Advanced Tips. This appendix covers tips for how to deploy Live Communications Server 2005 SP1 in a resource. Deploying in a Resource Forest APPENDIX

Transcription

1 APPENDIX Advanced Tips This appendix covers tips for how to deploy Live Communications Server 2005 SP1 in a resource forest. In addition, it includes two helpful flowcharts: one to help you determine which prep steps to run to meet your Active Directory infrastructure requirements and the other to help you keep track of the sequence of steps for deploying a Standard Edition Server or Enterprise pool. Deploying in a Resource Forest Many organizations deploy multiple Active Directory forests for various reasons. To allow autonomy, organizations may allow each of their business groups to host their own forest. Other organizations might choose to separate business functions into different forests to reduce dependencies and risk to business disruption from IT activity. Organizations have different and varying business reasons for deploying a resource forest. This document details how to deploy Live Communications Server in a resource forest Active Directory. An Active Directory resource forest is a forest dedicated to deploying server infrastructure such as DHCP, DNS, Microsoft Exchange Server, and Microsoft Live Communications Server that relies on Active Directory. Although nothing restricts creating user accounts in the resource forest, user accounts are mostly created in separate Active Directory forests to maintain the clear separation of user infrastructure versus server infrastructure. Active Directory forests where only users are deployed will be referred to as user forests in this appendix. The Resource Forest Model sidebar is an excerpt from the TechNet article at igdrbp_2.mspx; it defines what an Active Directory resource forest is. 351

2 352 APPENDIX ADVANCED TIPS RESOURCE FOREST MODEL A separate forest is used to manage resources in the resource forest model. Resource forests contain only the resources and any user accounts required for service administration or those accounts that are used to provide alternate access to the resources within the forest. User accounts are held in the organizational forest(s) associated with the organization. Forest trusts are established to provide resource access to the forests where the user accounts reside. Resource forests are used to provide service isolations to protect areas of the network that need to maintain high availability. For example, an organization with a manufacturing facility can use this design to ensure the availability of the manufacturing resources even if the network connectivity between this forest and the organizational forest is unavailable. Advantages The advantages of the resource forest model include the following: Autonomy from service owners in the other forests: Because resources are managed in their own forest, it has complete autonomy of its data and services from other service owners in the organization. Isolation from service owners in the other forests: Because resources are managed in their own forest, its data and services are completely isolated from other service owners in the organization. Explicit setup of trusts: The members of each organizational forest do not automatically participate in trust relationships between forests. These relationships must be set up explicitly, either at the domain level or at the forest level, enabling increased control over which trusts should exist. Disadvantages The disadvantages of the resource forest model include the following: Costly to implement: This is an expensive model to implement from an administrative point of view. Additional personnel must be trained to maintain the forests, and additional hardware and software must be acquired to support the model. No default Kerberos authentication between forests: By default, two forests cannot use Kerberos v5 authentication between them. However, a forest-level trust can be implemented to provide this capability. No single global catalog of objects: Global catalogs do not replicate across forest boundaries. To get a unified view across multiple forests, directory synchronization software such as Microsoft Metadirectory Services must be implemented, which adds to the administrative burden. Active Directory Requirements Before you can deploy Live Communications Server in a resource forest topology, you must create a resource forest if one doesn t already exist. Creating a resource forest is no different from creating a new Active Directory forest. The only possible difference is you likely won t need to create multiple child domains. A resource forest with a single domain is often sufficient.

3 APPENDIX ADVANCED TIPS 353 If the resource forest hosts its own DNS service integrated with Active Directory, then the user forest s DNS must be able to resolve DNS queries to the resource forest, as explained in the following TechNet article: 517b4fa c fb56fabb85e1033.mspx?mfr=true. Different options are possible, as documented in this TechNet article: windowsserver2003/technologies/activedirectory/mtfstwp.mspx#ehaac. You can achieve this using delegation defined at the root DNS server, specifying DNS conditional forwarding, or adding an entry to the Root Hints list in the root DNS server. To allow the user forest s DNS service to resolve DNS queries to the resource forest, launch the DNS MMC snap-in (dnsmgmt.msc) from the Administrative Tools folder. Select the NETBIOS name of the user forest in the scope pane. Double-click the Root Hints entry shown in the status pane. The property page will appear. In the Root Hints tab, click Add. The New Resource Record property page will appear. In the Server Fully Qualified Domain Name (FQDN) field, type the FQDN of the root domain of the resource forest. In the IP Address field, enter the IP of the resource forest s primary DNS server. This is usually the primary domain controller of the root domain. Click OK to finish your configuration. For users to have single sign-on (SSO) experience when logging on to Live Communications Server using Microsoft Office Communicator, a minimum of a one-way trust relationship must be created. The direction of the trust is from the resource forest to the user forest, with the resource forest trusting the user forest. If the current domain functional level for both forests is Windows Server 2003, then the trust relationship can be forest level; otherwise, you must create domain-level trusts. Note If the trust level between the forest is not a forest-level trust, then the Live Communications Servers must be configured for NTLM authentication only. Kerberos authentication will fail. Open the property pages of the home server/pool to configure this authentication protocol in the Live Communications Server s Admin Tools MMC snap-in, as illustrated in Figure A-1. To determine the forest s domain functional level, launch the Active Directory Domains and Trusts MMC snap-in from the Administrative Tools folder. To raise the domain functional level, see the following TechNet article: library/5084a49d-20bd-43f0-815d-88052c9e2d mspx?mfr=true. To create a one-way domain- or forest-level trust from the resource forest to the user forest, launch the Active Directory Domains and Trusts MMC snap-in from the Administrative Tools folder using a computer joined to the user forest. Use a user account member of the Domain Administrators group from the root domain of the user forest. Right-click the forest FQDN node in the scope pane, and select Properties. Click the Trusts tab. Click the New Trust button. This will launch the New Trust Wizard. Click Next to go past the welcome page. In the Name field, type the FQDN of the resource forest, and then click Next. On the Trust Type page, select the Trust with a Windows Domain radio button option, retype the name of the domain, and click Next and finally Finish to complete the wizard.

4 354 APPENDIX ADVANCED TIPS Figure A-1. Configuring Live Communications Server for NTLM authentication To illustrate with an example, Figure A-2 shows two Active Directory forests: the user forest called zulu.local and the resource forest named touareg.local. Note the red arrow indicates a one-way forest-level trust between the two forests. A pool is deployed in the resource forest touareg.local. This pool s FQDN is srv.touareg.local. One-Way trust Active Directory Active Directory srv.touareg.local LCS 2005 Pool User Forest zulu.local Resource Forest touareg.local Figure A-2. One-way trust configuration between Active Directory forests

5 APPENDIX ADVANCED TIPS 355 To verify the trust relationship is working properly, select the trust entry. When using the Active Directory Domains and Trusts MMC snap-in from the user forest, this trust entry will appear in the incoming trusts table. If viewing this trust from the resource forest, this trust entry will appear in the outgoing trusts table. Click the Properties button after selecting the trust entry. To confirm the trust relationship, click the Validate button from the property page. You can find more details about how to determine trust relationship configurations in the following Microsoft article: This completes the minimum Active Directory requirements for a resource forest topology. Next, we describe the requirements necessary to deploy Live Communications Server in this resource forest. DNS Requirements Most organizations that deploy Live Communications Server use the automatic configuration setting when deploying Communicator instead of the manual configuration, which is the default setting. Using the automatic configuration setting removes the need to configure each Communicator client with the user s home server/pool FQDN setting. When deploying Communicator to thousands or tens of thousands of users, the logistics of communicating each user s FQDN becomes difficult and costly because this effort may result in support calls. To use the automatic configuration of Communicator, you must define a DNS SRV record for SIP in the authoritative DNS server(s) in the user forests. If the resource forest has its own DNS service, it is not necessary to create an SRV record for SIP in the resource forest since only users will need to query it. To add a DNS SRV record for SIP, launch the DNS MMC snap-in for the root domain of the user forest. Expand the root node in the scope pane. Expand the Forward Lookup Zones node. Expand the user forest FQDN node (not the node that starts with _msdcs.<domain>) until the _tcp node is shown. Right-click the _tcp node, and select Other New Records. The Resource Record Type dialog box will appear. Search for the service location (SRV) in the Select a Resource Record Type field. Click Create Record. The New Resource Record property page will appear. When making sure the entire resource forest deployment works, it s easier not to get confused with certificates just yet. Leave the Protocol field set to _tcp. Specify the FQDN of the Standard Edition Server or Enterprise pool if using a single pool in the resource forest or the FQDN of the Director if using multiple pools in the Host Offering This Service field. Depending on whether you plan to use TLS or TCP for internal client-to-server connections, you ll create a different type of SRV record. The following SIP SRV records are supported: 1. _sipinternaltls._tcp.<domain> 2. _sipinternal._tcp.<domain> 3. _sip._tls.<domain> 4. _sip._tcp.<domain>

6 356 APPENDIX ADVANCED TIPS If you require clients to connect to Live Communications Server over TLS, then your SRV record should be of the format 1 or 3. If clients are connecting to Live Communications Server over TCP, then the SRV record should be of the format 2 or 4. Only Communicator will understand SRV records of the form 1 and 2. Specify one of the previous four options in the Service field. If using TCP, specify 5060 in the Port Number field. If using TLS, specify 5061 in the Port Number field. Click OK to finish. To verify that the SRV record is resolvable, start a Command Prompt window (cmd.exe), and enter nslookup. Type the command set qq=srv in the session. Then type the SRV record created. In the following example, the two queries to _sip._tcp.zulu.local and _sipinternal._ tcp.zulu.local resolved to srv.touareg.local. Figure A-3 illustrates this verification. Set query type to SRV Resolve SRV query Resolve SRV query Figure A-3. Resolving DNS SRV records with NsLookup From the earlier example, these DNS SRV records are created in the zulu.local forest, as shown in Figure A-4. Active Directory SRV: _sipinternal._tcp.zulu.local _sip._tcp.zulu.local User Forest zulu.local Active Directory srv.touareg.local LCS 2005 Pool Resource Forest touareg.local Figure A-4. DNS SRV record configuration

7 APPENDIX ADVANCED TIPS 357 PKI Requirements Before rolling out certificates for your Live Communications Servers, it s recommended that you ensure your deployment in a resource forest topology is functional. It s simpler to troubleshoot problems before compounding additional complexity. Once you start rolling out more than one pool, server certificates will be required. Also, if you want to encrypt client-to-server traffic, then server certificates will be needed. Please refer to Chapter 8 for more information about configuring certificates for Live Communications Server. Deploying Live Communications Server Live Communications Server can be deployed at any stage as long as the resource forest is available. Documenting it at this stage made for a logical transition to focus on enabling user accounts in the user forest for LCS in the resource forest. Deploying LCS in a resource forest is no different from deploying it in a single-forest topology. All the same steps apply. Please refer to Chapters 7, 10, and 11. Configuring Users for Live Communications Server The process for enabling users for Live Communications in a resource forest topology requires some additional steps beyond the regular process for enabling users for Live Communications in a single forest. Since the user s account is located in the user forest, a corresponding account must be created in the resource forest. For security reasons, this account in the resource forest must be marked as disabled. To avoid users maintaining passwords in two different user accounts (that is, the account in the user forest and the account in the resource forest), the user account in the resource forest is mapped to the user account in the user forest referred to as the user principal account. This mapping is done by copying the objectsid value from the NT principal account into the msrtcsip-originatorsid attribute of the corresponding disabled user account in the resource forest. Figure A-5 demonstrates how to perform this mapping manually using AdsiEdit.msc.

8 358 APPENDIX ADVANCED TIPS Figure A-5. Mapping user accounts manually using AdsiEdit.msc

9 APPENDIX ADVANCED TIPS 359 Figure A-6 shows the logical representation of this user account mapping. You can now enable the account in the resource forest for Live Communications. When the user logs on to their desktop/laptop using their Active Directory credentials from the user forest, Communicator should be able to log on to Live Communications Server. One-Way trust Active Directory Active Directory User mapping users Disabled users srv.touareg.local User Forest zulu.local Figure A-6. User mapping logical representation LCS 2005 Pool Resource Forest touareg.local This process of creating a corresponding user account in the resource forest, marking the account as disabled, mapping the objectsid, and finally enabling the account for Live Communications can be tedious and error prone. Consider using Identity Integration Feature Pack (IIFP), a free version of MIIS for Active Directory only, or finding third-party tools that are available. For example, LcsSolutions provides a tool, LcsMap, to automate these steps. Alternatively, the Live Communications Server 2005 SP1 Resource Kit offers a tool that can be handy when the resource forest already has Exchange deployed in this topology. In this case, disabled user accounts have already been created and mapped to the user principal accounts in the user forest for Exchange. The Live Communications Server 2005 SP1 Resource Kit tool, SidMap.wsf, copies the objectsid from the msexchmasteraccountsid attribute to the msrtcsip- OriginatorSid attribute on the disabled user account. Once this step is completed, the administrator can use the Live Communications Server 2005 SP1 MMC to enable these disabled user accounts for Live Communications. For more information, please refer to the tool s accompanying documentation called sidmapreadme.htm, which is available in the resource kit. In addition to mapping the SID from the NT principal account in the user forest to the disabled user account in the resource forest to enable single sign-on, you ll want to map other user information so those users can be searchable in the Address Book via any of the values listed in Table A-1. LcsMap automatically maps these additional settings, and you can configure IIFP to synchronize these settings as well.

10 360 APPENDIX ADVANCED TIPS Table A-1. User Settings Mapping Table Attribute User Corresponding Disabled Account Cn Rui Rui ObjectSID sid(rui) Sid(X) msrtcsip-originatorsid sid(rui) telephonenumber displayname Rui Rui givenname Rui Rui surname Maximo Maximo physicaldeliveryofficename 30/ /3250 l (city) Issaquah Issaquah st (state) WA WA country U.S.A. U.S.A. title Lead program manager Lead program manager mail ruim@touareg.com ruim@touareg.com company Touareg Touareg Checklist To help keep track of the tasks necessary to deploy a resource forest topology, the following is a convenient checklist when deploying: 1. Configure a root DNS server in the user forest to resolve servers in the resource forest. 2. Create a one-way trust. 3. Validate a trust relationship. 4. Create an SRV record in user forests. 5. Verify the record route using the Nslookup.exe tool. 6. Request the server certificate (this is optional). 7. Deploy Live Communications Server 2005 or newer. 8. Configure user accounts for Live Communications Server 2005 on the resource forest: a. Create a corresponding user account in the resource forest for each user. b. Disable the user account. c. Map the disabled account to the user s account from the user forest. d. Provision the disabled account for Live Communications.

11 APPENDIX ADVANCED TIPS 361 Flowchart Guide to Active Directory Prep Figure A-7 illustrates the logical flow to determine which prep steps to run to meet your Active Directory infrastructure. Use this flowchart as an aid to help you. Obtain AD schema extension authorization Extend AD schema Run Forest prep in root domain RunDomainAdd prep in user-only option in child domain against domain hosting LCS Do you have any child domains? no Run Domain prep in root domain no no yes RunDomainAdd prep in child domain against domain hosting LCS yes Will domain hosting LCS manage these users? yes Will the child domain host LCS users? no Will the child domain host LCS Servers? yes Deploy Live Communications Servers Run DomainAdd prep in root domain against child domain Run Domain prep in child domain Figure A-7. Active Directory prep flowchart guide Flowchart Guide to Deploying Live Communications Server Refer to my website, for a diagram of the logic flow you should observe to deploy a Standard Edition Server or Enterprise pool. Use this flowchart as an aid to ensure your server deployment is correctly completed. Conclusion Using the resource forest topology to deploy Live Communications Server offers the advantage of isolating the AD schema extensions required from your production forest into a separate forest. In an organization with multiple forests, the resource forest topology provides a way to centralize your Live Communications Server infrastructure. Since Exchange also supports the resource forest topology, you can leverage the same resource forest to centralize your Live Communications Server and Exchange deployment.

12 Index Symbols %TEMP% directory, A ABServer, 156 access control entry (ACE), 95 Access Proxy server See also property page (Access Proxy) bank of servers, 177 bank of servers private interface, 181, 201 bank of servers public interface, 191 certificates of, 107 configuring to allow connections originating from Director, as clearinghouse, 211 external DNS to resolve public FQDN, 199 for federation, private interface with server certificate, public interface with server certificate, 198 default route federation and, 176 Director role and, 33 installing for federation topology, 177 network perimeter topologies and, PIC and, 215, routing outgoing SIP messages to, troubleshooting configuration problems, 207 Access Proxy server role, 5, 36 accessing SDK files, 314 accounts in Address Book Service, creating or selecting, 163 NT principal, 67 service, tracking passwords for, user, mapping, 359 Account Lockout and Management Tools (ALTools.exe), 153 accuracy of presence information, 4 activating See also enabling Address Book Service, Enterprise pool, server, 116, 118 Active Directory Address Book Service and, 155, 158 checking state of, 285 dependent topologies, 71 deploying in resource forest and, Enterprise pools and, 122 global settings, 80 integration of, 79 LCS pool representation in, 82 msrtcsip-pools container, 81 prep steps flowchart guide, 361 preparing for installation, 111 querying, 79 schema, extending Prep Domain step, Prep DomainAdd step, Prep Forest step, Prep Schema step, steps in,

13 364 INDEX searching, Trusted Server list, user settings stored in, 30 Active Directory Users and Computers Builtin security groups, 255 MMC (DSA.MSC), 145 user properties, 145 active-passive clustering, 32, 119 Add a Contact Wizard (Communicator), 44 Add/Remove Templates dialog box (Communicator), 49 adding users to Address Book, 169 Additional SIP Domains for Your Organization section, Address Book Service activating, Active Directory and, 155 adding users, 169 components of, 155 configuring Communicator to connect to and download files, Deployment Log, 164 download process, , 170 file store, forcing synchronization, 166 installing, overview of, 155 Planning and Deployment Guide, 157 supported topologies, 158 Admin Tools MMC, 281 administration console MMC Applications status view, 307 Domain status view, 304 Enterprise Pool status view, 304 Forest status view, 303 Server status view, 305 administrative template, adding (Communicator), 49 Administrative Tools folder, Services snap-in, 282 Administrator Contact Information section, 220 adsiedit.msc snap-in, 80, 357 Advanced Connection Settings dialog box (Communicator), 46 Advanced Settings, user properties, AIM (AOL Instant Messenger), 9 Allow IM Status Queries for People Not on the Messenger Contacts List policy, configuring, 53 Allow tab (Access Proxy property page), 208 allowing connections originating from Director, ALTools.exe (Account Lockout and Management Tools), 153 AOL Instant Messenger (AIM), 9 Appendix-Advanced Tips, 351, 361 Applications status view (administration console MMC snap-in), 307 archive settings, archiving back-end database structure, 270 best practice, 254 database schema, 270 logging compared to, 243 requirements for, 253 troubleshooting, 289 archiving facility and instant messaging, 8 Archiving Service deactivating, 265 enabling, global settings for, 266 installing, status window, 265 user settings for, 268 viewing archives, Archiving Service role, 36 archiving settings, 148 assigning web server certificate to front-end servers, 134 associated queue path warning, 264

14 INDEX 365 associating queue path, 265 auditing requirements and archiving, 253 authenticating Live Communications Servers, 105 authorized host, configuring CSTA gateway as, Automatic Configuration option (Communicator), 46, availability information, 11 B back-end server for Enterprise pool, clustering, 119 backing up MSDE database, 113 backup best-practice guidelines for, for Enterprise Edition databases, for Standard Edition forest and server configurations, MSDE database, testing, 229 Backup Exec 10 (Veritas), 229 best-practice guidelines for archiving, 254 for backing up and restoring, BlackBerry (Research in Motion) Instant Messaging, 62 Live Communications Server and, 4 Block tab (Access Proxy property page), 203 blocking contact from viewing presence information, 29 branch offices, deploying Standard Edition Server in, 112 buddy list, 7 business value and productivity, 3 5 C call detail records, 308 Capacity Planning Toolkit, 63, central forest topology, certificate authorities, 104 certificate distribution points (CDP), 108 Certificate Export Wizard, Certificate Import Wizard, 187 Certificate page, 196 certificate revocation lists (CRLs), 108 Certificate Server (Microsoft), 178 certificates See also server authentication certificate; server certificate adding for PIC, certification path, 109 common name, enhanced key usage, overview of, subject alternate name, 107 web server, 131 Certificates snap-in, adding, 185 certificate-signing request (CSR), generating, chat, 7 Choose Destination Location screen (SDK), 313 Choose Destination Locations page, 261 clearinghouse topology configuring Access Proxy as, 211 enhanced federation and, 175 Client Authentication, 109 clients See also Communicator 2005 BlackBerry Instant Messaging, 4, 62 Communicator Mobile, 61 Communicator Web Access, 38, 41, 60 installation of, 43 Windows Messenger 5.1, client-side tracing, enabling in Communicator, 53 clustering active-passive, 32 Enterprise pool back-end server, 119 common name (CN) of certificates, Find it faster at

15 366 INDEX Common Name field (Web Server Certificate Wizard), 182, 192 Communicator 2005 Active Directory, searching, Automatic Configuration option, automatic configuration setting, 355 client-side tracing, enabling, 53 configuring, 46 47, configuring for telephony integration, description of, 43 emoticons provided in, 8 installing in silent mode, 45 Manual Configuration option, 46 47, message pop-up in, 12 policy settings, presence awareness in, presence information, enabling, sample IM conversation using, 7 status flags in, 11 Trace utility, uses of, 4 Communicator Mobile, 4, 61 Communicator Web Access (CWA), 38, 41, 60 compatibility issues and presence awareness, 13 compiling sample (SDK), completion screen, Address Book Service activation, 164 computer settings, 87 Computer Supported Telephony Application (CSTA), 322 configuration files backing up, restoring, 234 configuration of Enterprise pool, verifying, Configure Live Communications Users Wizard, 150 configuring See also configuration files; configuring for federation; deploying Access Proxy to allow connections originating from Director, as clearinghouse, 211 for federation, archiving settings, 148 Communicator after installation, automatically, 55 to connect to and download Address Book files, manually, for telephony integration, default route, 212 direct federation, enhanced federation, external DNS, 199 for federation, listening port number, 198 listening port on front-end servers, Microsoft Operations Manager, for NTLM authentication, 353 phone number normalization, PIC Access Proxy, configuring, certificates, adding, DNS, configuring, 221 provisioning, steps for, 217 users, enabling, private interface with server certificate, public interface with server certificate, 198 SIP domains, 101 SIP/CSTA gateway, 322 static route to CSTA gateway, 323 for telephony integration,

16 INDEX 367 users Advanced Settings, Configure Live Communications Users Wizard, 150 Delete Live Communications Users Wizard, 150 Enable Users for Live Communications Wizard, 149 for federation, Move Live Communications Users Wizard, overview of, for resource forest, specifying SIP URI, for telephony integration, tracking service account passwords, Windows Management Instrumentation (WMI), web server certificate on front-end servers, configuring for federation Access Proxy, allowing connections originating from Director, external DNS, 199 installing Access Proxy, 177 Live Communications Server infrastructure, overview of, 176 private interface with certificate, public interface with certificate, 198 requesting server authentication certificate, server certificate, routing outgoing SIP messages to Access Proxy, users, connections originating from Director, allowing, Connectivity Information for Your Organization section, 219 contact lists, 27, 60 Create a New Certificate (Web Server Certificate Wizard), 180, 190 Create Enterprise Pool Wizard, Create Log File option (MOM), 297 critical server event information, 243 CRLs (certificate revocation lists), 108 CSR (certificate-signing request), generating, CSTA (Computer Supported Telephony Application), 322 CSTA gateway, 74, 322 Customer Information screen (SDK), 313 CWA (Communicator Web Access), 38, 41, 60 D database setup, troubleshooting, 290 databases See also MSDE database backing up, restoring, dbbackup.exe tool, 113, dbimpexp.exe tool, 151 dbsetup.wsf tool, 113 Default Domain Policy option, selecting, 48 default route federation, 176, 212 defining SIP URI of user, Delete Live Communications Users Wizard, 150 deleting MSDE database, 113 deploying See also configuring; configuring for federation; server roles; topologies CWA externally, 39 internally, 38 Enterprise pools, 119 forest environment and, 63 front-end servers, Find it faster at

17 368 INDEX global settings and, 79 LCS, flowchart guide, 361 in resource forest Active Directory and, checklist for, 360 configuring users, DNS and, LCS and, 357 overview of, PKI and, 357 Deployment Log file, 263 deployment, troubleshooting, 275 digital certificates. See certificates direct federation configuring, description of, Director configuring Access Proxy to allow connections originating from, configuring to route outgoing SIP messages to Access Proxy, Director role, Directory Security tab, 196 disabling See also enabling Archiving Service, 265 flat-file logging, Windows Messenger, 60 displaying Windows Trusted Root Certificate Authorities list, 222 DNS cache poisoning, 105 configuring, 221 deploying in resource forest and, external, configuring, 199 publishing Enterprise pool in, 126 SIP namespaces and, DNS resolution, network perimeter topologies and, 72 DNS SRV query, 33 DNS SRV records adding, 355 creating, resolving with NsLookup, 356 domain controller geographic availability, 71 Domain status view (administration console MMC snap-in), 304 download process and Address Book, , 170 downloading list of available newsgroups, 337 downsides to instant messaging, 10 to presence awareness, DSA.MSC, 145 E E.164 recommendation, 155 eavesdropping on instant messages, 10 ECMA (European Computer Manufacturers Association) standard 323 III, 322 editing permissions, 29 EKU (enhanced key usage), emoticons, 7 Enable Dynamic Presence policy, enabling, 52 Enable Users for Live Communications Wizard, 149 enabling See also activating; disabling Archiving Service, client-side tracing, 53, 278 Enable Dynamic Presence policy, 52 federation, 147 federation/outside user, troubleshooting, 289 flat-file logging,

18 INDEX 369 PBX integration Communicator, configuring, Live Communications Servers, configuring, phone number normalization, configuring, SIP/CSTA gateway, configuring, 322 users, configuring, presence information in Communicator, public IM connectivity, 147 remote call control, 148 remote user access, 147 users, 146 users for PIC, encryption, setting up Enterprise pool and, 120 endpoint identifier (EPID), 308 endpoints, 29 enhanced federation, 174, enhanced key usage (EKU), Enterprise Edition backing up databases, restoring databases, rule group, 301 enterprise instant messaging, 9 Enterprise Pool status view (administration console MMC snap-in), 304 Enterprise pools activating, adding Address Book URL to, advantages of, 120 back-end server, clustering, 119 creating, deploying, 119 description of, front-end servers, installing, hardware load balancer (HLB), 31, 119, installing, 119 physical representation, 122 Standard Edition Servers compared to, 112 system requirements for, 32 trading up to, 112 verifying configuration of, EPID (endpoint identifier), 308 error messages, troubleshooting, 290 Ethereal network protocol analyzer, 288 etiquette for newsgroups, 340 etrust, 104 European Computer Manufacturers Association (ECMA) standard 323 III, 322 Event Log ID, 166 event logs, event rule, examining properties of, 301 Event Viewer, 281 Export the Current Certificate to a.pfx File option (Web Server Certificate Wizard), 184 exporting certificate, user information, 151 external CA, 189 external deployment of CWA, 39 external DNS, configuring, 199 F FAQ for troubleshooting, federation clearinghouse, configuring Access Proxy as, 211 configuring for Access Proxy, allowing connections originating from Director, external DNS, 199 installing Access Proxy, 177 Find it faster at

19 370 INDEX Live Communications Server infrastructure, overview of, 176 private interface, configuring with certificate, public interface, configuring with certificate, 198 requesting server certificate, routing outgoing SIP messages to Access Proxy, server authentication certificate, users, default route, configuring, 212 deploying in forest environment and, 63 description of, 173 direct, configuring, enabling, 147 enhanced, configuring, flavors of, PIC as extension of, 217 Federation settings, federation topology, 176 federation/outside users, troubleshooting, 289 file store and Address Book configuring Communicator to connect to and download files, description of, flat-file logging description of, disabling, enabling, flowchart guide to Active Directory prep, 361 to deploying LCS, 361 forcing Address Book Service synchronization, 166 forest actions, backing up, 230 forest environment, deploying in, 63 Forest global properties for archiving, 266 Forest status view (administration console MMC snap-in), 303 forking incoming messages, 29 friendly name, entering (Web Server Certificate Wizard), 180, 190 front-end servers adding listening port to, 135 configuring listening port on, configuring web server certificate on, deploying, Enterprise pool, 123 installing, system requirements for, 32 full backup, 229 G General tab (Access Proxy property page), 202 geographic DNS load balancing, 72 global archiving settings, 148 global catalog and branch offices, 112 global settings, 79, 86, 266 Global Settings container, 83 H hardware load balancer (HLB), Enterprise pool and, 31, 119, hardware requirements Communicator Web Access, 41 front-end servers, 32 Standard Edition Server, 30 headers (SIP), history of instant messaging, 9 HLB (hardware load balancer), Enterprise pool and, 31, 119, home server/pool Enterprise Edition, Standard Edition Server, Hotfix KB , 60

20 INDEX 371 I ICQ, 9 identity fraud and instant messaging, 10 Identity Integration Feature Pack (IIFP), 69, 359 IETF (Internet Engineering Task Force), 9, 15 IExpress.exe tool, 59 IM Provider tab, 223 IM. See instant messaging Import Management Packs and/or Reports option (MOM), 294 importing management pack into MOM 2005, Included Computers tab (MOM), 299 incremental backup, 229 Install Agents link (MOM), 298 installing Access Proxy for federation topology, 177 Address Book Service, Archiving Service, clients, 43 Communicator, in silent mode, 45 Communicator Mobile, 61 Communicator Web Access, 60 Enterprise pool, 119, MSMQ, sample (SDK), SDK, Standard Edition Server activation, advantages and disadvantages of, 114 preparations before, Setup program, VeriSign certificate, 195 web server certificate, 134 Windows Messenger in silent mode, 59 instant messaging conversation sample, using Communicator, 7 downsides to, 10 history of, 9 presence awareness, saving messages, 8 SIP functions in, 15 spam and, 10 steps for typical conversation, 16 uses of, 7, 9 integrated Windows authentication (IWA), 38 integration, 13 Intelligent Instant Message Filter, 10 internal deployment of CWA, 38 Internet accounts list (Outlook Express), 335 Internet Engineering Task Force (IETF), 9, 15 interruptions, handling, 4 intrapool communications, 130 IWA (integrated Windows authentication), 38 J jelly bean, 3 K Kamdar, Nirav, 288 killer app, 11 L launching Certificate Export Wizard, Management Console on local computer, 188 PerfMon, 348 Stress Setup tool, 344 Web Server Certificate Wizard, 179 LCS Monitor, 309 LCS2005MP.AKM file, 294 LcsCertUtil.exe tool, 189 LcsCmd.exe tool export option of, 325 forest actions, 230 overview of, , 230, server actions, Find it faster at

21 372 INDEX LcsDiag.exe tool, , 207, 277 LcsError.exe tool, 251, 282 LcsLoadSim tool, 341 LcsMap tool, 359 LcsPing.exe tool, 200, 277 LcsRcc.exe tool, 324 LcsSync Management Agent, 70 LcsUserStress tool, 341 LcsUtil.exe tool (LcsSolutions.com), 152 license agreement (SDK), 312 licensing costs with PIC, 217 listening port adding to front-end servers, number for, configuring, 198 lists buddy, 7 certificate revocation, 108 contact, 27, 60 of newsgroups, downloading, 337 of tools, Trusted Server, Windows Trusted Root Certificate Authorities, 221 Live Communications IM Archiving Service Options page, 258 Live Communications Server 2005 Address Book Deployment Tool window, 158 Live Communications Server 2005 Resource Kit LcsCertUtil.exe tool, 189 LcsPing.exe tool, 200, 277 Management Agent, 70 Live Communications Server 2005 Service Pack 1 Capacity Planning Toolkit, 63, Microsoft Operations Manager 2005 (MOM) Pack, 114 Resource Kit, 70, 341, 359 setup menu, 311 Live Communications Server deployment tool, 258 Live Communications Server MMC snap-in, Resources tab, 333 location, specifying (Web Server Certificate Wizard), 193 logging description of, 243 flat-file disabling, enabling, levels of, using logs, logging on, single sign-on experience when, 353 logical representation of user account mapping, 359 M Management Agent (Live Communications Server Resource Kit), 70 management pack importing into MOM 2005, Windows Server 2003 Performance Advisor, for MOM 2005, 310 Manual Configuration option (Communicator), 46 47, mapping user accounts manually with AdsiEdit.msc, 357 message pop-up in Communicator, 12 message structures (SIP), methods (SIP), metrics, gleaning with SQL queries, Microsoft Certificate Server, 178 Knowledge Base articles, 348 Office suite, integration with, 13 Outlook, calendar information and presence state, 4 Outlook Express, setting up, Partners for Live Communications Server 2005, 349 Security Update Alerts, subscribing to, 113

22 INDEX 373 TechNet article, 287 Volume Licensing programs, 217 Microsoft Clustering Service (MSCS), 32 Microsoft Identity Integration Server (MIIS), 69 Microsoft Message Queuing (MSMQ), installing, Microsoft Office Communicator Feature Policies node, 49 Microsoft Operations Manager (MOM) configuring, importing management pack into, overview of, Windows Server 2003 Performance Advisor Management Pack, 310 Microsoft SQL Server Desktop Engine (MSDE), 113 Microsoft SQL Server Desktop Engine (MSDE) database backing up, deleting, 113 description of, 27 restoring, 235 migrating contact lists from WM to Live Communications Server, 60 users from one SIP namespace to another, MIIS (Microsoft Identity Integration Server), 69 MMC See also administrative console MMC Active Directory Users and Computers, 145 Admin Tools, 281 Live Communications Server, Resources tab, 333 MOM (Microsoft Operations Manager 2005) Pack for Live Communications Server 2005 SP1, 114 MOM. See Microsoft Operations Manager (MOM) monitoring performance administration console MMC snap-in Applications status view, 307 Domain status view, 304 Enterprise Pool status view, 304 Forest status view, 303 Server status view, 305 LCS Monitor, using, 309 Microsoft Operations Manager configuring, importing management pack into, overview of, overview of, 293 SQL queries, using, Windows Server 2003 Performance Advisor Management Pack, 310 Move Live Communications Users Wizard, MSCS (Microsoft Clustering Service), 32 MSDE (Microsoft SQL Server Desktop Engine), 113 MSDE (Microsoft SQL Server Desktop Engine) database backing up, deleting, 113 description of, 27 restoring, 235 MSMQ (Microsoft Message Queuing), installing, msrtcsip-archivedefault attribute, 89 msrtcsip-archivedefaultflags attribute, 89 msrtcsip-archivefederationdefault attribute, 89 msrtcsip-archivefederationdefaultflags attribute, 90 msrtcsip-defaultroutetoedgeproxy attribute, 90 Find it faster at

23 374 INDEX msrtcsip-defaultroutetoedgeproxyport attribute, 91 msrtcsip-defpresencesubscription- Timeout attribute, 93 msrtcsip-defregistrationtimeout attribute, 93 msrtcsip-defroamingdatasubscription- Timeout attribute, 93 msrtcsip-enablebesteffortnotify attribute, 95 msrtcsip-enablefederation attribute, 90 msrtcsip-globalsettingsdata attribute, 95 msrtcsip-maxnumoutstandingsearchper- Server attribute, 92 msrtcsip-maxnumsubscriptionsperuser attribute, 93 msrtcsip-maxpresencesubscription- Timeout attribute, 93 msrtcsip-maxregistrationtimeout attribute, 93 msrtcsip-maxroamingdatasubscription- Timeout attribute, 93 msrtcsip-minpresencesubscription- Timeout attribute, 92 msrtcsip-minregistrationtimeout attribute, 93 msrtcsip-minroamingdatasubscription- Timeout attribute, 93 msrtcsip-name namespace, 86 msrtcsip-numdevicesperuser attribute, 94 msrtcsip-pools container, 81 msrtcsip-searchmaxrequests attribute, 91 msrtcsip-searchmaxresults attribute, 91 msrtcsip-userdomainlist attribute, 94 MTLS (Mutual Transport Layer Security) CSTA gateways and, 74 PIC and, 217 multidomain forest topology, 64 multiforest topologies central forest, overview of, 66 resource forest, multiple-tree forest topology, 65 Mutual Transport Layer Security (MTLS) CSTA gateways and, 74 PIC and, 217 N network capture, 288 Network Load Balancing (Windows Server 2003), 122 network perimeter topologies, network topologies Active Directory dependent, 71 overview of, 70 perimeter, telephony, 74 newsgroups etiquette for, 340 overview of, reading and replying to posts, setting up Outlook Express for, setting up Web-based newsreader for, subscribing to, 338 NNTP server address for Outlook Express, 337 nondeterministic configuration, 33 NsLookup.exe utility, 276, 356 NT principal accounts, 67 NTLM authentication, configuring for, 353 number of unique active users, determining, 113 O Office 2003 Policy Template Files and Deployment Planning Tools, 51 Office Communicator See Communicator 2005 Office Communicator Mobile 2005, 4, 61 one-way trust configuration, online help, 333

24 INDEX 375 Option for Re-Using Existing Database page, 260 organization information, entering (Web Server Certificate Wizard), 181 organizational unit, checking permissions on, 285 orphaned users, 151 outgoing SIP messages, routing to Access Proxy, Outlook (Microsoft), calendar information and presence state, 4 Outlook Express (Microsoft), setting up, P partner solutions, 349 password protecting private key (Web Server Certificate Wizard), 185 passwords for service account, tracking, patching MSDE, 113 payload and SIP/CSTA gateway, 322 PBX (private branch exchange) system Communicator, configuring, description of, 321 enabling, 322 Live Communications Servers, configuring, phone number normalization, configuring, SIP/CSTA gateway, configuring, 322 users, configuring, PerfMon, launching, 348 performance counters and events administration console MMC snap-in Applications status view, 307 Domain status view, 304 Enterprise Pool status view, 304 Forest status view, 303 Server status view, 305 LCS Monitor, using, 309 Microsoft Operations Manager configuring, importing management pack into, overview of, overview of, 293 SQL queries, using, Windows Server 2003 Performance Advisor Management Pack, 310 Performance Monitor screen, 306 permissions description of, 28 editing, 29 on organizational unit, checking, 285 Phone Normalization utility, 155 phone number normalization, 155, phone services, integration with, 13 PIC (Public Instant Messaging Connectivity) Access Proxy, configuring, access to, 216 certificates, adding, description of, DNS, configuring, 221 provisioning, steps for, 217 users, enabling, PKI, deploying in resource forest and, 357 planning before deployment, 112 policy settings, Communicator, Pool class definition, 123 pool properties, Archiving tab, 264 pools, checking state of, 285. See also Enterprise pools port information, entering (Web Server Certificate Wizard), 183 Prep Domain step, Prep DomainAdd step, Find it faster at

25 376 INDEX Prep Forest step archive settings, Federation settings, overview of, registrar settings, search settings, Prep Schema step computer settings, 87 global settings, 86 overview of, user settings, 88 Prepare the Request Now, but Send It Later (Web Server Certificate Wizard), 190 preparing Active Directory forest Prep Domain step, Prep DomainAdd step, Prep Forest step, Prep Schema step, steps in, 84 presence awareness automatic updates to, 13 availability of, 11 Communicator and, description of, enabling in Communicator, problems with, presence icon, 3 presence information accuracy of, 4 blocking contact from viewing, 29 privacy issues Access Proxy server role and, 5 presence awareness and, 14 private branch exchange (PBX) system Communicator, configuring, description of, 321 enabling, 322 Live Communications Servers, configuring, phone number normalization, configuring, SIP/CSTA gateway, configuring, 322 users, configuring, private keys, 103 Private tab (Access Proxy property page), 187 privileges, activation and, 116 problems with instant messaging, 10 with presence awareness, productivity, 3 5 Profile and Product Information section, 219 Properties dialog box, Logging tab, 246 property page (Access Proxy) accessing, 188 Allow tab, 208 Block tab, 203 General tab, 202 Private tab, 187 Public tab, 198 property sets, protocol optimizations (SIP), provisioning PIC, proxy (SIP), 17 Proxy server role, 41 proxy server SIP call, 17 PSTN network, 321 public CA, 189 public IM connectivity, enabling, 147 Public IM Connectivity Provisioning Request for Volume Licensing Customers website, 218 Public IM Service Providers section, 221 Public Instant Messaging Connectivity (PIC) Access Proxy, configuring, access to, 216 certificates, adding, description of, DNS, configuring, 221

26 INDEX 377 provisioning, steps for, 217 users, enabling, public keys, 103 public network interface, requesting server authentication certificate for, Public tab (Access Proxy property page), 198 publishing Director or bank of Directors, Enterprise pool in DNS, 126 R RCC (remote call control), 74, 148 RCC SIP request, 328 reading and replying to newsgroup posts, Ready to Install the Program screen, 160 real-time communications, 86 redirect server (SIP), 17 redirect server SIP call, 18 registrar server (SIP), 17 registrar server SIP call, 18 registrar settings, registry settings, configuring, 50 remote call control (RCC), 74, 148 remote call control (RCC) integration. See telephony integration remote user access, enabling, 147 requesting server authentication certificate, server certificate for federation topology, requests (SIP), Research in Motion (RIM), 4, 62 resolving DNS SRV records with NsLookup tool, 356 resource forest, deploying in Active Directory and, checklist for, 360 configuring users, DNS and, LCS and, 357 overview of, PKI and, 357 resource forest topology, Resource Kit, 70, 341, 359 resources Microsoft Knowledge Base articles, 348 newsgroups etiquette for, 340 overview of, reading and replying to posts, setting up Outlook Express for, setting up Web-based newsreader for, subscribing to, 338 online help, 333 partner solutions, 349 tools, responses (SIP), 22 restore, testing, 229 Restore As Database box, 240 restoring best-practice guidelines for, Enterprise Edition databases, Standard Edition, RIM (Research in Motion), 4, 62 root domain GC dependency, 79 routing outgoing SIP messages to Access Proxy, RPC traffic flows, 130 RTC Application policy, configuring, 51 RTC Service SCP, 86 RTCABSDomainServices security group, 98 RTCArchivingDomainServices security group, 98 RTCDomainServerAdmins privileges, 79 RTCDomainServerAdmins security group, 97 Find it faster at