Evangelyze Community Site

My Blog has Moved

mike — Wed, 13 Jan 2010 11:18:00 GMT

My blog has now moved to http://mikestacy.typepad.com. If you are using RSS please update your feed with the new link: http://mikestacy.typepad.com/mike-stacys-blog/atom.xml. All of my previous articles have been reposted there with their original dates but I will no longer put new posts on this site, such as the one I posted today describing a feature of the January 2010 Communicator update.

Thanks for reading!

Mike

Quarterly UC Virtual User Group meeting tomorrow

mike — Mon, 07 Dec 2009 14:56:38 GMT

This is a reminder that the Microsoft Unified Communications Virtual User Group will be holding it's last quarterly meeting of 2009 tomorrow at 2:00 PM Eastern (-5 GMT). We've had a great year getting UCVUG off the ground and look forward to ending the year with an awesome presentation by Chris Norman from Microsoft. Chris will be presenting on Response Groups in OCS 2007 R2. You can register for the event at http://ucvugdec2009.eventbrite.com/. The Live Meeting link is also posted on the UCVUG website.

We will also be testing our new chat room on the UCVUG website prior to the meeting. Just logon to http://www.ucvug.org at 1:30 PM Eastern (-5 GMT) and click on the "Chat" tab to join us for a "meet and greet" chat session.

Thanks again for your continued support of UCVUG and we look forward to seeing you at the meeting tomorrow!

OCS R2 Integration with Exchange 2010 OWA

mike — Thu, 12 Nov 2009 20:05:03 GMT

Exchange 2010 includes the ability to add presence and IM integration right into the OWA experience. This adds a number of handy features:

- Presence for internal and federated OCS contacts

- Ability to start and maintain chat sessions directly from OWA

- OCS contact list integration, including add/remove contacts and groups

- Ability to control your presence state from OWA

Now for some screenshots…

Presence integration including context menu additions:

Chat window and the ability to control multiple simultaneous chat sessions:

Your presence and presence control:

Contact list integration with groups and presence (the contact list is in the left pane below your folders):

Installation and configuration was fairly straight forward, only a few items to point out. First of all, here’s the download link and link to documentation. Right now there’s a missing link in the documentation for a UCMA update for Windows 2008 R2. That update is part of the 968802 package here. All you need for this integration is to apply the UCMARedist.msp update to your Exchange 2010 server.

Now, a few things to point out in terms of the integration process. First, make sure to put the spaces in between each pair of characters in the IMCertificateSerialNumber web.config value. If you don’t the integration won’t work and you’ll get an error in your event log:

Log Name:      Application
Source:        MSExchange OWA
Date:          11/12/2009 11:36:28 AM
Event ID:      87
Task Category: InstantMessage
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      excassrv1.corp.evangelyze.net
Description:
An exception was thrown while attempting to load the IM provider .dll file.

File: C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\OWA\bin\Microsoft.Rtc.UCWeb.dll
The local certificate specified was not found in the store for local computer.

Next, when you run the command to add the InstantMessagingType value to your OWA virtual directory (Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -InstantMessagingType OCS) you will get errors for any CAS servers that are not running Exchange 2010:

Property InstantMessagingType can't be set on this object because it requires the object to have version 0.10 (14.0.100.0) or later. The object's current version is 0.1 (8.0.535.0).
+ CategoryInfo : NotSpecified: (0:Int32) [Set-OwaVirtualDirectory], InvalidObjectOperationException
+ FullyQualifiedErrorId : 79956A7E,Microsoft.Exchange.Management.SystemConfigurationTasks.SetOwaVirtualDirectory

This can be safely ignored – the value will be set on Exchange 2010 servers. If you want to be sure just run get-owavirtualdirectory –server <Ex2010CASSrvName> |fl where <Ex2010CASSrvName> is the name of your Exchange 2010 CAS Server. Among the output you should see this: InstantMessagingType: Ocs

Lastly, the documentation doesn’t seem to be complete in the “Configure Office Communications Server” section. You’ll need to add the FQDN of the certificate that you specified in the web.config as a trusted host to your OCS environment. To do so, right click your pool and select Properties –> Front End Properties. Click the Host Authorization tab and then click Add. Add the FQDN of your CAS and check the “Throttle as server” and “Treat as authenticated” check boxes.

It will take a few minutes for your OCS front end(s) to pick up this change. Depending on your level of impatience (mine is high) You can force it by restarting the front end service but this will disconnect all your users from OCS, so do this with caution if you are working in a production environment.

Lastly, in case you’re curious which user agent this connection uses, here you go:

That should do it. The entire process took about 5 minutes and works perfectly.

Moving the OCS 2007 Databases to a new SQL 2005 Server

mike — Wed, 11 Nov 2009 22:33:39 GMT

***Update – I’ve tested this process with OCS 2007 R2 as well and it works as expected. The only difference is that you need to repeat the backup/restore processes on the acddyn and rtcab databases.***

In this post I'll go over the relatively easy process of moving the OCS databases from one SQL 2005 server to another using only SQL Management Studio. Of course there are many options for how you perform backups and restores, but given the small size of the core OCS databases I find that it's usually fastest to use the built in tools. The entire process usually takes under 15 minutes.

Before you begin, stop all the OCS services on all servers in the pool. Now you are ready to take a backup of your existing rtc, rtconfig, and rtcdyn databases. To do so, open SQL Management Studio, right click on the database you wish to backup, and select Tasks/Backup:

You will be presented with some backup options:

All you need to do here is note the file location of the .bak file (or change it to a location of your choosing) then click OK. This will start the backup and the circle in the bottom left will show the backup progress. You will need to perform these steps on the rtc, rtcconfig, and rtcdyn databases. When you are done you can either copy the .bak files to the new server or note the location and access them via \\servername\share\location from the new SQL server.

Next you must restore the databases to the new SQL server. On the new SQL server right click Databases and select Restore Database:

You will be presented with a restore options window:

Enter the name of the database you are restoring (rtc, rtcconfig, or rtcdyn only). Next click the "From device" option to indicate that you would like to restore from a file and click the [...] button to specify the file. Once you have selected it it will be listed in the Backup location list. Click OK to continue:

You must check the box next to the restore set to continue:

On the options page you have the ability to specify the restore location. By default it displays the original location of the files. Modify these as appropriate to match the desired location of the mdf and ldf files on the new SQL server. It is a best practice to place the database files on a separate spindle set from the log files.

Now click OK and the database will restore. Complete this step for the rtc, rtcconfig, and rtcdyn databases. If you are doing this with an OCS 2007 R2 pool then you will also need to get the acddyn and rtcab databases.

At this point we're more than halfway done. There are a few other items to complete before we are ready to start the services up again. SQL databases retain their permissions during a restore, but the SQL server login information is stored in the master database on each SQL server, so we will need to give the appropriate RTC groups access to the new SQL server. Also, the rtc and rtcdyn databases require database chaining to be enabled. I've included the SQL query that you need to execute to handle all of this at once. To execute this query, open SQL Management Studio and click the New Query button in the top left:

Modify the query below so that <domain> matches your actual domain name (for example, CORP) and paste it into the query window

CREATE LOGIN [<domain>\RTCArchivingUniversalServices] FROM WINDOWS WITH DEFAULT_DATABASE=master;
CREATE LOGIN [<domain>\RTCComponentUniversalServices] FROM WINDOWS WITH DEFAULT_DATABASE=master;
CREATE LOGIN [<domain>\RTCHSUniversalServices] FROM WINDOWS WITH DEFAULT_DATABASE=master;
CREATE LOGIN [<domain>\RTCUniversalReadOnlyAdmins] FROM WINDOWS WITH DEFAULT_DATABASE=master;
CREATE LOGIN [<domain>\RTCUniversalServerAdmins] FROM WINDOWS WITH DEFAULT_DATABASE=master;
CREATE LOGIN [<domain>\RTCUniversalUserAdmins] FROM WINDOWS WITH DEFAULT_DATABASE=master;

EXEC sp_dboption 'rtc', 'db chaining', TRUE
EXEC sp_dboption 'rtcdyn', 'db chaining', TRUE

Now click the Execute button. In the messages pane you should see the following:

Updating OCS

Now you are at the last step - updating the OCS pool configuration to point to the new database. To perform this step you need to be on a system that has OCS or the OCS administrative tools installed. One of your pool servers is a likely candidate.

Open a command prompt and navigate to the location of lcscmd.exe, which is usually in C:\Program Files\Common Files\Microsoft Office Communications Server 2007. Next run lcscmd with the appropriate switches to update the pool backend:

lcscmd /forest /action:updatepoolbackend /poolname:mypool /poolbe:mysqlserver\rtc

Note that the "poolname" option must be entered the same way it is displayed in the OCS admin console rather than using the FQDN like you are probably used to. In the example above I specified "mysqlserver\rtc" as the pool backend. This indicates that I've restored my databases to the SQL server "mysqlserver" that is running an "rtc" instance. If you are using the default (unnamed) instance you would simply specify /poolbe:mysqlserver.

Once you have the command line options set to match your environment push enter and you should receive something similar to this:

Microsoft Office Communications Server 2007 Deployment Command Console
Copyright (c) Microsoft Corporation. All rights reserved.

Executing "Initialize Forest Object"
Executing "Initialize Active Directory Connections"
Executing "Check Pools Container"
Executing "Check Active Directory Object CN=Pools"
Executing "Update Pool Backend"
Executing "Update Attribute msRTCSIP-BackEndServer of Pool pool1"
Executing "Check Pool Active Directory Objects"
Executing "Check Active Directory Object CN=pool1"
Executing "Check Active Directory Object CN=Microsoft"
Executing "Check Active Directory Object CN=LC Services"
Executing "Check Active Directory Object CN=LS WebComponents Services"
Executing "Read Attribute msRTCSIP-BackEndServer"
Executing "Update Attribute msRTCSIP-BackEndServer"
Executing "Read Attribute msRTCSIP-BackEndServer"
Check the log file "C:\DOCUME~1\mike\LOCALS~1\Temp\3\updatepoolbackend[2008_02_
27][10_47_51].html" for details.
Action completed successfully

Execution time = 750 ms

Now you're finished! Depending on your Active Directory environment it may take a few minutes for this change to replicate to all the DCs in the site where OCS resides. Allow enough time for this to take place and then start all the OCS services back up on each pool server.

Polycom HDX 4000 and RMX 2000 with OCS

mike — Fri, 06 Nov 2009 15:47:00 GMT

I spent a good amount of time the other day working on the setup, integration, and various scenarios of Polycom’s HDX endpoints and RMX bridges with OCS. Previously I had provided assistance to customers who needed help getting an HDX to work with OCS but I hadn’t had the opportunity to do everything from start to finish. Overall the HDX integration was straight forward, even easy (it took about 5 minutes) while the RMX could use some help in a few areas.

First of all, a quick description in case you are not familiar with these devices. The HDX is primarily targeted as a room-based videoconferencing system but the 4000, with its incnluded monitor, could also be used as a personal video conferencing system though the price point will probably reserve that right primarily for CxOs, videoconferencing system architects, and Polycom employees. :) Like the other video systems on the market the HDX does not yet support RTAudio/RTVideo and therefore, with regards to OCS, can only be used for PC to PC calling (MOC <-> HDX). This limits the calls to CIF quality only, which is ok for use on a PC but of course doesn’t show off the HD capabilities of the HDX.

Setup was very simple – just create a user account (or use your own) and configure the HDX settings to point to OCS. From there you can choose to get your contacts from Active Directory (using the LDAP configuration) or from your OCS contact list. The benefit of the latter is that you get presence information from your contacts as well. It would be great to have access to search AD as well as have presence from your contacts but unfortunately there is currently no way to access both of these at the same time yet. Another thing to consider is that the HDX doesn’t support enhanced presence, so if you create an OCS account for the conference room you need to disable enhanced presence, otherwise it will always show as offline. Polycom’s HDX documentation outlines all this for you.

The RMX is a bridge that (among many other features) hosts audio and/or video conferences. With the OCS integration a MOC user (including an OCS-connected HDX) can call via audio, video, or both into a conference room that exists on the RMX. Obviously you could do this with OCS alone but the RMX extends the capability to standards-based systems so that you can have a mix of endpoints in your conference. You can also integrate PRIs into the RMX to enable PSTN audio participation.

However, the RMX integration was not without its issues. First, the requirements to get TLS working with OCS aren’t well documented or explained. Through quite a bit of trial and error you can make it work but the most minor changes, like modifying certain fields to use an FQDN instead of an IP address, unexpectedly cause the integration to fail despite the apparent support of name entry. Especially when you are dealing with TLS this is counterintuitive. Second, the certificate upload process is quite a hassle, to say the least. Despite the UI providing acknowledgement of certificate uploads, pfx files fail to load properly and in the end you are forced to use external utilities to break down your certificate into a combination of .pem and password files. Even then you have to perform the upload from the web client (there is an installable desktop client as well) and apparently not from Windows 2008 or Windows 7. I had to boot my XP mode system and connect from IE within the VM before the certificates actually took, despite receiving verification from the other upload methods.

However, once this was all sorted the process to connect to a conference was very simple. There are also options to register conference rooms but I haven’t had the chance to try this with OCS yet. I haven’t begun to touch on all the capabilities of the RMX in particular (check the Polycom site for that), but I hope that Polycom investigates the OIP program for the RMX 2000 as well as the upcoming RMX 4000. It would be great for customers to have an all-in-one OCS voice gateway and video conferencing bridge option.

9 Months of OCS 2007 R2

mike — Mon, 19 Oct 2009 23:24:01 GMT

I’m writing this from the plane on the way from Denver to NYC to spend a week with a customer of ours. This particular customer is in the Enterprise Lighthouse program, which means that they are moving to OCS 2007 R2 as the voice platform for at least 2000 users. In addition to this they are also migrating from Sametime to OCS for IM, presence, and web conferencing for their entire user population (150,000+ users). It’s my second project of this scale for OCS and, from what I can gather from my records, around my 65th OCS project altogether. Of those ~65 projects 52 included voice for at least a subset of the users. The customers have ranged in size from 50 users to 160K users, with most falling in the middle – a bunch of companies in the 3000-20000 user range. I was just sitting here reflecting on these projects and thought I’d capture some of these thoughts. First, a some charts of various data points:

As you can see, we used primarily NET/Quintum gateways, with Direct SIP connections coming in at a close second.

Nothing surprising here, the PBX market leaders are reflected in our implementation stats as well.

I’m curious how our CallManager version integration breakdown matches up to Cisco’s worldwide deployment percentages.

Now, some less data-specific observations. In general we saw faster voice adoption by organizations who a) were running an older PBX and b) had little to no call center staff. This manifested itself in a few ways – expanded pilot group, addition of capacity to voice components, and/or a more accelerated move to production. Not surprisingly smaller organizations were more likely to move towards production, which was typically because those organizations were more nimble and had a more manageable political environment.

As a consulting organization, predictability of the platform is a major consideration for us and has been a strong point of OCS to date. It allowed us to create a standard fixed price model for almost all our services, which in turn reduced customer’s fear in moving to the platform since they knew we stood behind our work and would, if something went awry, share in their pain. Happily for both us and our customers this did not happen – all issues/complications/etc. were properly accounted for in the engagements and covered as expected by our pricing models.

So where does everything stand today? The obvious state of things related to voice is the lack of features as compared to traditional PBXs. This is no secret, and will largely be addressed in the OCS Wave 14 product which we’re expecting to see in about a year. Despite some of these feature deficiencies, there are numerous organizations for whom we’ve helped deploy OCS as a replacement to one or more PBXs. By and large users need to be able to make/receive phone calls and subsequently forward, transfer, or conference those calls. OCS can easily handle all of that and display presence all the while. Reuse of existing telephony endpoints was a showstopper for a number of customers but the introduction of SmartSIP earlier this year had started to break down those deployment barriers.

What’s missing is a better story for geographic redundancy for larger organizations. The recent resiliency white paper attempts to address some of that but the latency requirements are too stringent for most organizations, even those with deep pockets, since global organizations will likely have datacenters that are more than 15ms apart. Luckily I’ve been architecting around those shortfalls since the LCS days so there’s not much we can’t deal with as long as you can handle a ~15 minute outage in the event that one of your datacenters is completely destroyed. So far that has been viewed as a reasonable recovery time. However, I’m hoping that additional work is done to complete this story in Wave 14.

The other major missing items such as Mac/Linux support are already expected in Wave 14 so there’s not much point to hash them out here. One thing I haven’t heard much about but would really like to see is a better story around video integration. The lack of codec support in the MCU today is a severely limiting factor, and the recent announcement of Cisco to purchase Tandberg might make things difficult for Microsoft if Polycom is the only remaining integration partner.

Overall though one of the most difficult concepts to convey is the paradigm shift from “the phone on my desk” to integrated, presence-enabled communication. It’s hugely powerful and Microsoft’s vision and ambition to get there is right on target. The extensibility of the platform dramatically strengthens this vision. Every time we bring on a new customer that does not yet have OCS you realize how much easier your communication with existing OCS-enabled internal, partner, and customer contacts is.

WM 6.1 Outlook Mobile Update for Exchange 2010

mike — Wed, 07 Oct 2009 00:15:38 GMT

I noticed today that even folks “in the know” are having a hard time finding the update to Outlook Mobile that supports some new features of Exchange 2010, so I thought I’d post it. The update is included in Windows Mobile 6.5 (which I hope to have soon now that a bunch of new devices are out – most likely the HTC Pure, aka Touch Diamond2) but is also available on Windows Mobile 6.1 via download. Here is the link: https://update.outlook.com/cabs/OutlookLiveSetup.cab.

For an overview of the new features check out the videos here. The most noticeable differences are the new view (which includes a conversation view, if you’re into that), and integrated UM playback. The UM playback is great – no more downloading attachments and playing them in Windows Media anymore. Everything is integrated right into the message.

Enjoy!

Microsoft releases XMPP Gateway for OCS 2007 R2, enables free AOL connectivity

mike — Thu, 01 Oct 2009 17:46:35 GMT

Today Microsoft released the XMPP gateway for OCS R2 (press release, download page). This gateway enables connectivity to systems such as Google Talk and Jabber. Simultaneously Microsoft has also announced that Public IM Connectivity (PIC) with AOL is now included in the licensing price, along with Windows Live, which was announced a few months ago. Folks that need connectivity to Yahoo! will still require licensing but the license will be half price.

This significantly opens the connectivity options for OCS customers. Albert Kooiman gives an architectural overview in a Channel9 interview (skip to the 4:00 mark to see the whiteboard architecture session). More details forthcoming once I have a chance to install and configure the gateway…

Are you really Away?

mike — Mon, 31 Aug 2009 19:52:09 GMT

Having been working with presence for some time now it’s hard to remember a time when I didn’t know in advance if a coworker or business partner was available before trying to contact them. Unfortunately there are people out there who are interested in obfuscating their availability, presumably to confuse people into not communicating with them. Most commonly people like this set their status to “Away” when they are really there. In the beginning it causes people not to communicate with them but over time people figure out that they may be there anyway, which eventually causes the more annoying situation of trying to communicate with someone who actually is away. It’s not overly pleasant to always wonder if the person on the other end is available.

I’ll stop the soapbox there. To address this, at least with regards to internal users, you can leverage the DiagShowPublisherPresence stored procedure in SQL. To do so, open SQL Management Studio, expand Databases/rtc/Programmability/Stored Procedures:

You’ll find a lot of stored procedures here (aka stored procs) and if you browse through them you’ll start to see how OCS works under the covers. It’s very important not to modify any of the stored procs - doing so could cause major problems with OCS.

With that aside, scroll down to the dbo.DiagShowPublisherPresence, right click, and select Execute Stored Procedure:

A dialog with options will appear. In the Value field enter the SIP address of the user whose presence you wish to see and click OK:

This will return a fair amount of data, as you can see below. The column we’re interested in is the one titled Data.

In the Data column you’ll see the raw XML of the presence data. You’ll see a lot of data here, especially if the user is logged on to multiple places. The “aggregateState” entries will reference the overall presence state of the user. You’ll also see “userState” and “machineState” entries:

Notice the difference between the availability of the userState and the machineState (15500 and 3500 respectively). 15500 represents an Away state whereas 3500 represents an Available state (see http://msdn.microsoft.com/en-us/library/bb878933.aspx for reference on the presence state integers). I can tell since the machineState is Available but the userState is Away and set to manual=”true” that this user has manually set their presence to Away.

Admittedly it’s not an elegant solution to finding this information. I may write a quick tab extension to show this right in Communicator but in the meantime it highlights the usefulness of the stored procs that you’ll find in SQL. Thanks to Simon Booth, our UC developer extraordinaire for some insight on the presence data.

Calling Name in OCS 2007 R2

mike — Wed, 12 Aug 2009 17:51:00 GMT

A couple weeks ago Microsoft released an array of updates for OCS 2007 R2. In addition to addressing various issues, one somewhat less publicized but highly anticipated change was the support of calling name for inbound and outbound calls. Applying these updates to your OCS environment will automatically add calling name to inbound calls. Here’s a before and after screen shot:

Before:

After:

I also noticed on the test PC where I ran this that it was necessary to update Communicator to the July 2009 update (6907.37) for calling name to appear. When I was running the May update (6907.22) Communicator did not show the calling name.

For outbound calling name you will need to add the forwardDisplayName setting to the MediationServer.exe.config file. Details on this can be found here.

Using Forefront for OCS to block large file transfers

mike — Mon, 18 May 2009 02:26:52 GMT

Customers ask me all the time if it is possible to file transfers over a certain amount, and I’m happy to see this feature in Forefront for OCS. It’s pretty easy to configure this particular feature.

There are two ways to configure file filtering – either directly in the file filter area or by configuring a list. Using a list allows you to group multiple settings into one as well as have more control over the rule name. For the latter reason I opted to use a list in my example. To start, I went to the Filter Lists item under the Filtering section and selected Files from the List Types option:

At the bottom I clicked Add and created a list called 1MB File Transfer Limit:

Next select the list and click the Edit button to bring up the Include/Exclude options. For this basic rule I simply created a filter for *.*>=1MB to match files which are greater than or equal to 1MB:

Since we’re using a filter list you could choose different sizes for different types of files or choose to exclude particular file types altogether. Next, head back to the main File area in the Filtering section. You’ll see your new list under the lists section at the bottom. On the right side make sure to enable the file filter and the action you wish to take when a matching file is encountered. In my case I selected to block the file and send a notification:

This resulted in an IM to the person sending the file:

Combining this with the virus scanning, content filtering, and other features of Forefront I’d say this appears to be a pretty useful tool for almost all OCS deployments.

How not to make a T1 crossover cable

mike — Mon, 11 May 2009 16:38:00 GMT

For those of you who work a lot with T1 media gateways like the ones we use to connect OCS and Exchange to PBXs, you are probably familiar with the connection of a T1 crossover cable between the gateway and the PBX. Sometimes the gateway comes with one in the box and sometimes customers have them on hand, but every now and then one has to be made by hand. This attached photo shows the outcome of that activity at a customer I worked with recently. Unfortunately the telecom guy that was doing the T1 connection didn’t have access to plugs and a crimper so a straight-through Ethernet cable fell prey to a pair of scissors and some electrical tape. From what I understand this took place around 1:30am.

To his credit it worked great and allowed us to finish the pilot. They assure me it will be replaced with a proper cable soon.

UC Virtual User Group Kickoff

mike — Fri, 08 May 2009 02:38:13 GMT

I’m excited to let everyone know about the kickoff meeting of the UC Virtual User Group (UCVUG), coming up on May 21st at 7pm Eastern time. There will be some great content and even some giveaways! Many thanks to fellow MVP Dustin Hannifin for organizing the group/event. I’ll be presenting our SmartSIP solution, which will hit RTM on May 20, and another fellow MVP, Jeff Schertz, will will be presenting on new features in OCS 2007 R2.

The UCVUG website is http://ucvug.org/ or you can jump straight to the registration page at http://ucvuglaunch.eventbrite.com/.

Hope to see you there!

Communicator cannot login, 0x80090308 SEC_E_INVALID_TOKEN

mike — Wed, 06 May 2009 17:29:00 GMT

Today I hit an issue at a customer where Communicator could not login with TLS. In the event log and a Communicator trace we would see 0x80090308 errors, which translates to SEC_E_INVALID_TOKEN. Also, communication between the existing OCS R1 and the new R2 server would fail in one direction – R1 users could not reply to R2 IMs. The R1 servers reported the same 80090308 error.

Log Name: Application

Source: Communicator

Date: 5/6/2009 9:32:16 AM

Event ID: 5

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: <Computer Name>

Description:

Communicator could not connect securely to server <ocspool> because the certificate presented by the server was not trusted due to validation error 0x80090308. The issuing certificate authority (CA) for the server's certificate may not be locally trusted by the client, the certificate may be revoked, or the certificate may have expired.

Upon further investigation we discovered the following error in the System event log of the R2 server:

Event Type: Warning

Event Source: Schannel

Event Category: None

Event ID: 36885

Date: 5/6/2009

Time: 8:42:26 AM

User: N/A

Computer: <Server Name>

Description:

When asking for client authentication, this server sends a list of trusted certificate authorities to the client. The client uses this list to choose a client certificate that is trusted by the server. Currently, this server trusts so many certificate authorities that the list has grown too long. This list has thus been truncated. The administrator of this machine should review the certificate authorities trusted for client authentication and remove those that do not really need to be trusted.

The Trusted Root certificate store had almost 300 certificates listed because this customer had been diligent in applying the root certificate updates that are published periodically. We deleted a large number of certificates that were not needed and ended up with around 120. Once this was done all communication completed successfully.

Subsequently we discovered a KB article related to IAS that also addresses this issue:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;933430

We did not contact PSS to acquire the hotfix so I can’t speak to whether or not it would have corrected the issue.

Periodic Audio Drops during a call through the A/V Edge

mike — Thu, 30 Apr 2009 15:20:09 GMT

This week I hit an issue at a customer where audio would drop periodically for external users. The call would stay up but audio would disappear. This happened in 2 situations…

- The user was in a quiet environment and was silently listening to the other caller

- The user was on mute

We could replicate this at will by calling a line with hold music and staying on mute. It made no difference Initially we thought that silence detection of some sort was coming into play. However, Netmon traces indicated that the A/V Edge was sending RTP packets the entire time but on the client side we would see large gaps in inbound RTP packets, each time lasting about 15 seconds.

After doing some research on this customer’s firewall, a Checkpoint, I noticed that Checkpoint includes a default UDP “Virtual Session Timeout” setting of 40 seconds. Comparing this to the client side netmon I noticed that the first audio drop occurred 40 seconds into the call. In fact, thinking back to the testing the audio drops would occur when the call timer in Communicator was around 37-38 seconds (the timer doesn’t start until the audio stream is fully up and running). Following this we would get a break of ~15 seconds and then the audio would drop again around 1:34 into the call, or about 40 seconds after the audio was reestablished. Now that I knew the default Checking timeout was 40 seconds it seemed unlikely that this was a coincidence.

The max setting for the Virtual Session Timeout is 3600 seconds on this customer’s version of Checkpoint, but you don’t want to needlessly crank this setting to the max. There are implications on firewall performance based on the number of open sessions. In our case we set this to 300 seconds:

This can be set as a global setting or on a per service basis. We only changed it on the specific service that was created for OCS so as not to impact other firewall services.

Watch out for underscores in OCS Pool FQDN

jose — Tue, 28 Apr 2009 15:10:00 GMT

I'm not much of a blogger but I've been thinking about contributing to the UC community because I run across a ton of valuable information in my line of work and I figured this would be a good one to start with.

So I recently ran into an issue with a customer who decided to name their OCS 2007 R2 pool with an underscore (e.g. ocs_pool1). Based on the fact that we received NO errors or warnings during the install and EVERYTHING in OCS worked (including Enterprise Voice, Remote Access, Federation, etc) we didn’t see a problem with this configuration.

Enter Exchange UM

During the Exchange UM installation process when we ran the exchucutil.ps1 script to create the UM IP Gateway objects we received the following error:

Configuring UMIPGateway objects... Pool: OCS_R2_pool.domain.com UMIPGateway: Not Found, creating...
Failed to create Exchange UMIPGateway objects. Please verify you are a member of the Exchange Organization Administrators group or have sufficient privilege to write to this Active Directory container. Additional information follows: Cannot convert value "OCS_R2_pool.domain.com" to type "Microsoft.Exchange.Data.UMSmartHost". Error: ""OCS_R2_pool.domain.com" is not a valid IP address or host name. Parameter name: SmartHost"

We checked DNS and obviously everything was fine. A google search led to zero hits on this specific issue (though TomL did have a post on LCS pools not supporting underscores for PIC: http://blogs.technet.com/toml/archive/2006/06/20/437862.aspx) however nothing like this exists for OCS.

Bottom line, you CANNOT have underscores in your OCS 2007 R2 Pool Name. My Microsoft buddies tell me it's not a limitation with OCS but rather DNS. However I find that a little difficult to understand since DNS supports underscores in Hostnames. I'm going to be doing some more research on this.

Anyway, if you plan on using Exchange UM DON'T USE UNDERSCORES IN YOUR POOLNAMES OR SERVERNAMES. In fact it's probably a good thing to steer clear of using underscores altogether as part of your OCS deployment .

If you have encountered this issue your best option is to:

Create a new pool - without underscores
Add new server(s) to this pool
Move users to the new pool
Deactivate servers from previous pool
Delete Pool

Obviously there will be some cleanup you’ll need to do if you have an edge, mediation server, etc. But I'm sure you've got it from here...

Updating the OCS R2 Internal URLs

mike — Tue, 21 Apr 2009 12:40:05 GMT

Last year I posted the process for updating the internal OCS URLs. From time to time I’ve found it necessary to do this for various reasons. Most commonly this is necessary if a customer does not have a reverse proxy in place and/or is not using a SAN certificate that includes both the external web farm FQDN as well as the pool FQDN.

The biggest difference with R2 is that you have to enter the WMI string in a query in order to find and edit it. This was done for performance reasons since enumerating all the instances of some classes can be a CPU-intensive operation.

First, here are the URLs you will modify:

MSFT_SIPAddressBookSetting - InternalURL

MSFT_SIPClientUpdaterSetting- InternalURL

MSFT_SIPDataMCUCapabilitySetting - InternalClientContentDownloadURL

MSFT_SIPGroupExpansionSetting - InternalDLExpansionWebURL

MSFT_SIPPSTNConferencingSetting- InternalURL

MSFT_SIPUpdatesServerSetting - InternalUpdatesDownloadURL, InternalUpdatesStoreURL

To find and modify the settings I decided to use CIM Studio since the interface is more intuitive than wbemtest. CIM Studio is part of the WMI Tools package, which can be downloaded here. Once installed, launch CIM Studio from the Start/Programs menu:

It launches in a browser using an ActiveX control, which you may need to allow depending on your security settings:

Once it is open it will prompt you for the namespace. If you are running this from the OCS front end then the default (root\CIMv2) is accurate. You can also connect to a remote machine using \\machinename\root\cimv2. You will be prompted to logon as the current user or specify credentials:

Now that you are connected the main screen will appear:

Now, because of the changes in R2 we can’t just find the class and click the Instances button like we used to. You need to run a WQL query to find the specific instance that you want to use. To do this, click the WQL Query button towards the top right of the window.

Your query is a simple SELECT statement that finds the instance you need to work with. In OCS this is derived from the backend pool information. For an enterprise pool the backend will be SQLServer\\SQLInstance (yes, the double backslashes are correct). For Standard Edition you can use OCSServerName\\rtc or (local)\\rtc. Therefore your SELECT statement will look something like this:

SELECT * from msft_sipaddressbooksetting where backend="evan-terra1\\rtc"

If successful, this will return a result:

Double click that result and the properties will be displayed. This one area where CIM Studio is much easier to use than wbemtest. Simply modify the appropriate property (InternalURL in this case) and click the Save button.

Repeat this find/modify process for the class/property values that I mentioned at the beginning of the post and you will be all set.

Exchange UM Fails to Validate Certificate

mike — Mon, 30 Mar 2009 02:52:09 GMT

Last week I hit an issue where Play on Phone was not working. After entering the phone number in the appropriate field, Outlook would try for 30 seconds and then give the generic error indicating that it could not connect to the UM server. As a starting point I checked the URL that was being sent to the client (https://<CAS URL>/unifiedmessaging/service.asmx) to ensure there were no connectivity or certificate issues. Everything checked out fine there.

Next I looked at the UM server and found an event 1113 with the following description:

The Unified Messaging server failed to exchange the required certificates with an IP gateway to enable Transport Layer Security (TLS) for an incoming call. Check that this is a configured TLS peer and that the correct certificates are being used. More information: A TLS failure occurred because the certificate that was presented by the remote server is not trusted. The error code was "-2146762487" and the message was "A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider".

This particular customer has separate servers for the mailbox, hub transport, CAS, and UM roles. Since the client connection goes through the CAS server this would indicate that the UM server was rejecting the certificate that was presented by the CAS server. A quick check of the certificates on the CAS server via get-exchangecertificate showed the certificate that we expected, and we could successfully browse to the same /unifiedmessaging/service.asmx URL from the UM server without any issues. A netmon trace further confirmed that the certificate presented to the UM server was the one we expected. Despite all this, the CAS server insisted that it was not able to find a valid UM server:

Event Type: Warning
Event Source: MSExchange Unified Messaging
Event Category: Shell
Event ID: 1083
Description:
The Unified Messaging Web service was unable to process a "PlayOnPhone" request for user "Doe, John". The error was "A valid Unified Messaging server could not be found for dial plan NorthAmerica.".

Since the CAS server was configured with a Verisign certificate this really didn’t make sense, but for the sake of completeness I checked each certificate in the chain and verified that it existed in the UM server’s local computer certificate store. What I found was that the Verisign root certificate was indeed in the Trusted Root Certification Authorities store but the intermediate CA, from which the CAS server’s certificate was issued, was not in the Intermediate Certification Authorities store. This didn’t seem to cause any problems from IE but just to be safe I added the intermediate certificate into the store. Sure enough, this caused UM to begin accepting the connections from the CAS server.

I haven’t had a chance to research whether or not this is documented/expected behavior but it’s certainly interesting to note this, especially as certificate vendors are beginning to use new 2048 bit based CAs.

EC SmartSIP

mike — Wed, 18 Mar 2009 03:12:17 GMT

About 2 weeks ago we opened a private beta of our upcoming product called SmartSIP, and so far the response has been amazing! It’s really exciting to hear from customers about their success connecting OCS to an array of SIP providers and IP PBXs.

If you’re not familiar with SmartSIP, it’s a product we’re releasing soon to extend the capabilities of OCS. The first version, due in April, will allow you to connect OCS with virtually any SIP system – TCP or UDP. The most common use is to connect a Mediation server to a customer’s existing ITSP, but it can also connect to other IP gateways, SBCs, IP PBXs, etc. We will also simplify phone number management by integrating with Active Directory to automatically route calls rather than burden administrators with additional phone number to SIP user mapping.

What’s really interesting is how creative our customers have been with the new possibilities. Because SmartSIP can connect to multiple IP systems, we have the flexibility to have failover routes. For example, we are working with one of our customers on an architecture where we will have primary routes through a T1/E1 media gateway, inbound routing through a SIP trunk for OCS Conferencing (many ITSPs provide free incoming minutes), and can also route outbound calls through the SIP trunk in the event of a PSTN outage. Scenarios become even more compelling (and cost effective) as this architecture expands to multiple sites for geographical redundancy.

Our first update to the product is scheduled for May and will extend the capability to register standard SIP phones as OCS endpoints. The cost savings here is huge – one of our smaller customers (about 350 users) would have had to spend $60,000-100,000 on new endpoints to fully leverage their Microsoft UC deployment but since we can reuse their Nortel 1120E phones they will have only costs of approximately $8,000 to roll out a complete solution with their existing endpoints.

If you are interested in SmartSIP drop us a line at smartsip@evangelyze.net, and stay tuned here for updates!

Entrust UC Certificates

mike — Fri, 13 Feb 2009 13:00:29 GMT

I’ve favorably referenced the UC certs from Entrust a few times over on the OCS Forums and I noticed recently that they’ve had a pretty significant price drop. They used to be priced at $1099 for 2 years but are now available in 1, 2, 3, and 4 year versions, all of which have been reduced in price. Definitely worth a look if you are doing an OCS installation or getting ready to renew your certificates.

Microsoft actually worked with the certificate providers when they created the UC Cert program, which includes other providers as well (check the link for the current list). Any time I’m working with a customer on an Edge deployment I use these certificates – they are simple to obtain, well priced, and can be easily reissued if your names change.

OCS 2007 R2 Live Meeting content fails to download

mike — Fri, 13 Feb 2009 12:49:23 GMT

When running OCS 2007 R2 on Windows 2008, users are able to upload content to the Live Meeting session but receive the following error after the download:

“Content failed to download due to a problem with the Conference Center configuration. Contact your administrator”

To figure out what what happening I decided to browse down into one of the content folders to see if I could load the pages. To do so I expanded Etc/Place/Null/FileTree/<branch1>/<branch2>/slidefiles in IIS on the front end server and switched to the content view:

Now in the right pane I can see at least a default.htm and an index.html file (if you don’t see these select another <branch2> folder until you find one that contains them), right clicked, and selected the browse option.

Sure enough, that presented a 500.19 error in IE. An inspection of the IIS logs showed a number of these errors from my testing.

A quick search turned up Jens’ blog which indicates that this problem also manifests itself in the device update URLs. Applying those steps to the FileTree folder solved the problem (I also did an iisreset for good measure). One addition to his article – if you are looking for Basic Settings it’s on the far right in the Actions pane when you click on FileTree:

If you don’t see it over there you are probably in the Content View. To fix this, right click on FileTree and select Switch to features view:

OCS R2 CDR Database schema

simon — Thu, 12 Feb 2009 01:54:55 GMT

Seems the R2 documentation is either incomplete or just hard to find at this time, so I dumped the schema out of the database. For descriptions, most of this is in the R1 documentation (http://www.microsoft.com/downloads/details.aspx?familyid=52627734-B354-4F74-A6ED-E298259CDA19&displaylang=en)

OCS R2 Schema Diagram

Tables / Columns :

TableName	ColumnName	DataType	Length
Application	ApplicationId	int	4
Application	Name	nvarchar	514
Application	Name	sysname	514
ClientVersions	VersionId	int	4
ClientVersions	Version	nvarchar	512
ClientVersions	Version	sysname	512
Computers	ComputerId	int	4
Computers	Computer	nvarchar	32
Computers	Computer	sysname	32
ConferenceMessageCount	SessionIdTime	datetime	8
ConferenceMessageCount	SessionIdSeq	int	4
ConferenceMessageCount	UserId	int	4
ConferenceMessageCount	MessageCount	smallint	2
Conferences	ConferenceUri	nvarchar	900
Conferences	ConferenceUri	sysname	900
Conferences	Checksum	int	4
Conferences	ConfInstance	int	4
Conferences	SessionIdTime	datetime	8
Conferences	SessionIdSeq	int	4
Conferences	ConferenceStartTime	datetime	8
Conferences	ConferenceEndTime	datetime	8
Conferences	PoolId	int	4
Conferences	OrganizerId	int	4
DbConfigDateTime	Name	nvarchar	64
DbConfigDateTime	Name	sysname	64
DbConfigDateTime	Value	datetime	8
DbConfigInt	Name	nvarchar	64
DbConfigInt	Name	sysname	64
DbConfigInt	Value	int	4
DbErrorMessage	Id	int	4
DbErrorMessage	Severity	tinyint	1
DbErrorMessage	Text	nvarchar	510
DbErrorMessage	Text	sysname	510
Dialogs	DialogId	int	4
Dialogs	ExternalChecksum	int	4
Dialogs	ExternalId	varbinary	775
ErrorDef	ErrorId	int	4
ErrorDef	ResponseCode	int	4
ErrorDef	MsDiagId	int	4
ErrorDef	RequestType	varbinary	33
ErrorDef	ContentType	varbinary	257
ErrorReport	ErrorTime	datetime	8
ErrorReport	ErrorId	int	4
ErrorReport	FromUserId	int	4
ErrorReport	ToUserId	int	4
ErrorReport	DialogId	int	4
ErrorReport	MsDiagHeader	image	16
ErrorReport	ClientVersionId	int	4
FileTransfers	SessionIdTime	datetime	8
FileTransfers	SessionIdSeq	int	4
FileTransfers	FileName	nvarchar	512
FileTransfers	FileName	sysname	512
FileTransfers	Cookie	int	4
FileTransfers	Accept	bit	1
FileTransfers	Reject	bit	1
FileTransfers	Cancel	bit	1
FocusJoinsAndLeaves	UserId	int	4
FocusJoinsAndLeaves	UserInstance	int	4
FocusJoinsAndLeaves	IsUserInternal	bit	1
FocusJoinsAndLeaves	UserRole	int	4
FocusJoinsAndLeaves	SessionIdTime	datetime	8
FocusJoinsAndLeaves	SessionIdSeq	int	4
FocusJoinsAndLeaves	UserJoinTime	datetime	8
FocusJoinsAndLeaves	UserLeaveTime	datetime	8
FocusJoinsAndLeaves	ClientVerId	int	4
Gateways	GatewayId	int	4
Gateways	Gateway	nvarchar	512
Gateways	Gateway	sysname	512
McuJoinsAndLeaves	UserId	int	4
McuJoinsAndLeaves	UserInstance	int	4
McuJoinsAndLeaves	IsFromPstn	bit	1
McuJoinsAndLeaves	McuId	int	4
McuJoinsAndLeaves	SessionIdTime	datetime	8
McuJoinsAndLeaves	SessionIdSeq	int	4
McuJoinsAndLeaves	UserJoinTime	datetime	8
McuJoinsAndLeaves	UserLeaveTime	datetime	8
Mcus	McuId	int	4
Mcus	McuUri	nvarchar	900
Mcus	McuUri	sysname	900
Mcus	McuType	nvarchar	512
Mcus	McuType	sysname	512
Media	SessionIdTime	datetime	8
Media	SessionIdSeq	int	4
Media	MediaId	tinyint	1
Media	StartTime	datetime	8
Media	EndTime	datetime	8
MediaList	MediaId	tinyint	1
MediaList	Media	nvarchar	512
MediaList	Media	sysname	512
Phones	PhoneId	int	4
Phones	PhoneUri	nvarchar	900
Phones	PhoneUri	sysname	900
Pools	PoolId	int	4
Pools	PoolFQDN	nvarchar	512
Pools	PoolFQDN	sysname	512
ProgressReport	ErrorTime	datetime	8
ProgressReport	ErrorId	int	4
ProgressReport	ProgressReportSeq	int	4
ProgressReport	ApplicationId	int	4
ProgressReport	Detail	image	16
Roles	RoleId	tinyint	1
Roles	Role	nvarchar	512
Roles	Role	sysname	512
SessionDetails	SessionIdTime	datetime	8
SessionDetails	SessionIdSeq	int	4
SessionDetails	DialogId	int	4
SessionDetails	CorrelationId	uniqueidentifier	16
SessionDetails	ReplacesDialogId	int	4
SessionDetails	User1Id	int	4
SessionDetails	User2Id	int	4
SessionDetails	TargetUserId	int	4
SessionDetails	SessionStartedById	int	4
SessionDetails	OnBehalfOfId	int	4
SessionDetails	ReferredById	int	4
SessionDetails	ComputerId	int	4
SessionDetails	PoolId	int	4
SessionDetails	User1ClientVerId	int	4
SessionDetails	User2ClientVerId	int	4
SessionDetails	IsUser1Internal	bit	1
SessionDetails	IsUser2Internal	bit	1
SessionDetails	InviteTime	datetime	8
SessionDetails	ResponseTime	datetime	8
SessionDetails	ResponseCode	int	4
SessionDetails	DiagnosticId	int	4
SessionDetails	User1MessageCount	int	4
SessionDetails	User2MessageCount	int	4
SessionDetails	SessionEndTime	datetime	8
UserAuthTypes	AuthTypeId	int	4
UserAuthTypes	AuthType	nvarchar	512
UserAuthTypes	AuthType	sysname	512
Users	UserId	int	4
Users	UserUri	nvarchar	900
Users	UserUri	sysname	900
Users	AuthTypeId	int	4
VoipDetails	SessionIdTime	datetime	8
VoipDetails	SessionIdSeq	int	4
VoipDetails	FromNumberId	int	4
VoipDetails	ConnectedNumberId	int	4
VoipDetails	FromGatewayId	int	4
VoipDetails	ToGatewayId	int	4
VoipDetails	DisconnectedByURIId	int	4
VoipDetails	DisconnectedByPhoneId	int	4

Communicator does not prompt for logon credentials

mike — Tue, 10 Feb 2009 22:53:18 GMT

Today I hit an extremely unusual issue where any external user could logon to any OCS account without entering any credentials whatsoever. It had no bearing on whether the machine was domain joined or not. In my case I used a PC that was a member of a workgroup running MOC 2007 R2 but we reproduced the issue in a few places. The issue was relatively straight forward to fix but a specific set of circumstances led up to the behavior…

Background

The customer had previously installed OCS 2007 R1 on their own and was never able to get everything working right. They called us to help out with installing R2 once it was released. We installed and configured R2 without issue then added a Mediation server. Everything was working great until the Edge server installation was complete. When we added the Edge server’s internal FQDN to the Edge Servers tab of the Forest properties we received the following error message:

Quite an unusual error. A discussion with the customer revealed that the Edge server has the same FQDN as the original R1 server, which it turns out was not properly removed. When they went to remove the R1 server they hit a permissions error and simply rebuilt the system rather than properly deactivate the services. A quick export of the RTC Service container (CN=RTC Service,CN=Microsoft,CN=System,DC=domain,DC=com) with ldifde did in fact show the same server name in 3 containers:

CN=Trusted MCUs,CN=RTC Service,CN=Microsoft,CN=System,DC=domain,DC=com (msRTCSIP-MCUType: meeting)

CN=Trusted MCUs,CN=RTC Service,CN=Microsoft,CN=System,DC=domain,DC=com (msRTCSIP-MCUType: audio-video)

CN=Trusted WebComponentsServers,CN=RTC Service,CN=Microsoft,CN=System,DC=domain,DC=com

Solution

Since the Edge server name matched these orphaned trusted server entries its traffic was being seen as an trusted application and therefore OCS was not requiring credentials. Removing these entries and restarting the front end services cleared up this problem. The actual item you will be deleting looks like this:

Warning: Deleting objects from Active Directory can cause irreparable harm to OCS and/or other applications. Always take a proper backup of Active Directory before deleting items with ADSI Edit or any other application.

Once these 3 items were deleted and we restarted the OCS services everything worked as expected. I can’t emphasize strongly enough that administrators should take their time when removing old systems. This is a great example of the issues that can arise when steps are skipped.

OCS 2007 R2 Edge Management Tools

mike — Thu, 05 Feb 2009 17:10:05 GMT

Now that more folks have their hands on OCS 2007 R2 a common question I’ve heard is “How do I manage my Edge server?” If you’ve installed R2 one thing you’ve noticed is that Microsoft no longer automatically installs the OCS admin tools on any server role. You must install these from the amd64/Setup folder on the OCS R2 media by running admintools.msi. This applies to the Edge server as well. Once that is complete you can find the Edge server tools right were they were before under Computer Management. In Windows 2008 you can no longer access this by right clicking “Computer” and selecting “Manage” from the start menu (this brings up the new Server Manager interface now). Instead you have to launch Computer Management from Administrative Tool or using Start/Run/compmgmt.msc.

OCS R2 Licensing Explained

mike — Tue, 03 Feb 2009 03:14:00 GMT

Interestingly the second most viewed post I have is the one on OCS 2007 licensing. Based on this I thought I’d post an equivalent post for OCS 2007 R2 licensing based on the licensing session that MS held for UC MVPs recently.

Overall the updates are good news. Microsoft heard the complaints from R1 customers and set a primary goal of simplification. Using the relative terms of Microsoft licensing, where almost nothing is easy, I’d say they succeeded. Here are the main takeaways:

No price change. R2 has no price change for either servers or CALs. Given all the new features and the fact that the platform has really evolved to at least a basic PBX replacement, this is pretty phenomenal in itself.

Office Communicator R2 License. No real change here – the OC R2 license is still separate. It’s worth highlighting that it is still included in Office Pro Plus and Office Enterprise – many people aren’t aware of this.

CAL versions. You can still mix and match CALs within your organization in order to provide the right licensing options to the users that need specific features. As before there is no correlation between server and CAL versions (standard and enterprise). The CAL is still additive, meaning that you need to buy the standard CAL to be able to purchase an enterprise CAL (the same is not true with servers).

Desktop Sharing. Ok, there was no way we were going to get through a licensing explanation with at least one funky MS nuance. The new Communicator R2 includes built-in desktop sharing without the need to launch the Live Meeting client. It’s a really cool feature and is included in the Standard CAL, sort of. As long as you are just viewing a shared desktop then you are covered by the Standard CAL. However, if you are the one sharing your desktop, regardless of whether or not you are sharing control, then you must be licensed with an Enterprise CAL.

R2 rights. OCS R2 is a new version all around, so in order to have upgrade rights you must have licensed your servers, CALs, and client software with Software Assurance. If this is not the case then you must purchase updated licensing. Interestingly, if you purchased LCS CALs under SA, your SA is still active, and you never upgraded them to OCS R1 CALs then congratulations – you own OCS 2007 R2 Enterprise CALs. Awesome deal, especially if you bought them under the IC promo deal that was going on back in 2005 or so.

Non-core licenses are included. The only servers for which you must purchase OCS R2 server licenses are your front ends (be they Standard or Enterprise) and your Edge servers (always purchase Standard Edition server licenses for your Edge servers). All other OCS server roles are included with the front end server licensing. Similarly, Office Communicator is the only client software you are required to purchase. The official term for this inclusion is “Additional Software” (I would like to suggest that Microsoft rename this to “Included Software”). The list of Additional Software (from http://www.microsoft.com/communicationsserver/en/us/pricing-licensing.aspx) is:

The clients:

Office Communicator Web Access 2007 R2
Office Communicator Mobile for Java 2007 R2
Office Communicator Mobile for Windows Mobile 2007 R2
Office Communications Server2007 R2 Group Chat Console
Office Communicators Server 2007 R2 Attendant Console
Office Live Meeting Console

The Office Communications Server 2007 R2 server roles:

Monitoring Server role
Director Server role
Mediation Server role
Archiving Server role
Web Components (includes CWA Server role)

External Connectors. Given that the platform continues to provide a high ROI based on the built-in web conferencing, MS has decided to drop the need for External Connector licensing altogether. This is great for organizations who want to extend their infrastructure to the web via web conferencing, external telephony conferencing, or a bolt-on solution such as our SmartChat product, which enables live chat from your website right to Communicator. You do still need CALs for any user in your organization who will be using OCS.