Lync Server Patching Guide Version 1.1 Author: John McCabe Email: johm@microsoft.com Date: 1/12/2011
Contents 1. Overview... 4 2. Patching References... 5 3. Patching Workflow... 6 4. Patching Procedure... 7 4.1 Preparing The Server... 7 4.1.1 Verify Event viewer and Pending Reboots... 7 4.1.2 Verify Patch has not already been installed... 8 4.1.3 Downloading the patches... 10 4.2 Applying Lync Patches... 12 4.2.1 Draining a Lync Server... 12 4.2.2 Applying the Patch... 13 4.2.3 Verifying the patch has installed successfully... 16 4.3 Testing functionality after patching... 17 4.3.1 Verify Services have started... 17 4.3.2 Verify Client Connectivity... 17 4.3.3 Verify Working Scenarios... 18 4.4 Patching Devices... 18 4.4.1 Prep Download the update... 18 4.4.2 Creating a Test Device... 21 4.4.3 Uploading the Patch to the lync server... 22 4.4.4 Approving the patch... 24 4.4.5 Verifying the patch was successful... 25 4.5 Patching Clients... 25 4.5.1 Downloading The Patch... 25 4.5.2 Installing the patch on a client... 26 Page 3 of 28
1. Overview This document aims to provide a process for the IT staff to be able to patch their Lync environment. Follow the procedures as closely as possible. Page 4 of 28
2. Patching References Before patching always reference the Lync Update Center located at the below URL. http://technet.microsoft.com/en-us/lync/gg131945 This is the Microsoft Lync Update Center and will provide all the latest information on what patches are available for the environment. The patches for server / client / devices are separated. Ensure you download (if available) the latest patches in each category. NOTE 1: Server Patches usually have a cumulative Installer (Lyncserverupdateinstaller.exe) please use this to patch the server components. This contains all the patches for all roles but will automatically detect only the installed components on the server it is executed on. NOTE 2: Ensure when using the reference site that you read and/or print off the release nodes of the patch. Occasionally there is manual work involved. For Example in Cumulative Update 3 for Lync Server there is a separate command needs to be run from a front end server update the databases. If you do not observe the release notes it could have a drastic effect on your environment. Page 5 of 28
3. Patching Workflow NOTE: During any patching deployment you should notify IT Staff and End-Users of potential outage or disruption to the service. Page 6 of 28
4. Patching Procedure Due to the possibility of manual configuration (see CU3) it is considered safer to download the patch from the previously mentioned link, rather than using an automated solution to patch the lync environment. 4.1 Preparing The Server 4.1.1 Verify Event viewer and Pending Reboots 4.1.1.1 Event Viewer Checks Event ID 1029 will be logged in the application log if an application has been installed that requires a restart. From powershell you can run the following command $rebootreqevents = get-eventlog -log application where {$_.instanceid -eq "1029"} $rebootreqevents This should give the following type of output Check the first entries date and time. In this case it is Oct 22 14:23 Now run the following commands from powershell $lastboot = Get-WmiObject -Class Win32_OperatingSystem write-host "Last Server Reboot:`t" $lastboot.converttodatetime($lastboot.lastbootuptime) You will get the following output As you will see the server was rebooted on the 22 nd November. Proceed with the registry checks to verify nothing is pending. Page 7 of 28
4.1.1.2 Pending Reboot Registry Checks (optional) You can verify the following registry keys to determine if the box has pending reboots before you progress the installation. HKLM\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\ *****Look for RebootPending Keys***** HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update ***** Look for RebootRequired Keys ****** HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\ ***** Look for PendingFileRenameOperations ***** HKLM\SOFTWARE\Microsoft\Updates\ ***** Look for UpdateExeVolatile ***** If the values exist and/or have data populated in the reg keys, It would be recommended to reboot the server before beginning to patch the installation. 4.1.2 Verify Patch has not already been installed To begin we need to verify the KB Article numbers associated with the patches to be installed. If we navigate to the site http://technet.microsoft.com/en-us/lync/gg131945 Page 8 of 28
Click into each individual update relevant to your installation Scroll down the screen until you come to the section Resolution and you will see each KB article number for each patch that is to be deployed Once you have the list gathered, open a powershell prompt and type the following $hotfix = KBXXXXXXX (make sure you replace the XXXXXXX with the actual number) get-wmiobject -class Win32_QuickFixEngineering where {$_.Hotfixid eq $hotfix } This will search the updates applied to the machine and determine if the patch is installed. Page 9 of 28
A simple script to help automate this task would be ########################################################################### cls #define the array and initialize [array]$hotfix = $null #store the hotfix numbers you are looking for, you can add more just use $hotfix += "KBXXXXXX" $hotfix += "KB2467771" $hotfix += "KB971033" Foreach ($h in $hotfix) { Write-Host "Processing HotFix:`t" $h $result = get-wmiobject -class Win32_QuickFixEngineering where {$_.hotfixid -eq $h} if ($result -ne $null) { Write-host "$h is installed on this server" } else { Write-Host "$h is not installed on this server" } } ######################################################################## NOTE: If you download the Consolidated Installer (Normally LyncServerUpdateInstaller.exe) it will also detect if a patch has previously been applied. See Page 15 for Screen Shot 4.1.3 Downloading the patches The Lync update center located here contains the information necessary to download the latest patches for the environment. When you click on the hyperlink to download the Lync Server 2010 Cumulative Update it will bring you to a page which will give you a link to the LyncServerUpdateInstall.exe (and the individual patches) but also instructions on how to apply the patch correctly. Attention must be paid for manual steps like upgrading the database Page 10 of 28
Download Link For Cumulative Installer Manual Steps that need to be performed Pay Attention to this line in regards to your deployment Download the necessary patches for your deployment and save them to a central share. In the next copy the patches that have been downloaded to each server to be patched. The core reason for this logic is that then during each install a set of logs per server will get generated when applying the patch, if the installer is run from a central share the logs will be overwritten each time and will make it difficult to troubleshoot. Page 11 of 28
4.2 Applying Lync Patches Before the actual application of the lync patches please re-confirm the following steps to ensure a smooth process. Read and Understand the steps necessary for the patch (i.e. what the patch is fixing / how it is to be applied / are there manual elements to it) Verify there is no pending reboots on the servers or previously failed patches. Notify Users of the downtime during the patching period. If you use a monitoring product place the servers in maintenance mode Complete change control processes if subject to them. Apply patch in a test environment if available 4.2.1 Draining a Lync Server The follow are the steps required to take to drain a Lync server before any patching cycle begins NOTE: Draining a server is a good way to minimize disruptions but it must be noted that some disruption will occur, Server draining only allows calls that are currently active to stay up and running until they terminate. This does not apply for other areas in the lync client. The client will after a small period of time log back into another server and operate as normally. But you can imagine doing a patch cycle on all servers and moving users from one server to another (if it happens to be round robin) could lead to disruption for the user. 4.2.1.1 Log on to the Lync server with CS Administrators Credentials 4.2.1.2 Click Start All Programs Microsoft Lync Server 2010 Microsoft Lync Management Shell 4.2.1.3 At the prompt type get-cswindowsservice and hit enter (The first time you run this it may take a while) Page 12 of 28
4.2.1.4 The following should resemble the output It should display which services have active users on it. 4.2.1.5 Type stop-cswindowsservice graceful and hit enter 4.2.1.6 Once stop-cswindowsservice returns the cli, repeat Step 4.1.3 to check on the state of the services. Once they are all stopped then you can move to the next step. NOTE: Once a server is patched and rebooted it will automatically start the services again. If a reboot is carried out prior to patching, set all the lync services to disabled. 4.2.2 Applying the Patch 4.2.2.1 Navigate to the central share that the patches have been downloaded to 4.2.2.2 Copy the patch to a local directory on the server (i.e. C:\lync install\cu4) 4.2.2.3 Navigate to the local copy of the patch and double click the LyncServerUpdateInstaller.exe Page 13 of 28
4.2.2.4 The following screen should appear 4.2.2.5 Notice the column Latest Installed and observe which patches have a Green Check Circle (i.e. it has the latest patch installed for that component) or a Red X Circle (i.e. it does not have the latest patch installed for that component). NOTE: Having mixed results for the latest patches is normal, the latest released patches may not update all components in the system. 4.2.2.6 When you are ready to start the patching process Click Install Updates. This will begin the patch process which is automated from here. Monitor the deployment to ensure all goes successfully. 4.2.2.7 Once the process has complete the installer screen will have updated itself if the patches have been installed successfully Page 14 of 28
4.2.2.8 Once the patches have been successfully deployed, any manual steps must Be carried out. In the case of CU3 and CU4 you need to run a database update script. To perform this task refer to the Lync Update Center (here) for full instructions In CU3 and CU4 a Lync Management shell is required to be launched (and the following command be executed Install-CsDatabase -Update -ConfiguredDatabases -SqlServerFqdn <EEBE.Fqdn> -UseDefaultSqlPaths NOTE: Please follow the notes regarding the co-location of the archiving server and backend server published in respect to executing this command. Reference the Lync Update Center for more information The SQLServerFqdn needs to be determined and can easily be found by running the following command Get-CSService -UserDatabase This DB upgrade must complete successfully, monitor the progress of the update. Page 15 of 28
4.2.3 Verifying the patch has installed successfully To verify the patch has been installed successfully we can re-run the Lyncserverupdateinstaller.exe and verify all Latest Update column has the Green Check Circle. As in the applying patch procedure. Using the PowerShell script in step 4.1.2 it will also determine if the patches have been installed and registered correctly. Finally to ensure the DB has been upgraded you can perform the following steps 4.2.3.1 On the server where the sql backend is located, open SQL Management Studio 4.2.3.2 Connect to the RTC Instance 4.2.3.3 Expand the RTC Database 4.2.3.4 Expand Tables 4.2.3.5 Locate the table dbo.dbconfigint 4.2.3.6 Right click the table and select Top 1000 Rows 4.2.3.7 In the results pain locate the Name DbVersionUpgrade and check its value In CU3 the value was 1 In CU4 the value is 3 Page 16 of 28
4.3 Testing functionality after patching 4.3.1 Verify Services have started 4.3.1.1 Open a lync management shell 4.3.1.2 Type get-cswindowsservice and press enter 4.3.1.3 Verify all the services are running 4.3.2 Verify Client Connectivity Perform the following tests from a client perspective and validate operation Automatic Sign In Name resolution from address book Peer To Peer IM Peer To Peer Audio Call Peer To Peer Video Call Web Conference (Whiteboard / Sharing / PPT) Group IM PSTN Breakout (if Enterprise Voice is Enabled) Inbound PSTN (if Enterprise Voice is Enabled) External User Access NOTE: Some of these tests can be automated through the use of synthetic transactions on the server. In the Microsoft Lync Resource Kit, the troubleshooting chapter details more information, it can be found here. Page 17 of 28
4.3.3 Verify Working Scenarios Depending on the environment you may also want to test scenarios relevant to your organization around the following Response Group Scenarios Dialin Conference (Web and PSTN Bridge) PSTN Routing NOTE: Some of these tests can be automated through the use of synthetic transactions on the server. In the Microsoft Lync Resource Kit, the troubleshooting chapter details more information, it can be found here. 4.4 Patching Devices 4.4.1 Prep Download the update 4.4.1.1 The Lync Update resource center (here) will also notify of any device updates. 4.4.1.2 Verify your edition of phone against this and determine if an update is required. 4.4.1.3 Click on the applicable link for your device estate Page 18 of 28
4.4.1.4 Scroll down the page until the resolution section and click the Download the UCUpdates.exe package now (see above) 4.4.1.5 This will bring you to the download center and from which the update can be obtained. 4.4.1.6 Once the update is downloaded, double click it. A self-extractor will launch 4.4.1.7 Select the language appropriate for your region and click next Page 19 of 28
4.4.1.8 Agree to the EULA and click next 4.4.1.9 Select a location to extract the patch to and click next 4.4.1.10 Press finish when prompted to complete the wizard. 4.4.1.11 Navigate to where you have extracted the files and locate ucupdates.cab, copy this file to the lync server Page 20 of 28
4.4.2 Creating a Test Device NOTE: Before starting this procedure ensure you have obtained the MAC address of the device you are nominating as a test device. You can obtain the settings from Menu -> System Information on the Device. 4.4.2.1 Open the Lync Control Panel 4.4.2.2 Navigate to Clients (in the left hand menu) and then Test Devices (on the top menu) 4.4.2.3 Click New Global Test Device (or Site Test Device depending on your requirements) Page 21 of 28
4.4.2.4 Populate the field device name and its MAC address that you collected earlier. Press Commit to confirm. 4.4.2.5 Verify the new test device appears in the Test Device Screen 4.4.3 Uploading the Patch to the lync server 4.4.3.1 Open a Lync Management Shell Instance 4.4.3.2 At the prompt type get-csservice webserver fl identity and press enter Page 22 of 28
4.4.3.3 This will return the identity of the webserver you need to use when uploading the device update. For later we will need the full string WebServer:lync-01.corp.contoso.com 4.4.3.4 Type import-csdeviceupdate identity WebServer:lync-01.corp.contoso.com filename c:\users\administrator\downloads\ucupdates.cab and press return NOTE: This will import the patch into Lync but you will receive no notification to say the import was successful 4.4.3.5 Open the Lync control panel 4.4.3.6 Navigate to Clients and then to devices 4.4.3.7 Verify the update applied NOTE: After you have imported the patch the update will automatically roll out to the test devices previously created. This update will reboot the phones to apply the update Page 23 of 28
4.4.4 Approving the patch 4.4.4.1 Select the updates you want to approve 4.4.4.2 Click Action Approve 4.4.4.3 Notice how the updates have changed from pending version to approved version Page 24 of 28
4.4.5 Verifying the patch was successful 4.4.5.1 Click Menu on the Lync Device 4.4.5.2 Click System Information 4.4.5.3 Verify the Version that is applied to the phone versus what you have uploaded and approved. 4.5 Patching Clients 4.5.1 Downloading The Patch 4.5.1.1 Navigate to the Lync Resource Center (here) to Obtain the client patches Click on the Lync 2010 link to take you to the download page 4.5.1.2 Navigate to the resolution section of the lync 2010 page and download the package appropriate to your clients. There are 32bit and 64bit packages. Page 25 of 28
4.5.2 Installing the patch on a client 4.5.2.1 Navigate to the folder that you have downloaded the patch to 4.5.2.2 Double click the lync.msp file 4.5.2.3 Click Next on the welcome screen Page 26 of 28
4.5.2.4 Click Update to start the patch installation 4.5.2.5 Click Finish to complete the patch installation NOTE: Deploying patches via a patch management solution or gpo is supported. A Sample string for silently installing the patch with these solutions is msiexec /qn ALLUSERS=2 /p Lync.MSP REBOOT=ReallySuppress Page 27 of 28
Page 28 of 28