Microsoft push notification messages are not delivered to Lync mobile IOS and WP7 clients, when URL filtering is configured on Lync 2010 Edge Servers or office communication 2007 R2 Access Edge Server, apparently this is caused by:

Taken from Microsoft KB2664650

The Lync Server 2010 Mobility service sends SIP messages that contain active hyperlinks in their Message-Body header that define the XML namespace information for the push notification to the Lync Server Push Notification service.

Lync Server 2010 Front End Pool

Using the URL Filter page in the IM and Presence group in Lync Server Control Panel to enable the Hyperlink prefix option Send warning message, will precede the active hyperlink with a user defined warning message in the SIP packet that contains the push notification message. The Lync Server Push Notification service will reject the modified push notification information and send an error response back to the Lync Server 2010 Mobility service.

Office Communications Server 2007 R2 Access Edge server

Using the URL Filter tab of the Office Communications Server 2007 R2 Intelligent IM Filter dialog to:

• Allow instant messages that contain hyperlinks, but convert the hyperlinks to plain text
• Allow instant messages that contain hyperlinks. Enter a warning that you want to insert at the beginning of each containing hyperlinks

Will precede the active hyperlink with a user defined warning message and convert the active hyperlink to text by preceding it with an underscore or precede the active hyperlink with a user defined warning message in the SIP packet that contains the push notification message. The Lync Server Push Notification service will reject the modified push notification information and send an error response back to the Lync Server 2010 Mobility service.

for more information about the workaround and how to fix this issue please click here

what is this Service used for ?

The Service is a cloud-based service located in the Lync online Data Center, it is used to send notifications to Lync mobile clients running on windows phone 7 and IOS based systems.

The push notification Service push notifications to mobile clients n the form of badges, icons, or alerts, even if the mobile application was inactive. Push notifications notify a user of events such as a new or missed IM invitation, missed calls, and voice mail.

How it works ?

The Microsoft Lync Server 2010 Mobility Service sends the notifications to the cloud-based Microsoft Lync Server 2010 Push Notification Service, which then sends the notifications to the Apple Push Notification Service (APNS) or the Microsoft Push Notification Service (MPNS). as illustrated in the below diagram.

So assuming User A sends an instant Message to User B located outside the organization and using WP7 Lync mobile client, and it happened that the User B has closed the Lyn Mobile client a while ago, in this case the Lync mobility Service will send a notification to the Lync push notification Service and then the Lync push notification service will push the notification to the MPNS and this last will forward the notification to the Mobile device.

when user B receive the notification he can click on it to activate the Lync mobile client and answer to the IM in request.

is it free of charge ?

The push notification service is Free of charge all that you have to do is to configure your Lync deployment to send the notification to the Lync Server Push notification Service hosted in the Lync online Data Center, push.Lync.com is the Microsoft office 365 domain that is used by the push notification service.

is it required ?

it is required to be configured if there are users within your organization that uses iphone, and WP7 based smartphones, since these types of phones doesn’t support application backgrounding , which means the Lync mobile client can’t remain active in the background while working on something else on the phone.

this is not the case with android and Nokia Symbian smartphones, these types of phones doesn’t require push notifications.

How to configure to support push notification service ?

Log on to the Lync Front-End Server with a user that is member of the RtcUniversalServerAdmins Group and open Lync management Shell.

1. Add Lync online hosting provider to the list of the hosting providers at the command line run:

you can change “lyncOnline” to whatever unique identifier you like

2. Set up hosting provider federation between your organization and the Push Notification Service at Lync Online. At the command line, type:

3.  we have setup a new hosting provider, configured the allowed domain, so now we can enable Enable push notifications.

At the command line, type:

to verify if the push notifications Service is enabled at the command line type:

you should have similar results

4. if you don’t have federation enabled on your Edge Server, you should Enable it by running.

5. you can test the federation configuration by using the test-CsFederationPartner cmdlet

At the command line, type:

where uc-edge1.unibox.me is the Edge Server internal FQDN

you should get a success result

6. you can also test push notifications by using the test-CsMcxNotification cmdlet

At the command line, type:

where uc-edge1.unibox.me is the Edge Server internal FQDN

you should also get a success result as follow

once all the above is completed successfully Lync Mobile clients will start receiving notifications. it is important to note that you should allow a bit of time for the push notification start working properly, and already connected users should sign out and sign in back again on the Lync Mobile client.

what are the Port and Firewall Requirements

if you support push notifications and want Apple mobile devices to receive push notifications over your Wi-Fi network, you also need to open port 5223 on your enterprise Wi-Fi network. Port 5223 is an outbound TCP port used by the Apple Push Notification Service (APNS). The mobile device initiates the connection. For details, see http://support.apple.com/kb/TS1629

Hope you find this post useful, and happy mobile Lyncing

so let’s get started, in this scenario Lync 2010 enterprise edition pool is deployed, running on windows 2008 R2 sp1 operating system.

Before beginning the installation it is recommended to review the official deployment guide to understand the mobility service concept

A) Install Lync 2010 Cumulative update 4 December 2011

since the Mobility Service requires Lync 2010 Cumulative update 4 December 2011 to be installed, ( you can get it from here) we will start by installing it in order to apply the Lync 2010 Hotfix KB 2493736.

1-on each Lync server download from here and run LyncServerUpdateInstaller.exe, select install updates and verify that now you have latest updated version installed, if not press install updates and wait until the updates are finished.

after verifying that the updates are installed properly stop all Lync services by running the following command from the Lync management shell

Stop-CsWindowsService

Also Stop the world Wide Web Service using the following command

net Stop w3svc

2- Update SQL bank End Database Instance

this procedure should be performed once per pool and should be run from only one Front End server per pool for each instance of Back End databases.

use install-CsDatabase to update the SQL Back End, as follows :

From Lync management Shell run

Install-CsDatabase -Update -ConfiguredDatabases -SqlServerFQDN db-1.unibox.me 

If you have collocated Databases within the SQL instance for any additional Lync Server roles for example Monitoring or archiving servers you should use the –ExcludeCollectedStore parameter

now we have applied the latest update to our Lync environment reboot the server or start all Lync service by running and the IIS world wide web service 

Start-CsWindowsService

net start w3svc

B)  Configure DNS Records

Internal and External DNS records are required to be configured for each supported sip domain, the DNS  (A) or CNAME records types are supported. the use of CNAME records is advisable in cases where Lync enterprise pool with multiple front-End servers is deployed for simplicity of administration when new Front-End Servers are deployed.

why SRV Records are not supported by the mobile clients! ?  I mean they could do it the same way that outlook clients query for Exchange autodiscover service no ?

actually this was the first question that I asked myself the first time I read mobility service requirements, after having a clear idea about the whole setup and concept I realized that this was done in order to provide a seamless experience for the mobile clients. So queries for SRV autodiscover records are not supported.

in our scenario a single sip domain will be supported for autodiscover and mobility service and defined by unibox.me, and it is shared inside and outside the organization network, thus we will be creating both the internal and external auto discovery records in the same name space.

Open DNS server management Console expand the forward lookup zone corresponding to the sip domain right-click the forward lookup zone and the following:

1- Configure  Internal Autodiscover DNS Record

select new CNAME record and set “LyncDiscoverInternal” as alias name, and the Lync pool internal web services FQDN as target host

In case where a director exist the target host should point to the director internal web services  FQDN

2- Configure External Autodiscover DNS Record

select new CNAME record and set “LyncDiscover” as alias name, and the Lync pool External web services FQDN as target host

it is important to note that the Lync external web services FQDN should point to the external IP address which is already assigned to the Reverse Proxy listener of Lync external web services FQDN. ( the reverse proxy configuration is discussed in details later )

the External Autodiscover record should be configured as an internal DNS record in order to provide mobile clients seamless connectivity experience when switching between locations and networks.

C) Deploy the Mobility Service

1 – Configure internal and external ports

since the mobility service is not a built-in part of the Lync server service ports should be configured explicitly in order for the service to operate properly, the mobility service covers internal and external requests, 2 ports should be configured  to listen to internal  and external requests respectively.

To configure the ports open Lync management shell and run the following

Set-CsWebServer –Identity ucpool01.unibox.me –McxSipPrimaryListeningPort 5086

Set-CsWebServer –Identity ucpool01.unibox.me –McxSipExternalListeningPort 5087

Enable-CsTopology -Verbose

2 – Install IIS Dynamic Content Compression features

The Mobility Service installation requires that the Internet Information Services (IIS) module for Dynamic Content Compression be installed. Most of the cases this module is not installed in your deployment by default, in this case you need to install it before running the McxStandalone.msi package.

If the Lync server machine is running windows 2008 R2 like in my case you can install the Dynamic content Module from Lync management shell as follows:

Import-Module ServerManager

Add-WindowsFeature Web-Server, Web-Dyn-Compression

After configuring all the above we can proceed by installing the mobility and autodisocver service binaries

3- Install the Mobility Service and autodiscover Service Binaries

You need to run the installer on each Front End Server and each Director in every Lync Server pool where you want to provide the mobility feature. The installer installs the Mobility Service on Front End Servers and installs the Autodiscover Service on Front End Servers and Directors.The latest installation package is available for download from the Microsoft Download Center at http://go.microsoft.com/fwlink/?LinkID=230577.

Copy the downloaded McxStandAlone.msi package to “C:\ProgramData\Microsoft\Lync Server\Deployment\cache\4.0.7577.0\setup”

Or from either Lync management shell or windows PowerShell type the following

The above code will download the msi package and save it in the proper location

after downloading the package run the bootstrapper.exe from the lync powershell at the following location

C:\Program Files\Microsoft Lync Server 2010\Deployment\Bootstrapper.exe

so far we have prepared the environment and installed the mobility and autodiscover service, the next step that is still required is to modify the Lync server certificate to include the new autodiscover SAN entries.

To verify that the Mobility Service has been successfully installed

On the Lync Front-End Server where  you have installed the Mobility Service and Autodiscover Binaries , open Internet Information Services (IIS) Manager, expand the Sites node,  expand the Lync Server External website, and check that the autodisocver virtual directory is created, do the same for the Lync Server Internal Website

also open the application pools and locate the CSExtMcxAppPool and CSIntMcxAppPool and check that they are started

4- Modify Lync Internal Certificate

In most of the cases, the Certificate installed on the Lync server would be issued from an internal CA, thus renewing or updating this certificate is simple.

The certificate should be modified to include Lyncdiscover.unibox.me and Lyncdiscoverinternal.unibox.me entries as SAN entries.

in most of the cases a single certificate is installed  and assigned for multiple use, in order to double check this, from the Lync management Shell run:

Get-CsCertificate

Get-Certificate will return all installed certificates with each certificate details. look for the thumbprint and use fields.

If the thumbprint Value is the same for all usage that means that a single certificate is assigned for multiple use. which means that we need to only submit one certificate request, to include the autodiscover entries.

From the Command line run following command

the above command will generate a new certificate request and install the certificate to the Lync Server computer Store.

“AllSipDomain” parameter is used here since as stated earlier we have only one sip domain is supported. In case multiple sip domain are supported, you have to specify the entries explicitly by using the –”Domainname” parameter for example

after verifying the the certificate request has been successfully submitted assign the new certificate for multiple use.

to assign the new Certificate, run the following command you need to use the new issued Thumbprint

to verify that the new certificate have successfully assigned run Get-CsCertificate Command again and compare the old and new Thumbprint values.

D) Reverse proxy configuration for mobility

The Reverse proxy used in this environment is Microsoft TMG 2010.

at this point the mobility service should be up and running and available for mobile clients connecting from inside the organization network through WIFI.

but In order to support mobile clients connecting from outside the organization network, the new External autodiscover URL should be published on the reverse proxy, the same way that simple URL and Lync web services are already published, there’s no need to add an additional publishing rule, only modify the existing rule and add lyncdiscover.<sipdomain> to the public Names and of course make sure that a Host record for lyncdiscover.<sipdomain> has been configured to point to the external IP address which is already assigned to the Reverse Proxy listener of Lync external web services FQDN. This is true as long as you modify the Reverse proxy Certificate to include the autodiscover URL as SAN, since as we know the simple URL and web components are published through HTTPS protocol.

What if your implementation supports multiple SIP domains! that means you should get a public certificate which include multiple autodisover URLs, which is not a cost effective solution. Fortunately the autodisover can be published through HTTP instead of Https , this is a good solution since we are only publishing the autodiscover Service and access everything else will remain using HTTPS.

In order to publish the autodiscover service using HTTP, we need to create and configure a new website publishing rule on the TMG Server.

Give the Publishing rule a meaningful name

On the Select Rule Action page, select Allow.

On the Publishing Type page, select Publish a single Web site or load balancer.

On the Server Connection Security page, select Use non-secured connections to connect to the published Web server or server farm.

On the Internal Publishing Details page, in Internal Site name, type the internal Web Services FQDN for your Front End pool, in our case it is csweb.unibox.me

On the Internal Publishing Details page, in Path (optional) type /* as the path of the folder to be published, and then select Forward the original host header instead of the one specified in the Internal site name field.

On the Public Name Details page, do the following:

• Under Accept Requests for, select This domain name.
• In Public Name, type lyncdiscover.unibox.me (the external Autodiscover Service URL).
• In Path, type /*.

On Select Web Listener page, in Web Listener, use the New Web Listener Definition Wizard to create a new one.

in the New Web listener definition wizard,in the Client Security page select Do not requires SSL Connections with clients.

in the New Web listener definition wizard,in the Web Listener IP addresses page select External Network, as the network to listen for incoming web requests.

if there are multiple IP addresses configured on the External Network of the reverse proxy select the appropriate IP address to which <lyncdiscover.sipdomain> is configured in the public DNS. ( we will create the public DNS later )

in the authentication settings, select no authentication

finish the wizard and select the new web listener as the listener of the new web publishing rule

On the Authentication Delegation page, select No delegation, and client cannot authenticate directly

On the User Set page, select All Users.

On the Completing the New Web Publishing Rule Wizard page, verify that the web publishing rule settings are correct, and then click Finish.

In the Forefront TMG list of web publishing rules, double-click the new rule you just added to open Properties.

On the Bridging tab, configure the following:

• Select Web server.
• Select Redirect requests to HTTP port, and type 8080 for the port number.
• Verify that Redirect requests to SSL port is not selected.

Click OK

Click Apply in the details pane to save the changes and update the configuration.

Click Test Rule to verify that your new rule is set up correctly

Verify that the external Autodiscover Service URL is not defined on any other web publishing rule.

E) Verify Mobility Service Deployment

1- verify autodiscover External URL publishing

to verify that the autodiscover service has been successfully published, from a computer that is connected via an external internet connection open http://lyncautodisocver.<sipdomain> in our case http://lyncdisocver.unibox.me

you should receive a file download request, open the file in notepad, this file contains the redirection information to the Lync web Services external website, note that this is the only information sent clear text, since the mobile client will establish a secure connection later with the Lync Server web components

{"Root":{"Links":[{"href":"https:\\/webservices.unibox.me\/Autodiscover\/AutoDiscoverService.svc\/root?sipuri=","token":"Redirect"}]}}

2- To test person-to-person instant messaging using test-CsMcxP2PIM

After you deploy the Microsoft Lync Server 2010 Mobility Service and Microsoft Lync Server 2010 Autodiscover Service, run a test transaction to verify that your deployment works correctly. You can run Test-CsMcxP2PIM to test sending an instant message between two users. To use this test transaction, you need two actual or test users and their full credentials.

from the Lync management shell run the following command

supply the username and password for the first user

then run

supply the username and password for the second user

then run the following command

the receiver should receive an instant message from the sender in addition you can verify the successful web ticket creation from the shell by examining the cmdlet output

F) Configure Mobility Policy

Cumulative update for Lync Server 2010: November 2011 introduces a new mobility policy that determines who can use mobility features and who can use the Call via Work feature. Call via Work allows a mobile user to make and receive calls on a mobile phone by using a work phone number instead of the mobile phone number. This feature prevents the called party from seeing the caller's mobile phone number and allows a user to avoid outbound calling charges.

By default, after deploying the mobility service both mobility and Call via Work features are enabled, in order to check the mobility policy

Get-CsMobilityPolicy

if desired you can change the policy settings by running the set-MobilityPolicy Command for example the below command set a description for the global mobility policy

Get-CsMobilityPolicy  | Set-MobilityPolicy –Description ‘Default Mobility Policy’

The mobility policy give administrators controls over mobile users, it is quite important to use this policy carefully

Test the Client

now testing from a Lync mobile client for iphone, using only the sign-in name and password

hope that you enjoy mobile Lyncing!

This document guides you through the process of deploying the Microsoft Lync Server 2010 Mobility Service and the Microsoft Lync Server 2010 Autodiscover Service. When you deploy the Mobility Service, users can use supported iOS, Android, Windows Phone, or Nokia mobile devices to perform such activities as sending and receiving instant messages, viewing contacts, viewing presence. The Mobility Service also enables mobile devices to use some Enterprise Voice features, such as click to join a conference, Call via Work, single number reach, voice mail, and missed calls.

When you use the Microsoft Lync Server 2010 Autodiscover Service along with the Mobility Service, mobile devices can automatically locate the URLs for Lync Server Web Services and the new Mobility Service regardless of network location.

The Mobility Guide is available for download here

 
When you use the Microsoft Lync Server 2010 Autodiscover Service along with the Mobility Service, mobile devices can automatically locate the URLs for Lync Server Web Services and the new Mobility Service regardless of network location. It supports client connections using either HTTP or HTTPS.

The Mobility Service Bits are available for download here

Lync server 2010 Cumulative updates 4 November 2011 CU4  is a requirement prior deploying the Mobility Service.

Supported Mobile Clients should be released soon, the expected release date is 12-12-2011

Finally the service pack 2 for exchange 2010 has been released to the public you can find it here

with this release the exchange multi-talent mode has been eliminated, this  suppose to be a hit in the messaging and collaboration environment.

these Cmd-lets works with the upcoming Lync mobility services, which we don’t have the full details released yet.

here’s a brief description about the new cmd-lets  thanks to Tom Arbuthnot

1. CsAutodiscoverConfiguration

   Modifies an existing collection of Autodiscover configuration settings. The Autodiscover service provides a way for client applications such as Lync Web Access or Microsoft Lync Mobile to locate key resources such as a user’s home pool or the URL for joining a dial-in conference.

2. New-CsWebLink

   Creates a new web link that points to the Autodiscover service. The Autodiscover service provides a way for client applications such as Lync Web Access or Microsoft Lync Mobile to locate key resources such as a user’s home pool or the URL for joining a dial-in conference.

3. Test-CsMcxPushNotification

   Verifies that the push notification service is working. The push notification service (Apple Push Notification Service and Microsoft Lync Server 2010 Push Notification Service) provides a way to send notifications about event s such as new instant messages or new voice mail to mobile devices like iPhones and Windows Phones, even if the Microsoft Lync 2010 application on those devices is currently suspended or running in the background.

4. CsMobilityPolicy

   Modifies an existing mobility policy. Mobility policies determine whether o r not a user can use Microsoft Lync 2010 Mobile. These policies also manage a user’s ability to employ Call via Work, a feature that enables users to make and receive phone calls on their mobile phone by using their work phone number instead of their mobile phone number.

5. CsMcxConfiguration

   Modifies an existing collection of Microsoft Lync Server 2010 Mobility Service configuration settings. The Mobility Service enables users of mobile phones such as iPhones and Windows Phones to do such things as exchange instant messages and presence information; store and retrieve voice mail internally instead of with their wireless provider; and take advantage of Microsoft Lync Server 2010 capabilities such as Call via Work and dial-out conferencing.

6. CsPushNotificationConfiguration

   Modifies an existing collection of push notification configuration settings . The push notification service (Apple Push Notification Service and Micros oft Lync Server 2010 Push Notification Service) provides a way to send notifications about events such as new instant messages or new voice mail to mobile devices such as iPhones and Windows Phones, even if the Microsoft Lync 2010 application on those devices is currently suspended or running in the background.

it is recommended to use the Cumulative Update installer to install the update package automatically or use the below links for a manual installation.

note that  a server restart is required after applying this update specifically when updating the mediation server.

Server-side updates

• Lync 2010 Server – KB2514980 – download
• Lync 2010 Mediation Server – KB2640253 - download
• Lync 2010 Policy Decision Point – KB2502809 - download
• Lync 2010 Administrative Tools – KB2467771 - download
• Lync 2010 Core Components – KB2514981 - download
• Lync 2010 Conferencing Attendant – KB2575872 - download
• Lync 2010 Conferencing Server – KB2514978 - download
• Lync 2010 Web Components Server – KB2514979 – download
• Lync 2010 Group Chat Server – KB2514984 - download

Client-side updates

• Lync 2010 (Communicator) – KB2514982 – download (x86 / x64)
• Lync 2010 Group Chat Client – KB2636065 – download
• Lync 2010 Group Chat Administration Tool – KB2636063 – download

Hi Antoine,

First of all, I'd like to thank you for you blog, I used your guide to set up an Exchange 2010 multi tenant set up and it worked like a dream! Very clear instructions, just what I needed to guide us through the potential minefield!

Do you have any blog posts or examples on how to bulk create mailbox in a multi tenant environment, I'd like to a take a spreadsheet with users name, e-mail address etc. and create multiple mailboxes using a powershell script. I'm a GUI man at heart and I find powershell tricky at the best of times. I saw your blog on how to import PST files which I also think will be very useful.

Any help you can offer would be greatly appreciated.

Before getting started, and if you are new to Exchange 2010 multi-tenant mode I suggest you check the list of tutorials I wrote : Exchange 2010 hosting for hosters.

Lab Setup

For this tutorial I am using a single exchange server in hosting mode running all the roles, but the number of exchange servers you have in your setup will not change anything.

I have also created 2 test organizations for this tutorial TestOrg1 and TestOrg2.

A look to the CSV file

We need to build a comma separated value file containing all the info about the mailboxes to be created. Here is what my CSV file looks like

First,Last,Organization,Alias,UPN,Password
John,Doe,TestOrg1,jdoe,jdoe@testorg1.com,P@ssw0rd1
Jane,Mcneel,TestOrg1,jmcneel,jmcneel@testorg1.com,P@ssw0rd2
Mark,Seamons,TestOrg2,mseamons,mseamons@testorg2.com,P@ssw0rd3
Tiffany,Michelle,TestOrg2,tmichelle,tmichelle@testorg2.com,P@ssw0rd4

As you can see I tried to keep it as minimal as possible you can, of course, add as much information as you need.

Bulk Importing

It is now time to use the above created CSV file and populate your organization. Here is the powershell script to run

Import-Csv C:\List.csv | % {
  $name = $_.first + " " + $_.last; 
  New-Mailbox -Name $name -Alias $_.Alias -Organization $_.organization -FirstName $_.first -LastName $_.last -UserPrincipalName $_.upn -password (ConvertTo-SecureString $_.password -AsPlainText -Force)
}

Well that's all about it, hope this will be helpful in your deployments

However if you have already done this and the option is still disabled it can easily fixed by running ApplyMandatoryProperties on it. This can be done by running the below powershell command

Get-OfflineAddressBook | Set-OfflineAddressBook -ApplyMandatoryProperties

Et voila! you can now "Enable Web-based distribution"

In this post I will show you how to allow to userA to manage group membership of DistGroup

First open Exchange Management Shell -> Recipient Configuration -> Distribution Group

Find the distribution group DistGroup and right click properties on it

Go to the Group information and add UserA as manager to this group and click OK

All this till now sounds pretty intuitive right? Well we are not quite there yet.

If you try now to change the group membership of DistGroup logged on as UserA, exchange will fire an error stating that the user does not have sufficient permissions to perform the operation.

Well that's because the permission was granted to the user just fine but we did not allow, on exchange, for users to manage the groups they own yet, and this is what we are going to do now.

Log-on to the Exchange Control Panel with a user that has administrative permissions on Exchange 2010 and switch to Manage My Organization -> Roles and Auditing -> User Roles

Select "Default Role Assignment Policy" and click Details, in this screen check the MyDistributionGroups role and click Save.

Well that's it, UserA can now add/remove members from DistGroup using Microsoft Outlook

Also when logging on to ECP -> Groups, there is now a "Public Groups I Own" section showing from which users will also be able to manage the group membership of the groups they are assigned to as managers.

That's it for now, hope you found this helpful