1. Open cmd
2. Type: nslookup
3. Type: set type=all
4. Type the SRV record to list its content

For OCS 2007 R2

• External
  • _sip._tls.domain.com
    • Usually points to Access EDGE FQDN on port 443 
  • _sipfederationtls._tcp.domain.com
    • Usually points to Access EDGE FQDN on port 5061
• Internal
  • _sipinternaltls._tcp.domain.com
    • Usually points to Pool name with correct sip domain on port 5061

For Exchange 2007/2010

• External autodiscover
  • _autodiscover._tcp.domain.com
    • Usually points to owa FQDN listener with NTLM negotiate on port 443

Prerequisites

1. Download and install OCS 2007 R2 Web Trust Tool on the Exchange 2010 server
   1. http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=ca107ab1-63c8-4c6a-816d-17961393d2b8 
   2. Locate and install the following files in elevated mode by running cmd.exe as administrator
      • vc_redistx64
      • UCMAredist.msi
      • CWAOWASSP.msi
2. If the Exchange 2010 server is running on Server 2008 R2 you also need to install the latest cumulative hotfix update for OCS 2007 R2 on the Exchange server
   1. http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=b3b02475-150c-41fa-844a-c10a517040f4
   2. Download and run ServerUpdateInstaller.exe
   3. Also download the latest update for UCMAredist that is not included in CU5
      • http://support.microsoft.com/?kbid=982614
   4. Reboot the server

Configuring Exchange 2010 RTM

NOTE: The below steps need to be done on all Exchange 2010 CAS servers in you deployment

1. Download and run the PowerShell Script found in the below link
   1. http://msunified.net/exchange-downloads/script-imexintegration-ps1/
   2. The script will not configure anything
   3. It takes backup of web.conf and  generates the configuration you manually need to add the web.conf file
   4. The script makes it easy to generate the correct syntax for populating the below keys 
2. Navigate to the web.conf file
   1. C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\Owa\web.conf
   2. Edit the file and search for the string IMPoolName
   3. Replace the three “add key” strings with the ones provided with the script
3. In Exchange Management Shell run the following command to configure OWA Virtual Directory

   • Get-OwaVirtualDirectory -Server "CasServer" | Set-OwaVirtualDirectory -InstantMessagingType 1

     • NOTE: The RTM documentation states OCS, but that don’t work. Use 1 as InstantMessagingType
4. Run IISreset in PowerShell

Configuring Exchange 2010 SP1

The Exchange 2010 SP1 guide is based on this great post written by Martin Sundström: http://msundis.wordpress.com/2010/06/21/integrate-ocs-2007-r2-with-exchange-server-2010-sp1-owa/ The configuration on Exchange is now moved from web.conf to the per server OWA Virtual Directory. I will definitely create a script automating the below process when I get more hands on :)

NOTE: The below steps need to be done on all Exchange 2010 CAS servers in you deployment 

1. Get the active Exchange 2010 certificate using this command in Exchange Management Shell 

   • Get-ExchangeCertificate | Where-Object {$_.Services -match "IIS"} | Get-ExchangeCertificate | fl thumbprint,subject

     • This command gets the active certificate on the local server, because only one certificate can have IIS as service at a time
2. Use the thumbprint and OCS pool FQDN in the command below

   • Get-OwaVirtualDirectory -Server "CasServer" | Set-OwaVirtualDirectory -InstantMessagingCertificateThumbprint 4DC1EE3506E06E971FF82AC8DD60015EAC11B21E -InstantMessagingServerName ocspool01.domain.local -InstantMessagingType OCS -InstantMessagingEnabled $true

     • NOTE: This time we use OCS as InstantMessagingType
3. Run iisreset

Configuring OCS 2007 R2

In order to allow the Exchange 2010 server to communicate with OCS using SIP containing presence and chat you need to add every Exchange 2010 CAS servers as authorized hosts on OCS.

1. On your OCS R2 Pool server configure authorized host
   • NOTE: Your user needs to be member of the RTCUniversalServerAdmins group
2. Open Office Communications Server R2 under Administrative Tool
3. Expand forest and Enterprise pool or Standard Edition Servers depending on you deployment
4. Right click your pool and choose properties->Front End Properties
5. On the Hosts Authorization tab
6. You need to add the Client Access server FQDN and configure as the below image 
   • NOTE: This is the FQDN of your subject name (CN) on the certificate used on the CAS server

• On OCS Front End you need to install the same cumulative update as we installed on the Exchange server if you have not already done it
  1. http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=b3b02475-150c-41fa-844a-c10a517040f4
  2. Download and run ServerUpdateInstaller.exe
  3. NOTE: It is good practice to have all OCS servers on the same hotfix level
  4. Reboot the server

Troubleshooting the Installation (RTM)

Next are a few troubleshooting steps that can assist with some of the more common problems encountered with Exchange/OCS integration. I found these valid troubleshooting steps on Rand Morimoto’s post: http://www.networkworld.com/community/node/47348

Configuring the Firewall on the CAS Server

If the Client Access Server has the Windows Firewall enabled, it might need an exception to enable OCS 2007 R2 to communicate with it. To create the exception, perform the following steps:

1. From the Control Panel, open Windows Firewall 
2. On the left side of the Windows Firewall window, click .“Allow a Program Through Windows Firewall.
3. Click Add Program; then click Browse.
4. Browse to C:\Windows\System32\inetsrv and select w3wp.exe.
5. Click Open and then click OK twice to apply changes and close the window. Be sure to perform this step on all CAS servers with IM integration enabled.

User Configuration

• Before the user community can utilize the IM features, they must be “provisioned” for Office Communications Server R2 and must be enabled for Enhance Presence. When the user is initially enabled on OCS 2007 R2, he will automatically be enabled for Enhanced Presence.
• Users must also have a valid SIP proxy address for the OWA IM integration component to enable the IM Integration UI.
• When attempting to view the Instant Messaging contact list, a user might receive a notification that states
  • Instant Messaging Isn’t Available Right Now. The Contact List Will Appear When the Service Becomes Available.
• If this occurs, perform the following steps:
  1. Using the same user account, confirm that you can access the IM services using the Office Communicator 2007 R2 client.
  2. If functional, confirm that the OCS Server name is properly entered in the Web.Config file of the CAS server.
  3. Also confirm the configuration of the Authorized Hosts option on the OCS pool contains all IM Integrated Client Access Servers.

OWA Certificate Error

If OWA cannot locate the certificate, an error stating The Local Certificate Specified Was Not Found in the Store for the Local Computer appears.

In this case, confirm that the value of the OCSCertificateIssuer and OCSCertificateSerialNumber fields in the Web.Config file are correct. Also ensure that there are blank spaces between every two characters in the serial number to separate octets in the string.

References

TechNet: http://technet.microsoft.com/en-us/library/ee633458%28EXCHG.140%29.aspx
Chris and Robin’s Technology blog: http://chrislehr.com/2009/11/implementing-integrated-ocs-in-owa-2010.htm
Martin Sundström: http://msundis.wordpress.com/2010/06/21/integrate-ocs-2007-r2-with-exchange-server-2010-sp1-owa/
Rand Morimoto: http://www.networkworld.com/community/node/47348

• Inside Client
• Customer OCS Front End
• Customer OCS EDGE
• Outside Federated Client
• Firewall

The Symptoms

• SIP, Presence and IM working fine
• The call gets connected but fails with no media connectivity after just a few seconds
• No RTP traffic on any machine in Network Monitor
• In the SIP log we could see that the client used NAT AV EDGE IP, not public IP
  • Therefore no media connectivity because the external client and external EDGE cant reach that IP
  • When Internal Client and Federated Client was on the same subnet audio and video worked fine

The Solution

Read Rick Varvel’s blog post up and down and studied all the fine print and found that the Internal Client has to be able to resolve the Public IP of the AV EDGE server. This is an issue when the internal DNS is authoritative for the external domain without all external entries. 

Below are the complete steps to set up OCS 2007 R2 EDGE when behind NAT

1. Implement OCS 2007 R2 EDGE with at least two NIC’s
   • One Internal
   • One or more External
   • When you have more than one external NIC beware of the Strong Host Model feature in Server 2008 where NIC’s don’t share gateways and media flow works different
2. Configure the firewall to perform DNAT inbound and SNAT outbound for the A/V Edge external interface
3. Configure the Internal NIC with an IP address and FQDN that is resolvable from you internal subnets
4. Configure the External NIC’s with NAT’ed IP addresses, not the public ones because you are behind NAT
5. Make sure that the OCS 2007 R2 EDGE server can resolve all the external FQDN’s with the public IP addresses
   • Add them in the external DNS
   • Or add them in the local hosts file
6. Make sure that the A/V EDGE public IP and FQDN is resolvable from the Internal Client subnets
7. Make sure that the OCS 2007 R2 EDGE server knows it is behind NAT
   • On your edge server goto: start->run-> type in compmgmt.msc
   • Expand Services And Applications
   • Expand Office Communications Server
   • Right-click the OCS EDGE entry and choose properties
   • Under A/V EDGE server make sure that the “External IP address is translated by NAT” check mark is checked
   • Press apply and exit
   • Restart the OCS EDGE services

Resources

Rick Varvel: http://blogs.technet.com/rickva/archive/2009/04/03/Configuring-A_2F00_V-Edge-Service-for-NAT.aspx
Mino – The UC Guy: http://theucguy.wordpress.com/2009/03/04/the-ocs-2007-r2-edge-and-nat/
Elan Shudnow – Audio/Media Negotiation: http://msunified.net/2009/08/30/office-communications-server-2007-r2-audiomedia-negotiation/
Inside OCS – Ports required for OCS 2007 R2 EDGE: http://blog.insideocs.com/2008/08/20/what-ports-do-i-need-to-open-on-my-firewall/
msunified.net – Single consolidated EDGE server clarified: http://msunified.net/2009/07/01/single-consolidated-edge-server-clarified/

Part one – Before you install OCS 2007 R2 binaries

• Open powershell as administrator and run the following commands
  • Import-Module ServerManager
  • Add-WindowsFeature as-net-framework,desktop-experience,telnet-client
    • This installs the following features
      • [As-Net-Framework] – .Net Framework 3.5 SP1
      • [Desktop-Experience] – Desktop Experience
      • [Telnet-Client] – Telnet Client (recommended not required)
• Request the Hotfix that is described in KB975858 for Windows Server 2008 R2
  • You need to request it, then you recieve a link by email, from there you can download and install it
• Install the prerequisites for the specific role as described in part three
• Run Windows Update untill everything is updated
• Install the OCS 2007 binaries for the role you are installing

Part two – After you install OCS 2007 R2 binaries

• When you try to activate OCS 2007 R2 Standard Edition, Enterprise Edition or Edge Server role when all windows updates are installed it fails
  • Download and install OCSASNFix.exe
  • Re-run the activation wizard
• Download and install the latest cumulative updates for OCS 2007 R2
  • I recommend downloading ServerUpdateInstaller.exe that features all the updates and will install the ones necessary for the specific role
  • You need to manually update the Pool DB
    • Guide for updating the pool DB can be found here: http://msunified.net/2009/11/08/how-to-install-ocs2009-dbupgrade/
  • After installing the latest cumulative updates I have experienced that some services can’t start when you reboot the server, the symptoms are
    • It takes long time before you can RDP the server after reboot
    • When you finally log in you find that the Front End, EDGE or Mediation service has not started
    • In the eventviwer you find something about WMI
    • When you start the services everything works fine
    • To resolve this, see this post: http://msunified.net/2010/04/09/after-installing-the-latest-cumulative-updates-to-ocs-2007-r2-some-services-dont-start/
• If you have XP or Vista clients in your enterprise change the default NTLM security settings from 128-bit encryption to “no minimum”
  • Start secpol.msc on a Windows Server 2008 R2 operating system server.
  • Click to select Local Policies and then click Security Options node.
  • Make sure that the following values of the policies are set to “No Minimum.”
    • Network Security: Minimum session security for NTLM SSP based (including secure RPC)
    • Network Security: Minimum session security for NTLM SSP based (including secure RPC) servers
    • Read more about it here: http://technet.microsoft.com/pl-pl/library/dd566199(WS.10).aspx

Part three – Commands to install the necessary prerequisites for OCS 2007 R2 on Windows Server 2008 R2

Front End on Windows Server 2008 R2

• Import-Module ServerManager
• Add-WindowsFeature web-windows-auth,web-mgmt-compat,web-mgmt-console,web-http-logging,msmq-server,msmq-directory,was-process-model,was-config-apis,rsat-adds

Installs the following components:

• [Web-Windows-Auth] – Windows Authentication
• [Web-Mgmt-Compat] – IIS 6 Management Compatibility
• [MSMQ-Server] – Message Queuing Server
• [MSMQ-Directory] – Directory Service Integration
• [RSAT-ADDS] – Active Directory Domain Services Tools
• [WAS-Process-Model] – Process Model
• [WAS-Config-APIs] – Configuration APIs
• [Web-Mgmt-Console] – IIS Management Console
• [Web-Http-Logging] – HTTP Logging
• [PowerShell] – Windows PowerShell

The last 3 in the list are not required, but they are highly recommended. IIS 7.0 Management Console is IMHO much easier to use than the IIS 6.0 version. The logging tools often come in handy when troubleshooting OCS IIS issues.

NOTE: If you are to run the create pool wizard from the Front End server against SQL 2008, you also need the MS SQL Native Client: X64 Package (sqlncli.msi) – 7963 KB
Also check out this post of mine whether to run create pool on OCS Front End or Back End SQL server: http://msunified.net/2009/08/11/create-pool-%e2%80%93-run-on-ocs-or-sql-server/

Office Communicator Phone Edition deployment on Windows Server 2008

• Import-Module ServerManager
• Add-WindowsFeature Web-Static-Content

Installs the following components in addition to Front End prerequisites:

[Web-Static-Content] – Static Content

NOTE: It exists default MIME types for both the .xml and the .cat extensions that is used by the updater. There is however no default for the .nbt extension and you need to configure it manually. See this post on how to do it http://www.codesalot.com/2010/communicator-phone-edition-update-issues/

Monitoring Server on Windows Server 2008

• Import-Module ServerManager
• Add-WindowsFeature msmq-server,msmq-directory

Installs the following components:

• [MSMQ-Server] – Message Queuing Server
• [MSMQ-Directory] – Directory Service Integration

CWA Server on Windows Server 2008

• Import-Module ServerManager
• Add-WindowsFeature web-windows-auth,web-digest-auth,web-basic-auth,web-mgmt-compat,web-mgmt-console,web-common-http,web-ISAPI-ext,web-ISAPI-filter,web-request-monitor,web-http-redirect,web-http-logging

Installs the following components:

• [Web-Windows-Auth] – Windows Authentication
• [Web-Digest-Auth] – Digest Authentication
• [Web-Basic-Auth] – Basic Authentication
• [Web-Mgmt-Compat] – IIS 6 Management Compatibility
• [Web-Mgmt-Console] – IIS Management Console
• [Web-Common-Http] – Common-http-features
• [Web-ISAPI-Ext] – ISAPI Extensions
• [Web-ISAPI-Filter] – ISAPI Filters
• [Web-Request-Monitor] – Request Monitor
• [Web-Http-Redirect] – HTTP Redirection
• [Web-Http-Logging] – HTTP Logging

Mediation Server on Windows Server 2008

• Import-Module ServerManager
• Add-WindowsFeature rsat-adds

Installs the following components:

• [RSAT-ADDS] – Active Directory Domain Services Tools

References:
For base OS prerequisites: http://support.microsoft.com/kb/982021
For supporting OCS 2007 R2 after raising the domain functional level: http://support.microsoft.com/kb/982020

The Problem 

• I have experienced this issue on Enterprise Front End servers and Mediation servers
• The after reboot it takes for ages to be able to connect through RDP, ping works fine
• When you finally log in you find that the Front End or Mediation service has not started
• When you start the services everything works fine

The Solution 

• Set the services below to automatic start
  • [Winmgmt] – Windows Management Instrumentation
  • [Keyiso] – CNG Key Isolation
  • [WMIapsrv] – WMI Performance Server
  • [Rasman] – Remote Access Connection Manager
• On the Enterprise Front End server set the rtcsvr dependent on the above services
  • Open Command Prompt as administrator and run the below command
  • sc config rtcsrv depend= WinMgmt/KeyIso/WmiApsrv/rasman 
• On the Mediation server set the rtcmedsrv dependent on the above services
  • Open Command Prompt as administrator and run the below command
  • sc config rtcmedsrv depend= WinMgmt/KeyIso/WmiApsrv/rasman 

I have seen similiar problems talked about in the below blogposts:
by Mino – The UC Guy: http://theucguy.wordpress.com/2009/05/13/ocs-2007-r2-server-loses-network-connection-on-server-startup/
by Aaron Tiensivu: http://blog.tiensivu.com/aaron/archives/1909-OCS-2007-R2-services-hang-at-Starting-on-reboot-with-Server-2008.html

The EDGE server gave the following Event ID:    

• Source: OCS Web Conferencing Edge Server
• Event ID: 41993
• Level: Error
• Description:  Failed to process data received from the client

That did not tell me much so I checked the Front End server. It had the following Event ID:

• Source: OCS Data MCU
• Event ID: 41059
• Level: Error
• Description:  Failed to connect external users because the download URL is invalid. 

It was now clear to me that the external web farm FQDN had to be wrong so I checked the Meeting Settings at pool level. The “External URL for meeting content download” was empty. Also the addressbook URL was empty. I decided to set the external web farm FQDN and found a way using lcscmd. After using lcscmd as described below external Live Meeting users could connect just fine. With the below steps I was able to set the external webfarm FQDN.

NOTE: PoolName in an Enterprise Edition deployment is the full FQDN name like ocspool01.domain.local. In a Standard Edition deployment you only need the Front End Server name like ocs-server and do not use FQDN

Step 1. Check current settings
To check the current URLs configured for these services, you can use LCSCMD.exe, and run the following:
Lcscmd /web /action:ListWMISettings /poolname:poolName 
 To retrieve the settings, check out the created html in the location provided after the command

Step 2. Update External URL
To update the external URL, you need to run the following command:
Lcscmd /web /action:updatepoolurls /externalwebfqdn:WebfarmFQDN /poolname:poolname   

Step 3. Check the settings again
Rerun the line stated in Step 1 to check your settings again, and check the created html file:
Lcscmd /web /action:ListWMISettings /poolname:poolName  

To clear the external URL in one step, just run the following:
Lcscmd /web /action:clearpoolexternalurls /poolname:poolName    

For more information, check the following link: http://support.microsoft.com/kb/938288
Thanks to: http://www.pro-exchange.eu/modules.php?$1&name=News&file=article&sid=971

To apply the hotifx, you must have the following software installed.

• OCS administration tools
• MS SQL Native Client
  • X64 Package (sqlncli.msi) – 7963 KB
• If you decide to install SQL 2008 Client Tools, SQL 2005 Service Pack 2 (SP2) Backward Compatibility must also be installed.
• To install the  SQL 2005 Service Pack 2 (SP2) Backward Compatibility you need to download and install
  • Microsoft SQL Server 2005 Management Objects Collection
    • X64 Package (SQLServer2005_XMO_x64.msi) – 14675 KB
  • Microsoft SQL Server 2005 Backward Compatibility Components
    • X64 Package (SQLServer2005_BC_x64.msi) – 18516 KB
• Finally run the patch with the following command when on a OCS Enterprise deployment
  • OCS2009-DBUpgrade.msi POOLNAME=poolname

If the installation failes check Scott Oseychik’s post about SQL won’t allow update here: http://blogs.msdn.com/scottos/archive/2009/08/21/installation-of-ocs-2007-r2-hotfix-package-969834-may-fail-if-sql-settings-have-been-changed.aspx

View the full technical article here: http://support.microsoft.com/kb/969834

Check out the latest Nov 2009 updates released for the different Office Communications Server 2007 R2 server roles as described in KB968802. This applies to both the Standard and Enterprise Editions.

A very important and welcome addition to assist the patch management process is the “Cumulative Server Update Installer” (ServerUpdateInstaller.exe) delivered as part of this release. Instead of having to determine and manually applying the relevant patches to the various R2 server roles, this tool relieves the administrator from those tedious chores by applying all updates for the appropriate server role in just one click. You can also use this tool on the command line with the switches /silent, /forcereboot and /extractall.

If not already present, you shoud also apply the update* for the Office Communications Server 2007 R2 Back-end Database (KB969834).

Download for the updates (.msp), executable (.exe) and installer (.msi) can be obtained here.
Here is a good guide on how to install the updates: http://blogs.technet.com/ucspotting/archive/2009/11/26/3296447.aspx

To implement this for Contoso, we would create a zone “_sipinternaltls._tcp.contoso.com” and zone “sip.contoso.com.” Notice that these are two zones – not two records in one “contoso.com” zone. A zone is a name resolution boundary in the hierarchical DNS namespace. By configuring the internal DNS server to be authoritative only for these two names, clients will continue resolving other names in the contoso.com domain as they always have.

Coincidentally, over on his blog, Geoff Clark has just suggested the same thing. He describes the problem and suggests the same solution but shows a method of creating the zone on a Windows DNS server via the DNS management console. Unfortunately, there is a limitation in the management console that is not present in the underlying Windows DNS implementation. This limitation required Geoff to create the zone as “_tcp.contoso.com” when what we would really like is a zone named “_sipinternaltls._tcp.contoso.com.”

This limitation in the user interface can be resolved by creating the zones and the records using the Dnscmd command line tool. For Contoso, here are the required commands:

dnscmd . /zoneadd _sipinternaltls._tcp.contoso.com. /dsprimary
dnscmd . /recordadd _sipinternaltls._tcp.contoso.com. @ SRV 0 0 5061 sip.contoso.com.
dnscmd . /zoneadd sip.contoso.com. /dsprimary
dnscmd . /recordadd sip.contoso.com. @ A 172.16.45.12

Of course, you’ll need to make the appropriate changes for your environment. If you are not running the command on your Windows DNS server, you will need to replace the first dot with your server name. You may also prefer a different zone type than “dsprimary.” If so, change the zoneadd commands appropriately. I doubt that your pool’s IP address is the same as my example but, if you have followed me this far, you already know what to change there.