January 2015 - Jack Stromberg

As of 11/11/2014, Microsoft has released their next generation tool for providing synchronization between an on-premise Active Directory environment and Microsoft based cloud service (Azure, Office 365 Suite (Lync Online, CRM, SharePoint, Exchange, etc.)). The utility is now referenced as Microsoft Azure Active Directory Sync Services (AADSync).

In this tutorial, we will go over the process to ensure you are on the new generation of their synchronization tool. The process is fairly straight forward, uninstall the old DirSync utility, install the new AADSync utility. If you wish to install the utility on a new server, stop the DirSync service, install the AADSync utility on the new server, and then uinstall DirSync after you have verified synchronization is successful on the new machine.

Here is the uninstall DirSync and install AADSync process

Download a copy of the AADSync utility from Microsoft's website: http://www.microsoft.com/en-us/download/details.aspx?id=44225
Login to the server currently running DirSync
Open up Control Panel
Select Programs and Features (notice I am in the View By Small icons view)
Uninstall the Windows Azure Active Directory Sync tool
Select Yes to uninstall when prompted
Uninstall Forefront Identity Manager Synchronization Service if it wasn't uninstalled already
Run the MicrosoftAzureADConnectionTool.exe application you downloaded from Microsoft
Check I agree to the license terms and click Install
Once the install has finished, open up Computer Management and navigate to System Tools -> Local Users and Groups, Groups, and double click on ADSyncAdmins
Ensure your user account, user group, or local machine has been added to the security group
Log out of Windows
1. Note: This step is needed to ensure you have proper user privileges when running the sync tool. When running through the sync tool's installer, your user account will automatically be placed in a local security group called ADSyncAdmins. A logout is needed to update your session otherwise you may receive the following error message:
  Your account is not a member of the ADSyncAdmins security group. If you have recently installed Azure AD Sync, sign out before running this installation guide again.
Upon login, open up the DirectorySyncTool application
Enter your Azure or Office 365 admin credentials and click Next
Enter in your forest name, username (must be in domain\username format), and password (Active Directory on-premise credentials) and click Add Forest
1. Note: If you are unsure what your forest name is, login to your domain controller and execute the following powershell command to list all forests in your deployment:
  Get-AdForest | FT Name
Click Next once your forest has been validated
Click Next on User Matching
Check the boxes that are applicable to your deployment and click Next
Click Configure
Click Finish

Scenario: A user leaves the organization and you would like to forward their number/calls to a manager.

Solution: Microsoft has a Lync Server 2013 (and 2010) Resource Kit that contains a command-line tool called SEFAUtil (secondary extension feature activation) which can be used to achieve this task. Before beginning, I would recommend taking a look at the official TechNet article/documentation on the utility itself: http://technet.microsoft.com/en-us/library/jj945604.aspx In this tutorial, we will download the tool and execute the proper commands to configure call forwarding for a specified user.

Download a copy of the Lync Server 2013 Resource Kit from Microsoft's website here: http://go.microsoft.com/fwlink/p/?LinkID=330429
Run the installer from your Front End Server/Pool
Create a trusted application pool
1. Execute the following command
  1. $Site=Get-CsSite -Identity "My Site"
    1. Note: If you don't know what to substitute for My Site, execute the following command to see what sites you have available and then use the Identity value.
      1. Get-CsSite
  2. Execute the following command
    1. New-CsTrustedApplicationPool -id <Pool FQDN> -Registrar <Pool Registrar FQDN> -site $Site.SiteID
      1. Note: Technically we didn't need to run the 1st command, however this can help cut-down on user error. Additionally, if you have multiple sites and you knew what site you wanted to use but not the ID, this helps skip a step.
Define SEFAUtil as a trusted application in the Lync topology
1. Execute the following command
  1. New-CsTrustedApplication -ApplicationId sefautil -TrustedApplicationPoolFqdn <Pool FQDN> -Port 7489
Enable the Lync topology to commit the changes
1. Enable-CsTopology
Forward a user's number
1. Navigate to %ProgramFiles%\Microsoft Lync Server 2013\ResKit
2. Execute the following command
  1. SEFAUtil.exe /Server:<Pool FQDN> [email protected] /enablefwdimmediate /setfwddestination:[email protected]

That should be it!

Note: If you are more comfortable using a GUI or don't wish to type in multiple powershell commands, I would highly recommend checking out Johan Veldhuis's SefaUtil GUI PowerShell script. Once you are done following steps 1-5 above, you you can grab a copy of the script here: http://johanveldhuis.nl/sefautil-gui/sefautil-gui/

Jack Stromberg

A site about stuff

Monthly Archives: January 2015

Upgrading DirSync to AADSync for Office 365 and Azure environments

How to administratively forward Lync calls or numbers