Recently I have been troubleshooting and doing health checks on a couple of Lync systems. When troubleshooting it is good to know what patch level your servers are on, whether they are on the same patch level or the newest patch level.
I discovered at one client that the Edge servers in DMZ was being patched through Windows Update, but the internal Front End servers where not being patched, they where not part of the patch system the customer where enforcing. The result was that at one point, with the january 2014 cumulative update on the Edge server and the RTM patch level on the Front End servers, the gap became too large and the it ended up with the Front End servers not supporting and working with the Edge AV relay server. We saw the error occur with unsupported realy server in the diagnostics header before the Front End servers even tried setting up the media traffic on the Edge servers. Quite a strange problem to troubleshoot, but best practice is that all servers should be on the same patch level. Patching the internal Lync servers solved the issue.
Here is some notes on finding what patch level your servers have
- To find the patch level of your Lync server, the easiest way is looking at the installed components under control panel and programs and features
- The cool way to do it is to use PowerShell script
- Check a scritp I developed for this: https://msunified.net/2014/05/05/script-to-find-current-cumulative-updates-on-lync-servers-in-a-deployment/
- Also check out a similar script developed by MVP Pat Richard: http://www.ehloworld.com/2641
- Do not use WMI quiries because it will get the MSI package to reconfigure itself: http://powershell.org/wp/forums/topic/alternatives-to-win32_product/
- I see there is a lot of blogposts using wmi quiries like these, do not use them.
- Get-WmiObject -query ‘select * from win32_product’ | where {$_.name -like “Microsoft Lync Server*”} | ft Name, Version -AutoSize
- You can also just output the core components using this oneliner
- Get-WmiObject -query ‘select * from win32_product’ | where {$_.name -like “Microsoft Lync Server*core components*”} |ft Name, Version -AutoSize
- A good way to check the patch number with what time it was deployed I check the list in this blogpost by Murat
- Since all servers should be at the same patch level, it is a good practice to check installed version on all of the servers with core components installed, including trusted servers
- To find what servers have core components installed, you can run this cmdlet
- Get-CsComputer | ft fqdn
- This will give you all involved servers, including gateways which you should ignore
- Remember, all servers with UCMA installed, like Exchange, should be patched for Lync as well
- When patching your servers it is a good thing to stop all Lync services first, patch the server and then restart the services
- Reboot is not required after this procedure
- For a more detailed description on how to patch your servers I find this blogpost to be most helpful by Charbel Hanna
- It is also a good practice to patch the clients the same time you patch the servers, since each, client and server, may be part of a solution to a problem
- If you to have strange errors like not being able to forward calls, check for pending windows updates, install them and reboot the server
January 24th 2013 I had the honour to speak at the 
msunified.net 
