Basically as it is described to me, Lync client for Mac OSX (10.6 and 10.7) will connect, show presence, but within one minute it blanks out and disconnects with an error.

Here is a sample error log from a TechNet Forums post where I got the solution from:

2011/12/22 10:46:04.328 [o365] process server certificate from input token failed

http://social.technet.microsoft.com/Forums/en-US/ocsclients/thread/af8935f3-e1a0-47bc-9792-536c07e0ecf2 

So there isn’t a fix just yet however there is a work around. This seemed to resolve the issue, thanks to “Jonathanpisarczyk” on the forums:

Open Lync Control Panel -> security
in the right pane we can find the authentication methods
Double click on the global setting so that we can edit that.
Uncheck the Enable Certificate Authentication.
Commit the changes.
User will need to signoff and back on.

If you have any other details on resolutions please leave them below in the comments.

-Eric

The server forwarders cannot be updated.
A zone configuration problem occurred.

When setting up conditional forwarders in Windows 2003 R2 DNS Server then more then likely its because the zone already exists as a stub zone.

In my case I tried to add xyz.local and got this error message each time. My first move was to check if there was a xyz.local stub zone and sure enough there was NOT. After some more checking I noticed there was a “local” stub zone.

Make sure to check for the root level as a stub zone, I bet you will find that is your issue.

Hope it helps!

-Eric

Real quick one today, one of my users today told me she had been holding off upgrading to Office 2010 SP1 due to an error using one of the Wizards in Access 2010.

She happened to be on x64 but I believe this was a bug in both.

Error Details:

"The database cannot be opened because the VBA project contained in it cannot be read. The database can be opened only if the VBA project is first deleted. Deleting the VBA project removes all code from modules, forms and reports. You should back up your database before attempting to open the database and delete the VBA project."
Once you click OK on this message, you may receive any of the errors below:
Cannot update. Database or object is read-only.

OR

The Visual Basic for Applications project in the database is corrupt.

OR

Microsoft Access can’t find the wizard. This wizard has not been installed, or there is an incorrect setting in the Windows Registry, or this wizard has been disabled.

Well all you need to do to fix it is get the hotfix from Microsoft:

http://support.microsoft.com/default.aspx?scid=kb;en-US;2581301

Just simply scroll down to the large consumer focused icon that say "Microsoft Fix It" and click it. You download a quick package which patches Access.

Note: Make sure you close down all of Office first!

Enjoy,

Eric

I was a good admin and installed CU4 and the Mobile Connectivity add-on however it wasn’t working.

First thing to know about troubleshooting is to enable logging on the CLIENT. Its in Help –> About or near it depending on platform. Microsoft did a great job with the logging. One easy button emails everything you need to a email address of your selection.

Second thing is to do a basic test. Using a desktop browser, can you get to https://lyncdiscover.domainname.net (replace domainname.net with your SIP domain) and be offered a download OR does it give you access is denied message?

If you get accessed denied then you had the same problem I did. Turns out if you don’t use the bootstrap install method for the mobile connectivity pack IIS doesn’t get configured correctly.

While I am not totally sure I “think” what’s missing is in the web.config file this section:

<rule name=”autodiscover rule 1″ enabled=”true” stopProcessing=”true”>
<match url=”(.*)” />
<conditions logicalGrouping=”MatchAll”>
<add input=”{HTTP_HOST}” pattern=”.*lyncdiscover.*” />
<add input=”{REQUEST_URI}” pattern=”Autodiscover/AutodiscoverService.svc/root” negate=”true” />
</conditions>
<action type=”Rewrite” url=”Autodiscover/AutodiscoverService.svc/root” />
</rule>

See access denied isnt for lync, its for you trying to browse the root directory of IIS. Without the above rule it delivers you to the root.

So anyways thanks to Matthew C. Evans from the comments on this excellent post on how to install Mobile Service: http://blog.schertz.name/2011/12/deploying-the-lync-2010-mobility-service/

If that is your problem then just uninstall the mobile component from add / remove programs (its headless don’t be scared when it just vanishes) then follow that post above for using the bootstrap to install the client. Like magic everything started working for me.

I had followed “most” of Microsoft’s directions but I think I hit page down one two many times and skipped the bootstrap method of installing the mobility service. Just IMO the installer should be fixed OR blocked from installing without being done via the bootstrap.

Hope it helps others, I couldn’t find any good posts about this one issue.

Please leave comments if you know anything additional about it.

Public Folders Only:

Get-recipient -RecipientTypeDetails PublicFolder | select Name -ExpandProperty EmailAddresses | ? {$_.SMTPAddress -like “*MyDomain.com*”} | select Name, SMTPAddress

To pump to CSV:

Add this to the end: | Export-CSV C:\Filename.csv

Other  RecipientTypeDetails types? Just change the RecipientTypeDetails to one or more of the following (comma delimited):

• MailUniversalDistributionGroup
• MailUniversalSecurityGroup
• DynamicDistributionGroup
• MailNonUniversalGroup
• MailUser
• UserMailbox
• PublicFolder
• MailContact
• DiscoveryMailbox
• SharedMailbox
• RoomMailbox

So the Backup Server is going nuts with these storageservice.exe processes consuming 100% of the CPU. It makes it very hard to troubleshoot when the server doesn’t have enough CPU to let the OS run.

Below is a script I just created that takes all of them and sets them to only use cores 1 – 4 (basically only allowing it 50% of the total CPU power.

# Set Processor Affinity by adding the number together. For cores 1 – 4 its 15 for example.
# 1 (CPU 1)
# 2 (CPU 2)
# 4 (CPU 3)
# 8 (CPU 4)
# 16 (CPU 5)
# 32 (CPU 6)
# 64 (CPU 7)
#128 (CPU 8 )

$instances = Get-Process storageservice
foreach ($i in $instances) {
    $i.ProcessorAffinity=15
}

Ah much better, now time to figure out why its going nuts….

They got this NDR back:

“None of your e-mail accounts could send to this recipient.”

Now I have never seen that error before, and what really got my interest was there was no x.x.x error code. This lead me to think it was a local issue with the client.

Some Google searching lead me to think it had to do with missing message connectors (like fax, etc..) but this user didn’t have any of that.

Some times it really helps to just talk to the end user. After speaking to her we discovered this only happened when clicking a mailto: hyperlink from a forwarded email down in the thread.

When I went back to my desk I noticed that my FROM: tags were not hyperlinked like the ones from my user.

After comparing the differences I finally noticed that she had the SalesForce.com plug-in installed. What it is doing is actually sending outlook a email type of “MAILTO” instead of SMTP.

After pressing ALT+K you can double click the resolved address and see what the email type is. If its set to MAILTO it will not work. You can however press the internet type button and it will change it to SMTP (which will allow it to send).

So there is no real solution right now, I am going to check with SF.com enterprise support but I have a feeling they wont do anything about it. After showing the end user what not to do and showing how to correct it she was happy enough with the solution.

If you find the same problem or any other add-on causing this please let me know so I can add it to the list.

UPDATE: Thanks to Andrew down there in the comments Outlook 2007 has been patched by MS: http://support.microsoft.com/kb/2475888/en-us

UPDATE 2: Thanks to Tom, we now know MS is hopefully rolling out a patch for Outlook 2010 sometime this month (fingers crossed).

UPDATE 3: I just saw there might be a fix for 2010 you can test out this hotfix from MS. If it works let me know in the comments: http://support.microsoft.com/kb/2475888/en-us or possibly http://support.microsoft.com/kb/2597052.

Hey I just got the torch and I am loving it! Sure it’s a little laggy now and then and sometimes it doesn’t play nice with my WiFi but all in all, BEST BLACKBERRY EVER! The two things I mentioned I believe will be fixed with soon upcoming future releases of the OS.

However there is one problem, BES isn’t push my OCS / Communicator Client to the phone. I did a little Google Searching and didn’t find anything. Here is how I fixed it.

Special Note: If RIM releases a new version please don’t follow these directions anymore, this is just a work around for now and I am not responsible if you toast your torch

1) Download the desktop version from RIM’s site: https://www.blackberry.com/Downloads/entry.do?code=24E01830D213D75DEB99C22B9CD91DDD

2) Extract the following files to your desktop
- \oc2007\For_5.0.0\net_rim_bb_qm_oc2007.cod
- \oc2007\For_5.0.0\net_rim_bb_qm_oc2007_resource_en.cod

3) Download BBSAK 1.7 (if you don’t already have it) from here: http://rimgeeks.com/viewtopic.php?f=62&t=56

4) Open BBSAK (if no start menu short cut its here: C:\Program Files\BBSAK\BBSAK.exe)

5) Put in your device password (if you have one) then go to the Modify COD’s tab

6) Click on “JAD Maker”

7) Add the two files on your desktop, Name the App “Enterprise Manager”, give it a description, Version “2.5.20″, and Vendor is Research in Motion”.

8) Finally click Create JAD

9) Once its created click the INSTALL JAD button and select the newly created JAD file. NOTE: This may reboot the device, scared me a lot but it came up just fine after the boot and application works.

Thanks and let me know if you have any problems!

However like many things RIM they made it EXTREMELY hard to configure. When I called T-Support they didn’t know how to configure it but forwarded me to page 260 of the 5.0.2 admin guide.

For those that just want the steps scroll down, the next few paragraphs will be me ranting. Look for the larger underlined text for the steps.

Ok let’s see, Step 1 from the Admin Guide:

Use the Windows Server® ADSI Edit tool to add the following SPNs for the BlackBerry® Administration Service pool to the

Microsoft® Active Directory® account :

• HTTP/<BAS_pool_FQDN> (for example, HTTP/BASconsole104.example.com)

• BASPLUGIN111/<BAS_pool_FQDN> (for example, BASPLUGIN111/BASconsole104.example.com)

Ok doesn’t really make any sense, doesn’t tell you for which AD account nor how to do those steps but I am sure step 2 will explain better.

If you create separate pools of BlackBerry Administration Service instances and BlackBerry Web Desktop Manager instances

in the BlackBerry Administration Service pool, add the HTTP/<BAS_pool_FQDN> SPN for each pool to the Microsoft Active

Directory account.

Nope, no help there. THANKS RIM! Super awesome instructions! I called back and got their overseas call center. He was not helpful at all, when I told him “listen it’s a new feature that came out yesterday, let’s just save us both some time and pass me along to someone who has actually enabled this before” I was told he could not. When I asked for his manager he told me that management wasn’t technical and couldn’t help me either. I insisted and magically I got elevated to level 2 (an “analyst”) without speaking to the manager.

Side Note: If they put as much thought into their tech documents as they do their technical support tier names I think I wouldn’t have to call them.

Level 2 wasn’t much more help, they definitely didn’t get any training on what I would think would be a highly requested feature. He put me on hold for 10 minutes and came back with a “private section of the admin guide”. I am going to spare you the 8 pages of nonsense from that and instead give you clear steps on how to enable this feature.

Configuring AD at accept BlackBerry Enterprise Server 5.0.2 Single Sign-on

Background info: I am going to be using a Windows 7 / 2008 R2 Active Directory Users and Computers MMC, if you don’t have this version you can use ADSI edit to do the same thing. For deployment I decided to make a new AD Account for the purpose of Single Sign-On instead of making AD changes to the existing BES Service Account we had been using. The documentation isn’t clear if this is the way you should do it or not.

Disclaimer: This is all at your own risk. This did work for me but I do not clam to know your exact environment. If you are in doubt of any of these steps contact T-Support and have them help you. Also if you find better ways or if I have items that are not accurate please leave me a comment so I can clean it up. For all my ranting at RIM the real reason I do this is so others don’t have to go through the hassle that I did.

1) Open ADUC (Active Directory Users and Computers MMC)

2) Make sure Advanced Features are enabled by clicking View -> Advanced Features (checked means its enabled)

3) Find a nice OU to put your new service account in and create the account. (For my example I called mine svc-blackberry-ldap)

4) Right click your new user account and go to properties

5) Go to the Attribute Editor (if not there you don’t have advanced features enabled or you are not using a later version of ADUC, if that is the case use ADSI edit)

6) Double click on “servicePrincipalName”

7) Add the following:

BASPLUGIN111/<poolname /w FQDN>
HTTP/<poolname w/FQDN>

If your blackberry pool is called blackberry and your domain name is company.local then it would be:

BASPLUGIN111/blackberry.company.local
HTTP/blackberry.company.local

That is SPN then forward slash then FQDN of Pool. No spaces.

8) Then click OK.

9) Next open the properties of the new account again by right click -> properties

10) You should see a delegation tab next to telephone

11) Select the “Trust this user for delegation to specified service only” and the sub option of “Use Kerberos only”

12) Next click Add on the bottom of the delegation screen

13) Click the “Users or Computers…” button

14) Type in the name of that service account you just created (that you also have the properties open for) my example is “svc-blackberry-ldap” and click OK

15) Next click Select All on the bottom then click OK

16) Then click OK the finish configuring AD.

Now your AD is setup correctly, we have to move onto configuring the BES/BAS Server to use this account. If you have a larger environment you may want to wait till AD replication is finished. In my setup both DC’s that my BES/BAS server used were local site, I waited 5 minutes anyways just to be safe.

Configuring BAS / BlackBerry Enterprise Server 5.0.2 Single Sign-on

1) Logon to your BES/BAS Admin Site (I recommend using the account you used to install but not required if you have full admin rights)

https://<apppool>/webconsole/login

2) Click on Administrator User -> Create an Administrator User

3) Next put in the account details from the service account you just created and click “create an administer user” (note | the password is of the BES Admin not the new account.)

4) Next navigate to Server and Components -> BlackBerry Solutions Topology -> BlackBerry Domain -> Component View -> BlackBerry Administration Service

Side note: these names and structure could have only been thought up by a java programmer who has total disregard for end user mental stability.

5) Click on the Microsoft Active Directory Authentication Tab

6) Click on Edit Components on the bottom

Side Note: Ah the final configuration screen, this was by far the hardest part. This page is riddled with bugs so you have to be very careful here.

8) Change the Username to the new account on the top box, make sure domain is in there, put the password of your new account, set the default domain, then set the Single sign-on to YES and click SAVE ALL.

If it works it will take a second then tell you it was ok and to restart the BAS service. If it failed there can be a number of reasons. One, if you only have one domain you do not need to put anything on the bottom box (which BTW doesn’t have a name!!! It’s not called the “account forest name” box is it??) If you have more than one domain my directions might not be exactly right for you but should give a good start.

9) Restart BAS. Easiest way is to use the services.msc console to restart the BAS-NC service, this will stop and start the app service as well.

So with any luck you should be good to go now. Enjoy and shame on you RIM for not documenting this properly! This only took me 6 hours on the phone with your support and 1 hour to write up. If you are going to take the time to release a feature you could take 1 hour to make sure that bullet listed features are easy to configure.

UPDATE / SIDE NOTE: Sandra from in the comments added that you can not test this on the server console locally, you must do it from another machine.

Fix: All you need to do is install the RSAT tools for the OS you are installing it to. For Windows 2008 R2 just go to server manager, features, add features, then add the remote administration tools.