Migrating to Lync in a child domain from OCS in a Parent domain

I am looking to migrate from OCS to Lync 2010. I have gotten as far as deploying the target pool, but when I try and merge the topologies it fails.
OCS is in The root domain of my forest but Lync is planned for the primary Child domain where 80% of my users live. I just need to know if this is a supported migration scenario for Lync. If it is how do I merge the two topologies, as it looks
like the merge tool is only looking at the child domain for the configuration of OCS?
Jeff

Hi,
Did you build a new pool with Side by side approach?
It is supported to migrate Lync from one domain to another domain in the same forest. Here is the supported server migration paths in the link below:
http://technet.microsoft.com/en-us/library/gg425764.aspx
For the issue merge topology failed, did you receive any error message from FE server Event Viewer?
The Lync server default sip domain should be the same when migrating from OCS to Lync server. If not, you can add sip domain in Lync topology and then run the command such as below on Lync FE server:
Set-CsSipDomain –Identity new sip domain name –IsDefault $True
Note: (change new sip domain name to your Lync server sip domain name)
Then run OCS merge again to test the issue again.
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

Similar Messages

Remove a domain from Exchange 2003, now other domains cannot send to the old domain error 5.1.1

We have a single Exchange 2003 server. We have multiple mail domains on the server, but are slowly moving to a hosted email solution. I moved the first domain, I will call it
domainABC, to our hosted solution. I have removed all exchange mailboxes from the users, and deselected the domain from Recipient Policies. I then ran the policy.
Whenever I send an email to anyone on Domain ABC from any other domain on the Exchange server, I get the 5.1.1 message. I am not sure what to do next - any help would be appreciated...
Brian

Hi Brian,
Could you post the detail information for the NDR message?
When you migrate all the users to the host email server, did you change mx record point to the new server?
You also can use this tool to help you check for the inbound email test (for Domain ABC).
Exchange Remote Connectivity Analyzer
https://www.testexchangeconnectivity.com/
Thanks,
Evan Liu
TechNet Subscriber Support in forum
If you have any feedback on our support, please contact
[email protected]
Evan Liu
TechNet Community Support

Lync crashes when someone sharing from OCS

Hi,
When a OCS 2007 Client user sharing his desktop to LYNC 2013 client, suddenly Lync client crashes. Is there any fix or recommended setting for solving this issue.
Regards,
Boopathi S

Did you deploy Lync Server 2010 or Lync Server 2013?
Please note that OCS 2007 client is not supported for Lync Server 2013.
Lisa Zheng
TechNet Community Support

"domain network" - name is forest parent domain

I'm testing Windows 7 in our corporate environment. How does the Windows 7 Network and Sharing center determine the name for the "Domain Network" to which I'm attached? I notice on my test PC it is showing the name of another domain in our forest (our tree root), not the name of the domain I am joined to. For example, each of our regions has their own domain:
region1.company.com
region2.company.com
region3.company.com
ad.company.com (tree root)
I'm in region1.company.com, however my N&S Center shows my connection as being in ad.company.com. My DHCP server is in region1.company.com. It is handing me a connection specific suffix of region1.company.com.
How does Windows 7 determine this name?
Baffling... and I've searched all over

Hi,
“ad.company.com” should be your Network Name. I think this is related to “Network Awareness”:
Windows 7: Pre-release privacy supplement (Please note the section “Network Awareness”.)
For more information about Network Awareness, please also refer to:
Network Awareness in Windows Vista and Windows 7
Thanks.
Nicholas Li - MSFT

Manage client in parent domain from child domain

My site has a root domain (mydomain.net) and a parent domain (ent.mydomain.net).
My primary SCCM site is installed in ent.mydomain.net and is managing all my clients.
I have 4 DC's installed in mydomain.net that I would like to manage from my child domain (ent.mydomain.net).
It is my understanding that if the schema has been extended in the parent domain, and I manually install the client on the DC, it should be able to be managed from the child domain.
I have installed the client in the parent, but it cannot find the site in the child (I have not extended the schema yet). i know that the client will not be able to find the site until the system management container has been created and populated
(does not currently exist). I know that I can create the container, but how would it get populated with the correct site information.
If anyone has any experience with this kind of configuration, the help would be appreciated.
Thanks

i know that the client will not be able to find the site until the system management container has been created and populated (does not currently exist). I know that I can create the container, but how would it get populated with the
correct site information.
You could enable AD publishing to that domain, but site assignment is also a matter of site assignment boundary groups. You can also assign a client to a site manually though.
Torsten Meringer | http://www.mssccmfaq.de

Migrating to Lync 2013 from OCS 2007 R2 ... to unprep or not to unprep

I've been reading on TechNet that I should unprep the domain and forest after decommissioning / uninstalling all OCS 2007 R2 server roles:
http://technet.microsoft.com/en-us/library/dd572243(v=office.13).aspx
...but then, in other places (such as blogs and TechNet forums), I've read not to unprep the domain and forest if Lync 2013 is already deployed:
http://social.technet.microsoft.com/Forums/lync/en-US/6b8cd7ca-fe67-418b-ae66-5be682d8d2d6/unprep-ocs-2007-r2-domain-and-forest-with-existing-lync-installation?forum=ocsplanningdeployment
http://www.ucprofessional.com/2011/04/decommisioning-ocs-2007-r2-after.html
Would someone please clarify what to do here and why?

While I haven't personally done a deep dive on everything it does, my understanding is that's it's more than just a simple mod to the system container. For example, from the OCS decommission article you referenced: "Running
Unprep for a domain removes the access control entries (ACEs) granted to Active Directory universal groups". Lync still uses the same RTCUniversal groups, so touching it at all with Lync in production as well could be bad.
Forest prep actually creates these groups:
http://technet.microsoft.com/en-us/library/dd441353(v=office.13).aspx That said, I haven't seen an unprep referenced in the migration from OCS to Lync docs, and the doc you referenced is specifically for completely removing OCS from your environment
where these groups wouldn't be needed. So, while I can't tell you exactly what all it does, I really wouldn't mess with it unless you have a strong reason to or are willing to rebuild Lync to get a few old objects out of the system container.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications

Separating a child domain from a forest/parent domain

Our infrastructure is currently as follows:
There are two domains which I will call "apple.local" and "banana.local". The domain "apple.local" is the parent/forest which is at a Windows 2003 Functional Level. The domain "banana.local" is a child domain of "apple.local"
which is at a Windows 2008 Functional Level. This unusual arrangement was the result of a merger.
Recent business changes have meant that the domain "banana.local" needs to become the forest and "apple.local" needs to be permanently retired. I have been searching as to whether this is possible but the general consensus is "no".
However, many of the discussions are several years old and I am interested in whether anything has changed with recent updates.
As an added "bonus", a single Exchange 2010 SP3 server is present and - just to complicate things further - is a member of the child domain "banana.local". Mailboxes (shared and user) and DGs from both domains are present. Access to shared
mailboxes is granted using a mixture of users and security groups from both domains.
Is the best way forward to simply create a new domain on a fresh server? What would be the most straight-forward solution with minimal impact to the users and - in particular - the Exchange platform?
I am in a position to purchase new servers, software and licenses as required to meet the ultimate goal and - within reason - additional expenditure is not an obstacle. We also have the option to create new IP ranges if required.
Any ideas and/or suggestions welcomed!

Is the best way forward to simply create a new domain on a fresh server? What would be the most straight-forward solution with minimal impact to the users and - in particular - the Exchange platform?
It is not possible to detach a child domain from its parent. One of the things you can do is to create your domain and establish trusts between them and migrate resources from old domain to the new domain. Note that computer account migration will take some
time. For exchange part you can ask in Exchange forums but the one thing you can do is to Cross-Forest mailbox move after you set up the new forest.
Exchange 2010 Cross-Forest Mailbox Moves
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Lync 2013 client is deployed but user accounts are not migrated from OCS to Lync 2013 Server - how to open Lync meetings automatically in the Lync Web Plug-in

We have in our enterprise the following scenario:
1 - Lync 2013 client is installed
2 - User accounts are not migrated to Lync 2013 Server, users are using Office Communicator as their main tool
3 - Users receive Lync 2013 meeting requests but when try to access them, Lync 2013 client launches and shows error. Users will need to open the browser and paste the URL to the address bar but this still open
4 - We cannot use the workaround of adding "?SL=1" to the Lync 2013 meeting URL as the user base is large and manual workaround is not accepted
5 - Question: is there any automated way, via egistry key or GPO setting, so that users temporarily (until their accounts are migrated to Lync 2013 server) can bypass Lync 2013 client completely and automatically open all Lync 2013 meetings
on the browser, using Lync Web Plug-in?

Thanks for the response,
First, I should have mentioned clearly that users have Office Communicator 2007 client and Lync 2013 client installed in their machines. Their accounts are not migrated yet to Lync 2013 server.
Second, we are using IE9 and IE10. The issue is that users CAN join Lync 2013 meetings with their browsers but have to paste the URL manually to browser and add "?SL=1" otherwise, if they just click at the "Join Online Meeting" or "Join
Lync Meeting" URL it launches Lync 2013 client which shows error because is not configured yet, as they are using OCS client and migrating slowly to Lync 2013 server.
Is there a Group Policy setting or a registry key from Microsoft that can be turned on to these users machines and make will all Lync meeting requests to be opened in IE browser instead of Lync 2013 client. We need a way to ignore
Lync 2013 client until user accounts are migrated to Lync 2013 Server. Manually typing URLs is not an option in a big organization, can't explain thousands of users of different levels what to do.
We are regretting the decision not to separate Lync 2013 from Office 2013 package we deployed recently. If Lync 2013 is uninstalled then all Lync meeting requests are opened in browser without an issue.

Prevent Active Directory Parent Domain Admins from accessing Child Domain

We want to prevent Parent domain administrators (or a similar profile?) from accessing and/or administering child domains. Is this possible, or do parent domain admins have irrevocable administrative access to any child domain?
Asked another way, can a restricted profile be configured for administration of the parent domain that does not cross domain boundaries effectively isolating each domain's administrative needs?
Thanks in advance for input and advice!
Best regards.

Sorry, I was replying again after I read your second paragraph. The parent domain is the Forest root. we have parentdomain.com
parent.parentdomain.com
child1.parentdomain.com
child2.parentdomain.com
child3.parentdomain.com
We do not want the Domain Administrator for parentdomain.com to be able to administer, or preferably, even access the Child Domains.
1.) Can we remove that user from "Enterprise Admin" role and assign a different role so that they can only administer parentdomain.com (effectively demoting that user)?
2.) Promote a Child.parentdomain.com user to Enterprise Admin?
Thanks sorry for the confusion.
Ah ok.
Yes, you can. the answer is the same basically. The group membership is what counts. So in the child domain, remove the enterprise admins group from the child domain admins groups. OR make sure the domain admins of the forest root are not members of the
enterprise admins group. that way they are still only admins in the parent domain.
It is really only depending on group members ship and including those groups in the child domain. by default the enterprise group is included for example, but nothing stops you from removing those groups.
based on the group membership you can also deny them the ability to log on.
the only thing you cannot prevent is the forest administrator account from doing something.
One thing I would like to add though: any admin in the forest domain likely has the ability to still get access if he wants to force his way in.

Domain migrations and Lync

Lync 2010 environment lives in Domain B
Exchange 2010 environment lives in Domain B
Users are in domain A, and are being migrated to domain B via Quest AD migration tool
Lync Attributes are being populated via power script.
However, once the users are migrated, their contact list in Lync is present, but they can no longer search for, or add new Lync contacts.

You can use the Update-CsAddressBook cmdlet to force an Address Book server to immediately synch with the user information stored in the User database.
Also check below link
http://technet.microsoft.com/en-us/library/gg429695.aspx
http://technet.microsoft.com/en-us/library/gg398194.aspx
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
Mai Ali | My blog: Technical | Twitter:
Mai Ali

Lync 2013- 4 FE servers-F5 HLB- migrating users from OCS-WMI error

There are 4 Lync 2013 EE FE's with an F5 HLB. 3 of the FEs are Windows 2012 R2 and one is Windows 2008 (this will be decommissioned).
Access the Lyncadmin/cscp web page works to migrate users from OCS to Lync most of the time. We noticed at times the following error message:
Move-CSLegacyUser: verify that WMI Provider is installed by running OCSWMIBC.MSI. For details, see the inner exception.
So for troubleshooting we would use the <FEname>/cscp to test each server. The 2008 and one of the 2012 servers worked fine. The other 2 2012 servers failed with that same error message.
I looked at lots of articles and made sure that all of the servers had the HKLM\System\CurrentControlSet\LSA\DisableLoopbackCheck set to 1 as well as putting the Poolname FQDN and LB VIP IP address in the HKLM\System\CurrentControlSet\LSA\MSV1_0 registry
keys. Just the pool FQDN alone was tried as well. All the servers were rebooted one at a time as well after these changes. The Pool FQDN is a DNS entry with the VIP address.
The same user account is being used when logging into the CSCP. Trying the CSCP from any server or client machine and using the <FEname>/cscp fails for the 2 servers.
I have checked the authentication methods in IIS for CSCP internal and have negotiatekerberos then NTLM listed under Windows authentication\challenge.
I am running out of resources and ideas.
Anyone?

Have you confirmed that ocswmibc.msi is installed on all the 2013 Front Ends?
"First install the Windows Management Instrumentation (WMI) Backward Compatibility interfaces package; this application is installed
by running OCSWMIBC.msi. (OCSWMIBC.msi can be found on the installation DVD in the Setup folder.)" - http://technet.microsoft.com/en-us/library/gg413025.aspx
Please mark posts as answers/helpful if it answers your question.
Blog
Lync Validator - Used to assist in the validation and documentation of Lync Server 2013.

Migrated to Lync 2013 now need federation assistance

I have migrated from a Lync 2010 environment to a Lync 2013 environment for the Front End Servers. I am now needing to be able to Federate with several other external companies. I am a somewhat intelligent person however, this piece has me perplexed.
internal domain - domain.local
external domain - domain.com
internal front end server - server00.domain.local
edge server - server11.domain.local (in a workgroup in DMZ)
email domain - domain-company.com
SIP addresses - [email protected]
I have a DMZ that has an internal and external Checkpoint Firewall, we have blown so many holes through it the Security Expert here is afraid, however, Testconnectivity.microsoft.com succeeds as long as I do not choose A/V tests.
I want to have Directed federation with other entities within our company and have done nslookup's, used Lync IP Tools, and multiple other tests to find out where I am failing to understand why I cannot get Federation to work.
Any thoughts?
I absolutely deplore certificates....

When you say you want to federate with other entities within your company, are they separate forest/domains? How do you connect to them, over the Internet or via a direct path? Or do I misunderstand? Is your intention to also federate with
entities external to your company?
Your sip domain really should match your email domain, just to make it easier to locate your users from outside. On top of this, you'll be able to get a third party certificate (they won't typically issue one for .local) which will be valuable for
Lync mobility and federation without having the others install your self signed cert.
Are the certificates currently deployed on the edge self signed or third party?
How many SIP domains do you have deployed?
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications

Error during the migration of Lync 2013 onpremise user to Office 365 Lync

Hi,
I am trying to migrate a Lync 2013 onpremise user to Office 365 Lync in a Hybrid environment.
I am connecting to the Lync server from my machine with the following commands
$lyncOptions = New-PSSessionOption -SkipRevocationCheck -SkipCACheck -SkipCNCheck
$lync = New-PSSession -ConnectionUri https://lyncserver/ocspowershell -SessionOption $lyncOptions -Authentication NegotiateWithImplicitCredential
Import-PSSession $lync
In the next step I am trying to migrate the user to the Office 365 Lync:
Move-CsUser -Identity "username" -Target 'sipfed.online.lync.com' -HostedMigrationOverrideUrl 'https://admin1e.online.lync.com/HostedMigration/hostedmigrationservice.svc'
After that I get a warning message due to to migration to a previous version which I accept.
WARNING: Moving a user from the current version to an earlier version (or to a service version) can cause data loss.
Confirm
Move-CsUser
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): y
Then I am getting the following error message:
Can not load Live Id module. Make sure correct version of Live Id Sign-in assistant is installed.
    + CategoryInfo          : NotSpecified: (:) [Move-CsUser], CommonAuthException
    + FullyQualifiedErrorId : Microsoft.Rtc.Admin.Authentication.CommonAuthException,Microsoft.Rtc.Management.AD.Cmdle
   ts.MoveOcsUserCmdlet
    + PSComputerName        : lyncserver
Tried to Google it but found nothing.
As far as I can see it is complaining about the Live ID Sign-in assistant, which is installed (the 64bit version) on my computer but not on the remote server. Does it need to be installed on the server as well?
Thanks for the answers in advance.
Regards,
Akos
Akos_DB

This error related to reporting services, you need to verify that reporting services is installed on these instances.
Secondly, you didn't need to create this instance manually then setup monitoring role. delete this instance from shared storage and try again to setup rule using different instance name and it will create automatic on shared storage.
You can also refer below link
http://windowspbx.blogspot.com/2012/07/aaa-donotpost-install-lync-standard.html
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"

Active Directory : Replication Issue - "Disconnected" sub-domain from the Forest

Hello everyone,
I'm managing a multi-domain forest (with 7 sub-domain). All are working fine except for one. Throught repadmin (Repadmin /replsum /bysrc /bydest /sort:delta), I noticed I got both domain controllers of a subdomain (there are only 2 DCs in that
subdomain), who hadn't replicated with the rest of the forest for more than 60 days.
According to my research, it's usually recommended to Depromote and repromote the problematic DC to avoid the issue of lingering objects. In this case, it's both DC of a sub-domain. Of course, on the others DCs in the forest, I got the event
ID 2012 "it has been too long since this machine last replicated with the named source machine....".
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication With Divergent and Corrupt Partner
to a value of 1.
As I understand it, this may cause lingering objects to appear (they can be removed with repadmin /removelingeringobjects command with the DSA GUID, naming context, etc..). So far, I haven't used that registry key yet because of the associated risks.
I didn't noticed any other issue so far. Users in the problematic sub-domain are fine, and the problematic sub-domain seems to be able to pull replication data from the others DCs in the forests. (at least, I'm not getting any error in the A.D. Sites
and Services)
I added two new DCs for the affected sub-domains, so the number of DCs for that domain went from 2 to 4 DCs. The two old DCs that hadn't replicated for 60 days are windows Server 2003 and the two new DCs are Server 2008 R2.
Unfortunately (and I was half expecting this, but did it anyway since I must eventually replace the old DCs), that didn't solve my issue, since the rest of the forest "doesn't see" the two new DCs of the sub-domain. By that, I mean that I
cannot add an Active Directory Domain Services Connection in Sites & Services console (from a DC in another domain of the forest or even the root domain). I see all the DCs, including the two old DCs that are server 2003, but not the new ones.
I believe it's because the others DCs doesn't pull/replicate the information from the old DCs anymore, so they aren't "aware" of the two new DCs for that problematic sub-domain.
I was wondering what is the best course of action. Is it worthwhilte to use the registry key force replication with the old DCs ? (and hopefully, the new DCs will get their AD Services connection/replication vector created, so I can depromote
the old DCs.
Since the Old DCs from the problematic sub-domain seems to be able to pull the replication from the rest of the forest, does the risk of Lingering object isn't that great ?
Or is it too risky and I must create a new sub-domain and migrate one way or another the users ? (which would be time-consuming)
Thanks in advance,
Adam

Thanks for the reply. One of the link had another link to a good article about the use of repadmin :
So, I ran the command "repadmin /removinglingerobjects " on one of the problematic DCs ().
For clarity purpose, let's say I used the domain :
domain = main domain
subdomain = the domain whose DC are problematic (all of them).
AnotherSubDomain = Just another subdomain I used as a "reference" DC to cleanup the appropriate partition.
Command (the DSA guid is from a DC "clean" in another domain)
repadmin /removelingeringobjects adrec01.mysubdomain.domain.ca C4081E00-921A-480D-9FDE-C4C34F96E7AC dc=ANOTHERsubdomain,dc=domain,dc=ca /advisory_mode
I got the following message in the event viewer :
Active Directory Domain Services has completed the verification of lingering objects on the local domain controller in advisory mode. All objects on this domain controller have had their existence verified on the following source domain controller.
Source domain controller:
c4081e00-921a-480d-9fde-c4c34f96e7ac._msdcs.mydomain.ca
Number of objects examined and verified:
0
Objects that have been deleted and garbage collected on the source domain controller yet still exist on this domain controller have been listed in past event log entries. To permanently delete the lingering objects, restart this procedure without using the
advisory mode option.
How should I interpret the message "number of objects examined and verified 0". Does it mean it just didn't find any object to compare ? (which would be odd IMHO) Or there is another problem ?
Thanks in advance,
Adam

Using LDAP query to get all the domains from all the forests in my company

Foreword:
I'm using two domain controller (dc1 and dc2). I'm using a domain registered to the root domain dc1 and simply request all of the domains in its forest by preforming search in the CN=Partitions,CN=Configuration,DC=dc1,dc=local.
I can also get the root domain dns of my trusted forest (dc2) from the default naming context under "CN=System" by looking for an object of type "trustedDomain".
The problem:
The problem is that I can't see/find the other domains (childs) of the root domain dc2 from the active directory information found in dc1. In order to get these domains I currently bind to this domain controller (dc2) and preform the same search as I did in
the domain controller dc1 (CN=Partitions,CN=Configuration,DC=dc2,dc=local) to get all its childs.
Must I use this binding to each root domain in other forest in order to request all of its domains? Is there a better way to do it? I read about referrals which seems like a solution to my problem but I'm not sure if it is and I'm not sure how it should be
used.
Note : I'm using the DirectoryEntry class in C#.

Hello,
>> read about referrals which seems like a solution to my problem but I'm not sure if it is and I'm not sure how it should be used.
Here are some information I found on the MSDN which might help you:
Active Directory Searches Processes and Interactions
Avoid unnecessary SearchResultReference referral chasing
In the thread below, there is a code snpont shows the usage of this property:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/fb338aed-4172-4132-a85e-f9bebdb74e00/when-does-adsi-refferal-chasing-work-?forum=winserverDS
Regards.
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Migrating to Lync in a child domain from OCS in a Parent domain

Similar Messages

Maybe you are looking for