LYNC SERVER COOKBOOK

Create the CSUserModifier user group (with the scope as universal and type as security) in Active Directory.

Open the Lync Server Management Shell and launch the following cmdlet:

New-CsAdminRole -Identity CsUserModifier -Template CsViewOnlyAdministrator

The cmdlet will clone the permissions of the CsViewOnlyAdministrator group to the custom group.

Launch the following cmdlet to verify the list of administrative tasks delegated to the new group:

Get-CsAdminRole CSUserModifier | Select-Object –ExpandProperty cmdlets | fl

The output will be similar to what is shown in the following screenshot:

Now, we are able to use the cmdlet customization, adding the Set-CsUser cmdlet to the available tasks:

Set-CsAdminRole -Identity CsUserModifier -Cmdlets @{add="Set-CsUser"}

The same command, with an @{remove parameter, can be used to remove some administrative tasks that were previously available from a group:

Set-CsAdminRole -Identity CsUserModifier –Cmdlets @{remove="Get-CSVoiceRoutingPolicy","Get-CSVoiceTestConfiguration"}

Verification of the previously mentioned cmdlet is done using the same process we used in step 2, to verify the list of delegated tasks.

The New-CSAdminRole cmdlet supports the –Cmdlets switch that we saw in step 5, so when defining a custom group role, we are able to add custom cmdlets. A command like the next one could achieve both role customization and cmdlet customization in a single step:

New-CsAdminRole -Identity CSUserModifier -Template CsViewOnlyAdministrator -Cmdlets @{add="set-CsUser"}

The Security Configuration Wizard option is accessible from the Tools menu in Server Manager, as we can see in the following screenshot:

In the first screen, we have to click on Next and then on Create a new security policy.

Select the name of the Lync Server that will act as a baseline (in our scenario, Madhatter).

We can select Next in the Role-Based Service configuration screen and again Next in the Select Server Roles screen until we arrive at Select client features. Flag all the options and select Next.

In the Select Administration and Other Options screen, select Background Intelligent Transfer Service BITs and Windows Audio.

In the Select Additional Services menu, flag all the services and click on Next.

Select Do not change the startup mode of the service and then select Next.

In the Confirm Service Change screen, accept the default value and select Next.

Flag the Skip this section in the Network Security screen (we have to leave the flag box clear if we want to use the Windows firewall too).

Click on Next in the Registry Settings screen (if we don't have a legacy operating system that needs to connect to the Lync Server).

In the Require SMB Security Signatures screen, we can clear the second flag as shown in the following screenshot. If the server has enough unused processing resources, digital signature is a security option that we can consider:

As we can see in the following screenshot, in the Outbound Authentication Methods screen, we can leave the default settings as is if we are not going to use local accounts to authenticate with other servers:

In the Outbound Authentication using Domain Accounts screen, we can leave the default settings as is and select Next with no changes also in Registry Settings Summary.

If we are not going to use auditing, we can select Skip this section in the Audit Policy screen, and then click on Next in the Save Security Policy screen.

Type a name for the policy (for example, LyncTemplate), optionally adding a description, and click on Next.

Select Apply Now, and then click on Next and Finish in the Completing the Security Configuration Wizard screen.

It is advisable to reboot the server in order to verify that the new settings have impacted the Lync Server startup phase.

On the machine that hosts our SQL server, open SQL Server Configuration Manager and go to SQL Server Network Configuration. Select Protocol for "name of our SQL instance".

Right-click on TCP/IP and select Properties:

Click on the IP Addresses tab, select the various IP addresses available for our SQL server, and set TCP Dynamic Ports as empty. Set TCP Port to the port value we want to use:

Go to the start screen and type Services. Open the services MMC and right-click on the SQL Server Browser service. Select Properties, and from the drop-down menu, set Startup Type as Disabled:

On one of the Lync Servers that require access to the database, go to the start screen and type cliconfg.exe.

Click on the Alias tab and select Add, as shown in the following screenshot:

In the Server alias field, type a name for the SQL alias. In Network libraries, select TCP/IP. The Connection parameter option is the Fully Qualified Domain Name (FQDN) of the SQL server\name of the instance. If we have configured a static port for SQL, deselect Dynamically determine port and add the port number, as shown in the following screenshot:

Now, go to the start screen and type regedit. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo and then right-click and select Export:

Now, we are able to use the .reg file to import the same server alias settings on all the Lync Servers that require a connection to the database.

We can start assessing the security configuration of conferencing for our Lync deployment using Get-CsMeetingConfiguration.

To disable the lobby bypass for PSTN users, use the following cmdlet:

Set-CsMeetingConfiguration -PstnCallersBypassLobby $false

To force users to schedule private meetings (with unique IDs), use the following cmdlet:

Set-CsMeetingConfiguration -AssignedConferenceTypeByDefault $false -EnableAssignedConferenceType $true

Then, we have to work on the conferencing policies. The default global policy allows almost any of the available conferencing features. I suggest that you clone it using New-CsClonedPolicy from Pat Richard (http://www.ehloworld.com/2300). This script is useful to create a new user-conferencing policy called, for example, DefaultConferencing, which will have the same parameters we had in the global policy. The cmdlet we will use is the following one:

.\New-CsClonedPolicy.ps1 -SourcePolicyName global -TargetPolicyName "DefaultConferencing" -PolicyType ConferencingPolicy 

Restrict the global conferencing policy to match the minimal level of service we will grant to every Lync-enabled user.

To enhance conferencing security, we can also restrict the number of TCP ports involved in the client communication. Launch the Get-CsConferencingConfiguration cmdlet to look at the applied configuration. If ClientMediaPortRangeEnabled is False, then the clients will use a port between ports 1024 and 65535 when involved in a communication session. We can use the following cmdlet to force port range (default will be starting from TCP port 5350 for all the kind of network traffic):

Get-CsConferencingConfiguration | Set-CsConferencingConfiguration  -ClientMediaPortRangeEnabled $True

Open MMC, navigate to Add or Remove Snap-ins, and add Certificates.

Select Computer Account and go to Local Computer, and then click on Finish.

Navigate to Certificates (Local Computer) | Personal | Certificates and select the server certificate.

Go to Certification Path and select the root CA, as shown in the following screenshot:

Select the Details tab and go to Thumbprint. Copy the thumbprint value (Ctrl + C).

Paste the value in the notepad, remove the empty spaces, and copy the new value.

Launch the Lync Management Shell and type $cert = New-CsWebTrustedCACertificate -Thumbprint "‎Thumbprint" -CAStore TrustedRootCA.

The thumbprint is the value we copied at step 6. For example, consider the following:

$cert = New-CsWebTrustedCACertificate -Thumbprint "7a06f5b75287f17d4596118418b77004b4cd4d92" -CAStore TrustedRootCA

Type the following cmdlet:

Set-CsWebServiceConfiguration -TrustedCACerts @{Add=$cert}

Use the following cmdlet to verify that the thumbprint has been added to the TrustedCACerts parameter:

Get-CSWebServiceConfiguration

Repeat the preceding steps for all the intermediate and root CA required in our deployment.

Connect to a Lync Front End Server.

Open the Lync Server Management Shell and launch the following cmdlet to get a list of the existing server applications:

Get-CsServerApplication

Now, we can install the script (BlockFederatedPresence.am).

New-CsServerApplication -Identity "EdgeServe:cheshirecat.absoluteuc.corp/Simple" -Uri "http://sip.absoluteuc.org/BlockFederatedPresence" -ScriptName "C:\BlockFederatedPresence.am"-Enabled $true -Critical $false

The explanation of the preceding code is as follows:

We have to restart the Lync services (Stop-CsWindowsService | Start-CsWindowsService).

To disable inline images (pictures added to IM conversations), we can use the two filters proposed by Graham Cropley (http://www.lyncexch.co.uk/love-lync-26th-sept-2013/).

To block .jpg files, use the following:

Set-CsFileTransferFilterConfiguration -Identity <Site / Global> -Extensions @{Add=".jpg"}

To disable Rich Text Format, use the following:

Set-CsClientPolicy -Identity <policy> -DisableRTFIm $true

Before we go to the next step, it is useful to know a list of file extensions that are prohibited from our policies. The cmdlet to use is:

Get-CsFileTransferFilterConfiguration -Identity global | Select-Object –ExpandProperty Extensions

According to Chris Norman (http://voipnorm.blogspot.it/p/about.html), we have three filters that we can use to enhance the security for our Lync Edge Server (we can pair them with the steps in the Deploying a secure Lync Edge recipe). The following scripts could be used respectively to block URL style links, to block the transfer of files with common extensions, or to block the transfer of all files:

New-CsImFilterconfiguration -Identity EdgePoolIdentity -BlockFileExtension $True -Action Block -Enabled $True
New-CsFileTransferFilterConfiguration -Identity EdgePoolIdentity -BlockFileExtension $True -Action Block -Enabled $True
New-CsFileTransferFilterConfiguration -Identity EdgePoolIdentity -BlockFileExtension $True -Action BlockAll -Enabled $True

Our reverse proxy will be located in a DMZ (that is a best practice). Usually, in a similar scenario, we have no access to a DNS server that is able to resolve the FQDNs of the internal domain (in our situation, wonderland.lab), so we have to populate the local HOSTS file on our server.

Prepare the SSL digital certificate, starting from a CSR generated using IIS (http://technet.microsoft.com/en-us/library/cc732906(v=ws.10).aspx) or a third-party utility like the DigiCert Certificate Utility for Windows (https://www.digicert.com/util/) and follow the steps required by the selected CA.

Open the Internet Information Services (IIS) Manager and go to the server home screen. Select Server Certificates and select Import… to import the SSL certificate (in our example, it will be named LyncCert).

Open the Default Web Site page, and select Bindings….

Select Add, set Type HTTPS, and select the SSL certificate as shown in the following screenshot:

Launch the installer and select Application Request Routing 3.0, as shown in the following screenshot. The configuration will go on automatically.

Open the start screen, select Internet Information Server (IIS) Manager, and go to the Server Farms screen. Right-click and select Create Server Farm, as we can see in the following screenshot:

Type the FQDN of the service we are going to publish (for example, madhatter.absoluteuc.org). Leave the online flag selected. Click on Next.

Before we add the server, select the Advanced Settings… tab. On the ApplicationRequestRouting parameters, change the HTTP and HTTPS ports (for Lync Server 2013, they are 8080 and 4443, if we haven't customized them in the topology design). In the server name field, type the name of our internal server (or load balancer) and click on Add. The configuration is shown in the screen capture. The steps are shown in the following screenshot:

Select Finish. A notification like the one in the following screenshot will be shown. Select Yes.

Now, under the Server Farms menu, we will have lyncdiscover.absoluteuc.org. We have to select it and modify some of the options shown in the following screenshot:

Go to the Caching options. Remove the flag from Enable disk cache. Select Apply.

Go to the Routing Rules options. Remove the flag from Enable SSL Offloading. Select Apply.

Go to the server's home screen and select URL rewrite. The previous wizard created two rewrite rules, one with HTTPS/SSL and one with plain HTTP. Remove the one we are not going to use and edit the other one to match our needs. In our example, we are going to publish madhatter.absoluteuc.org using HTTPS, so we will remove the HTTP rule and edit the SSL rewrite rule, as shown in the following screenshot:

The conditions to use are as follows:

input= {HTTPS}, Type=Matches the Pattern, Pattern=on input={HTTP_HOST}, type=Matches the pattern, Pattern=madhatter.*

We also have a Test Pattern option to match the URL we are going to use with the rules. When we have done, we have to select Apply. The screen is shown in the following screenshot:

The previously mentioned steps have to be repeated for every URL we plan to publish.

Tip

To avoid the "Your server configuration has changed. Please restart Lync" message on Apple mobile devices, it is recommended that you set the Proxy Time-out to 960 seconds (it is a parameter related to every Server Farm we have defined), as we can see in the next screenshot: