Tip, tricks and general information for Microsoft's Lync Server 2010
Lync Security Guide published
The Lync Security guide as been published by Microsoft and is available for download.
Lync Resource Kit - Sample Chapters
Sample chapters of the forthcoming Lync Resource Kit are available for download.
The sample chapters are:
The sample chapters are:
- Technical Overview
- New Features Overview
- Response Group Application
- SharePoint Integration
- Enterprise Voice
Lync Director Role
The Lync Director role is one of the most confusing roles in the Lync environment. This follows on from the confusion that existed in OCS where I for one was never sure of when a Director should be deployed. One thing that has changed is that Microsoft have made an explicit Director role in Lync, whereas in OCS, the Director was simply a pool without users homed on it. Therefore Microsoft obviously believe that the Director has a role to play in Lync designs.
The function of the Director is different dependent on whether the clients are internal or external.
Internal Clients
For internal clients, the purpose of the Director is to re-direct users to the correct pool in a multi-pool deployment. Without a Director, clients through autodiscovery, will receive from DNS a pointer to only one pool. If this is not their home pool then they will be redirected to the correct pool. This leads to an overhead on the pool pointed to by the DNS records. The Director will take on this role, redirecting clients to their home pool. Once redirected, the Director is no longer in the communications path for internal clients.
The fact that the Director role in Lync is a dedicated role means that users cannot accidentally be homed on it, unlike the situation in OCS where the Director was a front end pool but was designed not to home users.
External Clients
For external clients, the role of the Director is different. In this situation, it is acting to offload the authentication process from the Front End server. Also, once authenticated the Director will stay in the communications path, which also traverses the Edge server. For this reason, the Director can scale to 15,000 remote users. The Director will act as a further layer of security for external clients. If a Denial of Service attack is initiated against the Lync system, this will affect the Director but will not affect your Front End servers and will therefore minimize the impact for internal users who can continue to use the services of the Front End servers.
The platform requirements for the Director role are the same for other Lync roles with the exception of requiring only 4 GB of memory.
Dr Rez on the Director
Another Reason for the Director from Doug Deitterick's Blog
The function of the Director is different dependent on whether the clients are internal or external.
Internal Clients
For internal clients, the purpose of the Director is to re-direct users to the correct pool in a multi-pool deployment. Without a Director, clients through autodiscovery, will receive from DNS a pointer to only one pool. If this is not their home pool then they will be redirected to the correct pool. This leads to an overhead on the pool pointed to by the DNS records. The Director will take on this role, redirecting clients to their home pool. Once redirected, the Director is no longer in the communications path for internal clients.
The fact that the Director role in Lync is a dedicated role means that users cannot accidentally be homed on it, unlike the situation in OCS where the Director was a front end pool but was designed not to home users.
External Clients
For external clients, the role of the Director is different. In this situation, it is acting to offload the authentication process from the Front End server. Also, once authenticated the Director will stay in the communications path, which also traverses the Edge server. For this reason, the Director can scale to 15,000 remote users. The Director will act as a further layer of security for external clients. If a Denial of Service attack is initiated against the Lync system, this will affect the Director but will not affect your Front End servers and will therefore minimize the impact for internal users who can continue to use the services of the Front End servers.
The platform requirements for the Director role are the same for other Lync roles with the exception of requiring only 4 GB of memory.
Dr Rez on the Director
Another Reason for the Director from Doug Deitterick's Blog
Server Virtualization in Microsoft Lync Server 2010
Microsoft have published a whitepaper on Virtualisation for Lync Server 2010. It is available for download from Microsoft here.
Recommended networking:
Windows Server 2008 R2 is the required guest operating system. Windows Server 2008 SP2 is not supported.VMWare ESX 4.0 is also supported.
Small VM Host Configuration
A single VM host with direct attached storage configuration.
 |
| Small VM host configuration diagram |
Recommended networking:
· Dual network adapter/host: 1 network adapter reserved for host access, 1+ network adapter for shared VM guest application workload.
· network adapter speed: 1 GbE or 10 GbE (VMQ)
Recommended storage:
· Dedicated spindle for VM host, as well as a dedicated spindle for each VM guest virtual drive
Not recommended:
· 100 Mbps network adapters
· Single network adapter (for VM host and VM guest application workload)
· Shared spindles between host and guests, or between guests
Virtual Standard Edition Deployment
The most interesting deployment is a single virtual host with all roles required for a full implementation for 2000 users.
All virtual Standard Edition deployment, single Standard Edition server, with Archiving and Monitoring, SQL Server (Archiving and Monitoring), Edge Server (VLAN configuration to perimeter network)
Scale: 2K users, default usage profile, all modalities
Lync Server Role | Features | Physical | Virtual | ||||
CPU | Memory | User | CPU | Memory | User | ||
Enterprise Edition Front End Server | IM&P | 8 core | 12 GB | 20K | 4 core | 10 GB | 12.5K |
Enterprise Edition Front End Server | IM&P, AS, AV, EV | 8 core | 16 GB | 5K | 4 core | 16 GB | 2.5K |
Enterprise Edition Front End Server | IM&P, AS, EV (8 Front End pool) | 8 core | 12 GB | 10K | 4 core | 11 GB | 5K |
Enterprise Edition Front End Server | IM&P, AS, EV (single Front End Server in pool) | 8 core | 12 GB | 7K | 4 core | 11 GB | 4K |
Standard Edition Front End Server | IM&P | 8 core | 16 GB | 25K | 4 core | 12 GB | 12.5K |
Standard Edition Front End Server | IM&P, AS, AV, EV | 8 core | 16 GB | 5K | 4 core | 16 GB | 2.5K |
Director | Reg | 4 core | 4 GB | 20K | 4 core | 4 GB | 10K |
Monitor/Archiving Server | 8 core | 16 GB | 230K | 4 core | 8 GB | 110K | |
A/V Conferencing Server | AV | 8 core | 16 GB | 20K | 4 core | 11 GB | 10K |
Mediation Server* | MS | 8 core | 16 GB | 800 concurrent calls | 4 core | 10 GB | 400 concurrent calls |
Edge Server | AP, DP MR | 8 core | 16 GB | 15K | 4 core | 8 GB | 7.5K |
Survivable Branch Server | Reg, MS | 2 core | 2 GB | 1K | 2 core | 2 GB | 1K |
SQL Server Back End Server (FE) | 8 core | 32 GB | 80K | 4 core | 16 GB | 40K | |
SQL Backend (M/A) | 8 core | 16 GB | 230K | 4 core | 12 GB | 115K | |
File Server | 4 core | 4 GB | 80K | 2 core | 3 GB | 40K | |
Using Lync without a reverse proxy
A reverse proxy, such as Forefront TMG or ISA, is recommended to publish the web services on the front end server to the Internet while protecting the server from attack. However, it is possible to use a standard Stateful Firewall and allow the traffic through to the Front End. The configuration is documented in this blog from Ken Lasko.
An alternate solution, again not a supported configuration, is to use IIS ARR to publish the required websites. For a description of the steps involved, see this post at Unify This.
An alternate solution, again not a supported configuration, is to use IIS ARR to publish the required websites. For a description of the steps involved, see this post at Unify This.
Lync Address Book Service
The Lync Address Book service provides offline and online address book services to Lync clients. The Address Book service runs on a Front End server, usually the first server in the pool. Lync will manage a failed Address Book service by bringing the service online on an alternate Front End server. The AB service also provides Distribution Group expansion and Phone number Normalisation. In Lync 2010, the traditional offline Address Book has been supplemented by an Address Book Web Query.
The Lync 2010 (and Office Communicator 2007 & R2) clients will use the AB file download if available, while the Phone Edition, Mobile client and Web App will prefer the Web Query if available.
The handling of phone number Normalisation has been modified in Lync Server 2010. Phone numbers are now pre-screened to remove white space and non-mandatory characters before the phone numbers from AD are normalised. This makes the configuration of Address book normalisation rules simpler but does mean that rules carried over from OCS implementations may not function correctly.
The Address Book service will extract data from AD and import the data into the RTCab and RTCab1 databases on the Lync SQL server. The RTCab and RTCab1 databases are rotated on a daily basis to allow querying of a database while the alternate database is being updated. The database holds a table, AbAttribute, which controls which AD fields will be populated into the Address Book database and files.
Address Book Server Powershell Cmdlets
You cannot configure the Address Book Server settings in Lync Server Control Panel. Windows PowerShell is the primary tool for managing these settings. The following is a list of cmdlets that relate directly to managing the Address Book Server:
Address Book Server
There is a default Address book configuration created at install time at the Global level. You can create new Address Book configuration settings at the site level and all servers in that site will adhere to the site level configuration. There are Powershell cmdlets to retrieve an existing set of configuration parameters, create a new set, delete a set (except the Global configuration set) and modify parameters within a configuration set.
- Get-CsAddressBookConfiguration
- New-CsAddressBookConfiguration
- Remove-CsAddressBookConfiguration
- Set-CsAddressBookConfiguration
- Update-CsAddressBook
- Forces the specified Address Book servers to synchronize their contents with the User database.
- Test-CsAddressBookService
- Tests the ability of a user to access the server that hosts the Address Book Download Web service.
- Test-CsAddressBookWebQuery
- Tests the ability of a user to search for, and return, information from the Address Book by using the Address Book Web Query service.
The ABSConfig.exe utility from the Lync Resource Kit is used to configure which data is imported into the AB database from AD. It function is to - To enable administrators to map attributes in Active Directory Domain Services to the attributes for Lync Server.
- To enable administrators to specify the Active Directory attribute to be included or excluded in the Address Book Service files.
- To enable administrators to restore default Address Book Service settings.
The PS cmdlet Get-CsUserReplicatorConfiguration shows the interval between changes in AD and updates to the Lync AD database. The Get-CsAddressBookConfiguration cmdlet shows the time of day when the Lync AB database is exported to the Address Book data files and also shows the possible delay for the Address Book service to respond to the Update-CSAddressBook. The Update-CSUserDatabase will force the extract of AD data into the Lync AB database.
Jeff Guillet has published a batch file to force the download of the latest Address Book.
Subscribe to:
Posts (Atom)