User(s) not able to sign in

Question

I have a couple of new users that are unable to sign into the lync client.  The message they get is "You didn't get signed in. It might be your sign-in address or logon credentials, so try those again.  If that doesn't work, contact your support
team."  I installed Lync debugging tools on the machine and from that I am seeing the following failure: 
02/14/2014|09:12:11.883 1E28:2998 INFO  :: Data Received -172.22.2.14:5061 (To Local Address: 172.24.100.47:65317) 756 bytes:
02/14/2014|09:12:11.883 1E28:2998 INFO  :: 
SIP/2.0 401 Unauthorized
Date: Fri, 14 Feb 2014 14:12:11 GMT
WWW-Authenticate: NTLM realm="SIP Communications Service", targetname="server.domain.com", version=4
WWW-Authenticate: Kerberos realm="SIP Communications Service", targetname="sip/server.domain.com", version=4
WWW-Authenticate: TLS-DSK realm="SIP Communications Service", targetname="server.domain.com", version=4, sts-uri="https://server.domain.com:443/CertProv/CertProvisioningService.svc"
From: <sip:[email protected]>;tag=b8b9ed9834;epid=2a0eee599c
To: <sip:[email protected]>;tag=4409FF1D9F67BF05DD6E187CC6C991C1
Call-ID: 6a5c44c2439a4eb8b14206b4cd95186b
CSeq: 1 REGISTER
Via: SIP/2.0/TLS 172.24.100.47:65317;ms-received-port=65317;ms-received-cid=EC400
Server: RTC/5.0
Content-Length: 0
02/14/2014|09:12:11.883 1E28:2998 INFO  :: End of Data Received -172.22.2.14:5061 (To Local Address: 172.24.100.47:65317) 756 bytes
I have verified that they are able to sign into OWA, so it's not a password issue.  I tried removing the user from the Lync server and then adding them back in.  That did not resolve the problem.  
Strangely, they are able to sign into Lync externally and only get these failure messages when on our internal network.  This made me think maybe it was DNS but I have confirmed the DNS entries are correct and no other users are experiencing this problem.
 I made sure the users computer trusts the certs, which it does and I have removed and re-installed the Lync client, including removing the Lync settings under appdata, but this did not resolve the problem either. 
Any suggests? Ideas? Point me in the right direction?  

Answer 1

I'm just chiming in, I'm still not as knowledgible as I'd like to be.  I usually run into a problem where users change a parameter in AD (Name, location, phone) and AD sometimes likes to duplicate the account causing log in issues.  I know you
have new users but it may be worth it to check what AD has to say on the account and cross check it with the control panel in Lync. 
I also force my clients to do web lookups which take a lync policy modification and ensuring that the users client computer has the right windows policy/firewall settings to facilitate that.
You've already taken most of the steps I would have and I hope you find a resolution soon.
Also, here is a post that also had 401 sip messages on sigining in, not much help but you could stem from there.  The sip message is what sticks out to me.
http://social.technet.microsoft.com/Forums/lync/en-US/9aa58f50-aa69-4d2d-9ef7-aa2c07c8b627/internal-lync-client-cannot-sign-in-sip20-401-unauthorized?forum=lyncprofile