          Remove-CsLisLocation            Remove-CsLisLocation -Locati...
Cmdlet          Remove-CsLocationPolicy         Remove-CsLocationPolicy [-Id...
Cmdlet          Set-CsConfigurationStoreLoca... Set-CsConfigurationStoreLoca...
Cmdlet          Set-CsLisLocation               Set-CsLisLocation -Location ...
Cmdlet          Set-CsLocationPolicy            Set-CsLocationPolicy [[-Iden...
Cmdlet          Set-Location                    Set-Location [[-Path] Cmdlet          Test-CsLocationPolicy           Test-CsLocationPolicy [-Targ...

We will not be explaining every setting, because we will have to write a short book, which information is already available on the Microsoft website. We will be focusing the Set-CSLocationPolicy and the Get-CSLoactionpolicy. There is no reason to explain both cmdlets as get-CsLocationPolicy gets the location policy and Set-CSLocationPolicy set the parameters for the location policy.

Get-CsLocationPolicy:
Gets all location policies, as you know Lync policies are in-band provisioned and can be applied to following scopes:

• Global
• Site
• Tag (User/Service/Pool)

We have a location policy which is called LocTest, which we will discuss here.

Identity [mandatory = Name of the location policy)                         : Tag:Loctest

Description (optional = description of the location policy)                     :

EnhancedEmergencyServicesEnabled (Mandatory = specifies whenever E911 is enabled)  : False
Only supported in North America.

LocationRequired (Mandatory = Specifies if location needs to be set)                 : no
Options are Yes, No and Disclaimer

• Yes: When LocationRequired is set to Yes, the set your location will turn up Red in the Lync client. Location is required but can be ignored.
• No: Location is not required. The user will not be prompted for a location, but can still be set if the user does so.
• Disclaimer: The user sees that the location is marked red, prompting the user to set a location, if the user removes the prompt without setting the location, the user will receive a disclaimer. The disclaimer has to be set using the Set-CsEnhancedEmergancyServiceDisclaimer.

UseLocationForE911Only (Mandatory =   Location information can be used by the Microsoft Lync 2010 client for various reasons (such as notifying teammates of current location). Set this value to True to ensure location information is available only for use with an emergency call.)         : False

PstnUsage (Optional =
The public switched telephone network (PSTN) usage that will be used to determine which voice route will be used to route 911 calls from clients using this profile.)   :


EmergencyDialString (Optional = The number that is dialed to reach emergency services. For example 911, 112, 100) :

EmergencyDialMask (Optional = The number entered here is translated to the value in EmergencyDialString. Example: if you enter 112 here and enter 100 in the EmergencyDialString, 112 will be translated to 100) :

NotificationUri (Optional: One or more SIP Uniform Resource Identifiers (URIs) to be notified when an emergency call is made. For example, the company security office could be notified through an instant message whenever an emergency call is made.) :

ConferenceUri (Optional: The SIP Uniform Resource Identifier (URI), in this case the telephone number, of a third party that will be conferenced in to any emergency calls that are made. For example, the company security office could receive a call when an emergency call is made and listen in or participate in that call (depending on the value of the ConferenceMode property). :

ConferenceMode (Optional:
If a value is specified for the ConferenceUri parameter, the ConferenceMode parameter determines whether a third party can participate in the call or can only listen in. Available values are:
- oneway: Third party can only listen to the conversation between the caller and the Public Safety Answering Point (PSAP) operator.
- twoway: Third party can listen in and participate in the call between the caller and the PSAP operator.) :

Remarks:
The location policy cannot be set or changed by the user if LIS information is provided by the location database. To retrieve the information that is used for LIS, use following CMDLet: Get-CsNetworkConfiguration.

Lync 2010 Policies and settings

It is pretty obvious that Lync is a very complicated product, that aligns with many features in a corporate network. For example, Lync integrates or provides telephone, provides numerous forms of collaboration and presence.
We are not going to talk about the various features in Lync, Which have been widely discussed on other blogs. But lets talk about the numerous policies and configurations that help you manage this product. We clearly put the focus on policies, and add the configuration as a bonus, as many settings link to configuration settings.

When talking about policies we have following policy scopes in mind:

1. Client Policies
2. Location Policies
3. Voice Policies
4. Conferencing Policies
5. Presence Policies
6. Archiving Policies
7. Pin Policies
8. External Access Policies
9. Hosted Voice Mail Policies
10. Client Version Policies

Each scope will be discussed as a separate article.

1. Client Policies

We start off by discussing client policies.
Client policies apply to the Lync client as the name suggests. But before starting to describe what can be applied using client policies, it is interesting to look at how policies are applied in Lync 2010.

When talking about client policies, we have to make an distinction between two types of policies. Namely the "Out-of-band provisioning" policies and the "In-band provisioning" policies.

1.1 Precedence
As we are talking about client settings, the settings can be applied at several levels. The settings can be done by tattooing the registry, group policies, Lync policies, or configuring the options by hand in the client. It is important to understand which setting takes precedence when being set.

The precedence is set from 1 to 4, in which 1 takes precedence over 2, 3, and 4.

1. HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Communicator 
2. HKEY_CURRENT_USER\Software\Policies\Microsoft\Communicator
3. Lync Server In-brand provisioning
4. Lync Option Dialog box

Note: Another important thing to say is that lync allows policies to be set at certain levels, an example of this is the client policy and the voice policy. The voice policy will overrule the client policy if the user is voice enabled. An example is delegations in outlook when scheduling an on-line meeting. If you want your users to be able to schedule a online meeting you have to set the client policy to EnableExchangeDelegateSync to true. However if the user who has delegated his calendar is voice enabled, we have to make sure that "DelegationEnabled" is set to true in the voice policy for that user. If the voice policy for that user still states "DelegationEnabled: False", delegates will be unable to schedule an online meeting for the voice enabled user.


1.2  "Out-of-band provisioning" policies
"Out-of-band provisioning" or group policies have been replaced by "In-Band provisioning" policies. Out-of-band provisioning" policies are applied using group policy, and therefore have the limitation that come with group policies. "In-Band provisioning" do not use group policies and therefore do not have the limitations of group policies. Does this mean that group policies are gone? No, they are not, Goup Policies can still be used, and are applied to the client before the client logs on the Lync infrastructure.

These policies are available as a ADM file which is part of the Lync 2010 client download from the partner website. This communicator.adm file can be imported in any group policy template and applied to a computer, set of computers, user or off course a set of users.

The communicator.adm file contains 15 policy settings:

1. Specify Transport and server: Allows you to specify the name of your front-end and edge server. This way you do not need to provide the DNS names required for client Autodiscovery on the WAN or LAN.
2. Enable Strict DNS naming for server name: When not set, or disabled the client will connect to the SIP server that has the domain name of the SIP address. Meaning that if your SIP address is sip:Me@example.com, the sip server should be sip.example.com. If you enable this setting, the client will communicate with whatever server that has the SIP domain configured. In case the policy is enabled the client could communicate with a server called whatever.example.com, in which you would allow a potential risk for spoofers to mimic the sip server. Does only apply when TLS is used (default).
3. Configure SIP security mode: If you enable this policy the client requires TLS to be used, in which the client will not fall back to TCP in case TLS cannot be used. This setting if enabled also requires the client to authenticate using Kerberos or NTLM. If this setting is enabled all communications must run through the SIP server, in which peer 2 peer communications are disabled.
4. Configure SIP compression mode: whether or not to use SIP compression. By default the network adapter speed specifies whether compression is or is not used. Enabling this setting could increase logon time.  
5. Prevent users from running Microsoft Lync: States whether or not the lync client can be used by that particular user or machine.
6. Allow storage of user password: If you enable this policy setting, Microsoft Lync can store a password on request from the user. If you disable this policy setting, Microsoft Lync cannot store a password. If you do not configure this policy setting and the user logs on to a domain, Microsoft Lync does not store the password. If you do not configure this policy setting and the user does not log on to a domain (for example, if the user logs on to a workgroup), Microsoft Lync can store the password.
7. Require logon credentials: Requires the user to provide logon credentials for Microsoft Lync rather than automatically using the Windows credentials when Microsoft Lync authenticates the user using NTLM or Kerberos. If you enable this policy setting, Microsoft Lync requires the user to provide logon credentials. If you disable or do not configure this policy setting, Microsoft Lync authenticates the user based on the logon credentials for Windows.
8. Disable HTTP fallback for SIP connection: Prevents from HTTP being used for SIP connection in case TLS or TCP fail.
9. Disable version Server check: Prevents Microsoft Lync from checking the server version before signing in.
10. Additional Server version support: Specify a semicolon separated list of server version names,
    e.g. RTC/2.8;RTC/2.9, to which Microsoft Lync allows logon in addition to the server versions that are supported by default. Space character is treated as part of the version string.
11. Enable using BITS to download address book service files: This policy allows Microsoft Lync to use BITS (Background Intelligent Transfer Service) to download the Address Book Services files.
12. Use compact DELTA file for GAL: This policy allows Microsoft Lync to use compact delta file for GAL.
13. Help menu: This policy is used to extend the Help Menu in Microsoft Lync. An administrator can specify a help web site for Microsoft Lync using these keys. Help Menu Text is a string value that specifies the text to display to the user in the Help Menu for the help web site. Help Menu URL is a string value that specifies which web site to open when the user selects the Help Menu Text item in the Help Menu. Note that both Help Menu Text and Help Menu URL need to be specified in order for the Help Menu item to appear in Microsoft Lync.
14. Launch Microsoft Link First Run: This policy defines the behavior of the Microsoft Lync First Run. Whether it's enabled or not, whether it should be launched automatically or not.
15. Turn on tracing for Lync: Turn on tracing for Lync, primarily for use to assist customer problem solving. If this policy is not configured, then the user can specify the choice in Lync options. Otherwise, the corresponding behavior is enforced and the user has no choice.

Note: policy 1, 2, 3, 5, 6, and 7 can be configured on both the user as the computer level of the policy. Yet the computer policy takes precedence over the user policy. All other policies only apply on the computer level of the policy.

Now explaining how group policies work and how they are applied is really not the scope of this article. Yet i do want to point out why group policies have a certain disadvantage, and why Microsoft moved away from group policies and implemented the new way of assigning policies (in-band provisioning). Group policies are typically applied at logon, and are refreshed every 90 to 120 minutes by default (90+ random offset of 30 minutes). So when applying new settings this setting are not automatically applied, unless the policies are refreshed manually on the client. A second disadvantage is that you are not really sure that the policies set are actually applied. It could be that a corporate user who logs on to the network using VPN, does not get his/her policies applied, due to slow link detection. Or that the remote user logs on to the network using a computer that has not been subjected to group policies (home computer, none Windows system). 

1.3 In-band provisioning
Microsoft acknowledged the problem with group policies, and developed a new way of assigning policies in Lync 2010. The new way is known as in-band provisioning. The policies are applied through Lync itself and the policies are stored in the Lync CMS store and replicated to the local copy of the database.

The policies are applied as soon as replication has been done, and the policy is assigned to a certain level. The levels to which a policy can be applied is Global, Site, and Tag.

1. Global: The global Lync infrastructure, in this case every lync client.
2. Site: A Lync site, every client within a Lync site. The Lync organization can have multiple Lync Sites. 
3. Tag: the tag can be a user, group or service.

The client policy can only be set by using the Lync Management Shell and not by the Lync Control Panel. Most of the settings that determine Microsoft Lync 2010 features and functionality are configurable through Microsoft Lync Server 2010 Control Panel. However, there are several essential policies and settings that significantly impact client functionality and that can be configured only by using Group Policy or Lync Server Management Shell.

The following CMDlets are used to manage the client policies:

• Get-CsClientPolicy: Get the client policies which are configured, if you do not specify a name all client policies are returned.
• Grant-CsClientPolicy: Assigns the policy to a level (Global, Site, Tag). If you do not specify an identity the client policy is applied Global.
• New-CsClientPolicy: Creates a new client policy. Among other things, client policies help determine the features of Microsoft Lync 2010 that are made available to users; for example, you might give some users the right to transfer files while denying this right to other users.
• Remove-CsClientPolicy: Removes an existing client policy. Among other things, client policies help determine the features of Microsoft Lync 2010 that are available to users; for example, you might give some users the right to transfer files while denying this right to other users.
• Set-CsClientPolicy: Modifies the property values of an existing client policy. Among other things, client policies help determine the features of Microsoft Lync 2010 that are available to users; for example, you might give some users the right to transfer files while denying this right to other users.
• New-CsClientPolicyEntry: Allows you to assign new options to the client policy.

Information on the settings and applying the policy can be found here: http://technet.microsoft.com/en-us/library/gg398300.aspx