UC Unleashed

During a recent cross-forest migration, some users reported that after their workstation was moved to the new forest and their account was enabled for Lync, they would get the following prompt immediately after logging in:

Lync Response Groups prompt

Notice that it’s prompting for credentials for Response Groups. This environment had no Response Groups. If the user entered correct credentials, the prompt would just reappear right away. Users could click Cancel, and the prompt would go away, but would return about every 2 hours. Also noticed was that these users would never get a Lync Address Book, either.

This was a greenfield Lync deployment in a new forest that users, workstations, and email was migrated to from many other domains. Checking over the Lync environment yielded no real culprits. Issues with permissions on the Lync share can cause the issue, but those were correct as well. Certificates were also fine. Since only a few users reported the problem (< .1% of all Lync users), and all users in the organization were assigned the same policies in Lync, I became convinced it was a client side issue.

The resolution was to open Internet Explorer, go to Settings>Internet Options>Advanced. Scroll all the way to the bottom and remove the check for Enable Integrated Windows Authentication.

IE Integrated Windows Authentication setting

Click Ok, then reboot the machine. Once rebooted, go back and put the check back in the Enable Integrated Windows Authentication box and reboot again.

This resolved the problem for all of the users having this problem. Not only did the prompt stop appearing, but all users who performed the fix also reported successful address book downloads.

It’s important to note that while just disabling Integrated Windows Authentication generally resolves the prompt for credentials, you really should enable it again as described to avoid issues with other applications and services.

While implementing some Response Groups, I noticed that users who went to Tools>Response Group Settings in the Lync client would land at a page that said “You are not a member of any group. For assistance, contact your support team“. The happened for all users of all response groups. It’s critical that users be able to access this page, especially if they are agents of a response group set for a formal participation policy, as this is the page a user goes to to sign into and out of a response group.

I found some info by Drago Totev, who mentioned that some settings in the topology builder file are now case sensitive. The RTM and later versions of Lync require “urn:application:RGS” – notice the case, but some RC versions used lower case. This environment never had RC code in place – migrating from OCS 2007 R2 directly to Lync RTM code. I exported the topology to a .tbxml file anyways, made a copy for backup, and opened it in XML Notepad 2007*, and I searched for and found several instances of “urn:application:Rgs” (see screenshot below). I replaced all four of the instances of the lower case “urn:application:Rgs” with the upper case RGS version.

XML Notepad

Then I re-imported the file into Topology Builder and published it. Once I verified that replication had completed via Get-CsManagementStoreReplicationStatus, I restarted the Response Group service on my front end servers.

After restarting the Lync client, going to Tools>Response Group Settings now takes the user to the correct page showing the response groups that the user is a member of.

Response Groups

Users now also see the notification in the Lync client notifying them they’ve been added to a Response Group:

Response Group notification

* Note: Do not use Notepad to edit the topology XML. Doing so can result in system instability.