Lync Server 2013 Deployment – Part 2

Home » Lync 2010/2013 DNS » Lync Server 2013 Deployment – Part 2
Lync 2010/2013 DNS, Lync 2013 Nenhum Comentário

Continuing from Part 1 of the series this article covers the installation and configuration of the Lync Server components on a Standard Edition Front End server.  As with the previous article any mandatory steps are identified by bulleted paragraphs while additional steps for validation and knowledge transfer are optional.

Install Lync Server System

The next step is to install a second SQL Express named instance called RTCLOCAL on the local server which will contain a replica of the existing RTC named instance.

Only the first Standard Edition server in the organization would contain the authoritative RTC instance installed in the previous article, while all other Lync Front End Servers (and even Edge Servers) would contain their own RTCLOCAL instance to replicate the Central Management Store data.  This approach also allows for redundancy and availability features which were lacking in previous versions of OCS.  This RTCLOCAL instance can only ever be stored in an automatically installed SQL Express instance, it is not supported to locate this data in a full SQL Server instance on a Standard Edition server installation.

As the Administrative Tools have already been installed on the server then the Lync Server 2013 Deployment Wizard can be found in the Start Menu on the local server.  The Lync Server installation media is no longer required as the installation files have been copied to the server in the following default directory.

%ProgramFiles%\Microsoft Lync Server 2013\Deployment

image

  • On the Windows Start Menu search for ‘Deploy’ to locate and launch the Lync Server 2013 Deployment Wizard.  From the main menu select Install or Update Lync Server System.
  • On Step 1: Install Local Configuration Store select Run and leave the default setting of Retrieve the configuration data directly from the Central Management Store and complete the wizard.

image

Reviewing the results in the execution window should confirm that the second SQL Express instance of RtcLocal was installed as well as the core Lync Server components.

Checking prerequisite PowerShell…prerequisite satisfied.
Checking prerequisite WindowsIdentityFoundation…prerequisite satisfied.
Checking prerequisite SqlInstanceRtcLocalinstalling…success
Checking prerequisite VCredist…prerequisite satisfied.
Checking prerequisite SqlNativeClient…prerequisite satisfied.
Checking prerequisite SqlClrTypes…prerequisite satisfied.
Checking prerequisite SqlSharedManagementObjects…prerequisite satisfied.
Checking prerequisite UcmaRedist…prerequisite satisfied.
Installing OcsCore.msi(Feature_LocalMgmtStore)…success

Secondly the Local CMS replica was instantiated by importing the configuration from the existing CMS database an then replicating the database data itself.

Import-CsConfiguration -FileName “C:\Users\ADMINI~1.SCH\AppData\Local\Temp\2\CSConfigData-2013_03_16-08_10_01.zip” -Verbose -LocalStore

> Enable local replica service

Enable-CSReplica -Verbose -Confirm:$false -Report “C:\Users\administrator.SCHERTZ\AppData\Local\Temp\2\Enable-CSReplica-[2013_03_16][08_08_59].html”

An additional step is performed here which is new to Lync 2013: the automatic replication of certificates to the CMS.  Although no certificates have been installed yet for this deployment had there been one then this action would have replicated any existing OAuthcertificates required for server to server MTLS communications in Lync Server 2013.

> Replicate-CsCmsCertificates

Logging status to: C:\Users\administrator.SCHERTZ\AppData\Local\Temp\2\ReplicateCMSCertificates-[2013_03_16][08_08_59].html

To confirm the installation location of the RTCLOCAL database files on the server check the default SQL Server installation directory for the existence of the xds files.

%ProgramFiles%\Microsoft SQL Server\MSSQL11.RTCLOCAL\MSSQL\DATA

image

  • On the Lync Server 2013 Deployment Wizard advance to Step 2: Setup or Remove Lync Server Components and click Run to start the Set Up Lync server Components wizard.

Once again the Bootstrapper application will execute and perform a prerequisite check before installing additional components.  These include a third SQL instance called LyncLocal and additional Windows Speech components and foreign language packs.

Checking prerequisite SqlSharedManagementObjects…prerequisite satisfied.
Checking prerequisite UcmaRedist…prerequisite satisfied.
Checking prerequisite WinFab…installing…success
Checking prerequisite MicrosoftIdentityExtensions…installing…success
Checking prerequisite SqlInstanceLyncLocalinstalling…success
Checking prerequisite SqlInstanceRtc…prerequisite satisfied.
Checking prerequisite RewriteModule…installing…success
Checking prerequisite SpeechPlatformRuntime…installing…success
Checking prerequisite MSSpeech_TTS_ca-ES_Herena…installing…success
Checking prerequisite MSSpeech_TTS_da-DK_Helle…installing…success

Immediately following will be the installation of the Lync server components which make up the different services and roles on the Front End server (e.g. AVMCU, Mediation Server).

Installing OcsMcu.msi(OcsMCUCommon, ASMCU, AVMCU, IMMCU)…success
Installing AppServer.msi(Feature_AppServer)…success
Installing Ats.msi(Feature_Ats)…success
Installing CPS.msi(Feature_CPS)…success
Installing DataMcu.msi(Feature_DataMCU)…success

During the WebComponents installation a number of features will be installed which are the different virtual web directories and application pools in IIS.

Installing WebComponents.msi(Feature_Web_Common, Feature_Web_External, Feature_Web_GroupExpansion_Ext, Feature_Web_HybridConfig_Ext, Feature_Web_Internal, Feature_Web_JoinLauncher_Ext, Feature_Web_JoinLauncher_Int, Feature_Web_LocationInfo_Int, Feature_Web_Lwa_Ext, Feature_Web_Lwa_Int, Feature_Web_Mcx_Ext, Feature_Web_Mcx_Int,

To confirm the installation and configuration of the various web services launch Internet Information Services Manager (inetmgr.exe) and browse to the Sites folder to see the status of the two new web sites.

image

Then select the Application Pools object to view the various Lync web services which were installed for both the internal and external web sites.

image

Also check the installed services by running the Services control panel applet (services.msc).  They will not yet be running as server certificates must be imported first, which is the next step in the deployment.

image

To review exactly what SQL instances were installed and their roles the Microsoft SQL Server Management Studio (if installed as covered in the previous article) can be used to view each instance and database.

image

Instance Database Description
RTC lis Location Information Services data
RTC xds Central Management Store data
RTCLOCAL rtc Standard Edition Pool data
RTCLOCAL rtcdyn Standard Edition transient user data
RTCLOCAL xds Local replica of Central Management Store data
LYNCLOCAL lyss Lync Storage Service data

Returning to the server deployment process the next step is to request and assign server certificates so that the Lync services can be started.

  • Run Step 3: Request, Install or Assign Certificates and then expand the Default Certificate entry to verify that all roles are checked.  Click Request to start the Certificate Request wizard and enter the information listed in the following tables.

Delayed or Immediate Requests

  • Send the request immediately to an online certificate authority

Choose a certificate Authority

  • Select from a list detected in your environment
    (DC.schertz.name\schertz-RootCA)

Certificate Authority Account

Skipped as the current Administrator account has sufficient permissions to perform this action.


Specify Alternate Certificate Template

Skipped as the Windows CA certificate template of ‘Web Server’ will be used by default.


Name and Security Settings

Friendly Name Lync Front End Cert
Bit Length 2048
  •  ”Mark the certificate’s private key as exportable”

Organization Information

Organization Schertz Lab
Organizational Unit Home

Geographical Information

Country/Region United States
State/Province Illinois
City/Locality Chicago

Subject Name / Subject Alternate Names

The following names will be automatically populated for the subject name and subject alternative name.

Subject Name lync.schertz.name
Subject Alternative Name lync.schertz.name
dialin.mslync.net
meet.mslync.net
admin.mslync.net
Lyncdiscoverinternal.mslync.net
Lyncdiscover.mslync.net

SIP Domain setting on Subject Alternate Names (SANs)

Configured SIP Domains mslync.net

Configure Additional Subject Alternate Names

Skipped as no additional SIP domains are configured in the topology so there are none to add to the certificate request.

Completing the process will execute the Request-CsCertificate cmdlet with the provided configuration information, performing an online certificate request against the CA and then automatically importing the issued certificate into the Local Computer store.  (The following results were snipped down to just the important items.)

> Request Certificate

Request-CSCertificate -New -Type Default,WebServicesInternal,WebServicesExternal -CA “DC.schertz.name\schertz-RootCA” -Country US -State “Illinois” -City “Chicago” -FriendlyName “Lync Front End Cert” -KeySize 2048 -PrivateKeyExportable $True -Organization “Schertz Lab” -OU “Home” -DomainName “sip.mslync.net” -AllSipDomain -Verbose -Report

Create a certificate request based on Lync Server configuration for this computer.
Issued thumbprint “C6D87D6224A91E103734C582034E7FBE22F46A4A” for use “Default,WebServicesInternal,WebServicesExternal” by “DC.schertz.name\schertz-RootCA”.
No changes were made to the Central Management Store.

“Request-CSCertificate” processing has completed successfully.

  • In the next window verify that Assign this certificate to Lync Server certificate usages is selected and then click Finish  to launch theCertificate Assignment wizard next.
  • Complete the wizard which automatically runs the Set-CsCertificate cmdlet to assign the desired certificate to the three server usages.

> Assign Certificate

Set-CSCertificate -Type Default,WebServicesInternal,WebServicesExternal -Thumbprint C6D87D6224A91E103734C582034E7FBE22F46A4A -Confirm:$false -Report

The following certificate was assigned for the type “Default“:
Default: C6D87D6224A91E103734C582034E7FBE22F46A4A lync.schertz.name 03/16/2015 CN=schertz-RootCA, DC=schertz, DC=name 5A0000000313D2DB08C6C90DCE000000000003

The following certificate was assigned for the type “WebServicesInternal“:
WebServicesInternal: C6D87D6224A91E103734C582034E7FBE22F46A4A lync.schertz.name 03/16/2015 CN=schertz-RootCA, DC=schertz, DC=name 5A0000000313D2DB08C6C90DCE000000000003

The following certificate was assigned for the type “WebServicesExternal“:
WebServicesExternal: C6D87D6224A91E103734C582034E7FBE22F46A4A lync.schertz.name 03/16/2015 CN=schertz-RootCA, DC=schertz, DC=name 5A0000000313D2DB08C6C90DCE000000000003

At this point the main Certificate Wizard window should reflect the new status by adding a green check mark to the Default certificate and its usages.

image

Since this is the first Lync 2013 server in the topology then an additional shared certificate needs to be created for use with a new open authentication standard called OAuth.  This certificate will be used for server-to-server communications between Lync 2013 servers in addition to other 2013 products which support OAuth like Exchange Server and Office Web Apps Server.

  • On the main Certificate Wizard window expand and highlight the OAuthTokenIssuer entry and click Request to start the Certificate Request wizard and enter the information listed in the following tables.

Delayed or Immediate Requests

  • Send the request immediately to an online certificate authority

Choose a certificate Authority

  • Select from a list detected in your environment
    (DC.schertz.name\schertz-RootCA)

Certificate Authority Account

Skipped as the current Administrator account has sufficient permissions to perform this action.


Specify Alternate Certificate Template

Skipped as the Windows CA certificate template of ‘Web Server’ will be used by default.


Name and Security Settings

Friendly Name Lync OAuth Cert
Bit Length 2048

Organization Information

Organization Schertz Lab
Organizational Unit Home

Geographical Information

Country/Region United States
State/Province Illinois
City/Locality Chicago

Subject Name / Subject Alternate Names

The following names will be automatically populated for the subject name and subject alternative name.

Subject Name lync.schertz.name
Subject Alternative Name <blank>

Configure Additional Subject Alternate Names

Skipped as no additional SIP domains are configured in the topology so there are none to add to the certificate request.

Completing the process will execute the Request-CsCertificate cmdlet with the provided configuration information, performing an online certificate request against the CA and then automatically importing the issued certificate into the Local Computer store.  (The following results were snipped down to just the important items.)

> Request Certificate

Request-CSCertificate -New -Type OAuthTokenIssuer -CA “DC.schertz.name\schertz-RootCA” -Country US -State “Illinois” -City “Chicago” -FriendlyName “Lync OAuth Cert” -KeySize 2048 -PrivateKeyExportable $True -Organization “Schertz Lab” -OU “Home” -AllSipDomain -Verbose -Report

Create a certificate request based on Lync Server configuration for this computer.
Issued thumbprint “2A55DA39DD43DAEB2AC2510AFB61EE21103ADCDB” for use “OAuthTokenIssuer” by “DC.schertz.name\schertz-RootCA”.
No changes were made to the Central Management Store.

“Request-CSCertificate” processing has completed successfully.

  • In the next window verify that Assign this certificate to Lync Server certificate usages is selected and then click Finish to launch theCertificate Assignment wizard.
  • Complete the wizard which automatically runs the Set-CsCertificate cmdlet to assign the desired certificate to the OAuth usage.

> Assign Certificate

Set-CSCertificate -Identity Global -Type OAuthTokenIssuer -Thumbprint 2A55DA39DD43DAEB2AC2510AFB61EE21AA6ADCDB -Confirm:$false -Report

The following certificate was assigned for the type “OAuthTokenIssuer“:
OAuthTokenIssuer: 2A55DA39DD43DAEB2AC2510AFB61EE21AA6ADCDB mslync.net 03/16/2015 CN=schertz-RootCA, DC=schertz, DC=name 5A00000004B92C660018992201000000000004

> Export Global Configuration Store

Export-CSConfiguration -FileName “C:\Users\ADMINI~1.SCH\AppData\Local\Temp\2\CSConfigData-2013_03_16-13_27_15.zip”

> Import Local Configuration Store

Import-CSConfiguration -LocalStore -FileName “C:\Users\ADMINI~1.SCH\AppData\Local\Temp\2\CSConfigData-2013_03_16-13_27_15.zip”

> Replicate-CsCmsCertificates

The main difference between the two certificate requests is that the creation of the OAuth certificate also triggers a database replication task as this certificate is automatically replicated to all Lync Servers in the topology.

To review the new certificates on the server use either the Certificates snap-in available in the Microsoft Management Console (mmc.exe) or IIS Manager (inetmgr.exe).  In IIS Manager for example highlight the server object in the Connections window and then open Server Certificates in the IIS section to view the two Lync server certificates.

image

View each certificate file to see the configured parameters and compare the Subject Name and SAN fields (the OAuth certificate will not include any SAN entries).

image     image

  • Returning to the Lync Server 2013 Deployment Wizard move on to Step 4: Start Services and click Run to trigger an automatic start of all Lync services.  This process may take a few minutes as due to some service dependencies they are started in a specific order and not all simultaneously.

> Start Services

Start-CSWindowsService -NoWait -Verbose -Report

Start services for the Lync Server computer “lync.schertz.name”.

“Start-CSWindowsService” processing has completed successfully.

To verify that all services have started successfully click Run on the Service Status (Optional) step to launch the Services control panel applet.  Depending on how soon after the previous step this is performed one or more of the services may still be in a stopped or starting state.  (Note that the Lync Server Audio Test Service will typically not be running as this service will routinely start and stop itself.)

image

If the Lync Server Front-End service (or any other prerequisite service) is still reported as starting then check the server CPU in Task Manager as it may still be fully tasked with all of the first-time processes performed after a fresh server installation.

image

DNS Configuration

Since this deployment is using a Standard Edition server then the required server host record (e.g. lync.schertz.name) already exists in the form of the Dynamic DNS record created by the server when it was previously joined to the domain.  But a number of additional DNS records need to be manually created to match the various Autodiscover and Simple URLs which were defined in the topology in the previous article.

  • Review the Subject Alternative Name field on the Default certificate which was just assigned to the Front End server as it will contain all of the FQDNs which need to be represented in the appropriate internal DNS forward lookup zones.

DNS Name=sip.mslync.net
DNS Name=lync.schertz.name
DNS Name=dialin.mslync.net
DNS Name=meet.mslync.net
DNS Name=admin.mslync.net
DNS Name=LyncdiscoverInternal.mslync.net
DNS Name=Lyncdiscover.mslync.net

As mentioned the server FQDN is already automatically defined in the proper DNS zone so that entry can be ignored (e.g.lync.schertz.name).  The Simple URLs (dialin, meet, admin) were manually created in the previous article after publishing the topology so all that remains to be created are the Automatic Client Sign-In and Autodiscover records.

It is important to understand the different between the legacy Automatic Client Sign-In process and the newer Lync Autodiscover approach as these are two completely different solutions.

In the legacy scenario OCS 2007 and Lync 2010 clients locate their SIP registrar directly by looking for one or more predefined hostnames (e.g. sip.<sipdomain>).  Yet in the newer Autodiscover scenario Lync 2013 clients are programmed to first look for a different set of predefined hostnames (e.g. lyncdiscover.<sipdomain>).  But these names will instead direct the client to a web service which will in turn respond back to the client with the appropriate SIP registrar URL.  So in the first case the clients are attempting to locate a SIP registrardirectly, where as in the second and more flexible solution they are attempting to locate a service which will tell them where to find their SIP registrar.  This advancement in Lync provides for additional flexibility not previously made available, most notably the ability to support distributed Access Edge registrations in enterprise networks with multiple Edge pools.

Legacy Automatic Client Sign-In

This section is only required if any legacy clients will be used with the environment (e.g. Lync 2010).  All Lync 2013 clients will leverage the newer Autodiscover process, although some 2013 clients still support this legacy mode as a fall-back.

  • Using DNS Manager create a new Host (A) record in the DNS zone which matches the SIP domain namespace (e.g.sip.mslync.net) using the same IP address as the Lync Front End server.

image

  • Create a new Service Location (SRV) record in the same zone (e.g. _sipinternaltls._tcp.mslync.net) and define the Port number as 5061 and the Host offering this service as the previously created host record (e.g. sip.mslync.net)

image

To verify the new DNS record configuration run the following command from the Windows Command Prompt.

C:\>nslookup -q=srv _sipinternaltls._tcp.mslync.net

_sipinternaltls._tcp.mslync.net SRV service location:
priority       = 0
weight         = 0
port           = 5061
svr hostname   = sip.mslync.net
sip.mslync.net internet address = 192.168.1.33

Lync Autodiscover

Either a Host (A) or an Alias (CNAME) record can be used for the Autodiscover records.  But some Lync clients (primarily the mobility clients) do not support a CNAME record which points to a Host record in a different domain namespace, so in the topology used in this series of articles it would be poor practice to create an alias in the SIP domain namespace (e.g. lyncdiscoverinternal.mslync.net) which then pointed to the server’s FQDN (e.g. lync.schertz.name) in another namespace.

Thus two configuration possibilities are available: either use a Host record with the server’s IP address, or create an Alias record pointing to a Host record in the same namespace (e.g. sip.mslync.net).  In an Enterprise Edition deployment this Lyncdiscoverinternal record would typically be an alias pointing to the Internal Web Service FQDN (e.g. lyncweb.<sipdomain>) but as this is a Standard Edition server then in the internal web service FQDN is the same as the server’s FQDN (e.g. lync.schertz.name) so the simplest configuration would be to just create a host record here.

Only the Lyncdiscoverinternal entry should be created on internal DNS zones as Lyncdiscover is used by external clients and thus should be reserved for external DNS zones which will be addressed in a later article.

  • Create a new Host (A) record in the DNS zone which matches the SIP domain namespace (e.g.lyncdiscoverinternal.mslync.net) using the same IP address as the Lync Front End server.

image

 

LEAVE A COMMENT