Jeff Schertz: Skype for Business Server 2015 Deployment – Part 2

Continuing from a previous post this article moves into the installation and configuration of the Skype for Business Server components for a Standard Edition Front End server.  As with the previous article any mandatory steps are identified by bulleted paragraphs while non-indented steps for validation and educational purposes are optional.

Deployment

The second article in this series will cover the following deployment steps:

• Defining the Topology
• Deploying the Server Components
• Verifying the Installation

Before performing these steps in this article make sure to successfully complete all of the prerequisite actions covered in Part 1 of this series.

Define Topology

Before installing any additional server components the Skype for Business topology must be defined.

Create New Topology

• Launch the Skype for Business Server 2015 Topology Builder and then select New Topology.

• Save a new .tbxml file with any desired name (e.g. 06072015.tbxml).

• For the Primary SIP domain enter the desired domain namespace (e.g. jdskype.net).

Add any additional desired SIP domains at this point , but a single SIP domain is sufficient for most deployments as well as this series of articles.

• Select a Name for the first site to be created in the topology (e.g. Lab) and enter a Description if desired.
• Specify the locality information associated with the first site and then complete the wizard.

At this point the Define New Front End Pool wizard should be automatically launched.

• On the Define Front End Pool FQDN page select Standard Edition Server and then enter the Fully Qualified Domain Name (FQDN) of the Windows domain member server where the SFB prerequisites were installed (e.g. fe.jdskype.net).

• Select the features which should be installed and enabled on this Front End server.  Later articles will cover the deployment of some of these additional features.

• Retain the default enabled setting of Collocate Mediation Server on the Select Collocated Server Roles page.

• On the Associate Server Roles with this Front End Pool page leave the option blank as an Edge Server does not yet exist.  This setting will be addressed when an Edge Server is deployed in a later article.

• As this is a Standard Edition server then there will be no configurable options available on the Define the SQL Store page.  Take note of the automatically defined SQL Server store which is comprised of the server’s FQDN (fe.jdskype.net) followed by the previously installed SQL Express instance name (RTC).

• On the Define a File Store page enter the name of the Windows file share created in the previous section (e.g. SFBShare).

• On the Specify the Web Services URL page the External Base URL will automatically be set to the same FQDN as the internal Front End server (e.g. fe.jdskype.net).  For the purposes of this article the default setting will be retained and in the future when external services are published this will be updated to reflect the external namespace.

• The next page Select an Office Web Apps Server is new to Lync Server 2013 and is used to either define a new OWAS pool FQDN or associate this server with an existing OWAS pool.  As a later article will cover deploying OWAS simply uncheck this option and then click Finish to complete the wizard.  (Note that until this server is deployed that PowerPoint content sharing will be unavailable in Lync conferences as this is no longer performed by the Front End server.)

  Upon completion the Topology Builder window should refresh and the defined settings will be populated as shown.

• Back at the main Topology Builder window select Edit Properties on the Lync Server root-level object.  Highlight the Simple URLs section and enter the desired Administrative Access URL (e.g. https://admin.jdskype.net).  Technically his is an optional step as the administrative access URL is not required, but is a convenient way to access the Server Control Panel via a web browser internally.

• Move down to the Central Management Server section and select the new Front End server (e.g. fe.jdskype.net) as the location to install the CMS component on.

Publish Topology

The final process is to publish the changes made to the topology into the Central Management Server database which also updates information in the RTC services container in Active Directory and sets up the folder structure and permissions on the file share.

• From the Action menu select Publish Topology.  The local server FQDN for the Central Management Store location should already be populated in the drop-down menu due to the previous step.  If all configuration steps were performed correctly then the wizard should complete without any errors or warnings.

Deploy Server

Unlike most other Microsoft server platform products were installation of the actual server components is one of the very first steps, the Communications Server family has historically been different.  The server installation itself is quite hands-off and can be automated to a large degree.  The fair amount of activity up until this point has been geared around providing the backend components to store the overall configuration of the environment, which is now available for use by the server installation steps.

Install Skype for Business Server Components

The next step is to install a second SQL Express named instance called RTCLOCAL on the local server which will contain a replica of the existing RTC named instance.

Only the first Standard Edition server in the organization would contain the authoritative RTC instance installed in the previous article, while all other Front End Servers (and even Edge Servers) would contain their own RTCLOCAL instance to replicate the Central Management Store data.

As the Administrative Tools have already been installed on the server then the Skype for Business Server Deployment Wizard can be found in the Start Menu on the local server.  The installation media is no longer required as the installation files have been copied to the server.

• On the Windows Start Menu search for ‘Deploy’ to locate and launch the Skype for Business Server Deployment Wizard.  From the main menu select Install or Update Skype for Business Server System.

• On Step 1: Install Local Configuration Store select Run and leave the default setting of Retrieve the configuration data directly from the Central Management Store and complete the wizard.

Reviewing the results in the execution window should confirm that the second SQL Express instance of RTCLOCAL was installed as well as the core SFB Server components.

Checking prerequisite SupportedOSNoDC…prerequisite satisfied.
Checking prerequisite DotNet35…prerequisite satisfied.
Checking prerequisite SupportedSqlRtcLocal…prerequisite satisfied.
Checking prerequisite WMIEnabled…prerequisite satisfied.
Checking prerequisite NoOtherVersionInstalled…prerequisite satisfied.
Checking prerequisite PowerShell…prerequisite satisfied.
Checking prerequisite SqlUpgradeInstanceRtcLocal…prerequisite satisfied.
Installing SQLEXPR_x64.exe(/Q /IACCEPTSQLSERVERLICENSETERMS /UPDATEENABLED=0 /HIDECONSOLE /ACTION=Install
/FEATURES=SQLEngine,Tools /INSTANCENAME=RTCLOCAL /TCPENABLED=1 /SQL…

Secondly the Local CMS replica was instantiated by importing the configuration from the existing CMS database an then replicating the database data itself.

Import-CSConfiguration -FileName "C:\Users\ADMINI~1.JDS\AppData\Local\Temp\2\CSConfigData-2015_06_08-13_19_39.zip" -Verbose -LocalStore

> Enable local replica service

Enable-CSReplica -Verbose -Confirm:$false -Report "C:\Users\administrator.JDSKYPE\AppData\Local\Temp\2\Enable-CSReplica-[2015_06_08][13_17_14].html"

Additionally the replication of any certificates stored in the CMS is performed.  Although no certificates have been installed yet for this deployment had there been one then this action would have replicated any existing OAuthcertificates required for server to server MTLS communications.

> Replicate-CsCmsCertificates

Logging status to: C:\Users\administrator.JDSKYPE\AppData\Local\Temp\2\ReplicateCMSCertificates-[2015_06_08][13_17_14].html

To confirm the installation location of the RTCLOCAL database files on the server check the default SQL Server installation directory for the existence of the xds files.

%ProgramFiles%\Microsoft SQL Server\MSSQL12.RTCLOCAL\MSSQL\DATA

• On the Skype for Business Server Deployment Wizard advance to Step 2: Setup or Remove Skype for Business Server Components and click Run to start the Set Up Lync server Components wizard.

Once again the Bootstrapper application will execute and perform a prerequisite check before installing additional components.  These include a third SQL instance called LyncLocal and additional Windows Speech components and foreign language packs.

Checking prerequisite KB2858668Installed…prerequisite satisfied.
Installing vcredist_11_x64.exe(/Q)…success
Installing WindowsFabric\v3\WindowsFabric.msi( REBOOT=ReallySuppress STARTUPTYPE=demand REMOVEDATA=yes IACCEPTEULA=yes TESTMODESKIPPREREQUISITECHECK=yes)…success
Installing MicrosoftIdentityExtensions.msi( REBOOT=ReallySuppress ALLUSERS=1)…success
Checking prerequisite SqlUpgradeInstanceLyncLocal…prerequisite satisfied.
Installing SQLEXPR_x64.exe(/Q /IACCEPTSQLSERVERLICENSETERMS /UPDATEENABLED=0 /HIDECONSOLE /ACTION=Install
/FEATURES=SQLEngine,Tools /INSTANCENAME=LYNCLOCAL /TCPENABLED=1 /SQL…

Immediately following will be the installation of the Lync server components which make up the different services and roles on the Front End server (e.g. AVMCU, Mediation Server).

Verify that the installation task status was reported as successfully completed.

Create Default Server Certificate

Returning to the server deployment process the next step is to request and assign server certificates so that the Lync services can be started.

• Run Step 3: Request, Install or Assign Certificates and then expand the Default Certificate entry to verify that all roles are checked.  Click Request to start the Certificate Request wizard.

• Populate the desired information making sure to select the SIP domain to add the sip.<sipdomain> record to the certificate.

The Friendly Name can be set to anything and is not actually part of the certificate request, it can even be changed after the certificate is returned and imported.  Note that although Lyncdiscover.<sipdomain> was not defined as an internal DNS record in the previous article the certificate wizard still includes this FQDN as a requirement for external support.

• Submit the request to the online certificate authority and when the task completes successfully select the View Certificate Details button to validate the certificate status and that a private key was correctly associated.

• Advance to the next wizard to perform the Certificate Assignment task.  In the event that the role assignment is accidentally lost between the request and assignment wizards then the assignment task might fail with an error that a Type has not been provided.  If that occurs simply cancel out of the wizard and return to the main wizard screen.  On the Certificate Wizard main screen If the checkboxes to the left of the Server Default, Web Service Internal, and Web Service External roles are no longer selected then reselect them and click Assign.
• Verify that the proper certificate is highlighted (in the event that this server already has any other server certificates installed on it) and then complete the wizard, verifying that the task status is reported as Completed.

• Back at the Certificate Wizard main screen the new certificate should now be listed on each of the three Default Certificate roles.

Create OAuth Certificate

As this is the first SfB server deployed into the environment then a new OAuth certificate needs to be created as well.  This is a one-time process as this certificate will be shared by any other SfB server which may be later installed.

• On the Certificate Wizard main screen select the OAuthTokenIssuer role and then click Request.

• Enter a descriptive Friendly Name and then submit the certificate request.

• Advance through the assignment wizard to finish the OAuth certificate configuration in the same fashion as performed for the server certificate.

Start Services

In previous releases the services could be started directly from the deployment wizard as part of Step 4: Start Services.  With the addition of a new PowerShell cmdlet in SFB this task is now a manual one.  While SfB Server now includes a new cmdlet called Start-CsPool this is only intended for use with multiple node Enterprise Edition pools.  When dealing with a single server in a pool or a Standard Edition server as in this article then the previous guidance of using the CsWindowsService cmdlets still holds true.

• Launch the Skype for Business Server Management Shell and execute the following Start-CsWindowsService cmdlet.

Start-CsWindowsService

To validate the server status the Get-CsWindowsService cmdlet can be issued to list the individual SfB services.

Get-CsWindowsService

Verify Topology

Utilizing the Skype for Business Server 2015 Control Panel the basic functionality of the new deployment can begun to be tested.

Before opening the Skype for Business Server 2015 Control Panel, just as with previous Lync Server releases, it is helpful to configure the local server’s Internet Options to bypass the the prompt for credentials whenever the tool is launched.

• Open Internet Options, navigate to the Security tab, select Local Internet and click Sites, then click Advanced.

• Enter the local server’s FQDN as a URL (e.g. https://fe.jdskype.net) and then save the changes.

• If Silverlight is not already installed on the server than the Control Panel will report this fact.

• Use the provided link to immediately download and install Silverlight on the local server.

• Once the installation is complete the Home page of the control panel will be displayed.  Select the Topology menu and verify that the new server is listed and the Status and Replication fields are healthy.

Summary

With the conclusion of this article a functional Skype for Business Server should now be deployed and is ready for further configuration.  The next article in the series will cover enabling user accounts for clients and devices to leverage.