Hyper-V backup using Windows Server Backup

A new feature in Windows Server 2012 is that Windows Server Backup (WSB) now has Hyper-V support, meaning you can use it to take backup of and restore virtual machines running on Hyper-V. This provides a complete backup and restore solution out-of-the-box which can prove to be good enough in some environments, particularly in the SMB market.

Install Windows Server Backup

To install Windows Server Backup you can use

• Server Manager – Added as a feature under “”Add/Remove Roles and Features”
• Command Line – Run “start /w ocsetup WindowsServerBackup”
• Powershell – Run “Add-WindowsFeature Windows-Server-Backup”

Nice 2 know about Windows Server Backup 

1. WSB uses VSS (Volume Shadow copy Service) to create a .VHDX file which contains a snapshot of the virtual machines that is backed up. This also enables WSB to take full backup of and flush the transaction logs of VSS-aware databases like Active Directory and Microsoft Exchange when you select “VSS full backup”, this is not selected by default.
2. WSB uses VSS to manage the backup versions, and since VSS is pr-volume this makes WSB unable to maintain several versions of a backup job when you backup to a network share. A backup to a network share will overwrite the previous backup. If you backup to you locally connected drive you can have several versions.
3. When you backup a VM you get a warning saying the VM will be put in saved state while the backup runs. This is not the case. The VM will continue to run uninterrupted and no one will notice you are backing it up.

Backing up a VM

“wbadmin start backup” is the primary command to backup you vm’s and I won’t go through all the options and switches but there are a few examples.

To backup a VM named “Server1″ to the disk mapped as Y, run the following command:

wbadmin start backup -backuptarget:Y: -hyperv:Server1

To backup a VM named “Server1″ to a shared folder, run the following command:

wbadmin start backup -backuptarget:\\server2\backup -hyperv:Server1

To backup a VM named “DC1″ to a the mapped as Y and flush the transaction logs of AD, run the following command:

wbadmin start backup -backuptarget:Y: -hyperv:DC1 -vssFull

Restore a VM

“wbadmin start recovery” is the primary command to recover a VM from backup. Recovering a VM is slightly more trickier than backing it up, but I have never heard of a backup product where a restore is easier than taking a backup. The command has several options and switches but I’ll stick to the basic ones in this post.

The restore procedure involves finding the version of your backups you want to restore, then which items within that version before the restore itself. To begin with you find your backup versions with the following command

wbadmin get versions

This will provide a list for the backups taken from the local machine. Look for the field “Version Identifier” which you need in the next command. Then we take a look what resides in this backup version with the next command

wbadmin get items -version:(version identifier)

Here you see I have a VM named “LAB2-PC2″ that I am able to restore from this backup. To do so I have to grab the “vm identifier” value and the backup version number from before and run the following command

wbadmin start recovery -itentype:hyperv -version:(version identifier) -items:(VM identifier)

Notice the warnings that it will delete the VM if it still exists and restore the VM from the backup. Also you have to verify the network settings of the VM after the restore. As mentioned this command has a numerous options for restoring to alternate locations and such so I would suggest that you go exploring with “wbadmin -?” or have a look at http://technet.microsoft.com/en-us/library/cc754015(v=ws.10).aspx

Restore a single file or folder

WSB only provides a snapshot og the vm and you have to restore the entire vm or nothing at all. But if you just need to restore a file or a folder, then locate the .VHDX file in the backup and mount in disk manager and extract the files from there. Alternatively you can restore on another hyper-v host and boot it up ther to extract the files.

Final words

I’ll keep this short and straight to the point: TEST YOUR BACKUP!

Longer version: I’m convinced one of the more common failures among IT is that people does not try a proper restore until the day they need it the most. I can’t express how important it is that you test your backups and try a restore. Create a restore procedure and write it down! When the day comes that you need it, you will thank yourself that you did.

Thank you for reading, hopefully you have enjoyed it.

Step by Step Guide to deploy RMS

Step by Step Guide to deploy RMS 

Prerequisites

AD RMS would require the following –
· RMS Service account
· Ensure that the user has email address attribute filled in.
· Ensure that the RMS server is a member server in the Domain.
· RMS server is reachable using DNS name.
· Ensure that RMS Server is included in the Trusted Sites of IE.
· Office 2003 Professional or Office 2007 Professional Plus for authors. The end-user can be on Office 2003 standard / Office 2007 standard

• Creating AD RMS Service Account

a. If necessary, log onto the AD server as Administrator.
b. In the Server Manager window, expand Roles, then expand Active Directory Domain Services, and click Active Directory Users and Computers.
c. Create New User with the following parameters:
     i. First name: ADRMSSvc
     ii. User logon name: ADRMSSvc
     iii. Password: Str0ngPassw0rd
     iv. User must change password at next logon: Not Selected
     v. Password never expires: Selected
d. Select Next, and then Finish.
Close Active Directory Users and Computers

 

• Creating GPO to include RMS Server is included in Trusted sites of IEa. In the Group Policy Management Editor, expand User Configuration, expand Policies, and then selectWindows Settings.
  b. Expand the Internet Explorer Maintenance node and then click Security.
  c. In the details pane, double-click Security Zones and Content Ratings and click Continue in the pop-up window.
  d. In the Security Zones and Content Ratings dialog box, in the Security Zones and Privacy section, clickImport the current security zones and privacy settings.
  e. Click Modify Settings.
  f. Click Trusted Sites, and then click Sites.
  g. Verify that the following entries have been added to the list:
  · *. xxxxx.com (This would be your domain name)
  h. Click Close.
  i. Click Local Intranet, and then click Sites.
  j. Click the Advanced button.
  k. Verify that the following entries have been added to the list:
  · *.xxxx.com
  l. Click Close, and then click OK in the local Intranet window.
  m. Click OK twice to return to the Group Policy Object Editor and close the Group Policy Object Editor.
  n. Close the Group Policy Management Console.
  o. Close all windows and log off

The other prerequisites do not require my help :)
I am sure, you can check if RMS server is reachable by pining it from client machines.
**** But don’t forget to ensure that the AD user accounts have email address field populated with valid email IDs.

Installing RMS Server (Provisioning RMS Server)

Lets see how the RMS Server is provisioned on Windows 2008 Server.

a. If necessary, log on Administrator to the Server identified for being RMS Server.
b. Click the Start button, and then click Server Manager.
c. Click Roles, and then click Add Roles on the right panel. The Add Roles Wizard opens. Click Next.
d. On the Select Server Roles page, select Active Directory Rights Management Services.
e. The Add Role Wizard page appears, informing you that the required role-services dependencies on Message Queuingwill be installed. Click Add Required Features to install the role and role services. This may take several minutes.
f. The Add Role Wizard page will show you the following role selected:

· Active Directory Rights Management Services

g. Click Next.
h. The Add Role Wizard page shows you an Introduction to Active Directory Rights Management Services. ClickNext to continue.
i. The Add Role Wizard page shows you the component list. Only Active Directory Rights Management Services is selected. Click Next.
j. The Add Role Wizard – Create or Join an AD RMS Cluster page appears. Verify that the only option available is Create a New AD RMS Cluster and then click Next.
k. The Add Role Wizard – Select Configuration Database page appears. Select Use a different database server, and click Select.
l. In the Select Computer window, type xxxxxxx and click CheckNames, then click OK.
m. In the Database Instance dropdown, select Default, then click Validate and click Next.

Note: For Production environment, It is highly recommended that the databases are installed on a separate machine or SQL cluster.

n. The Add Role Wizard – Specify Service Account page appears; click the Specify... button and assign the following attributes to the account:

i. Username: AD RMSSvc

ii. Password: ********* (some strong password you can provide)

o. Click Next.

Note: This account doesn’t require any additional privileges (domain user only).

p. The Add Role Wizard – Configure AD RMS Cluster Key Storage page appears; click Use AD RMS centrally managed key storage, and then click Next.
q. The Add Role Wizard – Specify AD RMS Cluster Key Password page appears; specify the following strong password:Sup3r$Str0ngP@$$w0rd& and then click Next.

Note: The key password is sensitive because it protects all encryption key services. The sample password is only for example.

r. The Add Role Wizard – Select AD RMS Cluster Web Site page appears; verify that Default Web Site is selected and then click Next.
s. The Add Role Wizard – Specify Cluster Address page appears; select the option Use an SSL-encrypted connection (https://), and then specify the following FQDN: adrms.xxxxxx.com. Verify that the port specified is 443, click Validateand then click Next.
t. The Add Role Wizard – Name the Server Licensor Certificate page appears; assign a friendly name that represents your AD RMS organization, such as “xxxxx – AD RMS”, and then click Next.
(where xxxx is your company name)
u. The Add Role Wizard – Register AD RMS Service Connection Point page appears; select the option Register the AD RMS service connection point now, and then click Next.
v. The Add Role Wizard – Confirm Installation Selections page appears; verify that all the parameters are as you specified them to be configured, and then click Install. The installation process begins.
w. The Add Role Wizard – Installation Results page appears; verify that all components have been installed successfully, and then click Close.
x. Open the IIS Console.
y. Close all the windows and then restart the server

Create AD RMS Console

a. Log on to RMS Server as the Administrator.
b. Click Start, click Run, type mmc, and press Enter.
c. The MMC Console appears.
d. Click the File menu and then select Add or Remove Snap-ins.
e. In the Add or Remove Snap-ins window, select Active Directory Rights Management Services. Click the Add button and then click OK.
f. Select the Active Directory Rights Management Services snap-in and select the option Add Cluster in the right pane.
g. In the Add Cluster window, select the option called Connect To, and then select local machine and then click Finish.
h. In the File menu, select the option called Save. Put the MMC file on the computer desktop and assign the following name to the console: AD RMS
i. Do not close the AD RMS Console.

Configuring Extranet Pipelines

If you want your rights-protected document to be accessible from outside your organization, you must configure the external URLs immediately. The URL should not change after it is configured. The rights-protected documents contain this information within the non-encrypted header of the document. If you change the URL or configure the URL at a later time, none of the previously protected documents will be accessible from the extranet. These changes will not propagate to previously protected documents.

a. In the AD RMS MMC, expand Active Directory Rights Management Services, right-click AD RMS.xxxxxx.com, and then click Properties. Click the Cluster URLs tab, and then click the Extranet URLs check box.
b. For Licensing, click https://, and then type adrms.xxxxx.com
c. For Certification, click https://, and then type adrms.xxxxx.com
d. Click OK.
e. Close all the windows .
f. On the Microsoft Management Console, click No so that changes to the console will not be saved.

On the AD Domain Controller - Verify that the AD RMS service connection point is registered in Active Directory:

a. Log on to AD Domain Controller as the <Domain_name>\Administrator.
b. Click Start, click Run, and then type dssite.msc in the Open box. Click OK.
c. Expand Services and select RightManagementServices. In the right panel, select SCP, then right-click and selectProperties. In the SCP Properties dialog box, select the Attribute Editor tab, then select Distinguished Name and clickView.
On String Attribute Editor view, verify the following value: CN=SCP, CN=RightsManagementServices,CN=Services, CN=Configuration, DC=xxxxx,DC=com
Notice the various attributes registered in the service connection point. The keywords attribute is used by the clients to help query this object.
d. Click OK twice.
e. Close Active Directory Sites and Services. Don’t log off

Note - In order to enable external users or employee who are accessing the rights protected information from extranet, following should be performed –

• Allow TCP port 443/80 on Firewall for RMS Server i.e. Firewall to allow inbound and outbound traffic to RMS Server on TCP 443 & TCP 80
• Publish Extranet URL of RMS in DNS server. i.e. External user should be able to resolve the extranet URL of RMS.

Back up the AD RMS Private Key

Back up the AD RMS private key using following steps:
a. On the Desktop, click AD RMS.msc.
b. Expand Active Directory Rights Management Services.
c. Expand adrms.xxxx.com.
d. Expand Trust Policy and then select Trusted Publishing Domains.
e. Select xxxxx AD RMS and click Export Trusted Publishing Domain.
f. Click Save as, navigate to the desktop, and type xxxxx-Private-Key in the file name field.
g. Click Save, type pass@word1 as the password, and confirm the password.
h. Click Finish and do not save the changes.
i. Close the AD RMS Management Console.

Note: It is highly recommended that you store this file in a very secure place. In case of disaster recovery, this file is used to restore the service with a database backup.

Installing Lync 2013 Edge Server

Overview

The Edge Server provides users with the same external characteristics and internal experience that Lync Server 2013.. With the publication of the Edge Server, the following features are supported:

• Connecting remote clients;
• Federation with messenger; 
• Integration with Public IM's;

To run the setup, the service requires a server with two network cards, each one connected to a different network segment.. The Edge Server supports the use of the NAT only on the NIC, that is routed to the Internet and also to the network card that initiates communication with the internal network NAT is not supported.  To run the setup, the Edge have a DMZ divided into two networks . The IP address of the servers and networks are described in the figure and table below:

Corporate networks servers are running Windows Server 2012. All servers are part of the same Active Directory Domain Services with the internal FQDN home.intranet, there is a pool of the Lync Server Standard with the domain name: sip home.com.br. 

Server Name	IP	Role
Hm01.home.intranet	172.16.1.245/24	Domain Controller and Enterprise Certification
Hm02.home.intranet	172.16.1.246/24	Lync Server Standard
Hm11.home.intranet	172.16.1.251/24	Office Web Apps Server

I have three firewalls settings to networks segments bellow:

Firewall Names	1st Ip Address	IP Address 2	Description
FW-Internal	172.16.1.210/24	192.168.0.210/24	Firewall separating the DMZ Network Corporate Network 1.There is a relationship between the two routing networks.
FW-DMZ	192.168.0.250/24	10.0.0.250	Network Firewall DMZ that separates the DMZ Network 1 and 2. There is a relationship between routing network.
FW-External	10.0.0.254	xxx.x.178.155 xxx.x.178.156 xxx.x.178.157	Firewall separating the DMZ Network and Internet 2. There is a relationship between the two NAT network and all IPs address valid structure are configured on this device.

In the DMZ, I have two servers configured with two network cards, each network adapter connected to a different network DMZ. These servers are part of the Workgroup home.dmz. Only the ports required for the publication of the services are configured on the internal and external firewalls.

Server Name	Ip Network Address DMZ 1	IP Network DMZ 2	Description
HmRP	192.168.0.150/24	10.0.0.150/24	IIS Reverse Proxy
HmEdge	192.168.0.120/24	10.0.0.120/24 10.0.0.121 10.0.0.122	Lync Edge Server

Configuring the DNS Service

Internal DNS

I have two zones settings in the domain controller HM01. The zone home.intranet integrated with Active Directory supporting dynamic updates. and it was manually created a record that resolves the FQDN of the Edge Server in the DMZ.

  

The second zone called home.com.br, are not support dynamically updates from the records that were created at the zone by the the pool Lync and Exchange.

The following records were set in the area:

Type of Record	FQDN	IP	Description
A	sip.home.com.br	172.16.1.246	Address internal Front End  or Director for internal network clients
A	admin.home.com.br	172.16.1.246	URL Administration pool
A	DialIn.home.com.br	172.16.1.246	URL Access to Dial In
A	meet.home.com.br	172.16.1.246	URL of Web services meeting
A	lyncdiscoverinternal.home.com.br	172.16.1.246	Register for Lync AutoDiscover service to internal users
A	lyncdiscover.home.com.br	172.16.1.246	Register for Lync AutoDiscover service to external users
SRV	Service: _sipinternaltls Protocol: _tcp Port: 5061	sip.home.com.br	Record pointer services to internal customer connections using TLS

External DNS

At DNS zone home.com.br internet records were created:

Type of Record	FQDN	IP	Description
A	sip.home.com.br	xxx.x.178.155	Address external  Edge Server  for connecting external customers
A	WebConf.home.com.br	xxx.x.178.156	URL Access to Web Services Edge Server
A	AV.home.com.br	xxx.x.178.157	URL services Audio and Video
SRV	_sip._tls.home.com.br	sip.home.com.br: 443	Record scorer services for external connections using TLS clients. This connection should be pointed on port 443.

Configuring the Firewall

Ports Requirement for Internal Access

The following ports must be allowed access between the Edge Server internal network , Lync pool servers and internal network clients:

Protocol / Port	Source	Destination	Description
Sip/TCP/5061	Ip Address of the Front End Server or  Director Server	IP address of the network card's internal  Edge Server	SIP outbound traffic from Front Endor Director Server to the network card's internal Edge Server
Sip/TCP/5061	IP address of the network card intena the  Edge Server	Ip Address of the  Front End Server or  Director Server	Traffic inbound SIP network card's internal Edge Server to the address of the Front End or Director
PSOM/TCP/8057	Ip Address of the  Front End Server or  Director Server	IP address of the network card's internal  Edge Server	Traffic Conference Web Front End Server to the internal network card of the Edge Server
Sip/TCP/5062	Ip Address of the  Front End Server or  Director Server	IP address of the network card's internal  Edge Server	Authentication of users of Audio / Video  Front End Server  for  Edge Server
STUN/UDP/3478	All ip's Corporate Network	IP address of the network card's internal  Edge Server	Traffic Media Audio / Video between internal and external users
STUN/TCP/443	All ip's Corporate Network	IP address of the network card's internal  Edge Server	Traffic Restraint Media Audio / Video between internal and external users. If the connection to the UPD protocol fails, the 443/TCP port will be used for media traffic.
Https/TCP/4443	Ip Address of the  Front End or Back End Server	IP address of the network card's internal  Edge Server	Replication traffic from the internal pool settings for the Local Configuration Store the Edge Server
MTLS/TCP/50001	All ip's Corporate Network	IP address of the network card's internal  Edge Server	Controller Centralized Logging Service using the Lync Server Management Shell cmdlets and Centralized Logging Service, ClsController (ClsController.exe) or commands and agent logs (ClsAgent.exe)
MTLS/TCP/50002	All ip's Corporate Network	IP address of the network card's internal  Edge Server	Controller Centralized Logging Service using the Lync Server Management Shell cmdlets and Centralized Logging Service, ClsController (ClsController.exe) or commands and agent logs (ClsAgent.exe)
MTLS/TCP/50003	All ip's Corporate Network	IP address of the network card's internal  Edge Server	Controller Centralized Logging Service using the Lync Server Management Shell cmdlets and Centralized Logging Service, ClsController (ClsController.exe) or commands and agent logs (ClsAgent.exe)

 

Ports Requirement for External Access

To publish Lync and services necessary to create the following rules on the firewall of internet:

Protocol	Source	Destination	Description
Sip/TCP/443	Any Internet address	Ip public service for the SIP  Edge Server	SIP traffic between client-server for external users
Sip/TCP/5061	Any Internet address	Ip public service for the SIP  Edge Server
Sip/TCP/5061	Ip public service for the SIP  Edge Server	Any Internet address
PSOM/TCP/443	Any Internet address	Web Conferencing Service  Edge Server	Media Web conferencing
STUN/UDP/3478	Ip public service for the A / V  Edge Server	Any Internet address	Traffic used by the client to determine the version of the Edge Server.
STUN/UDP/3478	Any Internet address	Ip public service for the A / V  Edge Server	Traffic trading connection over UTP
STUN/TCP/443	Any Internet address	Ip public service for the A / V  Edge Server	Traffic trading connection on TCP/443
STUN/TCP/443	Ip public service for the A / V  Edge Server	Any Internet address	Traffic trading connection on TCP/443

 

Configuring Access Policies

By default when the pool is created, the Lync external access policy called Global is created with all access disabled. To allow external access to Lync clients need to change the default policy or create a new policy for users.
Changing the policy Global allows all users to have the ability to connect external. Visit the Lync Server Control Panel tab to access the Federation and External Access access policies on the Edge Access Edge Configuration. politics Select Global.

  

Select the options Enable remote user access and Enable anonymous user access to conferences

  

Check that the policy was changed successfully.

  

Return to the Lync Server Console click in External Access Policy and change the Global policy

  

Check the option Enable communication with remote users and apply the changes

 

Creating the Edge Server Pool

All steps of creating and configuring the Edge Server pool are performed using the Topology Builder. Begin the configuration tool and select Download Topology from existing deployment.

 

 

Select settings Edge Pools right click and create a pool in New Edge Pool ....

  

Go to start creating the pool

  

Click Single computer pool and add the name internal FQDN  reserved for the Edge server, this environment HmEdge.home.intranet

  

At this time I will not configure any feature integration with other IM services, leave all the boxes unchecked and go.

  

In this environment I have only IPv4 addresses for both internal and external interfaces, therefore only leave these boxes configured address. The external network adapter of the Edge Server connected to this network that the firewall is configured as NAT Network DMZ 2, so I marked the last dialog box The external IP address of this Edge pool is translated by NAT.

  

Then configure the names for the external FQDN's access services Edge Pool. As availability will have three services set for publication in the secure port 443 and publish each with a different Ip valid internet.

  

Configure which IP address of the network card that communicates with the Pool on the corporate network. In this scenario configured with the IP 192.168.0.120

  

Configure which ips configured on the network adapter external Edge Server associating a private Ip with each service.

  

Configure Ip public service that will be configured for Audio and Video pool.

  

Configure which the pool Front End Edge will be involved.

  

Configure which servers Front End will be used by Edge, and finalize the pool creation.

  

Return to Builer Topology and publish settings.

  

Go ahead and start the writing process on the basis

  

The process should finish without errors.

  

With the Edge Server pool created and published on the Central Management Store we have to export the settings to a file pool that will be used in the Edge server installation. Start the Lync Server Management Shell and run the cmdlet:

Export-CsConfiguration <folder path>

  

Access the Web service server certificate and export the root certificate into the same folder.

  

  

Copei entire contents of this folder to the server Edge Server.

Server Configuration Edge Server

The Edge Server server has two network cards each connected to a different network DMZ. A plate of Network DMZ one that is treated as a network card inside the server, and other network card connected Network DMZ 2 that is treated as the external network adapter on the server.

  

The NIC Network DMZ 1 was configured with the ip 192.168.0.120. This plate was configured without a default gateway address.

  

The NIC Network DMZ 2 was configured with three private ip's. Each ip is configured with an Access Service Edge. The three ip's are 10.0.0.120/24, and 10.0.0.121/24 10.0.0.122/24. This plate was configured with the default gateway pointing to the external firewall.

  

The Edge server should be able to route packets from clients for Lync Front End pool. To this you must add a route to the server in Corporate Network on IP address range 172.16.1.0/24.

  

To enable communication with the Edge Server Front End must add an exit route for the 172.16.1.0/24 network originated in inner plate Edge Server. To identify which interface is used to add the route first run ipconfig / all

  

Identify the route print how many physical interface. In this scenario the internal network card is labeled IF 12

  

Run the command route add with the option -p  to set the route as persistent. For that is not erased when the server restarts.

route add <rede address> mask <mascara of identificação> <IP gateway> if <identificação board <Network-p

  

After configuring the DNS suffix add routes to Edge server. Tab to change the computer name click Change, in Full computer name click More and add Primary DNS suffix of this computer: the suffix of the Active Directory Domain Services.

  

The Edge Server must be able to resolve the FQDN name of the Front End, to this add the name and ip of the Front End in the host file. Navigate to the folder C: \ windows \ System32 \ drivers \ etc \ hosts. 

  

To test the routing fireall release the ping and ping internal to the corporate network.

  

To finalize the operating system configuration, import the root certificate HM01 folder of Trusted Root Certification

  

Installation Services Edge Server

Supported are the following operating systems to install the Edge Server

• Windows Server 2008 R2 Enterprise Edition SP1 or Windows Server 2008 R2 Standard Edition SP1
• Windows Server 2012 Standard or Datacenter

The installation of services also requires inclusion of the following server features:

• . NET Framework 4.5, for installation on Windows Server 2008 R2 download link in  http://www.microsoft.com/en-us/download/details.aspx?id=30653 
• Windows Identity Foundation, for installation on Windows Server 2008 R2 download link in  http://www.microsoft.com/en-us/download/details.aspx?id=17331 

In Windows Server 2012 features are implemented by the Server Manager

• Windows Identity Foundation run the cmdlet

add-WindowsFeature Windows-Identity-Foundation

  

• . NET Framework 4.5, 

add-WindowsFeature Net-Framework-45-core

  

Creating the Local Configuration Store

To begin installing the Local Configuration Store lot of media  Lync Server  and double-click to start the wizard

  

Set the installation folder of files and click Install

  

Accept the license terms and click OK

  

Click Install or Update Lync Server System

  

Run the first step Install Local Configuration Store

  

In the Import from file (recommended for Edge Servers) click Browse .. and select the file generated by the cmdlet  Export-CsConfiguration in Front End

  

Finalize the installation of Configuration Store and return to the setup wizard

  

Installation and Service Components

Run the second step Setup or Remove Lync Server Components

  

Go to start copy the file and services

  

Finish the installation wizard and return to the Lync Server

  

Creation of Digital Certificates

All traffic Edge Server Front-End and Edge Server, Lync Client is encrypted using digital certificates. Each network card requires a digital certificate with the names FQDN's configured for remote connection services.

Board Certified Internal Network

To configure the certificate for the internal network card of the Edge Server run the third step Request, Install or Assign Certificates.

  

Select the Internal Edge and click Request.

  

Proceed to start the certificate request.

  

How the Edge Server does not have access to the server digital certificate will generate a file with the settings and import the certificate to the server's internal network.Select Prepare the Request now, but send it later (offile certificate request)

  

Select the file path and go

  

No need to change the certificate templates.

  

Configure the Friendly Name  of the digital certificate, this field does not affect any practical configuration of the certificate try the function only identification certificate.

  

Configure the organization's information

  

Configure the geographic information

  

In Subject Name configure the internal FQDN created for the Edge Server and advance

  

No need to add any records in the SAM internal certificate

  

In Summary Request make sure all information is correct and proceed.

  

The command to generate the certificate should be executed and the file created in the folder configured

  

Finalize the assistant certificate, then you need to create a request for external certificates

  

Board Certified External Network

The application process for the external certificate is identical to the internal process, I will show only the differences between the processes.
installation wizard Return to Lync Server, select External Edge Certificate  and click Requet.

  

Set the folder where you saved the file request

  

Configure the Friendly Name for the external certificate

  

Domain names sip supported by the Front End are now automatically added to the certificate

  

Select the SIP domain that will be supported for remote connections. Go ahead and finalize the request for the certificate.

  

Installation of Digital Certificates

Copy the certificate to the internal network and make the generation of the digital certificate in the certification. Copy the certificates to the final server Edge Server

  

Start the MMC console, connect to the local computer. Click Personal -> Import browse to the certificate and import the two files generated.

  

Both certificates must be installed on the computed form below

  

Configuring Certificates in the Services

With the certificate installed on the server you must associate them services and network card. Return to the installation wizard Lync Server and rerun the third step Request, Install or Assign Certificates

  

Select Edge Internal and click Assign.

  

Go on Assignment Certificate.

  

Select the certificate generated for the internal card's Edge, and click Next

  

Ensure that all information is correct and proceed to start the configuration.

  

The wizard must configure the certificate for the internal network card's Edge. Finish the wizard.

  

Return to assistant certificate configuration, select External Edge Certificate and click Assign

  

Proceed to start the configuration process

  

Select the certificate generated for the services of the external network adapter and go

  

Ensure that all information is correct and proceed to start the configuration.

  

The wizard must configure the certificate for the external network adapter of the Edge. Finish the wizard.

  

The configuration console should show the two certificates installed and configured services.

  

Close the assistant certificate and return to the main screen installation.

Starting the Services

In the installation wizard Lync Server run the fourth step, Start Services.

  

This process must start all services Lync Server Edge.

 

 

To verify that the services are running open the service console and check the status changed to running

  

Testing the Access

With the services started, the Front End Server initiates the replication settings for the Local Store on Edge Server. replication After first external users should be able to initiate connection to the Edge Server.  Microsoft provides a portal  https:/ / www.testocsconnectivity.com   to perform connection tests and doors in the structure.

 

  

Provide the information of a user enabled for remote connection and check the server status