Tag Archives: Skype for Business

Office 365, Office365, Skype for Business 2015, Teams

3- Migrate Users from Skype for Business 2015 to Teams

January 11, 2021 Mohammed Hamada Leave a comment

Hybrid Integration

In my last post about Skype for Business / Office 365 Skype for Business Online/Teams migration article I discussed the steps of how to create a hybrid environment between Skype for Business on-premises and went through the troubleshooting of each issue I have been through. In this article I am going to discuss the migration of users from on-premises to the cloud through UI and PowerShell.

Migrating users

This article will assume that you are planning to migrate users from Skype for Business Frontend 2015 Server and that you already have a hybrid configuration in place. If so then you’re going to fulfill the following prerequisites:

Update your PowerShell to 5.1 Framework https://www.microsoft.com/en-us/download/details.aspx?id=54616
Install Skype for Business Online Powershell Module https://www.microsoft.com/en-us/download/details.aspx?id=39366
Create a temporary admin user with MFA disabled.

To check the currently installed PowerShell run the following cmdlet

$PSVersionTable

After you Download and install PowerShell 5.1 you might need to restart the server. In which case the PowerShell will show that it is updated to the required version.

After Installing the Skype Online Connector Module, We will be able to connect right after launching PowerShell

To do so type:

Import-Module SkypeOnlineConnector

Connecting to Office 365 (Teams Online or Skype for Business Online)

The process of connecting to Office 365 Online PowerShell sounds easy but with MFA enforced in your environment you’ll have a nightmare mix of errors when you try so.

I have came through a lot of errors trying to force the use of PowerShell with MFA user authentication but eventually came to realize that Microsoft still does not support MFA for some cmdlets like Move-CsUser for instance.

So In short, to connect you’ll need to have a global or Teams admin user with MFA disabled to do so.

To create a new Skype Online Session enter:

– Make sure you start the regular PowerShell as admin and not Skype for Business Management Shell.

If you run these commands from SfB Management Shell you’ll get an error

So first, We will import the Skype Online connector Module

Import-Module SkypeOnlineConnector

Then get the OverRidePowershell URI using the command:

Get-CsOnlinePowerShellEndPoint

Next, We will connect and authenticate to our tenant using the following cmdlet

$sfbsess = New-CsOnlineSession -Username User@domain.onmicrosoft.com -OverRidePowerShellUri https://admin4a.online.lync.com/OcsPowershellOAuth –Verbose

Moving Users to Teams

To Move users to Office 365, You need to first provide credentials of the User with MFA disabled and then use the command Move-CsUser

An Example:

$Creds = Get-Credential

Moving User

Move-CsUser –Identity user@domain.com –target “sipfed.online.lync.com” –hostedMigrationOverRideUri https://admin4a.online.lync.com/HostedMigration/hostedmigrationservice.svc –ProxyPool “YourFEPool.Domain.local” –Credential $Creds

Let’s check the status of the migrated user, The hosting provider attribute is what we care about as it tells us where the user is homed at.

Checking the user from Teams Portal

Users seems to be licensed, online and can now login using the Microsoft Teams app.

Bulk Enable Users and assign Tel URI numbers to them

In case you have a big number of users that you want to enable them online

# Please provide your O365 admin credential

$creds = Get-Credential

-PSSession (New-CsOnlineSession $cred) -AllowClobber

$csv = Import-csv “C:\Users\Mohammed\users.csv”

ForEach ($user in $csv) {

Write-host now enabling $user.alias

Move-CsUser –Identity $user.alias –target “sipfed.online.lync.com” –hostedMigrationOverRideUri https://admin4a.online.lync.com/HostedMigration/hostedmigrationservice.svc –ProxyPool “YourFEPool.Domain.local” –Credential $creds

}

The CSV File will look like this

Alias

user@domain.com

user2@domain.com

Errors you might face

Error 1:

When you have your on-premises user enabled for dialin you will probably get the following error if you try to migrate them to Skype for Business online or teams.

Move-Csuser :: HostedMisrat ion fault: Error=(511), Description=(The user could not be moved because he or she is enabled for dial-in conferencing on-premises, but has not been an assigned an Audio Conferencing license in Office 365. Users must be licensed before they can be moved to Teams or Skype for Business Online.)

If you are sure do want to use migrate this user without an Audio Conferencing license, specify the

“BypassAudioConferencingCheck” switch. ) At line: 1 char: 1

The Solution is to either provide an audio conferencing license or as it is showing in the error itself as it says use the switch -BypassAudioConferencingCheck to ignore that.

Error 2:

When trying to import the session, I got the following error

the runspace state is not valid for this operation for PowerShell Online.

Solution: To overcome this problem you’ll need to use the overridePowershellUri Parameter in the New-CsOnlineSession in order to connect to Skype online powershell.

To get your tenant’s PowerShell URI use the cmdlet Get-CsOnlinePowerShellEndPoint

What you need to use is the AbsoluteUri

Error 3:

When you try to import the SkypeOnlineConnector module and then run the New-CsOnlineSession cmdlet from Skype for Business Management Shell you’ll get the following error after authenticating.

Sorry, but we’re having trouble signing you in.

AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: ‘7716031e-6f8b-45a4-b82b-922b1af0fbb4’. More details: Reply address did not match because of case sensitivity.

Troubleshooting details

If you contact your administrator, send this info to them.
Copy info to clipboard

Request Id: f0f97265-4669-4e4f-bcf7-609469e92f00

Correlation Id: 829c8a2b-f697-416f-bfa6-4a794a229a13

Timestamp: 2021-01-10T23:00:10Z

Message: AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: ‘7716031e-6f8b-45a4-b82b-922b1af0fbb4’. More details: Reply address did not match because of case sensitivity.

Advanced diagnostics: Disable

If you plan on getting support for an issue, turn this on and try to reproduce the error. This will collect additional information that will help troubleshoot the issue.

Solution:

Run the cmdlets from Windows PowerShell as admin not Skype for Business Management shell.

References:

https://docs.microsoft.com/en-us/microsoftteams/upgrade-to-teams-on-prem-overview

https://social.technet.microsoft.com/wiki/contents/articles/34339.skype-for-business-online-enable-your-tenant-for-modern-authentication.aspx

https://docs.microsoft.com/en-us/skypeforbusiness/hybrid/move-users-from-on-premises-to-skype-for-business-online

https://docs.microsoft.com/en-us/microsoftteams/teams-powershell-install

https://docs.microsoft.com/en-us/skypeforbusiness/troubleshoot/hybrid-move-sfb-online/move-csuser-hostedmigration-fault-507

Azure RMS, RMS for O365, Office365, Powershell, Skype for Business 2015

error when Installing Nuget module for Microsoft Teams integration

January 9, 2021 Mohammed Hamada Leave a comment

Story

I got a client requesting to integrate Skype for Business 2015 with Microsoft Teams. Skype for Business 2015 is installed on Windows Server 2012 R2 which has PowerShell 4.0

I already installed PowerShell 5.1 and restarted the server in question.

When I tried to install the Microsoft Teams PowerShell Module to integrate Skype for Business with Teams I got the following error:

Error

PS C:\Users\Admin> Install-Module MicrosoftTeams

NuGet provider is required to continue
PowerShellGet requires NuGet provider version ‘2.8.5.201’ or newer to interact with NuGet-based repositories. The NuGet
provider must be available in ‘C:\Program Files\PackageManagement\ProviderAssemblies’ or
‘C:\Users\Admin\AppData\Local\PackageManagement\ProviderAssemblies’. You can also install the
NuGet provider by running ‘Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force’. Do you want
PowerShellGet to install and import the NuGet provider now?
[Y] Yes [N] No [S] Suspend [?] Help (default is “Y”): y
WARNING: Unable to download from URI ‘https://go.microsoft.com/fwlink/?LinkID=627338&clcid=0x409′ to ”.
WARNING: Unable to download the list of available providers. Check your internet connection.
PackageManagement\Install-PackageProvider : No match was found for the specified search criteria for the provider
‘NuGet’. The package provider requires ‘PackageManagement’ and ‘Provider’ tags. Please check if the specified package
has the tags.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:7405 char:21
+ …     $null = PackageManagement\Install-PackageProvider -Name $script:N …
+   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     + CategoryInfo          : InvalidArgument: (Microsoft.Power…PackageProvider:InstallPackageProvider) [Install-Pac
    kageProvider], Exception
     + FullyQualifiedErrorId : NoMatchFoundForProvider,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackagePro
    vider

PackageManagement\Import-PackageProvider : No match was found for the specified search criteria and provider name
‘NuGet’. Try ‘Get-PackageProvider -ListAvailable’ to see if the provider exists on the system.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:7411 char:21
+ …     $null = PackageManagement\Import-PackageProvider -Name $script:Nu …
+   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     + CategoryInfo          : InvalidData: (NuGet:String) [Import-PackageProvider], Exception
     + FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.ImportPackageProv
    ider

More Details:

Although I have PowerShell 5.1 module installed but still it seems problems wont go away. It’s part of Microsoft’s main requirement to have Windows PowerShell 5.1 and to import the Microsoft Teams Module for an easy installation and integration with Teams as it leverages the Module MicrosoftTeams to make things easy.

When looking at the details of the error, it seems as if PowerShell is trying to connect to a particular link to download and install the NuGet Provider which is part of installing the MicrosoftTeams Module.

The error below can be noticed to be the cause.

Resolution:

After doing some digging it turns out that since April 2020 Microsoft has disabled the use of TLS Version 1.0 and 1.1 so people who are working on old Windows Server edition or any application servers that utilize these protocols will now have to force PowerShell or any other app to use the TLS 1.2 Version.

In order to fix this, You will need to run the following Script on your PowerShell as an Admin

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

See the announcement here:

https://docs.microsoft.com/en-us/powershell/scripting/gallery/installing-psget?view=powershell-7.1

After running this script, I was able to install NuGet and run the installation of MicrosoftTeams PowerShell Module

Hope this helps

Exchange 2016, Exchange 2019, Skype for Business 2015

Skype for Business IM integration with Exchange 2016 OWA–Part 2

June 12, 2020 Mohammed Hamada Leave a comment

This article is a completion of Part 1, Click here to go to Part 1

Configuration Steps – Part 2

7. On Exchange: Enable OWA VD Instant Messaging
8. On Exchange: Enable Messaging on OWA Policy
9. On Exchange: Create Enterprise Application for Skype Pool.
10. On Exchange: Create new SettingOverride for Skype for Business.
11- Generate a new Certificate for Exchange IM
12. Assign the newly imported certificate to IIS Exchange Back End site
13. On Exchange: Restart the WebAppPool
14. Log out and sign back in to OWA to Check
15. Troubleshooting methods

7- On Exchange Server: Enable OWA VD Instant Messaging

Part of enabling IM integration between Exchange and SfB is to enable OWA Virtual Directory to allow this. The below cmdlet does the job for you on all your Exchange Servers

From Exchange, Launch Exchange Management and run the following cmdlet

Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -InstantMessagingEnabled $true -InstantMessagingType Ocs

8- On Exchange: Enable Messaging on OWA Policy

Run the following to enable Messaging for Owa Policy

Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -InstantMessagingEnabled $true -InstantMessagingType Ocs

9- On Exchange: Create Enterprise Application for Skype Pool.

From Exchange Management shell Run the following cmdlet

Cd $exscripts

.\Configure-EnterprisePartnerApplication.ps1 -AuthMetadataUrl “https://sbg-pool01.domain.com/metadata/json/1” -ApplicationType Lync

The AuthMetadataUrl is going to be your local Skype for Business Pool URL. This URL should work in your Exchange server without any Certificate error. Meaning that the certificate assigned to your Skype for Business pool should already be imported to Exchange Servers to trust this URL.

If your previous configuration is correct then you should see the “The Configuration has Succeeded” Message.

10- On Exchange: Create new SettingOverride for Skype for Business.

Notes:

To configure the same settings on all Exchange 2016 and Exchange 2019 servers in the Active Directory forest, don’t use the Server parameter.

New-SettingOverride -Name “<UniqueOverrideName>” -Component OwaServer -Section IMSettings -Parameters @(“IMServerName=<Skype server/pool name>”,”IMCertificateThumbprint=<Certificate Thumbprint>”) -Reason “<DescriptiveReason>” [-Server <ServerName>]

The Thumbprint you use here will define if whether IM will work or not as this what secures the communication between Exchange and Skype. If you use the wrong certificate your Integration will fail and users wont be able to login to IM through OWA.

11- Generate a new Certificate for Exchange IM

IMPORTANT NOTE:

In order for IM in OWA to work the certificate you will generate must have its common name set as mail.domain.com to match the configuration.

Using Digicert tool on Exchange Server I will generate the CSR of the new certificate

Click on Create CSR

Choose SSL certificate type and make sure you choose Mail.domain.com as CN

In the SANs type all of the involved servers (Skype for Business Frontends, Mailbox servers in FQDN and in Hostnames as in the screenshot below). and click on Generate

Go to your CA Server’s CertSRV URL and copy the CSR code there to generate the new certificate.
Import the new certificate to the current server, then export it in PFX format and import it to all the Exchange Servers you’re planning to use.

After importing the certificate I will verify that I can see the private key

Click on the Details and copy the Thumbprint or from MMC right click the certificate > Properties give it a friendly name e.g. (IM) and then from Exchange Management shell you can copy the Thumbprint directly.

Get-ExchangeCertificate | select thumbprint,friendlyName

Now use the previous script to create the setting Override for OwaServer.

Things you can change are in bold “Name, IM Servername Value, and the Thumbprint value”.

New-SettingOverride -Name “IM Override” -Component OwaServer -Section IMSettings -Parameters @(“IMServerName=SBG-Pool01.domain.com“,”IMCertificateThumbprint= 28E4B1BA0F2FCB1535AF199F02A64EFC78367F2D“) -Reason “Configure IM”

If you enter the server parameter to use a single server you can change that by using. Note that you must not use FQDN but rather only the server’s hostname.

Get-SettingOverride | Set-SettingOverride -Server sbg-mx01,sbg-mx02

This should generate an event ID 112 on Exchange servers involved in the deployment.

12. Assign the newly imported certificate to IIS Exchange Back End site

Once the certificate is in the server store, You will be able to easily find in from IIS and bind it to the Exchange Back End site.

This is the most crucial step to get IM to work in OWA. Don’t worry about breaking up Exchange Sites or Powershell. If you have added Exchange Servers Hostnames and FQDNs in this certificate then you should be good.

Now Launch IIS
Click on Exchange Back End
Select Binding
Click on the 444 port and edit
Select the newly generated certificate that has the mail.domain.com as CN. (This certificate must also have all Exchange Servers hostnames and FQDNs set as SANs)

Make sure you change the backend cert to the new on all the involved Exchange Servers.

13. On Exchange: Restart the WebAppPool

Restart-WebAppPool MSExchangeOWAAppPool

14. Log out and sign back in to OWA to Check

Log out of OWA and back in and check if you are able to Login to IM . It should normally sign you in automatically but in case of an error then you should see it.

In case of an error you should see the following.

If it works then you should see the presence

15. Troubleshooting Methods

If you follow the above steps correctly then it should work especially when applying the right certificate for your Exchange Back End IIS part however if you face an error then you should do the following steps to troubleshoot the error

Set the Eventlog for Instant Messaging on Exchange from Low to High

Set-EventLogLevel -Identity “sbg-mx01\MSExchange OWA\InstantMessage” -Level High

Look in the following path for errors

C:\Program Files\Microsoft\Exchange Server\V15\Logging\OWA\InstantMessaging

Check the Healthset of the OWA Instant Messaging.

Get-ServerHealth -HealthSet OWA.Protocol.Dep -Server sbg-mx01 | Format-Table Name, AlertValue –Auto

Get-MonitoringItemIdentity -Server sbg-mx01 -Identity OWA.Protocol.Dep | Format-Table Identity,ItemType,Name -Auto

Ref

https://docs.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/configure-im-integration-with-owa?view=exchserver-2019

https://docs.microsoft.com/en-us/exchange/high-availability/managed-availability/health-sets?view=exchserver-2019

Exchange 2016, Exchange 2019, Skype for Business 2015

Skype for Business IM integration with Exchange 2016 OWA–Part 1

June 12, 2020 Mohammed Hamada Leave a comment

The Story

A good and detailed documentation is everything we need to implement any kind of project especially if it’s an integration between two different servers that perform different roles.

And with PKI involved the complications multiply thus a good article write up is what we need.

Previously I have tried a test lab with Skype for Business 2015/2019 IM Integration with Exchange 2016/2019 and the result was a complete failure and endless search for what’s missing to get IM to work from OWA?

ERROR

Upon completion of the steps mentioned in Microsoft’s Official documentation and after restarting Exchange IIS or OWAAppPool you will see this when you try to login to OWA with your user

There’s a problem with instant messaging. Please try again later.

MS Official Documentation

In their Official documentation Microsoft says that the certificate in question must be trusted by all the servers involved meaning Skype for Business Frontend and Mailbox Servers.

Meanwhile this is true, it still would not get the IM to login/work although it might drop the initialize event ID 112 in the event log.

Here is what MS says about the certificate.

Exchange and Skype for Business integration requires server certificates that are trusted by all of the servers involved. The procedures in this topic assume that you already have the required certificates. For more information, see Plan to integrate Skype for Business Server 2015 and Exchange. The required IM certificate thumbprint refers to the Exchange Server certificate assigned to the IIS service.

REF URL: https://docs.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/configure-im-integration-with-owa?view=exchserver-2019#what-do-you-need-to-know-before-you-begin

Step by Step Deployment

To do things the way that should get this to work, I will detail steps one by one so we can be sure to get the positive results we are all waiting for when dealing with Exchange and Skype for Business.

Exchange IM URL ¹: mail.domain.com

Skype for Business Pool FQDN: SBG-Pool01.domain.com

Autodiscover URL : Autodiscover.Domain.com

Prerequisites

For Default and Web Service Internal, Your Skype for Business Frontend Server/Pool must use a certificate that is generated from an internal CA which you can use later to generate Exchange’s IM Certificate.
UCMA must be installed (Doesn’t matter if version 4 or 5) both are supposed to work with Exchange 2016.
Local Certification Authority must already be deployed in the domain.

Configuration Steps – Part 1

On SfB: Set CsAuthConfiguration Autodiscover URL for Skype server to find Exchange Autodiscover
On SfB: Get-CsSite to see what is the current site ID.
On Exchange: Check AutodiscoverServiceInternalURI
On SfB: Create new Partner
On SfB: Create new Trusted Application Pool
On SfB: Create new Trusted Application ID

Configuration Steps – Part 2

Prerequisites

1- Update or Create Server Default and Web Service Internal Certificate for SfB Pool servers

The certificate installed on the Skype for Business Pool Frontend servers must be generated from a local Certification Authority which can be trusted by Exchange Server services.

The Certificate generated for Skype for Business pool as in the below screenshot is generated from my CA and includes the names of the servers:

Skype for Business Pool
Skype for Business Frontend FQDNs
Exchange Servers
Autodiscover FQDN
Lyncdiscover.domains.com
Lyncdiscoverinternal.domains.com
sip.domains.com
meet.domains.com
dialin.domain.com
External.domain.com

2- UCMA must be installed

On both Exchange and Skype for Business servers I already have UCMA 4.0 version installed, but if you don’t have it or have an older version then you can’t continue without it.

3- Make sure you have a Local Certification Authority deployed in your domain.

Configuration Steps – Part 1

1- On SfB: Set CsAuthConfiguration Autodiscover URL for Skype server to find Exchange Autodiscover

For Skype for Business Server to find Exchange Autodiscover Service point and to be able to authenticate servers we’ll be using the below cmdlet

This enables both servers to authenticate and share information when needed and without user’s interference.

Set-CsOauthConfiguration -ExchangeAutodiscoverUrl https://autodiscover.domain.com/autodiscover/autodiscover.svc

Ref:

https://docs.microsoft.com/en-us/powershell/module/skype/set-csoauthconfiguration?view=skype-ps

2- On SfB: Get-CsSite to see what is the current site ID.

Getting a site ID will be useful for later use to setup the Trusted Application Pool.

On Skype for Business Management shell. Type the following

Get-CsSite

So the Site ID is 1. I will keep this for later use

3- On Exchange: Check AutodiscoverServiceInternalURI

Specify the AutodiscoverServiceInternalURI for internal Autodiscover service. Make sure it points to your public URL and certificate not the internal one otherwise your users will get a certificate error through Outlook and might cause IM chat not to work.

The Cmdlet would be

Get-ClientAccessService | Set-ClientAccessService –AutoDiscoverServiceInternalUri https://autodiscover.domain.com/autodiscover/autodiscover.xml

4- On SfB: Create new Partner Application

On Skype for Business Server, Launch Management Shell and use this cmdlet to add Exchange as a trusted Application to the SfB topology.

New-CsPartnerApplication -Identity Exchange -ApplicationTrustLevel Full -MetadataUrl “https://autodiscover.domain.com/autodiscover/metadata/json/1“

5- On SfB: Create new Trusted Application Pool

New-CsTrustedApplicationPool -Identity mail.domain.com -Registrar sbg-pool01.domain.com -Site 1 -RequiresReplication $false

6- On SfB: Create new Trusted Application ID

From SfB Management Shell run the following cmdlet .

New-CsTrustedApplication -ApplicationId OutlookWebAccess -TrustedApplicationPoolFqdn mail.domain.com -Port 5199

Finally

Lync, Microsoft Lync, Skype for Business 2015

Deleting Old Skype for Business or Lync server from ADSI

December 16, 2019 Mohammed Hamada Leave a comment

The story

I had a project few weeks ago where my client wanted to install Skype for Business 2019 but had installed Lync before and removed the server without doing proper decommissioning which kept dirty records in AD database and had to be removed manually in order to make a new clean installation of Skype for Business 2019

To do so:

There are two days of doing so, One is using ADSIEdit and ADUC to remove Computer Objects and Users related attributes and Security Groups.

I normally would prefer PowerShell but since we can demonstrate both ways for people who like to work with GUI

Starting with GUI

Removing Legacy Lync server from the AD Schema

Prerequisites

Using a domain or enterprise admin
Access to the ADSIEdit.

Goal of removing Legacy Lync server from your AD environment.

Preparing AD schema and domain for a new deployment after you improperly deleted Lync Servers without uninstalling them.
Cleaning Users’ Lync related attributes for the new deployment.

Step#1: Remove permissions

This step removes the original Lync permissions from the active director.

Open Active Directory Users and Computers
Right click on your top level domain being cleaned and select Properties
From the Properties windows, select the Security tab.
Remove all security users titled RTC*
These are usually
– RTCUniversalServerReadOnlyGroup
– RTCUniversalUserReadOnlyGroup
– RTCUniversalUniversalServices
– RTCUniversalUserAdmins

From <http://blog.armgasys.com/?p=320>

Repeat the same steps for each of the following AD Folders and

OUs
NOTE: Not all RTC permissions will exist in each AD Folder or OU, but these three OUs do:
– Domain Controllers
– System
– Users

Domain Controllers

Systems

Users

Step#3: Additional AD cleanup

Open Active Directory Users and Computers
Drill down as follows
[Your Domain] \ Program Data \ Distributed \ KeyMan
Delete LyncCertificates
NOTE: This may not exist in all scenarios.
Drill down as follows
[Your Domain] Users
Delete all RTC* and CS* users created by Lync
I.E. CSAdministrator, CSHelpDesk, RTCComponentUniversalServices, Etc.

Deleting users from the User OU

Deleting CS Users

Step#4: Cleanup existing users

This steps resets Lync attributes for any domain users and contacts.

The Second way: Using PowerShell

get-aduser -filter {msRTCSIP-PrimaryUserAddress -like “*”}|set-aduser -clear msRTCSIP-PrimaryUserAddress,msRTCSIP-PrimaryHomeServer,msRTCSIP-UserEnabled,msRTCSIP-OptionFlags,msRTCSIP-UserPolicies, msRTCSIP-DeploymentLocator, msRTCSIP-FederationEnabled, msRTCSIP-InternetAccessEnabled

Result:

Users attribute are clean and AD has nothing left over of Previous installation of Lync or Skype for Business .

AsteriskNow, Skype for Business 2015

FreePBX (Asterisk Now) With Skype for Business Integration

March 17, 2016 Mohammed Hamada Leave a comment

In my earliest article about Lync with Asterisk Now (FreePBX) I have written step by step guide on how to integrate Lync and FreePBX but since Skype for Business came out and the new version of Free PBX 13.0.84 I thought it would be good idea to try the integration between both of them ..

In Skype for Business server I am using the latest CU version 6.0.9319.0.

The steps are very similar to the original article except with some UI changes..

In the following article I will be only showing the main steps which I have taken to integrate Skype for Business with FreePBX and will show the steps that have been done on the FreePBX side only not on the Skype for Business server as it is very similar to the original article.

Integration of AsteriskNow (FreePBX 13.0.84) and Skype for Business Server

Creating Trunk for Skype for Business

First I will start by creating a new trunk for S4B and configure it. To configure the trunk (Skype for Business trunk for outgoing calls from Asterisk to S4B)

Click on Connectivity >> Trunks and follow the below screenshots.

Under the SIP settings (Outgoing) tab type the following

host=10.10.124.120
transport=tcp
port=5060
insecure=very
type=friend
context=from-internal
promiscredir=yes
qualify=yes
canreinvite=yes

In the incoming tab make sure you delete everything and then submit changes

Configure the Trunk with an outbound route

While creating the Outbound route, this route must be associated with the Trunk that I have created earlier in the trunk sequence as in the below screenshot..

In my case the pattern NXXX should be enough as it’ll route the call to my S4B’s 4 extension users (5000)

==========================================

Click on Connectivity >>> Inbound routes

Click add inbound route

==========================================

Now the most important is the SIP settings

Configuring Asterisknow to accept TCP calls from S4B

From the Settings menu ->> click on Asterisk SIP settings then choose Chan SIP settings and do the same configuration like the one below

Scroll further down to the “Advanced General Settings”

Enter the two “Other SIP settings” fields below and submit changes.

Conference with 2 Extensions on Asterisk now with s4B

I can call from S4B to Asterisk extensions and vice versa without any issues.

Hybrid Integration

Migrating users

To check the currently installed PowerShell run the following cmdlet

Connecting to Office 365 (Teams Online or Skype for Business Online)

To create a new Skype Online Session enter:

Moving Users to Teams

An Example:

Moving User

Checking the user from Teams Portal

Bulk Enable Users and assign Tel URI numbers to them

Errors you might face

Error 1:

Error 2:

Error 3:

Solution:

Story

Error

More Details:

Resolution:

See the announcement here:

This article is a completion of Part 1, Click here to go to Part 1

Configuration Steps – Part 2

7- On Exchange Server: Enable OWA VD Instant Messaging

8- On Exchange: Enable Messaging on OWA Policy

9- On Exchange: Create Enterprise Application for Skype Pool.

10- On Exchange: Create new SettingOverride for Skype for Business.

11- Generate a new Certificate for Exchange IM

Click on Create CSR

12. Assign the newly imported certificate to IIS Exchange Back End site

13. On Exchange: Restart the WebAppPool

14. Log out and sign back in to OWA to Check

15. Troubleshooting Methods

The Story

ERROR

MS Official Documentation

Here is what MS says about the certificate.

Step by Step Deployment

Prerequisites

Configuration Steps – Part 1

Configuration Steps – Part 2

Prerequisites

1- Update or Create Server Default and Web Service Internal Certificate for SfB Pool servers

2- UCMA must be installed

3- Make sure you have a Local Certification Authority deployed in your domain.

Configuration Steps – Part 1

1- On SfB: Set CsAuthConfiguration Autodiscover URL for Skype server to find Exchange Autodiscover

2- On SfB: Get-CsSite to see what is the current site ID.

3- On Exchange: Check AutodiscoverServiceInternalURI

4- On SfB: Create new Partner Application

5- On SfB: Create new Trusted Application Pool

6- On SfB: Create new Trusted Application ID

The story

To do so:

Starting with GUI

Prerequisites

Step#1: Remove permissions

Repeat the same steps for each of the following AD Folders and

Domain Controllers

Systems

Users

The Second way: Using PowerShell

Result:

Just another IT Website