Inside OCS

Communicator Web Access Top 10

Curtis Johnstone — Tue, 10 Nov 2009 05:30:10 +0000

If you are planning on deploying Communicator Web Access (CWA) here are 10 important things to know based on experience:

A CWA R2 server is needed for providing users with PIN numbers for the OCS R2 dial-in audio conferencing feature.
A CWA R2 server is required to enable desktop sharing with Anonymous or Federated External Contacts.
To make desktop sharing work in CWA R2, additional firewall ports 49152 through 65535 must be opened in most configurations.
CWA desktop sharing users need a browser add-on (CWAPlugin.exe) on their client machine.
- The user is given the option to download and install the plug-in the first time they attempt to use CWA desktop sharing.
- 64-bit users must launch the 32-bit version of their browsers.
- The list of supported web browsers are: IE 6.0 Service Pack 2 or later, Safari 1.3 (or later) or Firefox 3.0 or later.
A CWA R2 user must be enabled for Web Conferencing and Program and Desktop sharing to use the desktop sharing feature in CWA.
A CWA R2 user must have the ‘Allow anonymous participant’ feature turned on to initiate a CWA conference (2+ participants). The Allow Anonymous Participant feature allows the user to ‘Invite By Email’ to conference in other participants. To enable this setting for users, the ‘Enfore per user’ option must be selected in the global policy section.
A CWA R2 server is not required for remote Communicator 2007 R2 (non-CWA) clients to use desktop sharing.
CWA users must be enabled for Enhanced Presence to login using CWA R2. If they are not, the user will be prompted multiple times to authenticate and then be shown an error message. If there are Office Communicator 2005 clients still deployed, there are implications enabling Enhanced Presence (see previous blog entry Enhanced Presence and Upgrading Communicator Clients).
The CWA R2 experience can be customized in several ways:
- A custom CWA sign-on page for users (e.g. custom headers and footers, etc..). See the TechNet article ‘Customizing the Login Page’ for specifics.
- A custom set of tabs and menus in the CWA client menu.
The CWA R2 role is not officially supported to run on a virtual machine. I have it fully functionally running on virtual machines in a lab environment, and there are several accounts of it running successfully in small production deployments. As end-user usage increases on a virtualized CWA server, the most notable issue is the slowing of client refreshes in IE.

Also note: a separate management console (mmc snap-in) is used to Administer CWA R2.

If you have any top CWA tips to share, I would like to hear them (in the comments section).

For more information CWA 2007 R2, see the following:

October 2009 Updates for Communicator 2007 R2 and OCS 2007 R2

Curtis Johnstone — Wed, 04 Nov 2009 15:10:46 +0000

October 2009 updates for both Office Communicator 2007 R2 and OCS 2007 R2 Server are available.

Microsoft Office Communicator 2007 R2

One fix caught my eye: “Error message when you log off, restart, or shut down a computer that is running Communicator 2007 R2: “End Program – Communicator”. I know several users who have experienced this before.

Microsoft Office Communications Server 2007 R2

There appears to be a ‘Cumulative Server Update Installer’ to help with installing all of these updates now (see “Method 1:” in the KB article). Most of these updates look to be a cumulative rollup of previous hotfixes. I see two new updates specifically for October 2009.

Enhanced Presence and Upgrading Office Communicator Clients

Curtis Johnstone — Mon, 02 Nov 2009 22:11:06 +0000

A quick but important reminder for those deployments upgrading their user clients from Office Communicator 2005 to Office Communicator 2007 or 2007 R2.

When an OCS user gets enabled for Enhanced Presence, either through the OCS management console or programmatically (through a script modifying AD directly or the WMI provider), Communicator 2005 users can still login. However, when the user signs-in for the first time with a newer Office Communicator client (such as 2007, 2007 R2, or even the R2 version of Communicator Web Access), there is no going back – the user will not be able to sign-in again with Communicator 2005. The “RichMode” value gets set to ‘true’ for that user in the OCS backend database when a newer client is used for the first time.

The Enhanced Presence status for a particular user can be seen in the OCS management console in the user properties (“Other settings” in the User properties in R2, or the Communications tab | Configure button” in the Active Directory snap-in).

For more information about modifying the AD user property to enable Enhanced Presence programmatically see my previous blog entry “Provisioning OCS Users (and the AD msRTCSIP-OptionFlags Attribute)”.

A good explanation of the different stages of Enhanced Presence is available here on the Office Communicator team blog.

Provisioning Office Communicator and Office Live Meeting

Curtis Johnstone — Mon, 26 Oct 2009 21:43:56 +0000

After OCS is deployed and the Office Communicator and Office Live Meeting clients are being rolled out to your users, the next question you will likely have is how do I configure the Communicator client for users so that it is tailored for my environment? This can be a challenging task in an diverse environment.

Practically, there are three administrative options at your disposal:

1) Group Policy: Communicator and Live Meeting client configuration settings are mostly set via client-side registry entries in three places:

Local Machine Settings (i.e. HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Communicator)
Current User Settings (i.e. HKEY_CURRENT_USER\Software\Policies\Microsoft\Communicator)
Current User Settings share with Live Meeting (i.e. HKCU\Software\Microsoft\Shared\UcClient)

2) Set Registry Entries through a Deployment Script. This is similar to the GPO option, except that one or more of the same settings used in the GPO can be set in a Windows script (usually the same script used to deploy Communicator).

3) In-Band Provisioning: Communicator receives settings from the OCS server (or pool) when the user signs in.

These three options are summarized below.

There is one other way Communicator settings can be set – users can simply change them through the Communicator Options Dialog box. Fortunately for administrators there is the notion of ‘Precedence’ which allows the three options above to take precedence over user settings directly in the client. Most Office Communicator settings configured with a GPO or in-band provisioning will be unavailable to the user in the UI (i.e. those options will be grayed-out).

Precedence

Here is the exact precedence taken by the various ways that Office Communicator client settings are set:

Local Machine Policy Registry (HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Communicator)
Local Current User Policy in the Registry (HKEY_CURRENT_USER\Software\Policies\Microsoft\Communicator)
OCS In-Band Provisioning
Office Communicator Options Dialog Box

Troubleshooting Note: with Communicator having different configuration sources, it helps to know exactly what settings are in-affect when trying to debug an issue with a particular user. A nifty feature was added to Office Communicator R2 that will show the current configuration of many important settings when it is running. See my previous blog post ‘Great New Office Communicator R2 Troubleshooting Feature’ for more information.

Office Communicator Group Policy

The various Communicator settings that can be set through a GPO can be found here:

Both of these downloads are installer files which ‘install’ (extracts to a directory) an administrative template (.adm file) and a corresponding Excel spreadsheet documenting the settings and the possible values. I have found a few errors in the spreadsheet involving possible values for a couple settings. I will try to publish these at a later date.

The Communicator GPO can then be applied to User or Computer Configuration objects in an AD domain or OU. The choice to tie the GPO to a user or computer has advantages and disadvantages. The user object is generally a good idea because the GPO will apply be applied on any machine the user login’s to. The downside is it will not get applied if the user is using a machine that is not part of the AD domain that it was applied to. The local machine policy will also work, but it will not apply the settings to any other machines (or devices) that the user uses.

For this reason, you might want to consider using a deployment script or in-band provisioning.

Set Registry Entries through a Deployment Script

This option uses a windows script (VBScript, Jscript, or any Windows Script File) to set Communicator registry entries with values that are tailored for the user and the environment. The script will typically exist on a common network share and users (or Administrators) will manually run the script, or it will be attached to a Windows user logon script.

One advantage of this approach is that the same script can double as a software deployment script if there are not good existing mechanisms to deploy the client software. The script will typically run the client installer (i.e. *.msi) files that exist on a common network share.

Another advantage of this method is flexibility and customization. For example the user’s SIP address can be configured by setting the registry value in “HKCU\Software\Microsoft\Shared\UcClient\ServerSipUri”. Within the script you can do things like do any AD lookup to populate the users’ SIP address with same format as their email address in AD.

The “Microsoft Office Communications Server 2007 R2 Resource Kit” contains a sample installation script that can be customized to a particular environment. I hope to release an advanced Office Communicator, Office Live Meeting, and Outlook Conferencing Add-In deployment script shortly that I have been working on for some time which has many more features and offers a better experience for Vista and Windows 7.

In-Band Provisioning

There are a limited number of settings you can set through this mechanism. Most settings are geared towards ensuring a consistent user experience regardless of the endpoint (or device) that a user signs in with.

Rather than repeat the settings here, this Microsoft TechNet article on ‘In-Band Provisioning over SIP’ does a great job detailing the settings, and where to find them in the OCS Management Console.

Arguably the three most significant, and often used, settings are the URLs for the Address Book, the A/V Edge Server (which tells the client what server to use as a Media Relay (aka “MRAS Server”), and the Global Meeting Policy.

Also note that the in-band provisioning settings can be set programmatically using three WMI classes: MSFT_SIPClientPortSettings, MSFT_SIPCommunicatorConfigSettings, the MSFT_SIPUCPhoneConfigSetting. My previous blog entry ‘OCS WMI Reference’ gives more information on using the WMI classes to administer OCS.

OCS File Transfers – Key Facts & Common Cures

Curtis Johnstone — Wed, 21 Oct 2009 22:30:30 +0000

The ability to transfer files in Office Communicator is an effective collaboration feature (and is often underused). A file can be shared in the context of a discussion by dragging-and-dropping it directly in the Communicator conversation session window. It is real time, and you avoid the storage headaches and application-context-switch that email attachments can bring.

From experience here the facts that matter most about file transfers and solutions to some common problems.

Key Facts

The actual data transfer in a file transfer is peer-to-peer. Several SIP transactions are used to setup the session with the OCS server, but the data transfer is then carried out peer-to-peer between the Communicator clients. One exception to this rule is when Microsoft ForeFront Security for Office Communications Server is installed on the OCS server. In this case, all communication goes through the OCS server.
Ports 6891-6901 are used on the client machines to transfer the files. A random port is chosen between 6891 and 6900 (6891 us used to advertise the randomly chosen port).
File transfers between internal users (i.e. clients inside the firewall) do not involve the Edge server.
The protocol used to do the transfer is TFTP (Trivial File Transfer Protocol).

Common Problems & Solutions

The best diagnostic to a failed file transfer between two Communicator clients is the usually the error message returned directly in the Communicator client. Here are the most likely reasons for a file transfer failure and what to do about it:

1) Ensure that File Transferring is Enabled on the OCS server and Check which File Extensions it is Configured to Block.

By default OCS installs with the Intelligent IM Filter activated. You can then configure it to block or allow certain file extensions. By default .zip, .doc, and .xml are allowed, but executable binaries and script extensions are blocked. To see this setting in the OCS management console, navigate to:

OCS 2007 R2: Front-End or Pool | Filtering Tools | Intelligent Instant Message Filter | File Transfer Filter tab.
OCS 2007: Front-End or Pool | Application Properties | Intelligent Instant Message Filter | File Transfer tab.

2) Is Either Client Running VMWare Workstation?

If a user has VMware Workstation installed on their client machine, Office Communicator file transfers tend to fail. If you disable the extra NICs that VMware creates in your Network Connections folder they should be able to send and receive successfully (thanks to Tom Pacyk for that nugget of information which I have verified as true).

3) Is there Network Access Between the Two Client Machines?

A variety of network architectures or DNS settings can prevent two machines from seeing or accessing each other on the network. A simple ping or attempted access to a network share will let you know whether this is an issue.

4) Is any Anti-Virus or Firewall Software Restricting Ports 6891-6901 on either Communicator Client?

Client-side port filtering or intercepting on either client will cause a failure. The most likely candidates for this is anti-virus software or firewall software.

5) Are File Transfers Explicitly Disabled on either Client Machine via Group Policy?

File transfers can be disabled through a Group Policy setting (or registry setting). The setting is documented in the Microsoft Office Communications Server 2007 R2 Client Group Policy Documentation.

6) Are ports 6891-6901 Accessible on any OCS Servers with Forefront Security for OCS Installed on it?

Forefront Security for OCS can be used to scan Communicator file transfers for viruses. For external file transfers, the firewall needs to be configured to allow inbound connections for the default Communicator file transfer ports. These default ports can be changed via registry keys. See Introduction to Forefront Security for Office Communications Server for more information.

7) Are the Communicator Clients Up-To-Date?

Communicator clients with the latest updates minimize the chances of a known issue causing a problem. You can download and install the July 2009 Communicator R2 updates here: http://support.microsoft.com/kb/969695. If all else fails, enabling event logging in the Communicator client (Options | General | Turn on Logging in Communicator) and checking the event logs after a failed file transfer is usually helpful.

Recent Security Update (KB 974571) May Cause OCS to Not Start

Curtis Johnstone — Wed, 14 Oct 2009 19:08:46 +0000

In case you missed it, as reporting by several blogs and the Microsoft Office Communications Server team, a recent O/S patch may cause your LCS 2005, OCS 2007, or OCS 2007 R2 servers to think they are an evaluation version which has expired, and the OCS services will not start (e.g. after a reboot).

Fortunately, uninstalling the patch fixes the problem. The issue is being investigated further.

More details on the specific patch in question be found here: MS09-056: Vulnerabilities in CryptoAPI could allow spoofing.

A fix has been released for this issue (on October 24, 2009). It is available on the same link describing the issue (above) – see the “Resolution for the known issue” section where you can download the fix (OCSASNFix.exe).

September 2009 Updates Available for Office Live Meeting

Curtis Johnstone — Sat, 10 Oct 2009 14:41:19 +0000

New updates are available for the Office Live Meeting Console and the Live Meeting Outlook Conferencing Add-In. Both updates replace version 8.0.6362.140 (which was the July 2009 update) with 8.0.6362.143.

The Live Meeting Console:

This update addresses a problem I have encountered several times whereby the “Do not save encrypted pages to disk” setting in Internet Explorer can cause an error message when trying to join a meeting via clicking the meeting URL (in Vista this could hinder the launching of the Live Meeting Console installation via the meeting URL).

The corresponding Office Live Meeting Outlook Conferencing Add-In:

iPhone Client for OCS

Curtis Johnstone — Tue, 06 Oct 2009 16:32:19 +0000

Several readers of my blog have asked about the availability of an OCS client for the iPhone. I recently tried iDialog from Modality Systems (http://www.modalitysystems.com/idialog/) and wanted to share my experience. iDialog is an iPhone (and iTouch) application providing OCS contact list presence information and 2-party instant messaging (see here for the full list of features including the ability to search the corporate GAL).

In general, it worked as advertised, and I love getting OCS presence on my iPhone! I didn’t use the instant messaging functionality often – mostly because of my preference for not typing on a mobile device. It was also useful to see current free-busy information for several of my contacts (e.g. “Free for the next 2 hours”) and having access to GAL details.

There were some minor nuisances such as initially having to manually expand the “All Contacts” group to see my contacts, and a periodic small delay when typing in an IM session.

Here are some other key notes:

There is no ability to do VoIP audio calls (aka Communicator calls). I didn’t really miss this though because I am on a mobile device and can call through the cellular network. I could see some users wanting to take advantage of a WiFi connection and do a VoIP call though.
It works for OCS 2007 and OCS 2007 R2 (corporate and hosted) via the OCS Communicator Web Access server, so an external facing OCS 2007 CWA must be available for it to work.
Given that presence can be a chatty protocol, one of the first questions I had was “How much data does it use?”. Modality Systems told me that approximately 1.2 kpbs is used over a 5 minute interval of “normal” usage. This is not broken down into presence and IM, but it gives a ballpark approximation.

iDialog can be purchased via the Apple iTunes Application Store. I purchased mine for $9.99 Cdn (from the Canadian App Store). I have been told that an update is coming shortly which address some outstanding issues (including the IM typing delay).

All-in-all it was an iPhone application worth purchasing.

You can read more about OCS mobility options in my “Mobile Options for OCS” blog post.

Jabber/Google Talk Interop & Changes to OCS Public IM Licensing

Curtis Johnstone — Thu, 01 Oct 2009 19:02:41 +0000

The long awaited OCS interoperability with XMPP-based IM systems (most notably Google Talk and Jabber) has been announced and made possible by a OCS 2007 R2 XMPP Gateway. More details are available here from the Communications Team web site. The Gateway will be a free download and will allow OCS users to:

Add or delete Google Talk and Jabber users as contacts.
Exchange Presence and two-party IM with Google Talk and Jabber users.

There were also some significant changes announced to OCS Public IM (PIC) licensing (starting on Oct 1, 2009):

No PIC license needed for federation with AOL if you have OCS 2007 R2 Standard CAL or Software Assurance.
PIC licenses for Yahoo! drop by 50%.
FYI – as announced in June, a PIC license is no longer needed for federation with Windows Live.
No additional license necessary for the newly announced XMPP Gateway.

More details can be found on the Microsoft Communications Server Team blog entry.

More details for configuring OCS connectivity with Gmail can be found here.

More details for configuring OCS connectivity with Jabber can be found here.

Communicator and Live Meeting Client Version Tool

Curtis Johnstone — Wed, 30 Sep 2009 14:23:21 +0000

One of the first things that should be done when debugging any client side issues with Office Communicator, Office Live Meeting, or the Office Live Meeting Outlook Add-In is to know what versions of each client the user is running.

Rather than have the user open each application and do a “Help | About” and tediously record the version information for each client , I’ve developed a small and simple free online tool that retrieves the version of all three clients and displays it in an HTML window that can be easily cut-and-pasted into an email.

Point your web browser to http://www.insideocs.com/Tools/ClientVersions.html and click the link to run it. There is also a link on the right-hand side of www.insideocs.com (under Inside OCS Resources).

The tools also:

Attempts to display the installation source of Office Communicator (i.e. OEM, Evaluation Version, Volume License, MSDN, or Academic).
Contains links to download the latest Office Live Meeting Console and the Office Live Meeting Outlook Conferencing Add-In from Microsoft.
Works for both 32-bit and 64-bit operating systems.

Here is a screenshot sample of what it produces: