Mino – The UC Guy

Microsoft Unified Communications Blog

Archive for the ‘OCS 2007 R2’ Category

OCS 2007 R2 Traffic Flow of protocols and ports used in each workload

Posted by Mino on January 27, 2010

You know that song saying “At last, my love has come along, My lonely days are over, And life is like a song, Ohhh at last” !!!

This is exactly how I felt when I saw the announcement today of Microsoft for the availability of the OCS traffic flow , Finally something official and no more rumors or some individual efforts .

You can Find it here

“This poster of Office Communications Server 2007 R2 describes the traffic flow of protocols and ports used in each workload. Communications Server 2007 R2 supports the following workloads: IM and Presence, Conferencing, Application Sharing, and Enterprise Voice. These filtered views can assist you in architecting your deployment of Communications Server 2007 R2. The different server roles are described along with server certificate requirements. Firewall and DNS configuration requirements are also described.”

Advertisements

Posted in A/V Edge Server, Consolidated Edge, Edge Server, OCS 2007 R2 | Tagged: , , , , , , , , , | 3 Comments »

OCS Response Group Service failed to start with Error event ID 31193

Posted by Mino on October 14, 2009

We have OCS 2007 R2 Pool with 2 front end servers enterprise edition, let us say that the FQDN of the servers are OCSFE01.contoso.com, OCSFE02.contoso.com and the Pool name is OCSPOOL.contoso.com.

I created the certificate request for the front end servers using the OCS wizard where I added the Pool name in the CN and in the SAN also , then I clicked the check box of add local machine name to the SAN certificate.

Then I try to enable the OCS Services and I found that the OCS Response Group Service failed to start with the below error:

Log Name:      Office Communications Server
Source:        OCS Response Group Service
Event ID:      31193
Task Category: (2001)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      OCSFE01.contoso.com
Description:
The provided certificate is not valid.

There was a problem validating certificate: Identity check failed for outgoing message. The expected DNS identity of the remote endpoint was ‘OCSPOOL.contoso.com’ but the remote endpoint provided DNS claim ‘OCSFE01.contoso.com’. If this is a legitimate remote endpoint, you can fix the problem by explicitly specifying DNS identity ‘OCSFE01.contoso.com’ as the Identity property of EndpointAddress when creating channel proxy.

 

How to Resolve:

The problem is in SAN certificate for the frontend servers you need to make sure that the last DNS entry in the SAN list matches the certificate subject name, which should be your pool name.

And since I clicked the checkbox of add local machine name to the SAN , so it added the FQDN of the machine as the last entry in the SAN and this was the problem.

So make sure that the CN should be the pool name ocspool.contoso.com and the last name in the SAN should also be pool name ocspool.contoso.com

 

Update : this is a known issue that  has been fixed with Hotfix in KB 969695

Posted in Certificates, Common Errors, Front End Server, OCS 2007 R2 | Tagged: , , , , , , | Leave a Comment »

PreCallDiagnostic Tool

Posted by Mino on September 21, 2009

The PreCallDiagTool is an application that reports expected audio quality as it relates to the network effect. The tool should be installed on any desktop or laptop PC that suffers from inconsistent network connection quality. The PreCallDiagTool can provide a quick check of the current network conditions and also preserve a history of quality data to let users profile their network performance over time or other conditions. The tool is particularly useful for home/mobile users and users using WIFI access points.

The tool is available for download here: http://www.microsoft.com/downloads/details.aspx?FamilyID=f16ab4c2-353f-4c9b-b353-22a656c03c9b

Monitor

Posted in communicator client, Mediation Server, Miscellaneous, OCS 2007 R2, OCS Tools Kit, Phone Edition | Tagged: , , , , , , | Leave a Comment »

No Name Appears When Callings from OC to Cisco or vice versa

Posted by Mino on August 10, 2009

One of the frustrating drawbacks when Implementing OCS enterprise voice integrating with Cisco Call Manager or other PBX is that No name would appear in Communicator 2007 when a telephone user calls a Communications Server 2007 user or vice versa .

The only solution by then was to place a media gateway in the middle between mediation and IP-PBX and use a translation feature built in the media gateway to edit the packet header and add Caller Name before sending it to the PBX.

But Finally Microsoft has listened to my prayers and they have released July fix for OCS 2007 R2, once they were released our team started to do the testing in our LABs. At the beginning things didn’t work fine but in the end it worked and it appeared that we only applied the server side updates while the KB 971844 includes Office Communicator update too.

However, even with these fixes, this don’t send display name by default. So, this configuration in KB 972721 will be also necessary. Below are the snapshots taken by our Engineer Amr Nassar who has worked on this and successfully made it work after applying those Fixes.

Calling from Office Communicator R2 with ext 6000 to Cisco IP Phone with ext 10000

From OCS

Calling from  Cisco IP Phone with ext 10000 to Office Communicator R2 with ext 6000 

From Cisco

But let me also share Microsoft explanation on why this problem happens in the first place and what these updates fix?

Problem Explanation:

When a Private Branch Exchange (PBX) telephone user calls a Microsoft Office Communications Server (OCS) 2007 R2 user, the calling party name that exists in PBX is stripped at the OCS 2007 R2 Mediation Server. Because the PBX telephone user does not exist in Active Directory, no name appears in Microsoft Office Communicator 2007 R2

This problem occurs because the OCS 2007 R2 Mediation Server does not forward the display name information from the Unified Communications (UC) side to the gateway side. Therefore, the Communicator 2007 R2 client does not receive the display name information.

Update 970679 introduces functionality for the Mediation Server role of Communications Server 2007 R2 to forward Display Name information that is part of the From header between its gateway side and its proxy side.

A file called MediationServerSvc.exe.config should be created in the Mediation Installation Directory which be default is at  %programfiles%\Microsoft Office Communications Server 2007\Mediation Server

This file should contain.

<?xml version=”1.0″ encoding=”utf-8″ ?>
<configuration>
                 <appSettings>
                                <add key=”forwardDisplayName” value=”True” />
                 </appSettings>
</configuration>

Posted in AVAYA, Cisco 4.x Integration, Cisco 5.x Integration, Cisco 6.x Integration, Cisco 7.x Integration, communicator client, Mediation Server, Nortel CS1000, OCS 2007 R2, PBX Integration, Phone Edition, Quintum's gateways | Tagged: , , , , , , , , , , , , , , | 3 Comments »

New Microsoft Office Communicator Mobile 2007 R2 Update

Posted by Mino on August 5, 2009

The Windows Mobile version of Office Communicator 2007 R2 has just been updated. Communicator Mobile is strongly positioned as a desktop replacement application allowing OCS-enabled users to receive and place work calls over a mobile phone, exchange instant messages, and keep their presence indicators up-to-date while on the road.

This new version is available now and will be also compatible with the soon-to-be-released Windows Mobile 6.5, offering even richer integration to its users.

includes additions such as the Join Conference feature, where instead of dialing in and entering complicated conference entry codes, users can now join a meeting with the click of a button. This capability is available for all types of meetings that are scheduled using the new UC Conferencing capability in Microsoft Office Communications Server 2007 R2.

 What’s new?

Communicator Mobile 2007 R2 update is far more than a standard QFE, with several new key features:

  • Click-to-join conferences!  No more pesky dial-in numbers or passcodes to remember!
  • A better Call via Work experience, where callbacks are automatically accepted.  Just click Call via Work, and place the phone to your ear.  After a quick call setup, you’ll be connected!
  • Support for new Windows Mobile Homescreens, on Windows Mobile 6.5 and higher devices.
  • The ability to call any number via Work, on Windows Mobile 6.5 and higher devices.  This means that you can even dial extensions from your mobile phone!
  • Detection for when the phone is roaming:  by default, Communicator does not sign in to roaming networks.

For more information about Communicator Mobile 2007 R2, visit the Microsoft Download website, or point your mobile browser to www.GetComo.com to download and install it.

Posted in communicator client, Communicator Mobile, OCS 2007 R2 | Tagged: , , , | Leave a Comment »

Single certificate for OCS/Exchange/ISA usage

Posted by Mino on July 7, 2009

Any Post starting with this disclaimer means that this post was not written by me however I have liked it and added to my blog. I am also including the link to the original or similar post to provide credit to the original author.

http://www.unifysquare.com/blog/post/Single-certificate-for-OCSExchange-firewall-usage.aspx

Internal certificates work wonders for your Active Directory Domain Services members. For Unified Communications, where OCS and Exchange are going to be using the same ISA 2006 server as the firewall, utilizing a Subject Alternative Name (SAN) certificate for your edge configuration and your ISA configuration can save you time, management hassles, and possibly provide cost savings as well. For internal servers, an internal PKI is just fine, but for the public interface of your system, you should most likely be looking at using a public-sourced key such as Go-Daddy, Thawte, DigiCert, etc. OCS Federation, remote users, and Public Instant Messaging Connectivity (PIC) demand public certificates.

The following table shows the SAN names needed on a certificate to support the base OCS and Exchange functions on ISA 2006 – and I imagine that this certificate construction will work just fine on many other firewalls as well. The table comes from my test domain; you should replace my test domain with your own domain name.

Obtain a public SAN (UCC) certificate from your favorite provider, import the certificate into your OCS Edge server and your ISA server computer account Trusted Root Certificate store and then you can use one certificate for all these uses. This approach leaves you with only the one certificate to manage and renew, or, if life treats you badly, move to a new server.

 

 

SAN Name

Usage

Notes

1

SIP.domain.com

OCS Edge Server

IM, Presence, Federation, PIC

2

webconf.domain.com

OCS Edge Server

Web Conferencing

3

AV.domain.com

OCS Edge Server

A/V

4

revproxy.domain.com

ISA Reverse Proxy

Web Components

5

CWA.domain.com

ISA Web Listener

Communicator Web Access

6

DOWNLOAD.CWA.domain.com

ISA Web Listener

CNAME for CWA desktop sharing

7

AS.CWA.domain.com

ISA Web Listener

CNAME for CWA desktop sharing

8

MAIL.domain.com

ISA publisher

Outlook Anywhere, OWA, POP, IMAP

9

AUTODISCOVER.domain.com

ISA Web Listener

Autodiscover for outlook and OCS.

Posted in A/V Edge Server, Certificates, Communicator Web Access, Consolidated Edge, Edge Server, Good Articles take from Other Blogs, OCS & Exchange07, OCS 2007 R2 | Tagged: , , , , , , , , , , , , , , , , , , | 10 Comments »

Address Book Download Issue (Vista Only)

Posted by Mino on July 6, 2009

This is a case I have faced right after the MVP award thing; it proves one thing to me.  You will always learn till the last minute of your life whether you are a Ranger or MVP or even one of the product team themselves. 

Ok here is the case; I have a Pilot on Isolated Environment where I have deployed 3 machines (AD+ CA+ Exchange, OCS Front End, OCS Mediation) And the users are on another production environment and they are planning to test the OC locally from their computers joined to the Production domain not the pilot one.

I have everything configured fine, hosts file edited correctly, Certificate Chain imported and Communicator is able to login correctly with no Problem. All of a Sudden all Vista machines are not able to download address book or to retrieve outlook free /busy information. However XP machines are working smoothly with no Problem

OK….then we think logic , what is common between Address Book and Exchange Free/ Busy?  Both are Web Services retrieved through HTTPS, so it has to be IE problem.

After some Googleing I found the solution on the UC No Evil blog as he describes details of troubleshooting steps he did and in the end it appeared to be the IE setting of Check for sever certificate revocation along with Disabling Windows Vista User Access Control

Below Are the Detailed Steps as described on the Blog:

  1. Make sure this symptom is the same on all of your Vista clients.
  2. Flush DNS by using ipconfig /flushdns on the client.
  3. Verify within IE that ‘Check for server certificate revocation* is disabled.  To do this go to IE > Advanced > Security section > Check for sever certificate revocation*.   Deselect the check box.
  4. Now  close Internet Explorer, close Communicator (Completely — sign-out and close application)
  5. Start Communicator| Sign in
  6. If you’re not presented with an error or the warning stating an issue accessing the Address Book, go to the %userprofile%\Local Settings\Application data\Microsoft\Communicator and verify that a GalContacts.db file exists.  If it does exist, GREAT! You’re done.   If not then continue with the rest of the procedure.
  7. Within IE add the Address Book URL that users will download the AB files.  IE > Internet Options > Security > Trusted Sites > Add the URL to trusted sites (ex.  https://ocsfrontend.company.com)
  8. Repeat steps 4-6
  9. If you still cannot download the address book try, move to step 10.
  10. Verify that User Access Control is off and then repeat steps 4-6.

Also some good technical details for the issue are available here on Microsoft Forums

Posted in Certificates, Common Errors, communicator client, Front End Server, Good Articles take from Other Blogs, Miscellaneous, OCS 2007 R2 | Tagged: , , , , , , , , , , , | 8 Comments »

How to get save password option for Office Communicator users

Posted by Mino on May 24, 2009

Open Registry editor and locate the following key:

HKLM/Software/Policies/Microsoft/Communicator,  and set SavePassword=1.  

This enables a checkbox to save password in MOC login dialogue.

After the password is entered it is saved into the registry

HKCU/Software/Microsoft/Communicator/AccountPassword

This registry key store in hashed value. Changing the hash requires re-entering the password.

Note: You may want to use this option if MOC users login from workgroup machine, or Kerberos authentication is not working

Source :http://www.ocspedia.com/FE/How_to_Save_Password_MOC.htm

Posted in communicator client, OCS 2007 R2, Uncategorized | Tagged: , , , , , | 3 Comments »

How to Fix Exchange UM Certificate errors when Integrating with OCS 2007

Posted by Mino on May 19, 2009

Typically When Exchange 2007 is installed, it generates a self-issued certificate for use with IIS, SMTP, and SIP (if you’re using UM).  This certificate generally isn’t ideal for Outlook and OWA clients because it’s not trusted by any machines except for the Exchange server, and one of the first tasks to do is replace this certificate with one that is trusted by the user’s machines.

So typically you would request to buy a Public certificate for the Exchange and usually people don’t include the internal FQDN of the servers in this request.

On the Other Hand when you deploy the OCS 2007 you will require Certificate for each OCS server and this is required for securing the communication internally between OCS to OCS servers and OCS to Client. So you will deploy internal Enterprise CA in your domain to issue the certificates for the OCS , and since this is Enterprise CA so it will be published in the Active directory and it will be trusted by default for all internal domain user computers.

However when you try to integrate the OCS 2007 with the Exchange UM by this design , the first thing you will notice that the Voice mail is not accessible from the Communicator client  and it is giving you communicator error whenever you click on voice mail ,and you will find lots of Certificate event logs and OCS Protocol stack errors on both OCS front end and Exchange UM Server.

The reason behind that is because the Exchange UM server is still using the Exchange Self Signed certificate for its internal name and it is trying to communicate with the OCS using this certificate , and since the OCS doesn’t know anything about this issuer so it drops the connection.

To solve this problem we will have to replace the Exchange UM self signed certificate with one from the same CA that the OCS 2007 is using. To accomplish this task simply run the below command on the Exchange command shell.

New-ExchangeCertificate -GenerateRequest -Path c:\UMrequest.req -SubjectName “c=US, o=Contoso, cn=umsrv.mydomain.local” -DomainName mydomain.local  -PrivateKeyExportable $true

This will generate a request on the C: drive under the name of UMrequest.req  for the UM server internal FQDN umsrv.mydomain.local , open it with notepad and copy the content and then go to the PKI auto enrolment page https:\\pkisrv.mydomain.local\certsrv   to issue the certificate and save it locally .

Then we need to import the certificate to exchange and Enable it for UM service usage , my certificate is saved on the C: drive with the name of UMCertificate.cer

Import-ExchangeCertificate -Path c:\UMCertificate.cer

The last thing we will do is to enable this certificate for UM usage, first make sure to copy the Thumbprint of the certificate that you will see in the command shell then run the below command .

Enable-ExchangeCertificate -Thumbprint 5113ae0233a72fccb75b1d0198628675333d010e –Services UM

Restart UM service and restart OCS Front End Server and now you will get the UM working fine with the OCS and you will no longer see the protocol stack errors.

Posted in Certificates, Common Errors, communicator client, Front End Server, Mediation Server, OCS & Exchange07, OCS 2007 R2, Phone Edition, Unified Messaging | Tagged: , , , , , , , , , , | 3 Comments »

OCS 2007 R2 Server Loses network connection on Server Startup

Posted by Mino on May 13, 2009

As strange as this might sound to you but this is the latest case I have faced which in the end appeared to be a known bug and Microsoft Premiere Support were able to solve it after 3 weeks of investigation

Setup

So you have OCS 2007 R2 implemented over Windows 2008 and the Backend is placed on SQL 2008 on windows 2008 server. The below roles are all implemented on windows 2008:

  • Front End 1
  • Front End 2
  • Mediation
  • Consolidated Edge not joined to the domain

Problem:

When you restart any OCS server you cannot remote access to that server again, the Ping over the server is lost and when you go and check the server you find the network is disconnected.

If you went through all of the OCS Server services you will find them all are in the mood of starting and it will take it like 10 minutes then it will fail to start .

If you set these OCS Services to manual start rather than Automatic then reboot. You will find that the server is functioning normally.

This is really a very strange problem and I never faced it before as I have already implemented the OCS on 2008 but I still up to this moment don’t know the symptoms that causes this problem to happen.

Solution:

– Set startup type for wmiApSrv to automatic

– Add dependency on RtcSrv to wmiApSrv

– Set startup type for RtcSrv to automatic

– Reboot

– RtcSrv is starting and running

– Set startup type for all Rtc* services to automatic

– Reboot

– All Rtc* services starting and running

 

To set the RTCSrv service dependency you can use the registry to modify the following:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RtcSrv and modify the DependOnService to include the wmiApSrv.

Posted in Consolidated Edge, Edge Server, Front End Server, Miscellaneous, OCS 2007 Components, OCS 2007 R2, Uncategorized | Tagged: , , , , , | 8 Comments »