Microsoft Lync Server 2010 Enterprise Edition Deployment Guide Microsoft Lync Server 2010

Transcription

1 Microsoft Lync Server 2010 Enterprise Edition Deployment Guide Microsoft Lync Server 2010 Published: March 2012

2 This document is provided as-is. Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred. This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. Copyright 2012 Microsoft Corporation. All rights reserved.

3 Contents Administrator Rights and Permissions Required for Setup and Administration... 1 Delegate Setup Permissions... 4 Deploying Lync Server 2010 Enterprise Edition... 5 Preparing the Infrastructure and Systems... 6 Set Up Hardware and the System Infrastructure... 6 System Requirements for Enterprise Edition Servers... 8 Install Operating Systems and Prerequisite Software on Servers... 9 Request Certificates in Advance (Optional) Configure IIS IIS Configuration Re-Activate Server After Security Configuration Wizard Closes Ports in IIS Configure SQL Server for Lync Server SQL Server Data and Log File Placement Configure SQL Server Deployment Permissions for SQL Server Database Installation Using Lync Server Management Shell Understanding Firewall Requirements for SQL Server Configure SQL Server Clustering Configure DNS Records for a Front End Pool DNS Requirements for Front End Pool Configure DNS Host Records Create and Verify DNS SRV Records Configure DNS for Load Balancing Defining the Topology in Topology Builder Topology Builder Installation Requirements Administrator Rights and Permissions Required for Setup and Administration Server and Tools Operating System Support Administrative Tools Software Requirements Requirements to Publish a Topology Install Lync Server Administrative Tools Defining and Configuring the Topology Define and Configure a Topology in Topology Builder Define and Configure a Front End Pool Define a New A/V Conferencing Server Edit or Configure Simple URLs Edit Federation Route Settings Finalizing and Implementing the Topology Design Verify the Topology Design... 81

4 Requirements to Publish a Topology Publish the Topology Setting Up Front End Servers and Front End Pools Install the Local Configuration Store Install Front End Servers Delegate Setup Permissions Configure Certificates for Front End Servers Start Services on Front End Servers Test the Pool Deployment Setting Up Kerberos Authentication Prerequisites for Enabling Kerberos Authentication Create a Kerberos Authentication Account Assign a Kerberos Authentication Account to a Site Setting Up Kerberos Authentication Account Passwords Set a Kerberos Authentication Account Password on a Server Synchronize a Kerberos Authentication Account Password to IIS Add Kerberos Authentication to Other Sites Remove Kerberos Authentication from a Site Testing and Reporting the Status and Assignment of Kerberos Authentication Test and Report Functional Readiness for Kerberos Authenticaion Report Kerberos Account Assignments Adding Server Roles Deploying a Stand-alone A/V Conferencing Server Define the A/V Conferencing Server in Topology Builder Publish the Topology Install the Local Configuration Store Install Lync Server 2010 on the A/V Conferencing Server Configure Certificates for Stand-alone A/V Conferencing Servers Start Services on the A/V Conferencing Server Configuring Dial-in Conferencing Dial-in Conferencing Configuration Prerequisites and Permissions Deployment Process for Dial-In Conferencing Configure Dial Plans for Dial-in Conferencing Create a Dial Plan Modify a Dial Plan Defining Normalization Rules Create or Modify a Normalization Rule by Using Build a Normalization Rule Create or Modify a Normalization Rule Manually Ensure Dial Plans Have Assigned Regions (Optional) Verify PIN Policy Settings Modify the Default Dial-in Conferencing PIN Settings Create or Modify Dial-in Conferencing PIN Settings for a Site or Group of Users

5 Configure Conferencing Policy for Dial-in Configure Dial-in Conferencing Access Numbers Create or Modify a Dial-in Conferencing Access Number (Optional) Verify Dial-in Conferencing Settings (Optional) Modify Key Mapping for DTMF Commands (Optional) Enable and Disable Conference Join and Leave Announcements (Optional) Verify Dial-in Conferencing Deploy the Online Meeting Add-in for Microsoft Lync Configure User Account Settings (Optional) Welcome Users to Dial-in Conferencing

6 Administrator Rights and Permissions Required for Setup and Administration Setup and deployment of Microsoft Lync Server 2010 requires that the person installing and deploying the software be a member of local or domain-level groups. Administrative tools for Lync Server 2010 can require additional permissions. Group Membership Requirements The following table summarizes the group or groups that a person should belong to in order to successfully install, manage, and troubleshoot Lync Server Lync Server Executable Setup.exe Executable that starts the installation of the Lync Server administrative tools. Group Membership Required Member of the Local Administrators group on the computer from which the executable is run. Member of Domain Users group to read information in Active Directory Domain Services (AD DS). This level of permission is required because the automatic installation of required MSI packages on the local computer requires privileges that allow reading from and writing to protected local computer resources such as Program Files directories, and protected registry such as the Local Machine hive. Tip: You can also delegate setup permissions to users or groups to whom you do not want to grant membership in the Domain Admins group. For details, see Granting Setup Permissions in the Deployment documentation. Deploy.exe Called by setup.exe, deploy.exe is responsible for the deployment of the software components for the server roles. Member of the Local Administrators group on the computer from which the executable is run. Member of Domain Users group to read information in AD DS. This level of permission 1

7 Lync Server Executable Group Membership Required is required because the automatic installation of required MSI packages on the local computer requires privileges that allow reading from and writing to protected local computer resources such as Program Files directories, and protected registry such as the Local Machine hive. Membership in RtcUniversalReadOnlyAdmins group is necessary to read the Central Management store. Note: If you are running the Windows Vista operating system or Windows 7 operating system, you will be prompted by User Account Control (UAC) to proceed with installation. If you are logged on with a standard user account, you will need someone who is a member of the Local Administrators group to provide credentials when prompted for an account with permissions to install the software. Bootstrapper.exe Called by setup.exe, bootstrapper.exe is responsible for deployment and configuration of server roles. OCSLogger.exe Administrative troubleshooting tool for capturing messages on server roles. Member of the Local Administrators group on the computer from which the executable is run. Member of Domain Users group to read information in AD DS. This level of permission is required because the automatic installation of required MSI packages on the local computer requires privileges that allow reading from and writing to protected local computer resources such as Program Files directories, and protected registry such as the Local Machine hive. Member of the Local Administrators group on the computer from which the executable is run. The executable is manifested as 2

8 Lync Server Executable Group Membership Required requireadministrator. TopologyBuilder.msc Wizard-driven user interface to create, view, adjust, and validate Lync Server topologies. AdminUIHost.exe Web-based graphical user interface for managing Lync Server. PowerShell.exe with the Lync Server module loaded Command-line administrative tool with cmdlets specific to management of Lync Server. Member of the Local Administrators group on the computer from which the executable is run to view the topology. Member of the RTCUniversalServerAdmins group to change configuration settings. Member of the RTCUniversalServerAdmins group and Domain Admins group, or member of the RTCUniversalServerAdmins group (only if the group has been granted delegate setup permissions), to publish the topology. For details about delegating setup permissions to allow members of the RTCUniversalServerAdmins group to publish the topology without being members of the Domain Admins group, see Granting Setup Permissions in the Deployment documentation. Member of CsAdministrator group or member of another role-based access control (RBAC) role to which the specific administrative task is assigned. Microsoft Lync Server 2010 Control Panel implements configuration changes by running Lync Server Management Shell cmdlets. For a list of predefined roles and the cmdlets members are permitted to run, see Role-Based Access Control in the Planning documentation. Member of CsAdministrator group or member of another RBAC role to which the specific cmdlet has been assigned. For a list of predefined roles and the cmdlets members are permitted to run, see Role-Based Access Control in the Planning documentation. Or, member of one or more of the following 3

9 Lync Server Executable Group Membership Required groups, depending on the cmdlet: RTCUniversalServerAdmins RTCUniversalUserAdmins RTCUniversalReadOnlyAdmins The group memberships in the preceding table represent the minimum memberships. Other memberships which will grant the permissions necessary to initiate the setup and deployment are possible, including membership in the Domain Admins group or Enterprise Admins group. See Also Install Lync Server Administrative Tools Delegate Setup Permissions If you do not want to grant membership in the Domain Admins group to users or groups who are deploying Microsoft Lync Server 2010, you can enable members of the RTCUniversalServerAdmins group to run the Enable-CsTopology Windows PowerShell cmdlet on servers running Lync Server By default, members of the RTCUniversalServerAdmins group do not have the ability to run this cmdlet. You grant permissions to run Enable-CsTopology on servers running Lync Server by using the Grant-CsSetupPermission cmdlet and specifying an organizational unit (OU) where computer objects for the server running Lync Server are located. Note: Enable-CsTopology is the key cmdlet to allow the RTCUniversalServerAdmins group members to set up and deploy Lync Server. To add the ability to run Enable-CsTopology to the RTCUniversalServerAdmins group 1. Log on to a server as a member of the Domain Admins group for the domain on which the delegated user will run Enable-CsTopology. 2. Open the Lync Server Management Shell. The Lync Server Management Shell is automatically installed on each Front End Server or any computer where the Lync Server 2010 administrative tools have been installed. For details about the Lync Server Management Shell, see Lync Server Management Shell in the Operations documentation. 4

10 3. Run the following cmdlet from the Lync Server Management Shell: Grant-CsSetupPermission ComputerOU <DN of the OU> -Domain <Domain FQDN> In the following example, the OU is Lync Servers, which is in the contoso.com domain. Grant-CsSetupPermission ComputerOU OU=Lync Servers Domain contoso.com Deploying Lync Server 2010 Enterprise Edition Deployment of Microsoft Lync Server 2010, Enterprise Edition requires using Topology Builder to define your topology and the components you want to deploy, preparing your environment for deployment of the Lync Server 2010 components, importing and publishing your topology design on the first Front End Server, and then installing and configuring Lync Server 2010 software for the components for your deployment. Tip: Before you begin, watch the short video at for an overview of using Topology Builder to set up your first Lync Server Front End pool. This documentation provides a staged approach to the Enterprise Edition deployment, starting with the minimum configuration required to get you up and running. The initial Enterprise Edition topology deployment described in this section includes the following environment and components: A single forest, single domain Active Directory structure A single domain controller with Domain Name System (DNS) and an Enterprise Root certification authority (CA) An Enterprise Edition Front End pool consisting of: Two Front End Servers Collocated Mediation Server and collocated A/V Conferencing Server on the Front End Servers A SQL Server-based Back End Server that also contains the Central Management store This documentation then describes how to add optional server roles and components to the initial Enterprise Edition deployment. These optional server roles and components include one or more Directors, a stand-alone A/V Conferencing Server, and a stand-alone Mediation Server. 5

11 After deployment of your Front End pool, you can deploy other server roles and features, such as Edge Servers to support external user access. In This Section Preparing the Infrastructure and Systems Defining the Topology in Topology Builder Finalizing and Implementing the Topology Design Setting Up Front End Servers and Front End Pools Setting Up Kerberos Authentication Adding Server Roles Preparing the Infrastructure and Systems Deployment of Microsoft Lync Server 2010 requires the use of Topology Builder to define and publish the topology design. To identify the components required for your topology, you use Topology Builder to create and save a topology design. To publish and enable the topology, you need the internal servers to be represented by computer accounts in Active Directory Domain Services (AD DS). This is accomplished by joining the computers to AD DS. You also must have the file share created, and the person publishing the topology must have permissions to access the file share. For SQL Server setup to succeed, the SQL Server-based server must be online and the person publishing the topology must have permissions to access the instance that Topology Builder is setting up. In This Section Set Up Hardware and the System Infrastructure System Requirements for Enterprise Edition Servers Install Operating Systems and Prerequisite Software on Servers Request Certificates in Advance (Optional) Set Up Hardware and the System Infrastructure Setting up the hardware and other components required in the infrastructure that you need to implement your topology requires that, prior to publishing your topology in Topology Builder, you do the following: 6

12 Install the hardware for each component in the topology design that you created and saved by using Topology Builder, including all required computers (servers running Lync Server 2010, database servers, servers running Internet Information Services (IIS), and reverse proxy servers, as appropriate), network adapters, hardware load balancers, and storage devices (such as file servers). For details about how to define a topology that specifies the components needed for your deployment, see Defining the Topology in Topology Builder. For details about hardware requirements for servers, see Supported Hardware in the Supportability documentation. Ensure that the networking infrastructure meets requirements. For details, see Network Infrastructure Requirements in the Planning documentation. Set up Active Directory Domain Services (AD DS). Setting up AD DS includes preparing AD DS and defining all components that you want to deploy in AD DS. For details about preparing AD DS, see Preparing Active Directory Domain Services for Lync Server 2010 in the Deployment documentation. Set up the required permissions for creating the file share. Permissions for use of file shares by Lync Server 2010 are automatically configured by Topology Builder when you publish your topology. However, the user account used to publish the topology must have full control (read/write/modify) on the file share in order for Topology Builder to configure the required permissions. To ensure that the file share can be managed properly during the Topology Builder publishing process, the user or domain group that the user is a member of should be made a member of the local Administrators group on the machine where the file share is located. In a multi-domain scenario, Domain A user or group should be made a member of the local Administrators group on the machine in Domain B where the file share will be located. Warning: The file share for Lync Server 2010, Enterprise Edition cannot be located on the Front End Server. Install and set up the hardware load balancer for Web Services. With Domain Name System (DNS) load balancing deployed, you still need to also use hardware load balancers for these pools, but only for HTTP/HTTPS traffic. The hardware load balancer is used for HTTPS traffic from clients over ports 443 and 80. Although you still need hardware load balancers for these pools, their setup and administration will be primarily for HTTP/HTTPS traffic, which the administrators of the hardware load balancers are accustomed to. 7

13 After you complete all of the preparation tasks as described in this topic, but prior to publishing the topology, you also need to: Install Operating Systems and Prerequisite Software on Servers Configure IIS Configure SQL Server for Lync Server 2010 Understanding Firewall Requirements for SQL Server Configure DNS Records for a Front End Pool System Requirements for Enterprise Edition Servers Servers running Microsoft Lync Server 2010, Enterprise Edition are intended for large organizations as the main organizational deployment. Enterprise Edition server is designed to scale to approximately 80,000 homed users per pool. The main difference between Enterprise Edition and Standard Edition is Standard Edition does not support the high availability features of Enterprise Edition. For high availability, multiple Front End Servers are deployed to a pool, the SQL Server-based server can be clustered, and the SQL Server database is deployed as a dedicated SQL Server-based server and maintains instances of data for the Front End pools. With Enterprise Edition server you can choose to collocate or define stand-alone servers for A/V Conferencing Server and Mediation Server. The Monitoring Server and Archiving Server can use a stand-alone SQL Server-based database server, or can have instances created on the SQL Server-based server for the Front End Servers and pools. Operating System Installation Important: Lync Server 2010 is available only in a 64-bit edition, which requires 64-bit hardware and a 64-bit edition of the Windows Server operating system. A 32-bit edition of Lync Server 2010 is not available with this release. Enterprise Edition server can use any of the following: Windows Server 2008 x64 SP2 Windows Server 2008 R2 Install the operating system software on the Enterprise Edition Front End Server. Apply all updates in order to bring the operating system up to the latest update and required update level consistent with your organization s standards. Lync Server 2010 requires Microsoft.NET Framework 3.5 with SP1. You should also apply the update discussed in Microsoft Knowledge 8

14 Base article , A memory leak occurs in a.net Framework 2.0-based application that uses the AesCryptoServiceProvider class, at Additional Software for Lync Server 2010 In addition to the updates required for the operating system, Lync Server 2010 requires operating system roles, features, and software to operate. For details about the additional software that must be installed prior to publishing your topology and installing Lync Server 2010, see Additional Software Requirements in the Planning documentation. Install Operating Systems and Prerequisite Software on Servers After you have set up the hardware and system infrastructure, you need to install the appropriate Windows operating systems and updates, in addition to all other prerequisite software on each server that you are deploying. This includes each Lync Server 2010 server role and any additional infrastructure servers and SQL Server-based servers required for your deployment. Note: This section describes installation of operating systems and prerequisite software for internal servers. If you are deploying Edge Servers to support external user access, you will also need to install operating systems and prerequisite software for those servers, including Edge Servers and reverse proxy servers. For details about preparing servers to support external user access, see Preparing for Installation of Servers in the Perimeter Network in the Deploying Edge Servers documentation. Install Windows Operating Systems on Servers On each server that you are deploying, install the appropriate Windows operating system: Servers running Lync Server For details about the operating system requirements for servers running Lync Server 2010, see Server and Tools Operating System Support in the Supportability documentation. Database servers. For details about operating system requirements for database servers, including the back-end database, Archiving database, and Monitoring database, see the SQL Server documentation. For SQL Server 2005, see the SQL Server Books Online 2005 at For SQL Server 2008, see the SQL Server 2008 Books Online at For SQL Server 2008 R2, see the SQL Server 2008 R2 Books Online at Install Windows Update on Servers Install the Windows Update required by Lync Server 2010 on each server: 9

15 Windows Update for servers running Lync Server For details about the Windows Update required for servers running Lync Server 2010, see Additional Software Requirements in the Planning documentation. Database servers. For details about the Windows Update required for database servers, including the back-end database, Archiving database, and Monitoring database, see the SQL Server documentation. For SQL Server 2005, see the SQL Server Books Online 2005 at For SQL Server 2008, see the SQL Server 2008 Books Online at For SQL Server 2008 R2, see the SQL Server 2008 R2 Books Online at Install Other Prerequisite Software on Servers Lync Server 2010 requires the installation of additional software on servers: Prerequisite software for servers running Lync Server The additional software prerequisites for servers running Lync Server depend on the server role being deployed. For details about the specific software requirements for each server, see Additional Software Requirements in the Planning documentation. Lync Server requires Microsoft.NET Framework 3.5 with SP1. You should apply the update discussed in the Microsoft Knowledge Base article , A memory leak occurs in a.net Framework 2.0-based application that uses the AesCryptoServiceProvider class at You should also apply the update discussed in the Microsoft Knowledge Base article , FIX: When you run a.net Framework 2.0- based application, a System.AccessViolationException exception occurs, or a dead-lock occurs on two threads in an application domain at Prerequisite software for database servers. For details about the Windows Update required for database servers, including the back-end database, Archiving database, and Monitoring database, see the SQL Server 2008 documentation at and SQL Server 2008 R2 documentation at Note: Lync Server 2010 automatically installs SQL Server 2008 Express on each Standard Edition server and each Lync Server 2010 server on which the local configuration store is located. After deploying the servers, you can upgrade the RTC database on the Standard Edition server and the RTCLocal databases on other server roles to SQL Server 2008 R2 Express by running the SQL Server 2008 R2 Express setup wizard and selecting the upgrade option. Repeat this process for each RTC and RTCLocal database. 10

16 Windows Media Format Runtime All Front End Servers and Standard Edition servers where conferencing will be deployed must have the Windows Media Format Runtime installed. The Windows Media Format Runtime is required to run the Windows Media Audio (.wma) files that the Call Park, Announcement, and Response Group applications play for announcements and music. We recommend that you install Windows Media Format Runtime before you install Lync Server If Lync Server 2010 does not find this software on the server, it will prompt you to install it, and then you must restart the server to complete installation. Important With the release of Windows Server 2008 R2 SP1, the name of the package that contains the Windows Media Format runtime has changed. The scripted methods in the Deployment Wizard for Lync 2010 Server do not yet reflect the updated package name. If you are deploying Lync Server to a computer running Windows Server 2008 R2 SP1, you must install the Windows Media Format runtime by using the command line cited below, and then restart the system to apply the change. If you use the Deployment Wizard prior to applying the runtime, the runtime will not install because the Deployment Wizard tries to apply the Windows Server 2008 or Windows Server 2008 R2 runtime, and fails because the package Deployment Wizard expects does not exist. The error may be missed because it is a subtle error. You resolve this issue by either applying the runtime prior to running the Deployment Wizard or after you run the Deployment Wizard. Restart the computer to complete the installation of the runtime. To install the Windows Media Format Runtime on servers running Windows Server 2008, use the following command: %systemroot%\system32\pkgmgr.exe /quiet /ip /m:%windir%\servicing\packages\microsoft-windows-media-format- Package~31bf3856ad364e35~amd64~~ mum To install the Windows Media Format Runtime on servers running Windows Server 2008 R2, use the following command: %systemroot%\system32\dism.exe /online /add-package /packagepath:%windir%\servicing\packages\microsoft-windows-media- Format-Package~31bf3856ad364e35~amd64~~ mum /ignorecheck To install the Windows Media Format Runtime on servers running Windows Server 2008 R2 SP1, use the following command: 11

17 %systemroot%\system32\dism.exe /online /add-package /packagepath:%windir%\servicing\packages\microsoft-windows-media- Format-Package~31bf3856ad364e35~amd64~~ mum /ignorecheck Message Queuing. Message Queuing (also known as MSMQ) role components and Directory Service Integration should be installed on the Front End Server, and the Archiving Server if you plan to deploy the Lync Server 2010 Archiving Server roles. The Message Queuing components can be found in Server Manager or can be deployed by using servermanagercmd.exe. For details, see "Install Message Queuing" at To install Message Queuing by using the Add-WindowsFeature Windows PowerShell cmdlet, do the following: a. On the Windows Server 2008 R2 x64 operating system, use Windows PowerShell 2.0. b. At the Windows PowerShell prompt, type: Import-Module servermanager, and then press Enter. c. Type: Add-WindowsFeature MSMQ-Server, MSMQ-Directory, and then press Enter. Request Certificates in Advance (Optional) Certificates are required for all internal servers that are running Microsoft Lync Server 2010, including each Enterprise Edition Front End Server, Standard Edition server, Director, standalone A/V Conferencing Server, and stand-alone Mediation Server. Although an internal enterprise certification authority (CA) is recommended for internal servers, you can also use a public CA. For details about certificate requirements and about the use of a public CA, see Certificate Requirements for Internal Servers in the Planning documentation. Lync Server 2010 setup includes the Certificate Wizard, which facilitates the tasks of requesting, assigning, and installing certificates during deployment. If you want to request certificates prior to installing servers (for instance, to save time during actual deployment of servers), you can do so by using a computer on which the Lync Server 2010 administrative tools are installed or by using a certificate request procedure defined in your organization, as long as you ensure that the certificates are exportable and contain all the required subject alternative names. Requesting certificates in advance is optional; if you do not request them in advance, you must request them as part of the setup of each server that requires a certificate. 12

18 This Deployment documentation provides procedures for using the Certificate Wizard to request certificates as part of the setup process, as described in the Configure Certificates for Front End Servers, Configuring Certificates for Standard Edition Servers, Configure Certificates for the Director, Configure Certificates for Stand-alone A/V Conferencing Servers, and Install the Files for Mediation Server sections of this Deployment documentation. If you request certificates in advance, you must modify the certificate deployment procedures in those sections as appropriate to importing and assigning the certificates instead of requesting them at the time of deployment. Note: Lync Server 2010 includes support for SHA-256 certificates for connections from clients running the Windows Vista, Windows Server 2008, Windows Server 2008 R2, and Windows 7 operating systems, and Microsoft Lync 2010 Phone Edition. To support external access using SHA-256, the external certificate is issued by a public CA using SHA-256. Configure IIS Configuring Internet Information Services (IIS) for Microsoft Lync Server 2010 involves installing the correct components to support the Web Services needed by Lync Server For details about installing IIS, see IIS Configuration. If you have a policy to run the Security Configuration Wizard on servers before putting them into service or as a typical part of your maintenance, see Re-Activate Server After Security Configuration Wizard Closes Ports in IIS for information about a side effect of running the wizard that will close ports on a Lync Server IIS configuration. See Also IIS Configuration Re-Activate Server After Security Configuration Wizard Closes Ports in IIS IIS Configuration To successfully complete this procedure, you should be logged on to the server minimally as a local administrator and a domain user. Before you configure and install the Front End Server for Microsoft Lync Server 2010, Standard Edition or the first Front End Server in a pool, you install and configure the server role and Web Services for Internet Information Services (IIS). Important: If your organization requires that you locate IIS and all Web Services on a drive other than the system drive, you can change the installation location path for the Lync Server 13

19 files in the Setup dialog box when you initially install the Microsoft Lync Server 2010 Administrative tools. You install the Administrative tools before installing IIS. If you install the Setup files to this path, including OCSCore.msi, the rest of the Lync Server 2010 files will be deployed to this drive as well. For details, see Install Lync Server Administrative Tools. For details about how to relocate the INETPUB deployed by Windows Server Manager when installing IIS, see The following table indicates the required IIS 7.0 and 7.5 role services. IIS Role Services Role Heading Common HTTP features installed Common HTTP features installed Common HTTP features installed Application development Application development Application development Application development Health and diagnostics Health and diagnostics Health and diagnostics Security Security Security Security Role Service Static content Default document HTTP errors ASP.NET.NET extensibility Internet Server API (ISAPI) extensions ISAPI filters HTTP logging Logging tools Tracing Anonymous authentication (installed and enabled by default) Windows authentication Client Certificate Mapping authentication Request filtering 14

20 Role Heading Performance Management Tools Management Tools Role Service Static content compression IIS Management Console IIS Management Scripts and Tools You can install IIS 7.0 or 7.5 from Server Manager or by using the command line. Run the following command from the command line to install the IIS 7.0 or 7.5 role services: ServerManagerCmd.exe -Install Web-Server Web-Scripting-Tools Web- Windows-Auth Web-Asp-Net Web-Log-Libraries Web-Http-Tracing Web-Stat-Compression Web-Default-Doc Web-ISAPI-Ext Web-ISAPI-Filter Web-Http-Errors Web-Http-Logging Web-Net-Ext Web-Client-Auth Web-Filtering Web-Mgmt-Console Or, on the Windows Server 2008 R2 x64 operating system, you can use Windows PowerShell 2.0. You must first import the ServerManager module, and then install the IIS 7.5 role and role services. Import-Module ServerManager Add-WindowsFeature Web-Server, Web-Scripting-Tools, Web-Windows-Auth, Web-Asp-Net, Web-Log-Libraries, Web-Http-Tracing, Web-Stat-Compression, Web-Default-Doc, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Http-Errors, Web- Http-Logging, Web-Net-Ext, Web-Client-Auth, Web-Filtering, Web-Mgmt-Console Note: Anonymous authentication is installed by default with the IIS server role. You can manage anonymous authentication after the installation of IIS. For details, see Enable Anonymous Authentication (IIS 7) at See Also IIS Requirements for Front End Pools and Standard Edition Servers Re-Activate Server After Security Configuration Wizard Closes Ports in IIS Some Lync Server 2010 roles run Web Services on Internet Information Services (IIS) port Running the Lync Server Deployment Wizard, Bootstrapper.exe, or using the Enable- CsComputer cmdlet creates an exception in the firewall and opens the port. If you then run the Windows Server 2008 or Windows Server 2008 R2 Security Configuration Wizard (or other hardening scripts), port 4443 will be blocked, and external clients will not be able to contact 15

21 Web Services. To reopen the port you can either modify the firewall exception directly or reactivate the server. To re-activate the server by using the Deployment Wizard 1. On the Lync Server Deployment Wizard page, click Run next to Step 2: Setup or Remove Lync Server Components. 2. On Setup Lync Server components page, click Next. 3. On the Executing Commands page, when the task status is shown as completed, click Finish. Note: You can also use bootstrapper.exe or Enable-CsComputer to re-activate the server. Configure SQL Server for Lync Server 2010 The Microsoft Lync Server 2010 Central Management store holds user data for all Enterprise Edition servers within a pool, and is designed to be located on a SQL Server-based Back End Server or a SQL Server cluster. As a centralized repository, the Central Management store cannot be installed on the same computer as any other Lync Server 2010 role. The Central Management store cannot reside on an Enterprise Edition server in the pool. The Central Management store is created automatically when you publish the topology and select to create the databases. The computer that you designate as the Back End Server must already be running Microsoft SQL Server database software in order for the installation to succeed. Before you deploy Enterprise Edition server, install SQL Server 2008 with Service Pack (SP) 1 (required) or latest service pack (recommended), SQL Server 2008 R2, or SQL Server 2005 with SP3 (required) or latest service pack (recommended) on a dedicated computer that meets the hardware requirements. For details about hardware requirements, see Server Hardware Platforms in the Supportability documentation. Before you create the Front End pool, you must also configure Windows Firewall to allow Lync Server 2010 access to SQL Server 2005 and SQL Server 2008 over specific ports by defining ports for the server using SQL Server Configuration Manager and opening ports in Windows Firewall with Advanced Security. In This Section SQL Server Data and Log File Placement Configure SQL Server Deployment Permissions for SQL Server 16

22 Database Installation Using Lync Server Management Shell Understanding Firewall Requirements for SQL Server Configure SQL Server Clustering SQL Server Data and Log File Placement A critical exercise in the planning and deployment of Microsoft SQL Server 2005, Microsoft SQL Server 2008, or Microsoft SQL Server 2008 R2 for your Microsoft Lync Server 2010, Enterprise Edition is the placement of data and log files onto physical hard disks for performance. The most critical files for performance are the Rtcdyn log and the Rtc log. Placing these files on their own hard disk or redundant array of independent disks (RAID) set is the optimal scenario. The database files and what they are responsible for is detailed in the following table. Data and Log Files for Central Management Store Central Management store database files Xds.ldf Xds.mdf Lis.mdf Lis.ldf Data file or log purpose Transaction log file for the Central Management store Maintains the configuration of the current Lync Server 2010 topology, as defined and published by Topology Builder Location Information service data file Transaction log for the Location Information service data file Data and Log files for User, Conferencing, and Address Book Core Lync Server 2010 database files Rtcdyn.mdf Rtcdyn.ldf Rtc.mdf Data file or log purpose Maintains transient user data (presence runtime data) Transaction log for Rtcdyn data Persistent user data (for example, access control lists (ACLs), contacts, Standard Edition server or Enterprise Edition Front End pool, 17

23 Core Lync Server 2010 database files Data file or log purpose scheduled conferences) Rtc.ldf Rtcab.mdf Rtcab.ldf Rtcab1.mdf Rtcab1.ldf Transaction log for Rtc data Real-time communications (RTC) address book database is the SQL Server repository where Address Book service information is stored Transaction log for Address Book Service Real-time communications address book database is the SQL Server repository where Address Book service information is stored. (Secondary copy for performance) Transaction log for Address Book service Data and Log Files for Call Park and Response Group Application database Cpsdyn.mdf Cpsdyn.ldf Rgsconfig.mdf Rgsconfig.ldf Rgsdyn.mdf Rgsdyn.ldf Data file or log purpose Dynamic information database for the Call Park application Transaction log for Call Park application data file Lync Server Response Group service data file for the configuration of the services Transaction log file for the Response Group application configuration Response Group service data file for runtime operations Transaction log for the Response Group service runtime data file 18

24 Data and Log Files for Archiving and Monitoring Server Microsoft Lync Server 2010 Enterprise Edition Deployment Guide Archiving and Monitoring database files LcsCdr.mdf LcsCdr.ldf QoEMetrics.mdf QoEMetrics.ldf Lcslog.mdf Lcslog.ldf Data file or log purpose Data store for the call detail recording (CDR) process of the Monitoring Server Transaction log for call detail recording (CDR) data Quality of Experience data file stored from the Monitoring Server Transaction log for Monitoring data Data file for the retention of instant messaging and conferencing data on an Archiving Server Transaction log for Archiving data In this topic, references are made to disk and to RAID set. Note that in the configuration of SQL Server resources, referring to a disk means a single hardware device. A hard disk drive with two partitions, one holding log files and the other partition holding data files, is not the same as two disks, each dedicated to either log or data files. In reference to RAID sets, there are a number of different RAID technologies from various vendors. And, with the proliferation of storage area networks (SAN), RAID sets dedicated to a single system are rarer. You should consult with your RAID or SAN vendor to determine what the best configuration is for your disk layout when configuring for SQL Server performance with Lync Server Note also that not all disk drives are created equally; some perform better than others. Even drives from the same manufacturer can vary in performance because of rotational speed, hardware cache size, and other factors. It is advisable that you test your disks to determine the better performing disks, and then place the more critical and speed sensitive log and data files specifically, Rtcdyn log and Rtc log onto the better performing disks. Disk and Database File Distribution There are a number of potential solutions for the placement of the files. Each of the possible combinations has pros and cons. The optimal distribution requires six hard disks or distinct RAID sets. We recommend that the two most active files, the Rtcdyn log file and Rtc log file, should always be placed on their own disks or RAID set. 19

25 Six-Disk Distribution The distribution scenario using six disks is typically only used in cases where you want to collocate the Archiving and Monitoring databases on the same SQL Server. This solution uses six physical disks or dedicated RAID sets. The distribution of the data and log files is shown in the following diagram. Advantages Very high performing, low latency, and little contention for disk I/O when compared to other solutions. Disadvantage More costly than other solutions. At minimum, you require six hard disks. Five-Disk Distribution The five-disk distribution uses five disks or five RAID sets. The Rtcdyn and Rtc log files are separated onto their own disks. Archiving and Monitoring logs and data are placed onto their own disks, respectively. The remaining log files and data files are placed on the fifth disk. Advantages Provides good performance for the Rtcdyn and Rtc log files, while reducing the overall number of disks required. Disadvantages All other log files are located on a single disk, potentially causing I/O performance latency for other workloads. Impact is minimized if the Archiving Server, the Monitoring Server, or both are not deployed. Four-Disk Distribution The four-disk distribution uses four disks or four RAID sets. This configuration is considered to be the best performing of the recommendations due to the low latency and low contention for disk I/O resources. The Rtcdyn and Rtc log files are separated onto their own disks. The remaining log files are placed on the third disk, while the data files are placed on the fourth. 20

26 Advantages Provides good performance for the Rtcdyn and Rtc log files, while reducing the overall number of disks required. Disadvantages All other log files are located on a single disk, potentially causing I/O performance latency for other workloads. Impact is minimized if the Archiving Server, the Monitoring Server, or both are not deployed. Three-Disk Distribution The Three Disk Distribution uses three disks or RAID sets. The Rtcdyn and Rtc log files are placed on drive one and drive two. The remaining log and data files are placed on disk three. Advantages Less costly than six and four disk solutions. Placing the Rtcdyn and Rtc log files on their own hard disks allows for good performance for the frequently updated transaction log files. Disadvantages All other log and data files are placed on the remaining disk. Increased potential for latency due to increased I/O of all other workloads on the single disk. If Monitoring and Archiving are not deployed, the impact is lessened, but performance impact is still a concern. Two-Disk Distribution Two-disk distribution uses two hard disks or RAID sets. The Rtcdyn and Rtc log files are both placed on the first disk. All other log and data files are placed on the second hard disk. Advantages Lowering of cost is the primary advantage. Log and data files for other workloads on the second disk will lessen the overall impact on the Rtcdyn and Rtc log files. Disadvantages Combining the Rtcdyn and Rtc log files will begin to negatively impact performance. 21

27 Single-Disk Distribution The single-disk distribution uses a single hard disk or RAID set. The Rtcdyn and Rtc log files are placed on the single disk along with the other log and data files. Advantages significantly lower cost than other solutions. Small user numbers may be able to experience acceptable performance. Disadvantages Disk latency and disk loading from all workload logs and data files on the single disk will have an impact on performance. Deployment of Monitoring and Archiving roles will impact performance further. Configure SQL Server SQL Server 2005 with Service Pack 3 (SP3) (required) or latest service pack (recommended), SQL Server 2008 with Service Pack 1 (SP1) (required) or latest service pack (recommended), and SQL Server 2008 R2 are supported for the Central Management store. For each database that you deploy, you can use a single SQL Server instance for all databases for your Microsoft Lync Server 2010 deployment that can be collocated on a database server, or you can use a dedicated SQL Server instance for each of these databases. For details about database collocation, see Supported Server Collocation in the Supportability documentation. Note: Lync Server 2010 automatically installs SQL Server 2008 Express on each Standard Edition server and each Lync Server 2010 server on which the local configuration store is located. After deploying the servers, you can upgrade the RTC database on the Standard Edition server and the RTCLocal databases on other server roles to SQL Server 2008 R2 Express by running the SQL Server 2008 R2 Express setup wizard and selecting the upgrade option. Repeat this process for each RTC and RTCLocal database. Additionally, each SQL Server instance must be installed and available prior to completing the steps in Topology Builder that set up the databases, or manually creating the databases with 22

28 Windows PowerShell cmdlets. If you intend to provide high availability for Microsoft Lync Server 2010, Enterprise Edition by using SQL Server failover clustering, see Configure SQL Server Clustering. For details about SQL Server supportability, see Set Up Hardware and the System Infrastructure. To install SQL Server 2008 SP1 1. See the SQL Server 2008 SP1 documentation at: 2. Download SQL Server 2008 SP1 from the Microsoft Download Center at: To install SQL Server 2008 R2 1. See the SQL Server 2008 R2 documentation at: To install SQL Server 2005 SP3 1. See the SQL Server 2005 SP3 documentation at: 2. Download SQL Server 2005 SP3 from the Microsoft Download Center at: Deployment Permissions for SQL Server Microsoft SQL Server 2005 and Microsoft SQL Server 2008 have specific requirements when installing and deploying Microsoft Lync Server Because Windows and SQL Server define their security differently, logging in as an administrator in the Active Directory domain does not implicitly grant permissions for SQL Server. You must also be a member of the sysadmin entity on the SQL Server-based server you are configuring. Permissions Required for Database and Lync Server Installation The following options detail three permissions and group membership associations for installation of Lync Server files and SQL Server databases. Choose the scenario that best meets the requirements of your organization. 23

29 Permissions and Group Membership Associations Microsoft Lync Server 2010 Enterprise Edition Deployment Guide SQL Server or Lync Server role Role-Typical SQL Server permissions and group membership Role-typical Lync Server permissions and group membership Permissions outcome Lync Server administrator Must be granted membership of sysadmins SQL Server security group and member of the SQL Server local Administrators group Must be a member of the RTCUniversalServerAdmins group Lync Server administrator has the proper permissions to install both Lync Server and SQL Server databases. SQL Server administrator SQL Server sysadmin group member (or equivalent) and member of the SQL Server local Administrators group Must be a member of the RTCUniversalServerReadOnly group SQL Server administrator has the proper permissions to install both Lync Server and SQL Server databases. Both administrators sharing installation duties SQL Server administrator is member of sysadmins group (or equivalent) and member of the SQL Server local Administrators group Lync Server administrator is member of RTCUniversalServerAdmins The Lync Server administrator can install Lync Server, but cannot install the databases. The SQL Server administrator uses the Lync Server Management Shell and Windows PowerShell cmdlets provided by the Lync Server administrator to install the databases. The Lync Server 24