Microsoft Lync Server 2013 Front End Server : Active Directory Preparation

Microsoft Lync Server 2013 heavily leverages Active Directory. This results in tight integration across the Microsoft stack, including Microsoft Exchange and Microsoft SharePoint Server. However, first Active Directory must be prepared before installation can begin. All the Active Directory preparation steps can be performed in either the Deployment Wizard GUI or the Lync Server Management Shell, a customized version of PowerShell.

The first step is to ensure that your Active Directory environment meets the minimum requirements for Lync Server 2013. The requirements are outlined here:

• All domain controllers in the forest where Lync Server 2013 will be deployed must be Windows Server 2003 SP2 or higher.

• All domains where you deploy Lync Server 2013 must have a functional level of Windows 2003 native or higher.

• The functional level for the forest must be Windows 2003 native or higher.

After the Active Directory prerequisites have been met, the next step is to extend the Active Directory schema to support Lync Server 2013. The schema preparation process adds new classes and attributes to Active Directory that are required for Lync Server 2013. This process must be run as a user that is a member of the Schema Admins group and is a local administrator on the server that holds the Schema Master FSMO role.

To extend the Active Directory schema using the Lync Server Deployment Wizard, as shown in Figure 1, follow these steps:

1. From the Lync Server 2010 installation media, run Setup.exe.

2. Click Prepare Active Directory.

3. For Step 1: Prep Schema, click Run.

4. At the Prepare Schema screen, click Next. You’ll see the Management Shell command that is being executed, as shown in Figure 2.

5. Ensure that the process was successful and click Finish to close the window.

6. Ensure that the information has replicated to all domain controllers before continuing to the next step.

Figure 1. Lync Server 2013 Deployment Wizard.

Figure 2. Prepare Schema command.

To prepare the Active Directory schema using the Lync Server Management Shell, open the shell and run the Install-CsAdServerSchema cmdlet. The proper syntax for the command is Install-CsAdServerSchema -LDF <full directory path where the ldf files are located>. For example

Install-CsAdServerSchema -LDF "C:\Program Files\Microsoft Lync Server 2013\Deployment\Setup"

The Lync Schema extension process adds the following attributes to Active Directory. The first two are flagged MayContain for every user account.

• msExchUserHoldPolicies—Shared with Exchange 2013 and will already be in place if the schema has already been extended for Exchange 2013. It is a multivalue attribute that holds identifiers for user hold policies applied to a given user account.

• msRTCSIP-UserRoutingGroupId—Defines the SIP routing group ID. The SIP routing group ID defines which Front End Server a user will register to.

• msRTCSIP-MirrorBackEndServer—Used to store the information for the mirrored SQL Server backend used by the front-end pool.

The next step is to prepare the Active Directory Forest. This process must be run by a user of the enterprise admins group or domain admins for the root domain. Forest preparation creates global objects and sets the appropriate permissions and groups to complete the installation process. Note that in a new deployment the global settings are automatically stored in the Configuration partition. If you are upgrading from an older version of Lync Server, you can still store the settings in the System container as was standard during previous versions’ installation. However, although it is not a requirement, it is recommended to move the global settings container from the System partition to the Configuration partition as part of the Lync Server 2013 installation process.

The Deployment Wizard should still be up from the preceding step. If not, run setup.exe and it will pick up where you left off. Follow these steps to prepare the forest:

1. For Step 3: Prepare Current Forest, click Run.

2. At the Prepare Forest screen, click Next. You’ll see the Management Shell command that is being executed, as shown in Figure 3.

Figure 3. Prepare Forest command.

3. Ensure that the process was successful and click Finish to close the window.

4. Ensure that the information has replicated to all domain controllers before continuing to the next step.

To prepare the Active Directory Forest using the Lync Server Management Shell, open the shell and run the Enable-CsAdForest cmdlet. The proper syntax for the command is Enable-CsAdForest -GroupDomain <FQDN of the domain to create the universal groups>. For example

Enable-CsAdForest -GroupDomain companyabc.com

The final step is to prepare the active directory domain or domains. You’ll need to run this in every domain where you plan to deploy Lync Server 2013. This step will add to universal groups the necessary ACEs (access control entries). As in the two previous steps, this can be done through the Lync Server Deployment Wizard or the Lync Server Management Shell.

Using the Deployment Wizard, perform the following steps. Note that if you closed the Deployment Wizard you’ll need to run setup.exe again.

1. For Step 5: Prepare Current Domain, click Run.

2. At the Prepare Domain screen, click Next. You’ll see the Management Shell command that is being executed, as shown in Figure 4.

Figure 4. Prepare Domain command.

3. Ensure that the process was successful and click Finish to close the window.

4. Ensure that the information has replicated to all domain controllers before continuing to the next step.

To prepare an Active Directory domain using the Lync Server Management Shell, open the shell and run the Enable-CsAdDomain cmdlet. The proper syntax for the command is Enable-CsAdDomain -Domain <current domain FQDN> -GroupDomain <FQDN of the domain where the Universal groups were created>. For example

Enable-CsAdDomain -Domain companyabc.com -GroupDomain companyabc.com

Following is a list of Active Directory Administration groups created by the preparation processes.

Service groups:

• RTCHSUniversalServices—Includes service accounts used to run Front End Server and allows servers read/write access to Lync Server global settings and Active Directory user objects.

• RTCComponentUniversalServices—Includes service accounts used to run conferencing servers, Web Services, Mediation Server, Archiving Server, and Monitoring Server.

• RTCProxyUniversalServices—Includes service accounts used to run Lync Server Edge Servers.

• RTCUniversalConfigReplicator—Includes Lync servers that participate in Central Management Store replication.

• RTCSBAUniversalServices—Grants read-only permission to Lync server settings and allows for the configuration of survival branch appliance devices.

Administration groups:

• RTCUniversalServerAdmins—Allows members to manage server and pool settings.

• RTCUniversalUserAdmins—Allows members to manage user settings and move users from one server or pool to another.

• RTCUniversalReadOnlyAdmins—Allows members to read server, pool, and user settings.

Infrastructure groups:

• RTCUniversalGlobalWriteGroup—Grants write access to global setting objects for Lync Server.

• RTCUniversalGlobalReadOnlyGroup—Grants read-only access to global setting objects for Lync Server.

• RTCUniversalUserReadOnlyGroup—Grants read-only access to Lync Server user settings.

• RTCUniversalServerReadOnlyGroup—Grants read-only access to Lync Server settings. This group does not have access to pool-level settings, only to settings specific to an individual server.

• RTCUniversalSBATechnicians—Grants read-only permission to the Lync Server configuration, and members of this group are placed in the local administrator group of the survivable branch appliance during installation.

Forest preparation then adds service and administration groups to the appropriate infrastructure groups, as described here:

• RTCUniversalServerAdmins is added to RTCUniversalGlobalReadOnlyGroup, RTCUniversalGlobalWriteGroup, RTCUniversalServerReadOnlyGroup, and RTCUniversalUserReadOnlyGroup.

• RTCUniversalUserAdmins is added as a member of RTCUniversalGlobalReadOnlyGroup, RTCUniversalServerReadOnlyGroup, and RTCUniversalUserReadOnlyGroup.

• RTCHSUniversalServices, RTCComponentUniversalServices, and RTCUniversalReadOnlyAdmins are added as members of RTCUniversalGlobalReadOnlyGroup, RTCUniversalServerReadOnlyGroup, and RTCUniversalUserReadOnlyGroup.

Forest preparation also creates the following role-based access control (RBAC) groups:

• CSAdministrator

• CSArchivingAdministrator

• CSBranchOfficeTechnician

• CSHelpDesk

• CSLocationAdministrator

• CSResponseGroupAdministrator

• CSPersistentChatAdministrator

• CSServerAdministrator

• CSUserAdministrator

• CSViewOnlyAdministrator

• CSVoiceAdministrator

• CSResponseGroupManager