Planning for other features lync server 2010 (rc)

Planning for Other Features in Microsoft Lync Server 2010 (Release Candidate)

Published: September 2010

This document is provided “as-is”. Information and views expressed in this document, including

URL and other Internet Web site references, may change without notice. You bear the risk of

using it.

Some examples depicted herein are provided for illustration only and are fictitious. No real

association or connection is intended or should be inferred.

This document does not provide you with any legal rights to any intellectual property in any

Microsoft product. You may copy and use this document for your internal, reference purposes.

This document is confidential and proprietary to Microsoft. It is disclosed and can be used only

pursuant to a non-disclosure agreement.

Copyright © 2010 Microsoft Corporation. All rights reserved.

Microsoft, Active Directory, ActiveSync, ActiveX, Excel, Forefront, Groove, Hyper-V, Internet

Explorer, Lync, MSDN, MSN, OneNote, Outlook, PowerPoint, RoundTable, SharePoint,

Silverlight, SQL Server, Visio, Visual C++, Windows, Windows Media, Windows PowerShell,

Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. All

other trademarks are property of their respective owners.

Contents

Planning for Other Features........................................................................................................1

Planning for Simple URLs........................................................................................................1

Role-Based Access Control.....................................................................................................3

DNS Load Balancing..............................................................................................................24

Preventing New Connections to Lync Servers.......................................................................27

Running in a Virtualized Environment....................................................................................27

Migrating Applications Built on Microsoft Unified Communications Managed API (UCMA) 2.0

Core SDK............................................................................................................................ 33

Planning for Other FeaturesThis section explains the features related to manageability of Microsoft Lync Server

2010 communications software.

Lync Server Control Panel

Lync Server Management Shell

Planning for Simple URLs

Role-Based Access Control

DNS Load Balancing

Preventing New Connections to Lync Servers

Planning for Simple URLsSimple URLs make joining meetings easier for your users, and make getting to Microsoft Lync

Server 2010 administrative tools easier for your administrators.

Microsoft Lync Server 2010 communications software supports three simple URLs:

Meet is used as the base URL for all conferences in the site or organization. An example of a

Meet simple URL is https://meet.contoso.com. A particular meeting URL might be

https://meet.contoso.com/username/JKTNME.

With the Meet simple URL, links to join meetings are easy to comprehend, and easy to

communicate and distribute.

Dial-in enables access to the Dial-in Conferencing Settings Web page. This page displays

conference dial-in numbers with their available languages, assigned conference information

(that is, for meetings that do not need to be scheduled), and in-conference DTMF controls,

and supports management of personal identification number (PIN) and assigned

conferencing information. The Dial-in simple URL is included in all meeting invitations so that

users who want to dial in to the meeting can access the necessary phone number and PIN

information. An example of the Dial-in simple URL is https://dialin.contoso.com.

Admin enables quick access to the Microsoft Lync Server 2010 Control Panel. From any

computer within your organization’s firewalls, an admin can open the the Lync Server 2010

Control Panel by typing the Admin simple URL into a browser. The Admin simple URL is

internal to your organization. An example of the Admin simple URL is

https://admin.contoso.com

Simple URL Scope

You can configure your simple URLs to have global scope, or you can specify different simple

URLs for each central site in your organization. If both a global simple URL and a site simple URL

are specified, the site simple URL has precedence.

1

In most cases, we recommend that you set simple URLs only at the global level so that a user’s

Meet simple URL does not change if they move from one site to another. The exception would be

organizations that need to use different telephone numbers for dial-in users at different sites. Note

that if you set a one simple URL (such as the Dial-in simple URL) at a site to be a site-level

simple URL, you must also set the other simple URLs at that site to be site-level as well.

You can set global simple URLs in Topology Builder. To set a simple URL at the site level, you

must use the Set-CsSimpleURLConfiguration cmdlet.

Naming Your Simple URLs

There are three recommended options for naming your simple URLs. Which option you choose

has implications for how you set up your DNS A records and certificates which support simple

URLs. In each option, you must configure one Meet simple URL for each SIP domain in your

organization. You always need just one simple URL in your whole organization for Dial-in, and

one for Admin, no matter how many SIP domains you have.

For details about the necessary DNS A records and certificates, see DNS Requirements for

Simple URLs and Certificate Requirements for Internal Servers in the Determining Your

Infrastructure Requirements documentation.

In Option 1, you create a new SIP domain name for each simple URL.

If you use this option, you need a separate DNS A record for each simple URL, and each Meet

simple URL must be named in your certificates.

Simple URL Naming Option 1

Simple URL Example

Meet https://meet.contoso.com,

https://meet.fabrikam.com, and so on (one for

each SIP domain in your organization)

Dial-in https://dialin.contoso.com

Admin https://admin.contoso.com

With Option 2, simple URLs are based on the domain name lync.contoso.com. Therefore, you

need only one DNS A record which enables all three types of simple URLs. This DNS A record

references lync.contoso.com. Additionally, you still need separate DNS A records for other SIP

domains in your organization.


Simple URL Example

Meet https://lync.contoso.com/Meet,

https://lync.fabrikam.com/Meet, and so on (one

for each SIP domain in your organization)

2


Dial-in https://lync.contoso.com/Dialin

Admin https://lync.contoso.com/Admin

Option 3 is most useful if you have many SIP domains, and you want them to have separate Meet

simple URLs but want to minimize the DNS record and certificate requirements for these simple

URLs.


Simple URL Example

Meet https://lync.contoso.com/contosoSIPdomain/Meet

https://lync.contoso.com/fabrikamSIPdomain/Meet

Dial-in https://lync.contoso.com Dialin

Admin https://lync.contoso.com/Admin

Changing Simple URLs after Deployment

If you change a simple URL after initial deployment, you must be aware of what changes impact

your DNS records and certificates for simple URLs. If the change impacts the base of a simple

URL, then you must change the DNS records and certificates as well. For example, changing

from https://lync.contoso.com/Meet to https://meet.contoso.com changes the base URL from

lync.contoso.com to meet.contoso.com, so you would need to change the DNS records and

certificates to refer to meet.contoso.com. If you changed the simple URL from

https://lync.contoso.com/Meet to https://lync.contoso.com/Meetings, the base URL of

lync.contoso.com stays the same, so no DNS or certificate changes are needed.

Whenever you change a simple URL name, however, you must run Enable-CsComputer on each

Director and Front End Server to register the change.

Role-Based Access ControlTo enable you to delegate administrative tasks while maintaining your organization's security

standards, Microsoft Lync Server 2010 introduces role-based access control (RBAC). With

RBAC, administrative privilege is granted by assigning users to pre-defined administrative roles.

Lync Server 2010 includes a rich set of built-in administrative roles, and you can assign user

groups to these roles.

Better Server Security and Centralization

In previous versions of Office Communications Server, administrative rights were defined very

broadly, and users with administrative access for a server running Lync Server could make many

types of changes. With RBAC, access and authorization is based more precisely on a user’s Lync

Server role. This enables greater use of the security practice of "least privilege," granting

administrators and users only the rights that are necessary for their job.

3


Important:

RBAC restrictions work only on administrators working remotely, using either the Lync

Server Control Panel or Lync Server 2010 Management Shell. A user sitting at a server

running Lync Server is not restricted by RBAC. Therefore, physical security of your Lync

Server is important to preserve RBAC restrictions.

Roles and Scope

In RBAC, a role is a list of cmdlets defined by Lync Server, designed to be useful for a certain

type of administrator or technician. A scope is the set of objects which the cmdlets defined in a

role can operate on. The objects that scope affects can be either user accounts (grouped by

organizational unit) or servers (grouped by site).

The following table lists the predefined roles in Lync Server 2010, and gives a general overview of

the types of tasks each can do. The fourth column shows the similar Microsoft Exchange Server

role for each Lync Server role, if there is one.

For a detailed list of exactly which cmdlets each role can run, see the tables later in this topic.

Pre-Defined Administrative Roles

Role Tasks allowed

Underlying

Active Directory

Group

Exchange

equivalent

CsAdministrator Can perform all

administrative tasks and

modify all settings,

including creating roles and

assigning users to roles.

Can expand a deployment

by adding new sites, pools,

and services.

CS

Administrators

Organization

Management

CsUserAdministrator Can enable and disable

users for Lync Server,

move users and assign

existing policies to users.

Cannot modify policies.

CS User

Administrators

Mail

Recipients

CsVoiceAdministrator Can create, configure, and

manage voice-related

settings and policies.

CS Voice

Administrators

Not applicable.

CsServerAdministrator Can manage, monitor, and

troubleshoot servers and

services. Can prevent new

connections to servers,

stop and start services,

CS Server

Administrators

Server

Management

4


Role Tasks allowed

Underlying

Active Directory

Group

Exchange

equivalent

and apply software

updates. Cannot make

changes with global

configuration impact.

CsViewOnlyAdministrator Can view the deployment,

including user and server

information, in order to

monitor deployment health.

CS View-Only

Administrators

View-Only

Organization

Management

CsHelpDesk Can view the deployment,

including user's properties

and policies. Can execute

specific troubleshooting

tasks. Cannot change user

properties or policies,

server configuration, or

services.

CS HelpDesk HelpDesk

CsArchivingAdministrator Can modify archiving

configuration and policies.

CS Archiving

Administrators

Retention

Management,

Legal Hold

CsResponseGroupAdministrator Can manage the

configuration of the

Response Group

application within a site.

CS Response

Group

Administrators

Not applicable

CsLocationAdministrator Lowest level of rights for

Enhanced 9-1-1 (E9-1-1)

management, including

creating E9-1-1 locations

and network identifiers,

and associating these with

each other. This role is

always assigned with a

global scope.

CS Location

Administrators

Not applicable

All predefined roles shipped in Lync Server have a global scope. To follow least privilege

practices, you should not assign users to roles with global scope if they are going to administer

only a limited set of servers or users. To accomplish this, you can create roles which are based

on the predefined roles, but with a more limited scope.

5


Creating a Role

When you create a role, you specify the scope, along with the existing role it is based on and the

Active Directory Domain Services group to be assigned the role. The Active Directory group you

specify must already be created. The following cmdlet is an example of a creating a role with

limited scope. It creates a new role called Site01 Server Administrators. The new role

has the abilities of the predefined CsServerAdministrator role, but only for the servers located in

the Site01 site. For this cmdlet to work, the Site01 site must already be defined, and a security

group named Site01 Server Administrators must already exist.

New-CsAdminRole -Identity "Site01 Server Administrators" -Template CsServerAdministrator -ConfigScopes “site:Site01"

After this cmdlet runs, all users who are members of the Site01 Server Administrators

group will have server administrator privileges for the servers in Site01. Additionally, any users

who are later added to this security group also gain the privileges of this role. Note that both the

role itself, and the security group it is assigned to are called Site01 Server Administrators.

The following example limits user scope instead of server scope. It creates a Sales Users Administrator role to administer the user accounts in the Sales organizational unit. The

SalesUsersAdministrator security group must already be created for this cmdlet to work.

New-CsAdminRole -Identity "Sales Users Administrator " -Template CsUserAdministrator -UserScopes “OU:OU=Sales, OU=Lync Tenants, DC=Domain, DC=com"

A user can be given multiple RBAC roles by being added to the underlying Active Directory

groups that correspond to each role.

Note that when you create a role, users who are later added to the underlying Active Directory

group gain the abilities of that role.

Assigning Roles to Users

Each Lync Server role is associated with an underlying Active Directory security group, which is

created in Active Directory when you deploy Lync Server. Any users who you add to the

underlying group gain the abilities of that role.

The examples in the preceding section both created a new role and assigned a group to it. To

assign an existing role to one or more users, add those users to the group associated with the

role. You can add both individual users and security groups to these role groups.

For example, the CsAdministrator role is automatically granted to the CS Administrators

security group in Active Directory. This security group is created in Active Directory when you

install deploy Lync Server. To grant a user or group this privilege, you can simply add them to the

CS Administrators group.

Planning for RBAC

For each person who is to be given any kind of administrative rights for your Lync Server

deployment, consider exactly which tasks they need to perform, then assign them to roles with

the least privilege and scope necessary for their job.

6


Users who have the CsAdministrator role can create all types of roles, including roles based on

CsAdministrator, and assign users to them. The best practice is to assign the CsAdministrator

role to a very small set of trusted users.

Cmdlets Permitted for Pre-Defined Roles

The following sections list the cmdlets that each pre-defined role is permitted to run.

CsAdministrator

The CsAdministrator role is permitted to run all cmdlets.

CsUserAdministrator

The CsUserAdministrator role is permitted to run the cmdlets in the following table.

Disable-CSUser

Enable-CSUser

Get-CSAdUser

Get-

CSUserPoolInfo

Move-CSUser

Move-

CSLegacyUser

Set-CSUser

Grant-

CSClientPolicy

Grant-

CSClientVersionPol

icy

Grant-

CSConferencingPol

icy

Grant-CSDialPlan

Grant-

CSExternalAccess

Policy

Grant-

CSHostedVoicemail

Policy

Grant-

CSLocationPolicy

Grant-CSPinPolicy

Get-CSArchivingPolicy

Get-CSClientPolicy

Get-

CSClientVersionPolicy

Get-

CSConferencingPolicy

Get-

CSExternalAccessPoli

cy

Get-

CSHostedVoicemailPo

licy

Get-CSLocationPolicy

Get-CSPinPolicy

Get-CSVoicePolicy

Get-CSClientPinInfo

Unlock-CSClientPin

Lock-CSClientPin

Set-CSClientPin

Get-

CSClientVersionConfig

uration

Get-CSDialPlan

Get-CsSite

Get-CsComputer

Get-CsNetworkInterface

Get-CSPool

Get-CSService

Get-CSSipDomain

Revoke-CSClientCertificate

Get-

CSManagementStoreReplicat

ionStatus

Get-CSAdContact

Get-CSUserAcp

Set-CSUserAcp

Remove-CSUserAcp

Get-CsArchivingConfiguration

Get-CsPresencePolicy

Grant-CsPresencePolicy

Get-CsWindowsService

Get-CSPstnUsage

Get-

CSRoutingConfig

uration

Set-

CSCommonAreaP

hone

Remove-

CSCommonAreaP

hone

Get-

CSCommonAreaP

hone

New-

CSCommonAreaP

hone

Set-

CSAnalogDevice

Remove-

CSAnalogDevice

Get-

CSAnalogDevice

New-

CSAnalogDevice

Set-

CSExUmContact

Remove-

CSExUmContact

Get-

7


Grant-

CSVoicePolicy

CSExUmContact

New-

CSExUmContact

CsVoiceAdministrator

The CsVoiceAdministrator role is permitted to run the cmdlets listed in the following table.

Remove-

CSNetworkSite

Remove-

CSNetworkSubnet

Set-

CSNetworkBandwid

thPolicyProfile

Set-

CSNetworkInterReg

ionRoute

Set-

CSNetworkInterSite

Policy

Set-

CSNetworkRegion

Set-

CSNetworkRegionL

ink

Set-CSNetworkSite

Set-

CSNetworkSubnet

Get-

CSVoicemailRerouti

ngConfiguration

Set-

CSVoicemailRerouti

ngConfiguration

Remove-

CSVoicemailRerouti

ngConfiguration

New-

CSVoicemailRerouti

ngConfiguration

Get-

CSEnhancedEmergenc

yServiceDisclaimer

New-

CSUcPhoneConfigurati

on

Get-

CSHostedVoicemailPoli

cy

Set-


cy

Remove-


cy

New-


cy

Test-CSP2PAV

New-CsAnalogDevice

Get-CsAnalogDevice

Get-CSExUmContact

Set-CSExUmContact

New-CsExUmContact

Remove-

CsAnalogDevice

Remove-

CsCommonAreaPhone

Remove-

CsExUmContact

Set-CsAnalogDevice

Set-

Get-

CSNetworkConfiguratio

n

Set-CSRgsAgentGroup

Set-

CSRgsHoursofBusines

s

Set-

CSRgsConfiguration

Set-CSRgsHolidaySet

Set-CSRgsQueue

Set-CSRgsWorkflow

Get-CsAdContact

Get-CsAdUser

Get-

CsAudioTestServiceAp

plicationContact

Get-

CsBandwidthPolicySer

viceConfiguration

Get-CsClientPinInfo

Get-

CommonAreaPhone

Get-CpsConfiguration

Get-

CsEnhancedEmergenc

yServiceDisclaimer

Get-CsLisCivicAddress

Get-CsLisLocation

Get-CsLisPort

Get-

CsLisServiceProvider

New-

CsMediaConfiguration

New-CsLocationPolicy

New-

CsCpsConfiguration

New-


viceConfiguration

New-CSRgsAnswer

New-CSRgsCallAction

New-CSRgsHoliday

New-CSRgsHolidaySet

New-

CSRgsHoursOfBusines

s

New-CSRgsQuestion

New-CSRgsQueue

New-

CSRgsTimeRange

New-CSRgsWorkflow

New-

CSRgsWorkflowPrompt

New-

CsRoutingConfiguratio

n

New-CsVoiceRegex

Publish-

CsLisConfiguration

Remove-


viceConfiguration

Remove-

8


Get-

CSTrunkConfigurati

on

Set-

CSTrunkConfigurati

on

Remove-

CSTrunkConfigurati

on

New-

CSTrunkConfigurati

on

Get-

CSOutboundTransl

ationRule

Set-

CSOutboundTransl

ationRule

Remove-

CSOutboundTransl

ationRule

New-

CSOutboundTransl

ationRule

Get-CSPstnUsage

Set-CSPstnUsage

Get-CSVoiceRoute

Set-CSVoiceRoute

Remove-

CSVoiceRoute

New-CSVoiceRoute

Get-

CSRoutingConfigur

ation

Set-

CSRoutingConfigur

ation

Remove-

CSRoutingConfigur

ation

CsCommonAreaPhone

New-

CsCommonAreaPhone

Test-

CSVoiceNormalization

Rule

Test-CSDialPlan

Test-CSVoiceRoute

Test-CSVoicePolicy

Test-

CSVoiceTestConfigurati

on

Test-CSVoiceUser

Get-

CSDeviceUpdateRule

Remove-

CSDeviceUpdateRule

Approve-

CSDeviceUpdateRule

Reset-

CSDeviceUpdateRule

Restore-

CSDeviceUpdateRule

Clear-

CsDeviceUpdateFile

Import-

CsDeviceUpdate

Clear-

CsDeviceUpdateLog

Get-

CsDeviceUpdateConfig

uration

Set-


uration

New-


uration

Remove-


Get-CsLisSubnet

Get-CsLisSwitch

Get-

CsLisWirelessAccessP

oint

Get-CsLocationPolicy

Get-


Get-

CsNetworkConfiguratio

n

Get-

CsQOEConfiguration

Get-PinPolicy

Get-CSRgsAgentGroup

Get-

CSRgsBusinessHours

Get-

CSRgsConfiguration

Get-CSRgsHolidaySet

Get-CSRgsQueue

Get-CSRgsWorkflow

Get-CSUserPoolInfo

Get-CSUserPoolInfo

Get-

CsWebServiceConfigur

ation

Get-

CsWindowsService

Grant-CsDialPlan

Grant-

CsHostedVoicemailPoli

cy

Grant-CsLocationPolicy

Grant-CsVoicePolicy

Import-

CsLisConfiguration

Import-CSRgsAudioFile

CsCpsConfiguration

Remove-

CsEnhancedEmergenc

yServiceDisclaimer

Remove-CsLisLocation

Remove-CsLisPort

Remove-


Remove-CsLisSubnet

Remove-CsLisSwitch

Remove-


oint

Remove-

CsLocationPolicy

Remove-


Remove-

CsNetworkBandwidthP

olicyProfile

Remove-


n

Remove-

CsQoEConfiguration

Remove-

CSRgsAgentGroup

Remove-

CSRgsHolidaySet

Remove-

CSRgsHoursOfBusines

s

Remove-CSRgsQueue

Remove-

CSRgsWorkflow

Set-


plicationContact

Set-


9


Get-CSDialPlan

Set-CSDialPlan

Remove-

CSDialPlan

New-CSDialPlan

Get-

CSVoiceNormalizati

onRule

Set-

CSVoiceNormalizati

onRule

Remove-

CSVoiceNormalizati

onRule

New-

CSVoiceNormalizati

onRule

Get-CSVoicePolicy

Set-CSVoicePolicy

Remove-

CSVoicePolicy

New-CSVoicePolicy

Get-

CSVoiceTestConfig

uration

Set-

CSVoiceTestConfig

uration

Remove-

CSVoiceTestConfig

uration

New-

CSVoiceTestConfig

uration

Get-

CSVoiceConfigurati

on

Set-

CSVoiceConfigurati

on

uration

Get-CsTestDevice

Set-CsTestDevice

New-CsTestDevice

Remove-CsTestDevice

Get-

CSManagementStoreR

eplicationStatus

Test-CsLisCivicAddress

Test-CsLisConfiguration

Debug-

CsLisConfiguration

Export-

CsLisConfiguration

Test-CsLocationPolicy

Test-

CsPhoneBootStrap

Test-

CsPstnOutboundCall

Test-

CsPstnPeerToPeerCall

Unlock-CsClientPin

Unpublish-

CsLisConfiguration

Set-CSPstnGateway

Set-

CsQoEConfiguation

Lock-CsClientPin

Move-

CsApplicationEndpoint

Move-

CsConferenceDirectory

Move-

CSRgsConfiguration

New-

CSRgsAgentGroup

New-

CsQoEConfiguration

New-

CsNetworkMediaBypas

sConfiguration

New-

CsNetworkBWPolicy

New-

CsNetworkBWAlternate

Path

viceConfiguration

Set-


n

Set-CsMediationServer

Set-


Set-CsLocationPolicy

Set-


oint

Set-CsLisSwitch

Set-CsLisSubnet

Set-


Set-CsLisPort

Set-CsLisLocation

Set-

CsEnhancedEmergenc

yServiceDisclaimer

Set-

CsCpsConfiguration

Set-CsClientPin

10


Remove-

CSVoiceConfigurati

on

Get-

CSUcPhoneConfigu

ration

Set-

CSUcPhoneConfigu

ration

Remove-

CSUcPhoneConfigu

ration

CsServerAdministrator

The CsServerAdministrator role is permitted to run the cmdlets listed in the following table.

Get-

CsApplicationEndpoint


Set-CsPresencePolicy

New-CsPresencePolicy

Remove-

CsPresencePolicy

Get-CSWindowsService

Start-

CSWindowsService

Stop-

CsWindowsService

Get-CSCertificate

Get-

CSAccessEdgeConfigur

ation

Get-

CSAddressBookConfigu

ration

Get-CSAllowAllDomains

Get-CSAllowedDomain

Get-CSAnnouncement

Get-

New-CSAnnouncement

Remove-

CSAnnouncement

Set-

CSAVEdgeConfiguratio

n

New-


n

Remove-


n

Set-

CSBandwidthPolicyServ

iceConfiguration

New-


iceConfiguration

Remove-


iceConfiguration

Set-CSBlockedDomain

New-CSBlockedDomain

Remove-

Remove-

CSNetworkInterRegi

onRoute

Set-

CSNetworkInterSite

Policy

New-

CSNetworkInterSite

Policy

Remove-

CSNetworkInterSite

Policy

Set-

CSNetworkRegion

New-

CSNetworkRegion

Remove-

CSNetworkRegion

Set-

CSNetworkRegionLi

nk

New-

CSNetworkRegionLi

nk

Import-

CSLisConfiguration

Publish-

CSLisConfiguration

UnPublish-

CSLisConfiguration

Test-

CSLocationPolicy

Enable-

CSPublicProvider

Disable-

CSPublicProvider

Test-

CSVoiceNormalizatio

nRule

Test-CSVoicePolicy

Test-CSVoiceRoute

Test-

CSVoiceTestConfigur

ation

Test-

CsFederatedPartner

Test-

11


CSArchivingConfigurati

on


Get-


n

Get-


iceConfiguration

Get-CSBlockedDomain

Get-CSCallParkOrbit

Get-

CSCdrConfiguration

Get-CSClientPolicy

Get-

CSClientVersionConfigu

ration

Get-


Get-

CSConferenceDirectory

Get-

CSConferenceDisclaim

er

Get-

CSConferencingConfigu

ration

Get-


Get-

CSCpsConfiguration

Get-

CSDeviceUpdateConfig

uration

Get-

CSDeviceUpdateRule

Get-

CSDiagnosticFilterConfi

guration

Get-

CSBlockedDomain

Set-CSCallParkOrbit

New-CSCallParkOrbit

Remove-

CSCallParkOrbit

Set-CSCdrConfiguration

New-

CSCdrConfiguration

Remove-

CSCdrConfiguration

Set-CSClientPolicy

New-CSClientPolicy

Remove-CSClientPolicy

Set-


ration

New-


ration

Remove-


ration

New-


Remove-


Move-


Set-


er

Remove-


er

Set-


ration

New-


Remove-

CSNetworkRegionLi

nk

Set-CSNetworkSite

New-CSNetworkSite

Remove-

CSNetworkSite

Set-

CSNetworkSubnet

New-

CSNetworkSubnet

Remove-

CSNetworkSubnet

Set-

CSOutboundTransla

tionRule

New-

CSOutboundTransla

tionRule

Remove-

CSOutboundTransla

tionRule

Set-CSPstnUsage

Set-CSPinPolicy

New-CSPinPolicy

Remove-

CSPinPolicy

Set-

CSPrivacyConfigura

tion

New-

CSPrivacyConfigura

tion

Remove-

CSPrivacyConfigura

tion

Set-

CSProxyConfigurati

on

New-

CsGroupExpansion

Test-

CsAddressBookServi

ce

Test-

CsAddressBookWeb

Query

Test-CsAVConference

Test-CsClientAuth

Test-

CsDialInConferencing

Test-CsGroupIM

Test-CsIM

Test-CsPresence

Test-CsRegistration

Test-CsP2PAV

Test-

CsPhoneBootstrap

Test-

CsPstnOutboundCall

Test-

CsPstnPeerToPeerCa

ll

Test-CsVoiceUser

Test-CsDialPlan

Clear-

CsDeviceUpdateFile

Clear-

CsDeviceUpdateLog

Get-CsAdContact

Get-CsAdminRole

Get-

CsAdminRoleAssign

ment

Get-CsAdUser

Get-CsAnalogDevice

Get-

CsAudioTestServiceA

pplicationContact

12


CSDiagnosticHeaderCo

nfiguration

Get-

CSDialInConferencingA

ccessNumber

Get-

CSDialInConferencingC

onfiguration

Get-

CSDialInConferencingD

tmfConfiguration

Get-

CSDialInConferencingL

anguageList

Get-CSDialPlan

Get-

CSEnhancedEmergenc

yServiceDisclaimer

Get-

CSExternalAccessPolic

y

Get-

CSTrustedApplication

Get-

CSTrustedApplicationE

ndpoint

Get-CSExUmContact

Get-

CSFileTransferFilterCon

figuration

Get-

CSHealthMonitoringCon

figuration

Get-


cy

Get-CSHostingProvider

Get-

CSImFilterConfiguration

Get-CSLisCivicAddress

ration

Remove-


ration

Set-


New-


Remove-


Set-

CSCpsConfiguration

New-

CSCpsConfiguration

Remove-

CSCpsConfiguration

Set-


uration

New-


uration

Remove-


uration

Remove-

CSDeviceUpdateRule

Set-


guration

New-


guration

Remove-


guration

Set-


nfiguration

New-

CSProxyConfigurati

on

Remove-

CSProxyConfigurati

on

Set-

CSPublicProvider

New-

CSPublicProvider

Remove-

CSPublicProvider

Set-

CSQoEConfiguratio

n

New-

CSQoEConfiguratio

n

Remove-

CSQoEConfiguratio

n

Set-

CSRegistrarConfigu

ration

New-

CSRegistrarConfigu

ration

Remove-

CSRegistrarConfigu

ration

Set-

CSRgsAgentGroup

New-

CSRgsAgentGroup

Remove-

CSRgsAgentGroup

Set-

CSRgsHoursOfBusi

ness

Remove-

CSRgsHoursOfBusi

Get-

CsClientCertificate

Get-CsClientPinInfo

Get-

CsClientVersionPolicy

Rule

Get-

CsCommonAreaPhon

e

New-

CsCommonAreaPhon

e

Remove-

CsCommonAreaPhon

e

Set-

CsCommonAreaPhon

e

Get-

CsRgsHoursOfBusine

ss

Get-

CsTrustedApplication

Computer

Get-


Pool

Get-CsUser

Get-CsUserAcp

Get-

CsUserDatabaseStat

e

Get-CsUserPoolInfo

Import-

CSAnnouncementFile

Import-

CsConfiguration

Import-

CsDeviceUpdate

Import-

13


Debug-

CSLisConfiguration

Get-CSLisLocation

Get-CSLisPort

Get-

CSLisServiceProvider

Get-CSLisSubnet

Get-CSLisSwitch

Get-

CSLisWirelessAccessP

oint


Get-

CSManagementConnec

tion

Get-

CSManagementStoreR

eplicationStatus

Get-

CSMediaConfiguration

Get-

CSMeetingConfiguratio

n

Get-

CSNetworkBandwidthP

olicyProfile

Get-

CSNetworkInterRegion

Route

Get-

CSNetworkInterSitePoli

cy

Get-CSNetworkRegion

Get-

CSNetworkRegionLink

Get-CSNetworkSite

Get-CSNetworkSubnet

Get-

CSNetworkConfiguratio

n


nfiguration

Remove-


nfiguration

Set-


ccessNumber

New-


ccessNumber

Remove-


ccessNumber

Set-


onfiguration

New-


onfiguration

Remove-


onfiguration

Set-


tmfConfiguration

New-


tmfConfiguration

Remove-


tmfConfiguration

Set-CSDialPlan

New-CSDialPlan

Remove-CSDialPlan

Set-

CSEnhancedEmergenc

yServiceDisclaimer

Remove-

CSEnhancedEmergenc

yServiceDisclaimer

ness

New-

CSRgsHoursOfBusi

ness

Set-

CSRgsConfiguration

Move-

CSRgsConfiguration

Set-

CSRgsHolidaySet

New-

CSRgsHolidaySet

Remove-

CSRgsHolidaySet

Set-CSRgsQueue

New-CSRgsQueue

Remove-

CSRgsQueue

Set-CSRgsWorkflow

New-

CSRgsWorkflow

Remove-

CSRgsWorkflow

Set-

CSRoutingConfigur

ation

New-

CSRoutingConfigur

ation

Remove-

CSRoutingConfigur

ation

Set-

CSServerApplicatio

n

New-

CSServerApplicatio

n

Remove-

CSServerApplicatio

CSRgsAudioFile

Export-

CsConfiguration

Invoke-

CsManagementStore

Replication

Move-

CsApplicationEndpoin

t

New-CsAnalogDevice

New-

CsClientPolicyEntry

New-


New-


Rule

New-

CsDiagnosticsFilter

New-CsIssuedCertId

New-

CsNetworkBWAlternat

ePath

New-

CsNetworkBWPolicy

New-

CsNetworkMediaBypa

ssConfiguration

New-CSRgsAnswer

New-

CSRgsCallAction

New-CSRgsHoliday

New-CSRgsQuestion

New-

CSRgsTimeRange

New-

CSRgsWorkflowProm

pt

New-CsSimpleUrl

14


Get-

CSOutboundTranslation

Rule

Get-CSPstnUsage

Get-CSPinPolicy

Get-

CSPrivacyConfiguration

Get-

CSProxyConfiguration

Get-CSPublicProvider

Get-

CSQoEConfiguration

Get-

CSRegistrarConfigurati

on

Get-CSRgsAgentGroup

Get-

CSRgsBusinessHours

Get-

CSRgsConfiguration

Get-CSRgsHolidaySet

Get-CSRgsQueue

Get-CSRgsWorkflow

Get-

CSRoutingConfiguration

Get-

CSServerApplication

Get-

CSSimpleUrlConfigurati

on

Get-CSSipDomain

Get-

CSStaticRoutingConfigu

ration

Get-CSTestDevice

Get-

CSTrunkConfiguration

Get-

CSUcPhoneConfigurati

Set-


y

New-


y

Remove-


y

Set-


New-


Remove-


Set-


ndpoint

New-


ndpoint

Remove-


ndpoint

Set-CSExUmContact

New-CSExUmContact

Remove-

CSExUmContact

Set-


figuration

New-


figuration

Remove-


figuration

Set-


figuration

n

Set-

CSSimpleUrlConfig

uration

New-

CSSimpleUrlConfig

uration

Remove-

CSSimpleUrlConfig

uration

Set-CSSipDomain

New-CSSipDomain

Remove-

CSSipDomain

Set-

CSStaticRoutingCo

nfiguration

New-

CSStaticRoutingCo

nfiguration

Remove-

CSStaticRoutingCo

nfiguration

Set-CSTestDevice

New-CSTestDevice

Remove-

CSTestDevice

Set-

CSTrunkConfigurati

on

New-

CSTrunkConfigurati

on

Remove-

CSTrunkConfigurati

on

Set-

CSUcPhoneConfigu

ration

New-

New-

CsSimpleUrlEntry

New-

CsSipProxyCustom

New-

CsSipProxyRealm

New-CsSipProxyTCP

New-CsSipProxyTLS

New-

CsSipProxyTransport

New-

CsSipProxyUseDefaul

t

New-

CsSipProxyUseDefaul

tCert

New-CsStaticRoute

New-


Computer

New-


Pool

New-CsVoiceRegex

New-

CsWebTrustedCACert

ificate

Remove-

CsAnalogDevice

ReMove-


ReMove-


Rule

ReMove-

CsNetworkConfigurati

on

ReMove-


Computer

15


on

Get-

CSUserReplicatorConfi

guration

Get-

CSUserServicesConfigu

ration

Get-

CSUnassignedNumber

Get-

CSVoiceConfiguration

Get-

CSVoicemailReroutingC

onfiguration

Get-

CSVoiceNormalizationR

ule

Get-CSVoicePolicy

Get-CSVoiceRoute

Get-

CSVoiceTestConfigurati

on

Get-

CSWebServiceConfigur

ation

Get-CSComputer

Get-CSPool

Get-CSService

Get-CSSite

Get-CSTopology


Set-


ation

Set-


ration

New-


ration

New-


figuration

Remove-


figuration

Set-


cy

New-


cy

Remove-


cy

Set-CSHostingProvider

New-

CSHostingProvider

Remove-

CSHostingProvider

Set-


New-


Remove-


Set-CSLisLocation

Remove-CSLisLocation

Set-CSLisPort

Remove-CSLisPort

Set-


Remove-


Set-CSLisSubnet

Remove-CSLisSubnet

Set-CSLisSwitch

Remove-CSLisSwitch

Set-

CSUcPhoneConfigu

ration

Remove-

CSUcPhoneConfigu

ration

Set-

CSUserReplicatorC

onfiguration

New-

CSUserReplicatorC

onfiguration

Remove-

CSUserReplicatorC

onfiguration

Set-

CSUserServicesCo

nfiguration

New-

CSUserServicesCo

nfiguration

Remove-

CSUserServicesCo

nfiguration

Set-

CsUnassignedNum

ber

New-

CsUnassignedNum

ber

Remove-

CsUnassignedNum

ber

Set-

CSVoiceConfigurati

on

Remove-

CSVoiceConfigurati

on

Set-

CSVoicemailRerouti

ngConfiguration

ReMove-


Pool

Set-CsAnalogDevice

Set-

CsApplicationServer

Set-

CsAudioTestServiceA

pplicationContact

Set-

CsCallParkServiceMu

sicOnHoldFile

Set-


Set-


Rule

Set-

CsConferenceServer

Set-CsDirector

Set-CsEdgeServer

Set-

CsManagementServe

r

Set-

CsMediationServer

Set-

CsMonitoringServer

Set-

CsNetworkConfigurati

on

Set-CsPstnGateway

Set-CsRegistrar

Set-CsSite

Set-


Pool

Set-

CsUserDatabaseStat

e

16


Remove-


ration

Set-CSAllowAllDomains

Set-CSAllowedDomain

New-CSAllowedDomain

Remove-

CSAllowedDomain

Set-CSAnnouncement


oint

Remove-


oint

Set-CSLocationPolicy

New-CSLocationPolicy

Remove-

CSLocationPolicy

Set-

CSManagementConnec

tion

Remove-

CSManagementConnec

tion

Set-


New-


Remove-


Set-


n

New-


n

Remove-


n

Set-

CSNetworkBandwidthP

olicyProfile

New-

CSNetworkBandwidthP

olicyProfile

Remove-

CSNetworkBandwidthP

olicyProfile

Set-

New-

CSVoicemailRerouti

ngConfiguration

Remove-

CSVoicemailRerouti

ngConfiguration

Set-

CSVoiceNormalizati

onRule

New-

CSVoiceNormalizati

onRule

Remove-

CSVoiceNormalizati

onRule

Set-CSVoicePolicy

New-CSVoicePolicy

Remove-

CSVoicePolicy

Set-CSVoiceRoute

New-CSVoiceRoute

Remove-

CSVoiceRoute

Set-

CSVoiceTestConfigu

ration

New-

CSVoiceTestConfigu

ration

Remove-

CSVoiceTestConfigu

ration

Set-

CSWebServiceConfi

guration

New-

CSWebServiceConfi

guration

Remove-

CSWebServiceConfi

Set-CsUserServer

Set-CsWebServer

Update-

CsAddressBook

Update-

CsUserDatabase

17



Route

New-


Route

guration

Approve-

CSDeviceUpdateRu

le

Reset-

CSDeviceUpdateRu

le

Restore-

CSDeviceUpdateRu

le

Enable-

CSHostingProvider

Disable-

CSHostingProvider

Test-

CSLisCivicAddress

Test-

CSLisConfiguration

Export-

CSLisConfiguration

CsViewOnlyAdministrator

The CsViewOnlyAdministrator role is permitted to run the cmdlets listed in the following table.

Get-

CSAccessEdgeConfigu

ration

Get-

CSAddressBookConfig

uration

Get-

CSAllowAllDomains

Get-CSAllowedDomain

Get-CSAnnouncement

Get-

CSArchivingConfigurati

on


Get-

Get-

CSExternalAccessPoli

cy

Get-


Get-


Endpoint

Get-CSExUmContact

Get-

CSFileTransferFilterCo

nfiguration

Get-

CSHealthMonitoringCo

nfiguration

Get-

Get-

CSOutboundTranslat

ionRule

Get-CSPstnUsage

Get-CSPinPolicy

Get-

CSPrivacyConfigurat

ion

Get-

CSProxyConfiguratio

n

Get-

CSPublicProvider

Get-

CSQoEConfiguration

Get-CSVoiceRoute

Get-

CSVoiceTestConfigura

tion

Get-

CSWebServiceConfigu

ration

Get-CSComputer

Get-CSPool

Get-CSSite

Get-CSService

Test-

CSNetworkInterface

Test-

CSSetupPermission

18



n

Get-

CSBandwidthPolicySer

viceConfiguration

Get-CSBlockedDomain

Get-CSCallParkOrbit

Get-

CSCdrConfiguration

Get-CSClientPolicy

Get-

CSClientVersionConfig

uration

Get-


Get-


Get-


er

Get-

CSConferencingConfig

uration

Get-


Get-

CSCpsConfiguration

Get-


uration

Get-

CSDeviceUpdateRule

Get-


guration

Get-


nfiguration

Get-


CSHostedVoicemailPo

licy

Get-

CSHostingProvider

Get-

CSImFilterConfiguratio

n

Get-

CSLisCivicAddress

Debug-

CSLisConfiguration

Get-CSLisLocation

Get-CSLisPort

Get-


Get-CSLisSubnet

Get-CSLisSwitch

Get-

CSLisWirelessAccess

Point


Get-

CSManagementConne

ction

Get-

CSManagementStore

ReplicationStatus

Get-


Get-

CSMeetingConfigurati

on

Get-

CSNetworkBandwidth

PolicyProfile

Get-

CSNetworkRInteregion

Route

Get-

CSNetworkInterSitePol

Get-

CSRegistrarConfigur

ation

Get-

CSRgsAgentGroup

Get-

CSRgsBusinessHour

s

Get-

CSRgsConfiguration

Get-

CSRgsHolidaySet

Get-CSRgsQueue

Get-CSRgsWorkflow

Get-

CSRgsHoursOfBusin

ess

Get-

CSRoutingConfigurat

ion

Get-

CSServerApplication

Get-

CSSimpleUrlConfigu

ration

Get-CSSipDomain

Get-

CSStaticRoutingConf

iguration

Get-CSTestDevice

Get-

CSTrunkConfiguratio

n

Get-

CSUcPhoneConfigur

ation

Get-

CSUserReplicatorCo

nfiguration

Get-

Get-CSTopology

Get-CSAnalogDevice

Get-

CSCommonAreaPhon

e

Get-CSCertificate

Get-

CSWindowsService

Get-CSAdUser

Get-CSUser

Get-CSClientPinInfo

Get-

CSVoiceConfiguration


Get-CsAdContact

Get-


plicationContact

Get-CsClientCertificate

Get-


Rule

Get-

CsTrustedApplicationC

omputer

Get-

CsTrustedApplicationP

ool

Get-CsUserAcp

Get-

CsUserDatabaseState

Get-CsUserPoolInfo

19


ccessNumber

Get-


onfiguration

Get-


tmfConfiguration

Get-

CSDialInConferencingL

anguageList

Get-CSDialPlan

icy

Get-CSNetworkRegion

Get-

CSNetworkRegionLink

Get-CSNetworkSite

Get-CSNetworkSubnet

CSUserServicesConf

iguration

Get-

CSUnassignedNumb

er

Get-

CSVoicemailReroutin

gConfiguration

Get-

CSVoiceNormalizatio

nRule

Get-CSVoicePolicy

CsHelpDesk

The CsHelpDesk role is permitted to run the cmdlets listed in the following table.

Get-


ation

Get-


ration

Get-CSAllowAllDomains

Get-CSAllowedDomain

Get-CSAnnouncement

Get-

CSArchivingConfiguratio

n


Get-

CSAVEdgeConfiguration

Get-

CSBandwidthPolicyServi

ceConfiguration

Get-CSBlockedDomain

Get-CSCallParkOrbit

Get-CSCdrConfiguration

Get-CSClientPolicy

Get-

Get-CSExUmContact

Get-

CSFileTransferFilterC

onfiguration

Get-

CSHealthMonitoringC

onfiguration

Get-

CSHostedVoicemailPo

licy

Get-

CSHostingProvider

Get-

CSImFilterConfiguratio

n

Get-

CSLisCivicAddress

Get-

CSLisConfiguration

Get-CSLisLocation

Get-CSLisPort

Get-


Get-

CSQoEConfiguratio

n

Get-

CSRegistrarConfigur

ation

Get-

CSRgsAgentGroup

Get-

CSRgsBusinessHou

rs

Get-

CSRgsConfiguration

Get-

CSRgsHolidaySet

Get-CSRgsQueue

Get-CSRgsWorkflow

Get-

CSRoutingConfigura

tion

Get-

CSServerApplication

Get-

CSSimpleUrlConfigu

Get-CsAdUser

Get-CsUser

Get-CSClientPinInfo

Lock-CSClientPin

Unlock-CSClientPin

Set-CSClientPin

Get-


Rule

Get-

CSWindowsService

Get-

CsNetworkInterface


Test-

CsFederatedPartner

Test-

CsGroupExpansion

Test-

CsAddressBookServic

e

Test-

CsAddressBookWebQ

20



ration

Get-


Get-


Get-

CSConferenceDisclaime

r

Get-


ration

Get-


Get-

CSCpsConfiguration

Get-


uration

Get-

CSDeviceUpdateRule

Get-


guration

Get-


nfiguration

Get-


ccessNumber

Get-


onfiguration

Get-

CSDialInConferencingDt

mfConfiguration

Get-

CSDialInConferencingLa

nguageList

Get-CSDialPlan

Get-CSLisSubnet

Get-CSLisSwitch

Get-

CSLisWirelessAccess

Point


Get-

CSManagementConn

ection

Get-

CSManagementStore

ReplicationStatus

Get-


Get-

CSMeetingConfigurati

on

Get-

CSNetworkBandwidth

PolicyProfile

Get-

CSNetworkInterRegio

nRoute

Get-

CSNetworkInterSitePo

licy

Get-

CSNetworkRegion

Get-

CSNetworkRegionLink

Get-CSNetworkSite

Get-

CSNetworkSubnet

Get-

CSNetworkConfigurati

on

Get-

CSOutboundTranslati

onRule

Get-CSPstnUsage

ration

Get-CSSipDomain

Get-

CSStaticRoutingCon

figuration

Get-CSTestDevice

Get-

CSTrunkConfiguratio

n

Get-

CSUcPhoneConfigur

ation

Get-

CSUserReplicatorCo

nfiguration

Get-

CSUserServicesCon

figuration

Get-

CSUnassignedNum

ber

Get-

CSVoiceConfiguratio

n

Get-

CSVoicemailRerouti

ngConfiguration

Get-

CSVoiceNormalizati

onRule

Get-CSVoicePolicy

Get-CSVoiceRoute

Get-

CSVoiceTestConfigu

ration

Get-

CSWebServiceConfi

guration

Get-CSComputer

Get-CSPool

uery

Test-CsAVConference

Test-CsClientAuth

Test-

CsDialInConferencing

Test-CsGroupIM

Test-CsIM

Test-CsPresence

Test-CsRegistration

Test-

CsPhoneBootstrap

Test-CsP2PAV

Test-

CsPstnOutboundCall

Test-

CsPstnPeerToPeerCal

l

Test-CsVoiceUser

Get-CsAdContact

Get-

CsRgsHoursOfBusine

ss

Get-CsUserAcp

Get-CsUserPoolInfo

Get-

CsAudioTestServiceA

pplicationContact

21


Get-

CSEnhancedEmergency

ServiceDisclaimer

Get-

CSExternalAccessPolicy

Get-


Get-

CSTrustedApplicationEn

dpoint

Get-CSPinPolicy

Get-

CSPrivacyConfiguratio

n

Get-

CSProxyConfiguration

Get-CSPublicProvider

Get-CSService

Get-CSSite

Get-CSTopology

Get-

CSAnalogDevice

Get-

CSCommonAreaPh

one

CsArchivingAdministrator

The CsArchivingAdministrator role is permitted to run the cmdlets listed in the following table.

New-CsArchivingPolicy

Get-CsArchivingPolicy

Set-CsArchivingPolicy

Remove-CsArchivingPolicy

Grant-CsArchivingPolicy

New-CsArchivingConfiguration

Get-CsArchivingConfiguration

Set-CsArchivingConfiguration

Remove-CsArchivingConfiguration

Get-CsUser

Export-CsArchivingData

Get-CsSite

Get-CsService

Get-CsPool

Get-CsComputer


Get-CsManagementStoreReplicationStatus


Get-CsUserPoolInfo

Set-CsArchivingServer

CsResponseGroupAdministrator

The CsResponseGroupAdministrator role is permitted to run the cmdlets listed in the following

table.

Get-CSRgsAgentGroup

Get-CSRgsHoursofBusiness

Get-CSRgsConfiguration

Get-CSRgsHolidaySet

Get-CSRgsQueue

Get-CSRgsWorkflow

Get-CSService

Get-CSUser

New-CSRgsWorkflowPrompt

Remove-CSRgsAgentGroup

Remove-CSRgsHoursofBusiness

Remove-CSRgsHolidaySet

Remove-CSRgsQueue

Remove-CSRgsWorkflow

Set-CSRgsAgentGroup

Set- CSRgsHoursofBusiness

22


Import-CSRgsAudioFile

Move-CSRgsConfiguration

New-CSRgsAgentGroup

New-CSRgsAnswer

New-CSRgsHoursofBusiness

New-CSRgsCallAction

New-CSRgsHoliday

New-CSRgsHolidaySet

New-CSRgsQuestion

New-CSRgsQueue

New-CSRgsTimeRange

New-CSRgsWorkflow

Set-CSRgsConfiguration

Set-CSRgsHolidaySet

Set-CSRgsQueue

Set-CSRgsWorkflow

Get-CsSite

Get-CsPool

Get-CsComputer



Get-CsManagementStoreReplicationStatus

Get-CsUserPoolInfo

CsLocationAdministrator

The CsLocationAdministrator role is permitted to run the cmdlets listed in the following table.

Get-CSNetworkSite

Get-CSNetworkSubnet

New-CSNetworkSite

New-

CSNetworkSubnet

Remove-

CSNetworkSite

Remove-

CSNetworkSubnet

Set-CSNetworkSite

Set-CSNetworkSubnet

Get-

CSLisCivicAddress

Test-

CSLisCivicAddress

Debug-

CSLisConfiguration

Publish-

CSLisConfiguration

Unpublish-

CSLisConfiguration

Set-CSLisLocation

Get-CSLisPort

Remove-CSLisPort

Set-CSLisPort

Get-CSLisSubnet

Remove-CSLisSubnet

Set-CSLisSubnet

Get-CSLisSwitch

Remove-CSLisSwitch

Set-CSLisSwitch

Get-

CSLisWirelessAccessPoint

Remove-


Set-


Get-CsSite

Get-CsService

Get-CsPool

Get-CSUser

Get-CsComputer



Get-

CsManagementStoreReplicationStatus

Get-CsUserPoolInfo


Grant-CSLocationPolicy

Export-CsLisConfiguration

Get-CsLisServiceProvider

Get-CsWebServiceConfiguration

Import-CsLisConfiguration

Test-CsLisConfiguration

Test-CsLocationPolicy

23


Get-CSLisLocation

Remove-

CSLisLocation

DNS Load BalancingMicrosoft Lync Server 2010 communications software introduces DNS load balancing, a software

solution that can greatly reduce the administration overhead for load balancing on your network.

DNS load balancing balances the network traffic that is unique to Lync Server 2010, such as SIP

traffic and media traffic. If you deploy DNS load balancing, you can eliminate the need for some

hardware load balancers, and greatly reduce the administration overhead related to some of the

hardware load balancers you still need to deploy.

DNS load balancing is supported for Front End pools, Edge Server pools, Director pools, and

stand-alone Mediation Server pools.

DNS Load Balancing on Front End Pools and Director Pools

You can use DNS load balancing for the SIP traffic on Front End pools and Director pools. With

DNS load balancing deployed, you still need to also use hardware load balancers for these pools,

but only for HTTPS traffic. The hardware load balancer is used for HTTPS traffic from clients over

ports 443 and 80.

Although you still need hardware load balancers for these pools, their setup and administration

will be primarily for HTTP traffic, which the administrators of hardware load balancers are

accustomed to.

DNS Load Balancing and Computers Running Earlier Versions

DNS load balancing is supported only by servers running Lync Server 2010 and Lync Server

2010 clients. Earlier versions of clients and Office Communications Server can still connect to

Front End pools and Director pools running DNS load balancing, but if they cannot make a

connection to the first server that DNS load balancing refers them to, they are unable to fail over

to another server in the pool. If you have only a few clients or servers running earlier versions, or

will soon be migrating these computers to Lync Server 2010, this may be tolerable. Alternatively,

you may achieve load balancing of connections from older clients and server by implementing

DNS round robin on the DNS Server. In this case, the DNS Server will reply back with a different

order of Front End IPs every time a DNS query reaches it, and this in turn will ensure that

connections from computers running earlier versions are load balanced.

Additionally, if you are using Exchange UM, only Exchange 2010 SP1 interoperates with Lync

Server 2010 DNS load balancing. If you use an earlier version of Exchange, you will not have

failover capabilities for users using Exchange UM capabilities, such as playing their Enterprise

Voice voicemail through their mailbox.

The following table summarizes the considerations for deciding whether to deploy DNS Load

balancing on a Front End pool.

24


DNS Load Balancing Decision Guidelines

Situation

DNS load

balancing

supported?

DNS load

balancing

recommended?

Hardware load

balancer (only)

recommended?

All or most users homed in the pool

run Lync Server 2010 clients.

Yes Yes

Many users homed in the pool still

running older clients.

Yes Yes

Interoperates only with other Lync

Server 2010 servers.

Yes Yes

Interoperates with many servers

running earlier versions of Office

Communications Server.

Yes Yes

Running Exchange UM with Exchange

2010 SP1 (or not running Exchange

UM)

Yes Yes

Running Exchange UM with earlier

versions of Exchange

Yes Yes

Deploying DNS Load Balancing on Front End Pools and Director Pools

Deploying DNS load balancing on Front End pools and Director pools requires you to perform a

couple of extra steps with FQDNs and DNS records.

A pool that uses DNS load balancing must have two FQDNs: the regular pool FQDN that is

used by DNS load balancing (such as pool01.contoso.com), and resolves to the physical

IPs of the servers in the pool, and another FQDN for the pool’s Web services (such as

web01.contoso.com), which resolves to virtual IP address of the pool.

In Topology Builder, if you want to deploy DNS load balancing for a pool, to create this extra

FQDN for the pool’s Web services you must select the Override internal Web Services pool

FQDN check box and type the FQDN, in the Specify the Web Services URLs for this Pool

page.

To support the FQDN used by DNS load balancing, you must provision DNS to resolve the

pool FQDN (such as pool01.contoso.com) to the IP addresses of all the servers in the

pool (for example, 192.168.1.1, 192.168.1.2, and so on).

DNS Load Balancing on Edge Server Pools

You can deploy DNS load balancing on either the external interface of your Edge Servers, the

internal interface, or both. If you do, you must be aware of some considerations.

25


Using DNS load balancing on the external interface of the Edge Servers causes a loss of failover

ability in the following scenarios:

Federation with organizations that are running previous versions of Office Communications

Server.

Instant message exchange with users of public instant messaging (IM) services, such as the

Windows Live network of Internet services, AOL, and Yahoo!, as well as XMPP-based

providers and servers, such as Google Talk and Jabber.

These scenarios will work as long as all Edge Servers in the pool are up and running, but if one

Edge Server is down, any requests for these scenarios that are sent to it will fail, instead of

routing to another Edge Server.

Using DNS load balancing on the internal interface of the Edge Servers causes a loss of failover

ability when external users use Exchange UM features. For example, when one of your users

checks voic email while outside your organization’s firewalls, if their request goes to an Edge

Server that is down, the request will fail instead of going through another Edge Server.

Deploying DNS Load Balancing on Edge Server Pools

To deploy DNS load balancing on the external interface of your Edge Server pool, you need the

following DNS entries:

For the Lync Server Access Edge service, you need one entry for each server in the pool.

Each entry must resolve the FQDN of the Lync Server Access Edge service (for example,

sipcontoso.com) to the IP address of the Lync Server Access Edge service on one of the

Edge Servers in the pool.

For the Lync Server Web Conferencing Edge service, you need one entry for each server in

the pool. Each entry must resolve the FQDN of the Lync Server Web Conferencing Edge

service (for example, webconfcontoso.com) to the IP address of the Lync Server Web

Conferencing Edge service on one of the Edge Servers in the pool.

For the Lync Server Audio/Video Edge service, you need one entry for each server in the

pool. Each entry must resolve the FQDN of the Lync Server A/V Edge service (for example,

avcontoso.com) to the IP address of the Lync Server A/V Conferencing Edge service on one

of the Edge Servers in the pool.

To deploy DNS load balancing on the internal interface of your Edge Server pool, you need one

DNS entry for each Edge Server in the pool. Each entry should resolve the internal FQDN of the

Edge Server pool (such as sipinternal.com) to the IP address of one of the Edge Servers in the

pool.

Using DNS Load Balancing on Mediation Server Pools

You can use DNS load balancing on standalone Mediation Server pools without need for a

hardware load balancer. All SIP and media traffic is balanced by DNS load balancing.

To deploy DNS load balancing on a Mediation Server pool, you must provision DNS to resolve the

pool FQDN (for example, mediationpool1.contoso.com) to the IP addresses of all the

servers in the pool (for example, 192.168.1.1, 192.168.1.2, and so on).

26


Preventing New Connections to Lync ServersMicrosoft Lync Server 2010 introduces a new feature that enables you to take a server offline (for

example, to apply software or hardware upgrades) without any loss of service to users. When you

specify the option to prevent new connections or calls to a server in a pool, it stops taking any

new connections and calls as soon as you implement this option. These new connections and

calls are routed through other servers in the pool. A server that is preventing new connections

allows its sessions on existing connections to continue until they naturally end. When all existing

sessions have ended, the server is ready to be taken offline.

When you prevent new connections to a Front End Server, some Lync Server 2010 features and

services rely on the new DNS load balancing feature to ensure that it functions properly. If you

are not using DNS load balancing on the pool, connections through these services may not be re-

routed to other servers during the period that the server is preventing new connections, and thus

when the server is taken offline some sessions and calls may be interrupted. The features that

rely on DNS load balancing to ensure that this option operates properly are as follows:

Microsoft Lync 2010 Attendant Conferencing Announcement application

Response Group application

Announcement application

Call Park application

For details about DNS load balancing, see DNS Load Balancing.

In addition to preventing new connections for all services on a server running Lync Server 2010,

you can also prevent new connections for individual Lync Server services. For example, this

method is useful in a situation where you need to apply a Lync Server update that does not

require the whole server to be shut down. Note that when you prevent connections for one

service, you must select a service as it is grouped and displayed in the Windows list of services.

For example, the Lync Server Front-End service and the data collection agent for Monitoring

Server are separate Lync Server services, but in the Windows services list they are consolidated

and shown as the RTCSrv.exe service. You can prevent new connections for the RTCSrv.exe

service, but you cannot prevent new connections for these two individual underlying Lync Server

services separately.

Running in a Virtualized EnvironmentMicrosoft Lync Server 2010 communications software supports virtualization topologies that

support all major workloads—instant messaging (IM) and presence, conferencing, and Enterprise

Voice. Windows Server 2008 R2 is required, and both Microsoft Hyper-V technology and VMware

are supported.

The supported topologies are as follows:

27


Lync Server 2010 Standard Edition server topology, supporting up to 2,000 users, for proof-

of-concept, pilot projects, and small businesses that do not need remote connectivity.

Data center topology, supporting up to 40,000 users.

Standard Edition Server Topology

This topology includes a physical host server running one virtualized Lync Server 2010 Standard

Edition server. You can also deploy an Edge Server (either physical or virtual). You may also

deploy Monitoring Server and/or Archiving Server on a physical server. Other server roles are not

supported in this topology.

The user capacity for a single virtualized Standard Edition server is 2,000 users. You can add

more user capacity by adding more virtualized Standard Edition servers. If you do so, each

virtualized server must run on a separate physical host server.

28


The server hosting the virtualized environment should meet the following requirements:

Hardware Requirements for the Server Hosting the Virtual Machines

Hardware component Minimum requirement

CPU 8 cores

Processor (recommended) 2.27 Gigahertz processor recommended for

best performance

Memory 16 gigabytes (GB)

Disk SAS drive with at least 500 GB

Network Two 1 gigabit per second (Gbps) network

adapters (for details, see information later in

this topic)

Both the physical host server and the virtual machine must run Windows Server 2008 R2 with the

software update described in Knowledge Base article 981836, "Network connectivity for a

Windows Server 2003-based Hyper-V virtual machine is lost temporarily in Windows Server 2008

R2," at http://go.microsoft.com/fwlink/?LinkId=201212.

The virtual machine running Standard Edition server must have 4 cores and 8 GB of memory

dedicated.

Both Hyper-V and VMware virtualization environments are supported

On both Hyper-V and VMware, this topology supports up to 2,000 users, with as many as 100

users concurrently connected to an A/V conference. Performance begins to degrade if more

users than this are connected.

Data Center Topology

The datacenter topology includes two options—one option with all server roles virtualized, and

another that supports a mixing of physical and virtualized servers.

Completely Virtualized Data Center Topology

The completely virtualized topology includes seven physical host servers running a total of 19

virtual machines, which run the Lync Server roles. All Lync Server 2010 workloads and server

roles are supported, including IM, Presence, Conferencing (including A/V conferencing and

application sharing), Enterprise Voice, Edge Server, Monitoring Server and Archiving Server.

The list of host servers, virtual machines, and hardware requirements for this topology at

maximum capacity (40,000 users) are shown in the following table. If you need to support fewer

users, you can scale down, with one virtual Front End Server for every 5,000 users and one

virtual A/V Conferencing Server for each 10,000 users.

29

http://go.microsoft.com/fwlink/?LinkId=201212


Host Servers, Virtual Machines and Hardware Requirements

Host Server Host server requirements

Virtual machines running on this

host

1 16 cores, 64 GB memory, dual 1 gigabit per

second (Gbps) network adapters

Four Front End Servers



Four Front End Servers



Four A/V Conferencing Servers



Two Directors



Two Edge Servers

6 8 cores, 32 GB memory , dual 1 gigabit per


One server running collocated

Monitoring Server and Archiving

Server



One Back End Server and one file

server

Each virtual machine must have 4 dedicated cores and 8 GB of dedicated memory.

All eight Front End Servers are combined into one Front End pool.

In addition to these virtualized components, your topology must also include Active Directory

servers, DHCP and Domain Name System (DNS) servers, and certificate authorities. These must

run on different servers than those hosting the virtualized Lync Server components.

All physical host servers and all virtual machines must run Windows Server 2008 R2 with the




Both Hyper-V and VMware virtualization environments are supported.

On both Hyper-V and VMware, this topology supports up to 40,000, with as many as 125 users

concurrently connected to an A/V conference. Performance begins to degrade if more users than

this are connected.

Mixed Data Center Topology

In the topology for a mixing of physical and virtual servers, all Front End Servers must be

virtualized. All other server roles can be a mixing of physical and virtual. For some server roles,

the reduced capacity of the virtualized topology causes you to need twice as many servers

running that role if you use virtual servers for the role instead of physical servers.

30



The list of server roles and their requirements for this topology at maximum capacity (40,000

users) are shown in the following table. If you need to support fewer users, you can scale down,

with one virtual Front End Server for every 5,000 users and one virtual A/V Conferencing Server

for each 10,000 users.

Host Servers, Virtual Machines, and Hardware Requirements

Server Role

Virtual or

Physical?

Number of Servers

Required

Host Server Requirements if

Role is Virtualized

Front End Server Must be virtual Eight 16 cores, 64 GB memory, dual

1 gigabit per second (Gbps)

network adapters

A/V Conferencing

Server

Either Four if virtual, two if

physical

16 cores, 64 GB memory, dual


network adapters

Director Either Two if virtual, one if

physical



network adapters

Edge Server Either Two 8 cores, 32 GB memory, dual


network adapters

Monitoring Server and

Archiving Server

(collocated)

Either One 8 cores, 32 GB memory, dual


network adapters

Back End Server and

File Server

Either One Back End

Server and One File

Server



network adapters

All eight Front End Servers are combined into one Front End pool.

In addition to these virtualized components, your topology must also include Active Directory

servers, DHCP and Domain Name System (DNS) servers, and certificate authorities. These must

run on different servers than those hosting the virtualized Lync Server components.

All physical host servers and all virtual machines must run Windows Server 2008 R2 with the




Both Hyper-V and VMware virtualization environments are supported.

On both Hyper-V and VMware, this topology supports up to 40,000 users, with as many as 125

users concurrently connected to an A/V conference. Performance begins to degrade if more

users than this are connected.

31



Managing Your Virtual Environment

We recommend you use Microsoft System Center Virtual Machine Manager (VMM) to manage

your virtualized Lync Server topology. You can use VMM with either Hyper-V or VMware.

By using VMM, you do not need to use Terminal Services or Remote Desktop Services for the

virtual machine management. Additionally, by using VMM you can view and manage

performance, as well as other components such as disk space. You can also save a virtual

machine as a template for creating new instances.

VMM uses the Windows PowerShell command line interface, so you can create VMM Windows

PowerShell scripts that integrate with Lync Server 2010 Management Shell to manage Lync

Server.

For details about VMM, see http://www.microsoft.com/systemcenter/en/us/virtual-machine-

manager.aspx.

Using VMM with VMware

To use VMM when you use VMware as your virtualization environment, you must use VMware

VSphere Hypervisor (ESXi), VMware VCenter Server, and VMware VSphere as your VMware

components. To use VMM with a VMware virtualized environment, see "Managing a VMware

Infrastructure in VMM" at http://go.microsoft.com/fwlink/?LinkId=201213.

Note:

If your virtualization deployment includes only VMware ESX, you must install VMware

VCenter Server, then start up vSphere client and point it to the FQDN (or IP) of the

machine running the VCenter Server. After you are connected, you can add the machines

in your data center. After you have added all the hosts and virtual machines to VCenter,

then can you connect VMM.

Getting Started Using VMM

To get started using VMM to manage your virtualized Lync Server topology, do the following:

1. In VMM, create a new host group named LS 2010.

2. In the Actions pane, click Add Host.

3. If your virtual environment is part of your Active Directory domain, select that option.

Otherwise, select the Windows Server-based host on a perimeter network, and click Next.

4. Install a VMM Agent on the host server. If the host server is on a perimeter network, you must

create a security key, which must then be available to the VMM Administrative Console.

5. Go back to the VMM Administrative Console and click Add Host.

6. Specify the machine name and the domain/machine name and security key, making sure that

VMM can find the host, and then click Next.

7. Once the host has been added, the four virtual machines should be available. In the VMM

Administrative Console, click the Virtual Machines button.

8. You will now see the Virtual Machines view, with the four virtual machines running Lync

Server listed.

32


http://www.microsoft.com/systemcenter/en/us/virtual-machine-manager.aspx

http://www.microsoft.com/systemcenter/en/us/virtual-machine-manager.aspx


Using System Center Operations Manager

You can use Microsoft System Center Operations Manager 2007 to monitor your virtualized

topology, just as you can with a physical topology. If you do so, you install Operations Manager

2007 R2 first, add the Lync Server Operations Manager pack, and then integrate it with VMM.

For details about installing the Lync Server Operations Manager management pack, see the

document “Monitoring Microsoft Lync Server 2010 (Release Candidate) with System Center

Operations Manager 2007 R2” on your installation media.

For details about integrating Operations Manager 2007 with VMM, see "How to Integrate

Operations Manager with VMM 2008 R2" at http://go.microsoft.com/fwlink/?LinkId=201214.

Migrating Applications Built on Microsoft Unified Communications Managed API (UCMA) 2.0 Core SDKMicrosoft Lync Server 2010 communications software works with Microsoft Unified

Communications Managed API (UCMA) 3.0 Core SDK. If you have external applications built on

UCMA 2.0 (which shipped with Office Communications Server 2007 R2), you can run these

applications in an environment that includes servers running Lync Server 2010.

If you run a UCMA 2.0 application, homed to an Office Communications Server 2007 R2 pool,

you can enable users homed on a Lync Server 2010 pool to call into the application.

To do so, be sure to follow the steps for migrating trusted service entries in Run Migration

Cmdlets in the Migration documentation. After you follow these steps, the trusted service entries

will exist on both the Office Communications Server 2007 R2 pool and the Lync Server 2010 pool,

and no further steps are needed for coexistence. Be sure to note that this copies only the trusted

service entries and route-related settings.

33


Technology

Planning for other features lync server 2010 (rc)