Planning for other features lync server 2010 (rc)

Planning for Other Features in Microsoft
Lync Server 2010 (Release Candidate)
Published: September 2010

This document is provided “as-is”. Information and views expressed in this document, including
URL and other Internet Web site references, may change without notice. You bear the risk of
using it.
Some examples depicted herein are provided for illustration only and are fictitious. No real
association or connection is intended or should be inferred.
This document does not provide you with any legal rights to any intellectual property in any
Microsoft product. You may copy and use this document for your internal, reference purposes.
This document is confidential and proprietary to Microsoft. It is disclosed and can be used only
pursuant to a non-disclosure agreement.
Copyright © 2010 Microsoft Corporation. All rights reserved.
Microsoft, Active Directory, ActiveSync, ActiveX, Excel, Forefront, Groove, Hyper-V, Internet
Explorer, Lync, MSDN, MSN, OneNote, Outlook, PowerPoint, RoundTable, SharePoint,
Silverlight, SQL Server, Visio, Visual C++, Windows, Windows Media, Windows PowerShell,
Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. All
other trademarks are property of their respective owners.

Contents
Planning for Other Features........................................................................................................1
Planning for Simple URLs........................................................................................................1
Role-Based Access Control......................................................................................................3
DNS Load Balancing..............................................................................................................23
Preventing New Connections to Lync Servers.......................................................................26
Running in a Virtualized Environment....................................................................................27
Migrating Applications Built on Microsoft Unified Communications Managed API (UCMA) 2.0
Core SDK............................................................................................................................32

Planning for Other Features
This section explains the features related to manageability of Microsoft Lync Server
2010 communications software.

• Lync Server Control Panel
• Lync Server Management Shell
• Planning for Simple URLs
• Role-Based Access Control
• DNS Load Balancing
• Preventing New Connections to Lync Servers

Planning for Simple URLs
Simple URLs make joining meetings easier for your users, and make getting to Microsoft Lync
Server 2010 administrative tools easier for your administrators.
Microsoft Lync Server 2010 communications software supports three simple URLs:
• Meet is used as the base URL for all conferences in the site or organization. An
example of a Meet simple URL is https://meet.contoso.com. A particular meeting URL
might be https://meet.contoso.com/username/JKTNME.
With the Meet simple URL, links to join meetings are easy to comprehend, and easy to
communicate and distribute.
• Dial-in enables access to the Dial-in Conferencing Settings Web page. This page
displays conference dial-in numbers with their available languages, assigned conference
information (that is, for meetings that do not need to be scheduled), and in-conference
DTMF controls, and supports management of personal identification number (PIN) and
assigned conferencing information. The Dial-in simple URL is included in all meeting
invitations so that users who want to dial in to the meeting can access the necessary
phone number and PIN information. An example of the Dial-in simple URL is
https://dialin.contoso.com.
• Admin enables quick access to the Microsoft Lync Server 2010 Control Panel. From
any computer within your organization’s firewalls, an admin can open the the Lync Server
2010 Control Panel by typing the Admin simple URL into a browser. The Admin simple
URL is internal to your organization. An example of the Admin simple URL is
https://admin.contoso.com

Simple URL Scope
You can configure your simple URLs to have global scope, or you can specify different simple
URLs for each central site in your organization. If both a global simple URL and a site simple URL
are specified, the site simple URL has precedence.
In most cases, we recommend that you set simple URLs only at the global level so that a user’s
Meet simple URL does not change if they move from one site to another. The exception would be

Planning for Other Features in Microsoft Lync Server 2010 (Release Candidate)
organizations that need to use different telephone numbers for dial-in users at different sites. Note
that if you set a one simple URL (such as the Dial-in simple URL) at a site to be a site-level
simple URL, you must also set the other simple URLs at that site to be site-level as well.
You can set global simple URLs in Topology Builder. To set a simple URL at the site level, you
must use the Set-CsSimpleURLConfiguration cmdlet.

Naming Your Simple URLs
There are three recommended options for naming your simple URLs. Which option you choose
has implications for how you set up your DNS A records and certificates which support simple
URLs. In each option, you must configure one Meet simple URL for each SIP domain in your
organization. You always need just one simple URL in your whole organization for Dial-in, and
one for Admin, no matter how many SIP domains you have.
For details about the necessary DNS A records and certificates, see DNS Requirements for
Simple URLs and Certificate Requirements for Internal Servers in the Determining Your
Infrastructure Requirements documentation.
In Option 1, you create a new SIP domain name for each simple URL.
If you use this option, you need a separate DNS A record for each simple URL, and each Meet
simple URL must be named in your certificates.

Simple URL Naming Option 1

Simple URL Example

Meet https://meet.contoso.com,
https://meet.fabrikam.com, and so on (one for
each SIP domain in your organization)

Dial-in https://dialin.contoso.com

Admin https://admin.contoso.com

With Option 2, simple URLs are based on the domain name lync.contoso.com. Therefore, you
need only one DNS A record which enables all three types of simple URLs. This DNS A record
references lync.contoso.com. Additionally, you still need separate DNS A records for other SIP
domains in your organization.


Simple URL Example

Meet https://lync.contoso.com/Meet,
https://lync.fabrikam.com/Meet, and so on (one
for each SIP domain in your organization)

Dial-in https://lync.contoso.com/Dialin

Admin https://lync.contoso.com/Admin

2

Option 3 is most useful if you have many SIP domains, and you want them to have separate Meet
simple URLs but want to minimize the DNS record and certificate requirements for these simple
URLs.


Simple URL Example

Meet https://lync.contoso.com/contosoSIPdomain/Meet
https://lync.contoso.com/fabrikamSIPdomain/Meet

Dial-in https://lync.contoso.com Dialin

Admin https://lync.contoso.com/Admin

Changing Simple URLs after Deployment
If you change a simple URL after initial deployment, you must be aware of what changes impact
your DNS records and certificates for simple URLs. If the change impacts the base of a simple
URL, then you must change the DNS records and certificates as well. For example, changing
from https://lync.contoso.com/Meet to https://meet.contoso.com changes the base URL from
lync.contoso.com to meet.contoso.com, so you would need to change the DNS records and
certificates to refer to meet.contoso.com. If you changed the simple URL from
https://lync.contoso.com/Meet to https://lync.contoso.com/Meetings, the base URL of
lync.contoso.com stays the same, so no DNS or certificate changes are needed.
Whenever you change a simple URL name, however, you must run Enable-CsComputer on each
Director and Front End Server to register the change.

Role-Based Access Control
To enable you to delegate administrative tasks while maintaining your organization's security
standards, Microsoft Lync Server 2010 introduces role-based access control (RBAC). With
RBAC, administrative privilege is granted by assigning users to pre-defined administrative roles.
Lync Server 2010 includes a rich set of built-in administrative roles, and you can assign user
groups to these roles.

Better Server Security and Centralization
In previous versions of Office Communications Server, administrative rights were defined very
broadly, and users with administrative access for a server running Lync Server could make many
types of changes. With RBAC, access and authorization is based more precisely on a user’s Lync
Server role. This enables greater use of the security practice of "least privilege," granting
administrators and users only the rights that are necessary for their job.

Important:
RBAC restrictions work only on administrators working remotely, using either the Lync
Server Control Panel or Lync Server 2010 Management Shell. A user sitting at a server

3

running Lync Server is not restricted by RBAC. Therefore, physical security of your Lync
Server is important to preserve RBAC restrictions.

Roles and Scope
In RBAC, a role is a list of cmdlets defined by Lync Server, designed to be useful for a certain
type of administrator or technician. A scope is the set of objects which the cmdlets defined in a
role can operate on. The objects that scope affects can be either user accounts (grouped by
organizational unit) or servers (grouped by site).
The following table lists the predefined roles in Lync Server 2010, and gives a general overview of
the types of tasks each can do. The fourth column shows the similar Microsoft Exchange Server
role for each Lync Server role, if there is one.
For a detailed list of exactly which cmdlets each role can run, see the tables later in this topic.

Pre-Defined Administrative Roles

Underlying
Active Directory Exchange
Role Tasks allowed Group equivalent

CsAdministrator Can perform all CS Organization
administrative tasks and Administrators Management
modify all settings,
including creating roles and
assigning users to roles.
Can expand a deployment
by adding new sites, pools,
and services.

CsUserAdministrator Can enable and disable CS User Mail Recipients
users for Lync Server, Administrators
move users and assign
existing policies to users.
Cannot modify policies.

CsVoiceAdministrator Can create, configure, and CS Voice Not applicable.
manage voice-related Administrators
settings and policies.

CsServerAdministrator Can manage, monitor, and CS Server Server
troubleshoot servers and Administrators Management
services. Can prevent new
connections to servers,
stop and start services,
and apply software
updates. Cannot make
changes with global
configuration impact.

4


Underlying
Active Directory Exchange
Role Tasks allowed Group equivalent

CsViewOnlyAdministrator Can view the deployment, CS View-Only View-Only
including user and server Administrators Organization
information, in order to Management
monitor deployment health.

CsHelpDesk Can view the deployment, CS HelpDesk HelpDesk
including user's properties
and policies. Can execute
specific troubleshooting
tasks. Cannot change user
properties or policies,
server configuration, or
services.

CsArchivingAdministrator Can modify archiving CS Archiving Retention
configuration and policies. Administrators Management,
Legal Hold

CsResponseGroupAdministrator Can manage the CS Response Not applicable
configuration of the Group
Response Group Administrators
application within a site.

CsLocationAdministrator Lowest level of rights for CS Location Not applicable
Enhanced 9-1-1 (E9-1-1) Administrators
management, including
creating E9-1-1 locations
and network identifiers,
and associating these with
each other. This role is
always assigned with a
global scope.

All predefined roles shipped in Lync Server have a global scope. To follow least privilege
practices, you should not assign users to roles with global scope if they are going to administer
only a limited set of servers or users. To accomplish this, you can create roles which are based
on the predefined roles, but with a more limited scope.

Creating a Role
When you create a role, you specify the scope, along with the existing role it is based on and the
Active Directory Domain Services group to be assigned the role. The Active Directory group you
specify must already be created. The following cmdlet is an example of a creating a role with

5

limited scope. It creates a new role called Site01 Server Administrators. The new role
has the abilities of the predefined CsServerAdministrator role, but only for the servers located in
the Site01 site. For this cmdlet to work, the Site01 site must already be defined, and a security
group named Site01 Server Administrators must already exist.
New-CsAdminRole -Identity "Site01 Server Administrators" -Template
CsServerAdministrator -ConfigScopes “site:Site01"
After this cmdlet runs, all users who are members of the Site01 Server Administrators
group will have server administrator privileges for the servers in Site01. Additionally, any users
who are later added to this security group also gain the privileges of this role. Note that both the
role itself, and the security group it is assigned to are called Site01 Server
Administrators.
The following example limits user scope instead of server scope. It creates a Sales Users
Administrator role to administer the user accounts in the Sales organizational unit. The
SalesUsersAdministrator security group must already be created for this cmdlet to work.
New-CsAdminRole -Identity "Sales Users Administrator " -Template
CsUserAdministrator -UserScopes “OU:OU=Sales, OU=Lync Tenants,
DC=Domain, DC=com"
A user can be given multiple RBAC roles by being added to the underlying Active Directory
groups that correspond to each role.
Note that when you create a role, users who are later added to the underlying Active Directory
group gain the abilities of that role.

Assigning Roles to Users
Each Lync Server role is associated with an underlying Active Directory security group, which is
created in Active Directory when you deploy Lync Server. Any users who you add to the
underlying group gain the abilities of that role.
The examples in the preceding section both created a new role and assigned a group to it. To
assign an existing role to one or more users, add those users to the group associated with the
role. You can add both individual users and security groups to these role groups.
For example, the CsAdministrator role is automatically granted to the CS Administrators
security group in Active Directory. This security group is created in Active Directory when you
install deploy Lync Server. To grant a user or group this privilege, you can simply add them to the
CS Administrators group.

Planning for RBAC
For each person who is to be given any kind of administrative rights for your Lync Server
deployment, consider exactly which tasks they need to perform, then assign them to roles with
the least privilege and scope necessary for their job.
Users who have the CsAdministrator role can create all types of roles, including roles based on
CsAdministrator, and assign users to them. The best practice is to assign the CsAdministrator
role to a very small set of trusted users.

6

Cmdlets Permitted for Pre-Defined Roles
The following sections list the cmdlets that each pre-defined role is permitted to run.

CsAdministrator
The CsAdministrator role is permitted to run all cmdlets.

CsUserAdministrator
The CsUserAdministrator role is permitted to run the cmdlets in the following table.

Disable-CSUser Get-CSArchivingPolicy Get-CsComputer Get-
Enable-CSUser Get-CSClientPolicy Get-CsNetworkInterface CSRoutingConfigu
ration
Get-CSAdUser Get- Get-CSPool
CSClientVersionPolicy Set-
Get- Get-CSService
CSCommonAreaP
CSUserPoolInfo Get- Get-CSSipDomain hone
Move-CSUser CSConferencingPolicy
Revoke-CSClientCertificate
Remove-
Move- Get-
Get- CSCommonAreaP
CSLegacyUser CSExternalAccessPoli
CSManagementStoreReplicat hone
cy
Set-CSUser ionStatus Get-
Get-
Grant- Get-CSAdContact CSCommonAreaP
CSHostedVoicemailPo
CSClientPolicy Get-CSUserAcp hone
licy
Grant- New-
Get-CSLocationPolicy Set-CSUserAcp
CSClientVersionPol CSCommonAreaP
Remove-CSUserAcp
icy Get-CSPinPolicy hone
Get-CsArchivingConfiguration
Grant- Get-CSVoicePolicy Set-
Get-CsPresencePolicy
CSConferencingPol Get-CSClientPinInfo CSAnalogDevice
icy Grant-CsPresencePolicy
Unlock-CSClientPin Remove-
Grant-CSDialPlan Get-CsWindowsService CSAnalogDevice
Lock-CSClientPin
Grant- Get-CSPstnUsage Get-
Set-CSClientPin
CSExternalAccess CSAnalogDevice
Get-
Policy
CSClientVersionConfig New-
Grant- uration CSAnalogDevice
CSHostedVoicemail
Get-CSDialPlan Set-
Policy
Get-CsSite CSExUmContact
Grant- Remove-
CSLocationPolicy CSExUmContact
Grant-CSPinPolicy Get-
Grant- CSExUmContact
CSVoicePolicy New-
CSExUmContact

7

CsVoiceAdministrator
The CsVoiceAdministrator role is permitted to run the cmdlets listed in the following table.

Remove- Get- Get- New-
CSNetworkSite CSEnhancedEmergenc CSNetworkConfiguratio CsMediaConfiguration
Remove- yServiceDisclaimer n New-CsLocationPolicy
CSNetworkSubnet New- Set-CSRgsAgentGroup New-
Set- CSUcPhoneConfigurati Set- CsCpsConfiguration
CSNetworkBandwid on CSRgsHoursofBusines New-
thPolicyProfile Get- s CsBandwidthPolicyServ
Set- CSHostedVoicemailPoli Set- iceConfiguration
CSNetworkInterReg cy CSRgsConfiguration New-CSRgsAnswer
ionRoute Set- Set-CSRgsHolidaySet New-CSRgsCallAction
Set- CSHostedVoicemailPoli
Set-CSRgsQueue New-CSRgsHoliday
CSNetworkInterSite cy
Set-CSRgsWorkflow New-CSRgsHolidaySet
Policy Remove-
Set- CSHostedVoicemailPoli Get-CsAdContact New-
cy Get-CsAdUser CSRgsHoursOfBusines
CSNetworkRegion
Get- s
Set- New-
CSNetworkRegionL CSHostedVoicemailPoli CsAudioTestServiceAp New-CSRgsQuestion
cy plicationContact New-CSRgsQueue
ink
Test-CSP2PAV Get- New-CSRgsTimeRange
Set-CSNetworkSite
CsBandwidthPolicySer
Set- New-CsAnalogDevice New-CSRgsWorkflow
viceConfiguration
CSNetworkSubnet Get-CsAnalogDevice New-
Get-CsClientPinInfo
Get- Get-CSExUmContact CSRgsWorkflowPrompt
Get-
CSVoicemailRerouti Set-CSExUmContact New-
CommonAreaPhone
ngConfiguration CsRoutingConfiguration
New-CsExUmContact
Get-CpsConfiguration
Set- New-CsVoiceRegex
Remove-
CSVoicemailRerouti Get-
CsAnalogDevice Publish-
ngConfiguration CsEnhancedEmergenc
CsLisConfiguration
Remove- yServiceDisclaimer
Remove- Remove-
CsCommonAreaPhone
CSVoicemailRerouti Get-CsLisCivicAddress
CsBandwidthPolicyServ
Remove-
ngConfiguration Get-CsLisLocation iceConfiguration
CsExUmContact
New- Get-CsLisPort Remove-
Set-CsAnalogDevice
CSVoicemailRerouti Get- CsCpsConfiguration
ngConfiguration Set-
CsLisServiceProvider Remove-
CsCommonAreaPhone
Get- Get-CsLisSubnet CsEnhancedEmergenc
CSTrunkConfigurati New-
yServiceDisclaimer
on CsCommonAreaPhone Get-CsLisSwitch
Get- Remove-CsLisLocation
Set- Test-
CsLisWirelessAccessP Remove-CsLisPort
CSTrunkConfigurati CSVoiceNormalization
oint Remove-
on Rule

8


Remove- Test-CSDialPlan Get-CsLocationPolicy CsLisServiceProvider
CSTrunkConfigurati Test-CSVoiceRoute Get- Remove-CsLisSubnet
on CsMediaConfiguration
Test-CSVoicePolicy Remove-CsLisSwitch
New- Get-
Test- Remove-
CSTrunkConfigurati
CSVoiceTestConfigurati CsNetworkConfiguratio CsLisWirelessAccessP
on n
on oint
Get- Get-
Test-CSVoiceUser Remove-
CSOutboundTransl CsQOEConfiguration
Get- CsLocationPolicy
ationRule
CSDeviceUpdateRule Get-PinPolicy Remove-
Set-
Remove- Get-CSRgsAgentGroup CsMediaConfiguration
CSOutboundTransl
CSDeviceUpdateRule Get- Remove-
ationRule
Approve- CSRgsBusinessHours CsNetworkBandwidthP
Remove-
CSDeviceUpdateRule Get- olicyProfile
CSOutboundTransl
Reset- CSRgsConfiguration Remove-
ationRule
CSDeviceUpdateRule Get-CSRgsHolidaySet CsNetworkConfiguratio
New-
n
CSOutboundTransl Restore- Get-CSRgsQueue
CSDeviceUpdateRule Remove-
ationRule Get-CSRgsWorkflow
CsQoEConfiguration
Get-CSPstnUsage Clear- Get-CSUserPoolInfo
CsDeviceUpdateFile Remove-
Set-CSPstnUsage Get-CSUserPoolInfo CSRgsAgentGroup
Import-
Get-CSVoiceRoute Get-
CsDeviceUpdate Remove-
Set-CSVoiceRoute CsWebServiceConfigur CSRgsHolidaySet
Clear- ation
Remove- Remove-
CsDeviceUpdateLog
CSVoiceRoute Get- CSRgsHoursOfBusines
Get- CsWindowsService
New-CSVoiceRoute s
CsDeviceUpdateConfig
Grant-CsDialPlan
Get- uration Remove-CSRgsQueue
CSRoutingConfigur Grant-
Set- Remove-
ation CsHostedVoicemailPoli
CsDeviceUpdateConfig CSRgsWorkflow
cy
Set- uration Set-
CSRoutingConfigur Grant-CsLocationPolicy CsAudioTestServiceAp
New-
ation Grant-CsVoicePolicy plicationContact
Remove- uration Import- Set-
CSRoutingConfigur CsLisConfiguration CsBandwidthPolicyServ
Remove-
ation Import-CSRgsAudioFile iceConfiguration
Get-CSDialPlan uration Lock-CsClientPin Set-
Set-CSDialPlan Get-CsTestDevice Move- CsNetworkConfiguratio
Remove- CsApplicationEndpoint n
Set-CsTestDevice
CSDialPlan Move- Set-CsMediationServer
New-CsTestDevice
New-CSDialPlan CsConferenceDirectory Set-
Remove-CsTestDevice
Get- Move- CsMediaConfiguration
Get-
CSVoiceNormalizati

9


onRule CSManagementStoreR CSRgsConfiguration Set-CsLocationPolicy
Set- eplicationStatus New- Set-
CSVoiceNormalizati Test-CsLisCivicAddress CSRgsAgentGroup CsLisWirelessAccessP
onRule Test-CsLisConfiguration New- oint
Remove- Debug- CsQoEConfiguration Set-CsLisSwitch
CSVoiceNormalizati CsLisConfiguration New- Set-CsLisSubnet
onRule CsNetworkMediaBypas
Export- Set-
New- CsLisConfiguration sConfiguration CsLisServiceProvider
CSVoiceNormalizati New-
Test-CsLocationPolicy Set-CsLisPort
onRule CsNetworkBWPolicy
Test- Set-CsLisLocation
Get-CSVoicePolicy New-
CsPhoneBootStrap Set-
Set-CSVoicePolicy CsNetworkBWAlternate
Test- CsEnhancedEmergenc
Remove- Path
CsPstnOutboundCall yServiceDisclaimer
CSVoicePolicy
Test- Set-
New-CSVoicePolicy CsPstnPeerToPeerCall CsCpsConfiguration
Get- Unlock-CsClientPin Set-CsClientPin
CSVoiceTestConfig
Unpublish-
uration
CsLisConfiguration
Set-
Set-CSPstnGateway
CSVoiceTestConfig
Set-
uration
CsQoEConfiguation
Remove-
CSVoiceTestConfig
uration
New-
CSVoiceTestConfig
uration
Get-
CSVoiceConfigurati
on
Set-
CSVoiceConfigurati
on
Remove-
CSVoiceConfigurati
on
Get-
CSUcPhoneConfigu
ration
Set-
CSUcPhoneConfigu

10


ration
Remove-
CSUcPhoneConfigu
ration

CsServerAdministrator
The CsServerAdministrator role is permitted to run the cmdlets listed in the following table.

Get- New-CSAnnouncement Remove- Import-
CsApplicationEndpoint Remove- CSNetworkInterRegi CSLisConfiguration
Get-CsPresencePolicy CSAnnouncement onRoute Publish-
Set-CsPresencePolicy Set- Set- CSLisConfiguration
CSAVEdgeConfiguratio CSNetworkInterSite UnPublish-
New-CsPresencePolicy
n Policy CSLisConfiguration
Remove-
New- New- Test-CSLocationPolicy
CsPresencePolicy
CSAVEdgeConfiguratio CSNetworkInterSite
Get-CSWindowsService Enable-
n Policy
CSPublicProvider
Start-
Remove- Remove-
CSWindowsService Disable-
CSAVEdgeConfiguratio CSNetworkInterSite
CSPublicProvider
Stop- Policy
n
CsWindowsService Test-
Set- Set-
CSVoiceNormalization
Get-CSCertificate CSNetworkRegion
CSBandwidthPolicyServ Rule
Get- iceConfiguration New-
Test-CSVoicePolicy
CSAccessEdgeConfigur New- CSNetworkRegion
ation Test-CSVoiceRoute
CSBandwidthPolicyServ Remove-
Get- Test-
iceConfiguration CSNetworkRegion
CSAddressBookConfigu Remove- CSVoiceTestConfigura
Set-
ration tion
CSBandwidthPolicyServ CSNetworkRegionLi
Get-CSAllowAllDomains iceConfiguration Test-
nk
CsFederatedPartner
Get-CSAllowedDomain Set-CSBlockedDomain New-
Test-
Get-CSAnnouncement New-CSBlockedDomain CSNetworkRegionLi
CsGroupExpansion
Get- nk
Remove-
Test-
CSArchivingConfigurati CSBlockedDomain Remove-
on CSNetworkRegionLi CsAddressBookServic
Set-CSCallParkOrbit e
Get-CSArchivingPolicy nk
New-CSCallParkOrbit
Get- Set-CSNetworkSite Test-
Remove- CsAddressBookWebQ
CSAVEdgeConfiguratio CSCallParkOrbit New-CSNetworkSite
uery
n Remove-
Set-CSCdrConfiguration Test-CsAVConference
Get- CSNetworkSite
New- Test-CsClientAuth
CSBandwidthPolicyServ Set-
CSCdrConfiguration Test-
iceConfiguration

11


Get-CSBlockedDomain Remove- CSNetworkSubnet CsDialInConferencing
Get-CSCallParkOrbit CSCdrConfiguration New- Test-CsGroupIM
Get- Set-CSClientPolicy CSNetworkSubnet Test-CsIM
CSCdrConfiguration New-CSClientPolicy
Remove- Test-CsPresence
Get-CSClientPolicy Remove-CSClientPolicy CSNetworkSubnet Test-CsRegistration
Get- Set- Set-
Test-CsP2PAV
CSClientVersionConfigu CSClientVersionConfigu CSOutboundTransla
Test-
ration ration tionRule
CsPhoneBootstrap
Get- New- New-
Test-
CSClientVersionPolicy CSClientVersionConfigu CSOutboundTransla
CsPstnOutboundCall
ration tionRule
Get-
Test-
CSConferenceDirectory Remove- Remove-
CsPstnPeerToPeerCal
Get- CSClientVersionConfigu CSOutboundTransla
l
tionRule
CSConferenceDisclaim ration
Test-CsVoiceUser
er New- Set-CSPstnUsage
Test-CsDialPlan
Get- CSConferenceDirectory Set-CSPinPolicy
Clear-
CSConferencingConfigu Remove- New-CSPinPolicy
CsDeviceUpdateFile
ration CSConferenceDirectory Remove-
Clear-
Get- Move- CSPinPolicy
CsDeviceUpdateLog
CSConferencingPolicy CSConferenceDirectory Set-
Get- Set- CSPrivacyConfigura Get-CsAdContact
CSCpsConfiguration CSConferenceDisclaim tion Get-CsAdminRole
Get- er New- Get-
CSDeviceUpdateConfig Remove- CSPrivacyConfigura CsAdminRoleAssignm
uration CSConferenceDisclaim tion ent
Get- er Remove- Get-CsAdUser
CSDeviceUpdateRule Set- CSPrivacyConfigura Get-CsAnalogDevice
Get- CSConferencingConfigu tion Get-
CSDiagnosticFilterConfi ration Set- CsAudioTestServiceA
guration New- CSProxyConfigurati pplicationContact
Get- CSConferencingConfigu on Get-
CSDiagnosticHeaderCo ration New- CsClientCertificate
nfiguration Remove- CSProxyConfigurati Get-CsClientPinInfo
Get- CSConferencingConfigu on
Get-
CSDialInConferencingA ration Remove- CsClientVersionPolicy
ccessNumber Set- CSProxyConfigurati Rule
Get- CSConferencingPolicy on
Get-
CSDialInConferencingC New- Set- CsCommonAreaPhon
onfiguration CSConferencingPolicy CSPublicProvider e
Get- Remove- New- New-
CSDialInConferencingD CSConferencingPolicy CSPublicProvider CsCommonAreaPhon

12


tmfConfiguration Set- Remove- e
Get- CSCpsConfiguration CSPublicProvider Remove-
CSDialInConferencingL New- Set- CsCommonAreaPhon
anguageList CSCpsConfiguration CSQoEConfiguratio e
Get-CSDialPlan Remove- n Set-
Get- CSCpsConfiguration New- CsCommonAreaPhon
CSEnhancedEmergenc Set- CSQoEConfiguratio e
yServiceDisclaimer CSDeviceUpdateConfig n Get-
Get- uration Remove- CsRgsHoursOfBusine
CSExternalAccessPolic New- CSQoEConfiguratio ss
y CSDeviceUpdateConfig n Get-
Get- uration Set- CsTrustedApplication
CSTrustedApplication Remove- CSRegistrarConfigu Computer
CSDeviceUpdateConfig ration Get-
Get-
CSTrustedApplicationE uration New- CsTrustedApplication
ndpoint Remove- CSRegistrarConfigu Pool
CSDeviceUpdateRule ration Get-CsUser
Get-CSExUmContact
Set- Remove- Get-CsUserAcp
Get-
CSRegistrarConfigu
CSFileTransferFilterCon CSDiagnosticFilterConfi Get-
guration ration
figuration CsUserDatabaseState
New- Set-
Get- Get-CsUserPoolInfo
CSRgsAgentGroup
CSHealthMonitoringCon CSDiagnosticFilterConfi Import-
figuration guration New-
CSAnnouncementFile
Remove- CSRgsAgentGroup
Get- Import-
CSHostedVoicemailPoli CSDiagnosticFilterConfi Remove-
CsConfiguration
cy guration CSRgsAgentGroup
Import-
Get-CSHostingProvider Set- Set-
CsDeviceUpdate
CSDiagnosticHeaderCo CSRgsHoursOfBusi
Get- Import-
nfiguration ness
CSImFilterConfiguration CSRgsAudioFile
New- Remove-
Get-CSLisCivicAddress Export-
Debug- CsConfiguration
nfiguration ness
CSLisConfiguration Invoke-
Remove- New-
Get-CSLisLocation CsManagementStore
Get-CSLisPort Replication
nfiguration ness
Get- Move-
Set- Set-
CSLisServiceProvider CSDialInConferencingA CSRgsConfiguration CsApplicationEndpoint
Get-CSLisSubnet ccessNumber New-CsAnalogDevice
Move-
Get-CSLisSwitch New- CSRgsConfiguration New-
CSDialInConferencingA CsClientPolicyEntry
Get- Set-
CSLisWirelessAccessP ccessNumber CSRgsHolidaySet New-

13


oint Remove- New- CsClientVersionPolicy
Get-CSLocationPolicy CSDialInConferencingA CSRgsHolidaySet New-
ccessNumber Remove- CsClientVersionPolicy
Get-
CSManagementConnec Set- CSRgsHolidaySet Rule
tion CSDialInConferencingC Set-CSRgsQueue New-
onfiguration CsDiagnosticsFilter
Get- New-CSRgsQueue
CSManagementStoreR New- Remove- New-CsIssuedCertId
eplicationStatus CSDialInConferencingC
CSRgsQueue New-
onfiguration
Get- Set-CSRgsWorkflow CsNetworkBWAlternat
CSMediaConfiguration Remove- ePath
New-
CSDialInConferencingC
Get- CSRgsWorkflow New-
onfiguration
CSMeetingConfiguratio CsNetworkBWPolicy
Remove-
n Set-
CSRgsWorkflow New-
CSDialInConferencingD
Get- CsNetworkMediaBypa
tmfConfiguration Set-
CSNetworkBandwidthP ssConfiguration
CSRoutingConfigur
olicyProfile New-
ation New-CSRgsAnswer
Get- New-CSRgsCallAction
tmfConfiguration New-
CSNetworkInterRegion
CSRoutingConfigur New-CSRgsHoliday
Route Remove-
ation New-CSRgsQuestion
Get-
tmfConfiguration Remove- New-
CSNetworkInterSitePoli
CSRoutingConfigur CSRgsTimeRange
cy Set-CSDialPlan
ation
New-CSDialPlan New-
Get-CSNetworkRegion
Set- CSRgsWorkflowProm
Get- Remove-CSDialPlan
CSServerApplicatio pt
CSNetworkRegionLink Set- n
New-CsSimpleUrl
Get-CSNetworkSite CSEnhancedEmergenc
New-
yServiceDisclaimer New-
Get-CSNetworkSubnet CSServerApplicatio
CsSimpleUrlEntry
Remove- n
Get-
CSEnhancedEmergenc New-
CSNetworkConfiguratio Remove-
yServiceDisclaimer CsSipProxyCustom
n CSServerApplicatio
Set- New-
Get- n
CSExternalAccessPolic CsSipProxyRealm
CSOutboundTranslation Set-
y New-CsSipProxyTCP
Rule CSSimpleUrlConfig
New- uration New-CsSipProxyTLS
Get-CSPstnUsage
CSExternalAccessPolic New-
Get-CSPinPolicy New-
y CsSipProxyTransport
CSSimpleUrlConfig
Get- Remove- uration New-
CSPrivacyConfiguration CSExternalAccessPolic
Remove- CsSipProxyUseDefaul
Get- y
CSSimpleUrlConfig t
CSProxyConfiguration Set- uration New-
Get-CSPublicProvider CSTrustedApplication
Set-CSSipDomain CsSipProxyUseDefaul

14


Get- New- New-CSSipDomain tCert
CSQoEConfiguration CSTrustedApplication Remove- New-CsStaticRoute
Get- Remove- CSSipDomain New-
CSRegistrarConfigurati CSTrustedApplication Set- CsTrustedApplication
on Set- CSStaticRoutingCo Computer
Get-CSRgsAgentGroup CSTrustedApplicationE nfiguration New-
Get- ndpoint New- CsTrustedApplication
CSRgsBusinessHours New- CSStaticRoutingCo Pool
Get- CSTrustedApplicationE nfiguration New-CsVoiceRegex
CSRgsConfiguration ndpoint Remove- New-
Get-CSRgsHolidaySet Remove- CSStaticRoutingCo CsWebTrustedCACert
CSTrustedApplicationE nfiguration ificate
Get-CSRgsQueue
ndpoint Set-CSTestDevice
Get-CSRgsWorkflow Remove-
Set-CSExUmContact New-CSTestDevice CsAnalogDevice
Get-
New-CSExUmContact Remove- ReMove-
CSRoutingConfiguration
Remove- CSTestDevice CsClientVersionPolicy
Get-
CSExUmContact Set- ReMove-
CSServerApplication
Set- CSTrunkConfigurati CsClientVersionPolicy
Get-
CSFileTransferFilterCon on Rule
CSSimpleUrlConfigurati
figuration New- ReMove-
on
New- CSTrunkConfigurati CsNetworkConfigurati
Get-CSSipDomain
CSFileTransferFilterCon on on
Get- figuration Remove- ReMove-
CSStaticRoutingConfigu
Remove- CSTrunkConfigurati CsTrustedApplication
ration
CSFileTransferFilterCon on Computer
Get-CSTestDevice figuration Set- ReMove-
Get- Set- CSUcPhoneConfigu CsTrustedApplication
CSTrunkConfiguration CSHealthMonitoringCon ration Pool
Get- figuration New- Set-CsAnalogDevice
CSUcPhoneConfigurati New- CSUcPhoneConfigu Set-
on CSHealthMonitoringCon ration CsApplicationServer
Get- figuration Remove- Set-
CSUserReplicatorConfi Remove- CSUcPhoneConfigu CsAudioTestServiceA
guration CSHealthMonitoringCon ration pplicationContact
Get- figuration Set- Set-
CSUserServicesConfigu Set- CSUserReplicatorC CsCallParkServiceMu
ration CSHostedVoicemailPoli onfiguration sicOnHoldFile
Get- cy New- Set-
CSUnassignedNumber New- CSUserReplicatorC CsClientVersionPolicy
Get- CSHostedVoicemailPoli onfiguration
Set-
CSVoiceConfiguration cy Remove- CsClientVersionPolicy

15


Get- Remove- CSUserReplicatorC Rule
CSVoicemailReroutingC CSHostedVoicemailPoli onfiguration Set-
onfiguration cy Set- CsConferenceServer
Get- Set-CSHostingProvider CSUserServicesCo Set-CsDirector
CSVoiceNormalizationR New- nfiguration
Set-CsEdgeServer
ule CSHostingProvider New-
Set-
Get-CSVoicePolicy Remove- CSUserServicesCo
CsManagementServer
Get-CSVoiceRoute CSHostingProvider nfiguration
Set-
Get- Set- Remove-
CsMediationServer
CSVoiceTestConfigurati CSImFilterConfiguration CSUserServicesCo
Set-
on nfiguration
New- CsMonitoringServer
Get- CSImFilterConfiguration Set-
Set-
CSWebServiceConfigur CsUnassignedNum
Remove- CsNetworkConfigurati
ation ber
CSImFilterConfiguration on
Get-CSComputer New-
Set-CSLisLocation Set-CsPstnGateway
CsUnassignedNum
Get-CSPool Remove-CSLisLocation ber Set-CsRegistrar
Get-CSService Set-CSLisPort Remove- Set-CsSite
Get-CSSite Remove-CSLisPort CsUnassignedNum Set-
Get-CSTopology Set- ber CsTrustedApplication
Get-CsNetworkInterface CSLisServiceProvider Set- Pool
Set- Remove- CSVoiceConfigurati Set-
CSAccessEdgeConfigur CSLisServiceProvider on CsUserDatabaseState
ation Set-CSLisSubnet Remove- Set-CsUserServer
Set- Remove-CSLisSubnet CSVoiceConfigurati Set-CsWebServer
CSAddressBookConfigu on
Set-CSLisSwitch Update-
ration Set-
Remove-CSLisSwitch CsAddressBook
New- CSVoicemailRerouti
Update-
CSAddressBookConfigu Set- ngConfiguration
CSLisWirelessAccessP CsUserDatabase
ration New-
oint
Remove- CSVoicemailRerouti
CSAddressBookConfigu Remove- ngConfiguration
CSLisWirelessAccessP
ration Remove-
oint
Set-CSAllowAllDomains CSVoicemailRerouti
Set-CSLocationPolicy ngConfiguration
Set-CSAllowedDomain
New-CSLocationPolicy Set-
New-CSAllowedDomain
Remove- CSVoiceNormalizati
Remove-
CSLocationPolicy onRule
CSAllowedDomain
Set- New-
Set-CSAnnouncement
CSManagementConnec CSVoiceNormalizati
tion onRule
Remove- Remove-

16


CSManagementConnec CSVoiceNormalizati
tion onRule
Set- Set-CSVoicePolicy
CSMediaConfiguration New-CSVoicePolicy
New- Remove-
CSMediaConfiguration CSVoicePolicy
Remove- Set-CSVoiceRoute
CSMediaConfiguration
New-CSVoiceRoute
Set-
Remove-
CSMeetingConfiguratio
CSVoiceRoute
n
Set-
New-
CSVoiceTestConfigu
ration
n
New-
Remove-
CSVoiceTestConfigu
ration
n
Remove-
Set-
CSVoiceTestConfigu
CSNetworkBandwidthP
ration
olicyProfile
Set-
New-
CSWebServiceConfi
CSNetworkBandwidthP
guration
olicyProfile
New-
Remove-
CSWebServiceConfi
CSNetworkBandwidthP
guration
olicyProfile
Remove-
Set-
CSWebServiceConfi
guration
Route
Approve-
New-
CSDeviceUpdateRu
le
Route
Reset-
CSDeviceUpdateRu
le
Restore-
CSDeviceUpdateRu
le
Enable-
CSHostingProvider
Disable-
CSHostingProvider

17


Test-
CSLisCivicAddress
Test-
CSLisConfiguration
Export-
CSLisConfiguration

CsViewOnlyAdministrator
The CsViewOnlyAdministrator role is permitted to run the cmdlets listed in the following table.

Get- Get- Get- Get-CSVoiceRoute
CSAccessEdgeConfigu CSExternalAccessPoli CSOutboundTranslat Get-
ration cy ionRule CSVoiceTestConfigurat
Get- Get- Get-CSPstnUsage ion
CSAddressBookConfig CSTrustedApplication Get-CSPinPolicy Get-
uration Get- CSWebServiceConfigu
Get-
Get- CSTrustedApplication CSPrivacyConfigurat ration
CSAllowAllDomains Endpoint ion Get-CSComputer
Get-CSAllowedDomain Get-CSExUmContact Get- Get-CSPool
Get-CSAnnouncement Get- CSProxyConfiguratio Get-CSSite
Get- CSFileTransferFilterCo n
Get-CSService
CSArchivingConfigurati nfiguration Get-
Test-
on Get- CSPublicProvider
CSNetworkInterface
Get-CSArchivingPolicy CSHealthMonitoringCo Get-
Test-
nfiguration CSQoEConfiguration
Get- CSSetupPermission
CSAVEdgeConfiguratio Get- Get-
n CSHostedVoicemailPo CSRegistrarConfigur Get-CSTopology
licy Get-CSAnalogDevice
Get- ation
Get- Get-
CSBandwidthPolicySer Get-
CSHostingProvider CSCommonAreaPhon
viceConfiguration CSRgsAgentGroup
e
Get-CSBlockedDomain Get- Get-
CSImFilterConfiguratio CSRgsBusinessHour Get-CSCertificate
Get-CSCallParkOrbit
n s Get-
Get-
Get- CSWindowsService
CSCdrConfiguration Get-
CSLisCivicAddress CSRgsConfiguration Get-CSAdUser
Get-CSClientPolicy
Debug- Get- Get-CSUser
Get- CSLisConfiguration CSRgsHolidaySet Get-CSClientPinInfo
CSClientVersionConfig
Get-CSLisLocation Get-CSRgsQueue Get-
uration
Get-CSLisPort Get-CSRgsWorkflow CSVoiceConfiguration
Get-
CSClientVersionPolicy Get- Get- Get-CsPresencePolicy

18


Get- CSLisServiceProvider CSRgsHoursOfBusin Get-CsAdContact
CSConferenceDirectory Get-CSLisSubnet ess Get-
Get- Get-CSLisSwitch Get- CsAudioTestServiceAp
CSConferenceDisclaim CSRoutingConfigurat plicationContact
Get-
er ion Get-CsClientCertificate
CSLisWirelessAccess
Get- Point Get- Get-
CSConferencingConfig CSServerApplication CsClientVersionPolicy
Get-CSLocationPolicy
uration Get- Rule
Get-
Get- CSSimpleUrlConfigu Get-
CSManagementConne
CSConferencingPolicy ration CsTrustedApplicationC
ction
Get- Get-CSSipDomain omputer
Get-
CSCpsConfiguration Get- Get-
CSManagementStore
Get- ReplicationStatus CSStaticRoutingConf CsTrustedApplicationP
CSDeviceUpdateConfig iguration ool
Get-
uration Get-CSTestDevice Get-CsUserAcp
CSMediaConfiguration
Get- Get- Get-
Get-
CSDeviceUpdateRule CSTrunkConfiguratio CsUserDatabaseState
CSMeetingConfigurati
Get- on n Get-CsUserPoolInfo
CSDiagnosticFilterConfi Get-
Get-
guration CSUcPhoneConfigur
CSNetworkBandwidth
Get- PolicyProfile ation
CSDiagnosticHeaderCo Get-
Get-
nfiguration CSUserReplicatorCo
CSNetworkRInteregion
Get- Route nfiguration
CSDialInConferencingA Get-
Get-
ccessNumber CSUserServicesConf
CSNetworkInterSitePol
Get- icy iguration
CSDialInConferencingC Get-
Get-CSNetworkRegion
onfiguration CSUnassignedNumb
Get-
Get- er
CSNetworkRegionLink
CSDialInConferencingD Get-
Get-CSNetworkSite
tmfConfiguration CSVoicemailReroutin
Get-CSNetworkSubnet
Get- gConfiguration
CSDialInConferencingL Get-
anguageList CSVoiceNormalizatio
Get-CSDialPlan nRule
Get-CSVoicePolicy

CsHelpDesk
The CsHelpDesk role is permitted to run the cmdlets listed in the following table.

19


Get- Get-CSExUmContact Get- Get-CsAdUser
CSAccessEdgeConfigur Get- CSQoEConfiguratio Get-CsUser
ation CSFileTransferFilterC n
Get-CSClientPinInfo
Get- onfiguration Get-
Lock-CSClientPin
CSAddressBookConfigu Get- CSRegistrarConfigur
Unlock-CSClientPin
ration CSHealthMonitoringC ation
Set-CSClientPin
Get-CSAllowAllDomains onfiguration Get-
CSRgsAgentGroup Get-
Get-CSAllowedDomain Get-
CSClientVersionPolicy
Get-CSAnnouncement CSHostedVoicemailPo Get-
Rule
licy CSRgsBusinessHou
Get-
rs Get-
CSArchivingConfiguratio Get-
CSWindowsService
n CSHostingProvider Get-
CSRgsConfiguration Get-
Get-CSArchivingPolicy Get-
CsNetworkInterface
CSImFilterConfiguratio Get-
Get-
n CSRgsHolidaySet Get-CsPresencePolicy
CSAVEdgeConfiguration
Get- Get-CSRgsQueue Test-
Get-
CSBandwidthPolicyServi
CSLisCivicAddress Get-CSRgsWorkflow CsFederatedPartner
Get- Test-
ceConfiguration Get-
Get-CSBlockedDomain
CSLisConfiguration CSRoutingConfigura CsGroupExpansion
Get-CSLisLocation tion Test-
Get-CSCallParkOrbit
CsAddressBookServic
Get-CSLisPort Get-
Get-CSCdrConfiguration
Get- CSServerApplication e
Get-CSClientPolicy Test-
CSLisServiceProvider Get-
Get-
Get-CSLisSubnet CSSimpleUrlConfigu CsAddressBookWebQ
CSClientVersionConfigu uery
ration
ration Get-CSLisSwitch
Test-CsAVConference
Get-CSSipDomain
Get- Get-
Test-CsClientAuth
CSLisWirelessAccess Get-
CSClientVersionPolicy
CSStaticRoutingCon Test-
Point
Get- CsDialInConferencing
figuration
CSConferenceDirectory Get-CSLocationPolicy
Get-CSTestDevice Test-CsGroupIM
Get- Get-
Get- Test-CsIM
CSConferenceDisclaime CSManagementConn
ection CSTrunkConfiguratio Test-CsPresence
r
n Test-CsRegistration
Get- Get-
CSConferencingConfigu CSManagementStore Get- Test-
ReplicationStatus CSUcPhoneConfigur CsPhoneBootstrap
ration
ation
Get- Get- Test-CsP2PAV
CSMediaConfiguration Get-
CSConferencingPolicy Test-
CSUserReplicatorCo
Get- Get- CsPstnOutboundCall
nfiguration
CSCpsConfiguration CSMeetingConfigurati Test-
on Get-
Get- CsPstnPeerToPeerCall
CSUserServicesCon
Get-

20


CSDeviceUpdateConfig CSNetworkBandwidth figuration Test-CsVoiceUser
uration PolicyProfile Get- Get-CsAdContact
Get- Get- CSUnassignedNum Get-
CSDeviceUpdateRule CSNetworkInterRegio ber CsRgsHoursOfBusine
Get- nRoute Get- ss
CSDiagnosticFilterConfi Get- CSVoiceConfiguratio Get-CsUserAcp
guration CSNetworkInterSitePo n
Get-CsUserPoolInfo
Get- licy Get-
Get-
CSDiagnosticHeaderCo Get- CSVoicemailRerouti
CsAudioTestServiceAp
nfiguration CSNetworkRegion ngConfiguration
plicationContact
Get- Get- Get-
CSDialInConferencingA CSNetworkRegionLink CSVoiceNormalizati
ccessNumber Get-CSNetworkSite onRule
Get- Get- Get-CSVoicePolicy
CSDialInConferencingC CSNetworkSubnet Get-CSVoiceRoute
onfiguration
Get- Get-
Get- CSNetworkConfigurati CSVoiceTestConfigu
CSDialInConferencingDt on ration
mfConfiguration
Get- Get-
Get- CSOutboundTranslati CSWebServiceConfi
CSDialInConferencingLa onRule guration
nguageList
Get-CSPstnUsage Get-CSComputer
Get-CSDialPlan
Get-CSPinPolicy Get-CSPool
Get-
Get- Get-CSService
CSEnhancedEmergency
CSPrivacyConfiguratio Get-CSSite
ServiceDisclaimer
n
Get-CSTopology
Get-
Get-
CSExternalAccessPolicy Get-
CSProxyConfiguration
CSAnalogDevice
Get-
Get-CSPublicProvider
CSTrustedApplication Get-
CSCommonAreaPh
Get-
one
CSTrustedApplicationEn
dpoint

CsArchivingAdministrator
The CsArchivingAdministrator role is permitted to run the cmdlets listed in the following table.

New-CsArchivingPolicy Export-CsArchivingData
Get-CsArchivingPolicy Get-CsSite
Set-CsArchivingPolicy Get-CsService

21


Remove-CsArchivingPolicy Get-CsPool
Grant-CsArchivingPolicy Get-CsComputer
New-CsArchivingConfiguration Get-CsNetworkInterface
Get-CsArchivingConfiguration Get-CsManagementStoreReplicationStatus
Set-CsArchivingConfiguration Get-CSWindowsService
Remove-CsArchivingConfiguration Get-CsUserPoolInfo
Get-CsUser Set-CsArchivingServer

CsResponseGroupAdministrator
The CsResponseGroupAdministrator role is permitted to run the cmdlets listed in the following
table.

Get-CSRgsAgentGroup New-CSRgsWorkflowPrompt
Get-CSRgsHoursofBusiness Remove-CSRgsAgentGroup
Get-CSRgsConfiguration Remove-CSRgsHoursofBusiness
Get-CSRgsHolidaySet Remove-CSRgsHolidaySet
Get-CSRgsQueue Remove-CSRgsQueue
Get-CSRgsWorkflow Remove-CSRgsWorkflow
Get-CSService Set-CSRgsAgentGroup
Get-CSUser Set- CSRgsHoursofBusiness
Import-CSRgsAudioFile Set-CSRgsConfiguration
Move-CSRgsConfiguration Set-CSRgsHolidaySet
New-CSRgsAgentGroup Set-CSRgsQueue
New-CSRgsAnswer Set-CSRgsWorkflow
New-CSRgsHoursofBusiness Get-CsSite
New-CSRgsCallAction Get-CsPool
New-CSRgsHoliday Get-CsComputer
New-CSRgsHolidaySet Get-CSWindowsService
New-CSRgsQuestion Get-CsNetworkInterface
New-CSRgsQueue Get-CsManagementStoreReplicationStatus
New-CSRgsTimeRange Get-CsUserPoolInfo
New-CSRgsWorkflow

CsLocationAdministrator
The CsLocationAdministrator role is permitted to run the cmdlets listed in the following table.

Get-CSNetworkSite Set-CSLisLocation Get-CsPool

22


Get-CSNetworkSubnet Get-CSLisPort Get-CSUser
New-CSNetworkSite Remove-CSLisPort Get-CsComputer
New- Set-CSLisPort Get-CSWindowsService
CSNetworkSubnet Get-CSLisSubnet Get-CsNetworkInterface
Remove- Remove-CSLisSubnet Get-
CSNetworkSite CsManagementStoreReplicationStatus
Set-CSLisSubnet
Remove- Get-CsUserPoolInfo
Get-CSLisSwitch
CSNetworkSubnet
Remove-CSLisSwitch Get-CSLocationPolicy
Set-CSNetworkSite
Set-CSLisSwitch Grant-CSLocationPolicy
Set-CSNetworkSubnet
Get- Export-CsLisConfiguration
Get-
CSLisWirelessAccessPoint Get-CsLisServiceProvider
CSLisCivicAddress
Remove- Get-CsWebServiceConfiguration
Test-
CSLisWirelessAccessPoint Import-CsLisConfiguration
CSLisCivicAddress
Set- Test-CsLisConfiguration
Debug-
CSLisWirelessAccessPoint
CSLisConfiguration Test-CsLocationPolicy
Get-CsSite
Publish-
Get-CsService
CSLisConfiguration
Unpublish-
CSLisConfiguration
Get-CSLisLocation
Remove-
CSLisLocation

DNS Load Balancing
Microsoft Lync Server 2010 communications software introduces DNS load balancing, a software
solution that can greatly reduce the administration overhead for load balancing on your network.
DNS load balancing balances the network traffic that is unique to Lync Server 2010, such as SIP
traffic and media traffic. If you deploy DNS load balancing, you can eliminate the need for some
hardware load balancers, and greatly reduce the administration overhead related to some of the
hardware load balancers you still need to deploy.
DNS load balancing is supported for Front End pools, Edge Server pools, Director pools, and
stand-alone Mediation Server pools.

DNS Load Balancing on Front End Pools and Director Pools
You can use DNS load balancing for the SIP traffic on Front End pools and Director pools. With
DNS load balancing deployed, you still need to also use hardware load balancers for these pools,
but only for HTTPS traffic. The hardware load balancer is used for HTTPS traffic from clients over
ports 443 and 80.

23

Although you still need hardware load balancers for these pools, their setup and administration
will be primarily for HTTP traffic, which the administrators of hardware load balancers are
accustomed to.

DNS Load Balancing and Computers Running Earlier Versions
DNS load balancing is supported only by servers running Lync Server 2010 and Lync Server
2010 clients. Earlier versions of clients and Office Communications Server can still connect to
Front End pools and Director pools running DNS load balancing, but if they cannot make a
connection to the first server that DNS load balancing refers them to, they are unable to fail over
to another server in the pool. If you have only a few clients or servers running earlier versions, or
will soon be migrating these computers to Lync Server 2010, this may be tolerable. Alternatively,
you may achieve load balancing of connections from older clients and server by implementing
DNS round robin on the DNS Server. In this case, the DNS Server will reply back with a different
order of Front End IPs every time a DNS query reaches it, and this in turn will ensure that
connections from computers running earlier versions are load balanced.

Additionally, if you are using Exchange UM, only Exchange 2010 SP1 interoperates with Lync
Server 2010 DNS load balancing. If you use an earlier version of Exchange, you will not have
failover capabilities for users using Exchange UM capabilities, such as playing their Enterprise
Voice voicemail through their mailbox.
The following table summarizes the considerations for deciding whether to deploy DNS Load
balancing on a Front End pool.

DNS Load Balancing Decision Guidelines

DNS load DNS load Hardware load
balancing balancing balancer (only)
Situation supported? recommended? recommended?

All or most users homed in the pool Yes Yes
run Lync Server 2010 clients.

Many users homed in the pool still Yes Yes
running older clients.

Interoperates only with other Lync Yes Yes
Server 2010 servers.

Interoperates with many servers Yes Yes
running earlier versions of Office
Communications Server.

Running Exchange UM with Exchange Yes Yes
2010 SP1 (or not running Exchange
UM)

Running Exchange UM with earlier Yes Yes
versions of Exchange

24

Deploying DNS Load Balancing on Front End Pools and Director Pools
Deploying DNS load balancing on Front End pools and Director pools requires you to perform a
couple of extra steps with FQDNs and DNS records.
• A pool that uses DNS load balancing must have two FQDNs: the regular pool FQDN
that is used by DNS load balancing (such as pool01.contoso.com), and resolves to
the physical IPs of the servers in the pool, and another FQDN for the pool’s Web services
(such as web01.contoso.com), which resolves to virtual IP address of the pool.
In Topology Builder, if you want to deploy DNS load balancing for a pool, to create this extra
FQDN for the pool’s Web services you must select the Override internal Web Services pool
FQDN check box and type the FQDN, in the Specify the Web Services URLs for this Pool
page.
• To support the FQDN used by DNS load balancing, you must provision DNS to
resolve the pool FQDN (such as pool01.contoso.com) to the IP addresses of all the
servers in the pool (for example, 192.168.1.1, 192.168.1.2, and so on).

DNS Load Balancing on Edge Server Pools
You can deploy DNS load balancing on either the external interface of your Edge Servers, the
internal interface, or both. If you do, you must be aware of some considerations.
Using DNS load balancing on the external interface of the Edge Servers causes a loss of failover
ability in the following scenarios:
• Federation with organizations that are running previous versions of Office
Communications Server.
• Instant message exchange with users of public instant messaging (IM) services, such
as the Windows Live network of Internet services, AOL, and Yahoo!, as well as XMPP-
based providers and servers, such as Google Talk and Jabber.
These scenarios will work as long as all Edge Servers in the pool are up and running, but if one
Edge Server is down, any requests for these scenarios that are sent to it will fail, instead of
routing to another Edge Server.
Using DNS load balancing on the internal interface of the Edge Servers causes a loss of failover
ability when external users use Exchange UM features. For example, when one of your users
checks voic email while outside your organization’s firewalls, if their request goes to an Edge
Server that is down, the request will fail instead of going through another Edge Server.

Deploying DNS Load Balancing on Edge Server Pools
To deploy DNS load balancing on the external interface of your Edge Server pool, you need the
following DNS entries:
• For the Lync Server Access Edge service, you need one entry for each server in the
pool. Each entry must resolve the FQDN of the Lync Server Access Edge service (for
example, sipcontoso.com) to the IP address of the Lync Server Access Edge service on
one of the Edge Servers in the pool.

25

Planning for other features lync server 2010 (rc)

Planning for other features lync server 2010 (rc)

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Planning for other features lync server 2010 (rc)

Similar to Planning for other features lync server 2010 (rc) (20)

Recently uploaded

Recently uploaded (20)

Planning for other features lync server 2010 (rc)