By default an installation of Lync Server does not contain any pre-installed or pre-approved updates, this must be performed manually by an administrator.  This is basically the same process as was used in Office Communications Server except that now there are multiple update packages, which on the surface appear to be identical.  Previously the only supported devices that used the Office Communicator Phone Edition client were the Microsoft reference-design “Tanjay” family of devices: the Polycom CX700 and LG-Nortel IP8540.  Both phones were identical and used the exact same software so a single installation package was distributed and updated on a regular basis.

Lync Server 2010 now has multiple versions of the update package, as they are both different clients (with different interfaces and features) as well as different device designs between vendors.  The Lync Phone Edition client now has two different interfaces. First, the original touchscreen-based client which started in OCS on the CX700 and was updated for Lync.  This client looks nearly identical to the previous version but has a few tweaks (most prominently a Lync Server branded background). Secondly there is a brand new Lync Phone Edition client which only runs on the new Aries family devices: the Polycom CX500, CX600, CX3000 and Aastra 6721ip, 6725ip. Although the client features are identical between the Aries devices the firmware is unique between the different manufacturer’s devices in order to support differing hardware components and physical features. So there are now three separate packages which can be downloaded: one for the original Tanjay devices, a second for Polycom’s Aries devices, and a third for Aastra’s Aries devices.  These packages unfortunately are all identically named as ucupdates.exe so be careful when downloading more than one at a time.

Additionally Microsoft plans to release new versions of the Lync Phone Edition client quarterly as Cumulative Updates (CU).  Just last week CU1 was released and CU2 is slated for release in Q2 2011.  These are not service pack type updates but are instead the full client repackaged as a single firmware.  Previous releases for the same device family and edition are then taken offline so that only the latest edition is typically available at any given time (previous URLs will be forwarded to the latest editions as well).

The latest firmware packages can be found in the article Updating Lync 2013 under the Lync Phone Edition table, which was previously included in this article but has since been moved into the newer article which documents the past of various client and server updates.


If the Lync Server environment is prepared correctly to support standard operation of the devices (detailed in this previous article) then the following process can be used to prepare, test, and update devices.

When working with Tanjay devices the Lync Server Client Version Policy by default blocks OCPhone clients running version 1.0.196 or older.  These are very old beta versions that I have not even had my hands on in a long time and unfortunately cannot test upgrading them directly against Lync Server.  My advice is to upgrade these using an OCS environment with this process documented by Rui Silva.  If a device has the slightly newer beta version 1.0.452 or 1.0.522 then this process also documented by Rui can be used.  In most cases the latest OCS 2007 R2 software (3.5.6907) will be installed on a Tanjay and this version is capable of signing directly into Lync Server given that the required DHCP options are configured.

  • An important caveat to discuss is that the older OCS 2007 and 2007 R2 clients are programmed to look for ucupdate and ucupdates-r2 hostname, respectively.  This calls for additional DNS records and certificate SAN entries to be included in the Lync deployment.  This is quite undesirable as most often by the time an administrator reaches this portion of the deployment the certificates have already been requested and installed.  Well, the Updating Devices portion of the Lync Server TechNet documentation covers this but does not explain that it is not necessary.  As long as a Lync Server supported client version is already installed on the Tanjay device then by simply signing into the phone using a Lync user the phone will be able to connect to the Device Update Service using the Lync server/pool FQDN passed down to it.  Thus there is no need to use those other hostnames in the environment.  I have updated out-of-the-box Tanjay devices to the Lync RTM edition with no additional configuration in basic Lync Server environments with none of the ucupdates hostnames configured.
    When updating Aries device there are no legacy hostnames used and as these devices only operate with Lync Server.  The process is even simpler to support, except for the case that a pre-release beta device is in question.  The large majority of Aries devices in existence today will have at least the Release Candidate version (4.0.7457), if not already at RTM.


1. Select a device and identify the current version.
2. Download and install the update package on to the Lync Server.
3. Configure a test device to first validate a successful update and working installation.
4. Trigger an update on the test device (or just wait).
5. Review multiple log files on the Lync Server.
6. Approve the update for all devices.

Prepare Device

Selected for this process is a factory-fresh Polycom CX500 Rev-C device, pre-installed with the Lync Release Candidate 7457 build.

  • Connect the phone to the network and sign-in using a SIP-enabled, Enterprise Voice-enabled user account on the Lync Server pool.  (As the CX500 is an Ethernet only device PIN Authentication is used, but a USB-enabled device like the CX600 can be tethered to a laptop to sign-in as well).
  • Complete the device customization wizard if prompt, or just skip it if not concerned with setting time zone or ring tone settings at this point.
  • Once at the home screen press the Menu button and select System information to view the Version number of the currently installed firmware.  The Release Candidate 7457 build is indicated by the following screenshot.


Install Update Package

Using the links provided in the table in the beginning of this article download the appropriate package(s) and save it on the Lync Server.

  • Download the latest ucupdates.exe package for Microsoft Lync 2010 Phone Edition for Polycom CX500, Polycom CX600 and Polycom CX3000.


  • Execute the downloaded program and select a directory to expand the file to.


The next step is to import the expanded CAB file into Lync Server using the command shell, as this process cannot be performed from the Control Panel.

  • From the Lync Server Management Shell execute the following cmdlet to import the update cab file into Lync Server.  The -Identity value format is important and must be exactly service:WebServer:<LyncFQDN> while the –FileName value is simply an absolute path to the extracted CAB file.

Import-CsDeviceUpdate -Identity service:WebServer:lync.schertz.local -FileName C:\temp\

It may take a few seconds for the cmdlet to complete but once it does open the Lync Server Control Panel (LSCP) and go to Clients > Device Update and the new version should be displayed as Pending Version on the appropriate devices.


The import can also be verified by locating the installed files on the Lync Server which are stored in the Lync File Share path.



Configure Test Device

As with all software updates it would be prudent to first test one a single device before blasting it out to all of the phones in the organization.  The Test Device configuration in Lync Server allows for a single device to automatically download the latest version of the software available regardless of whether it has been approved yet or not.

  • From the LSCP navigate to Clients > Test Device and select New > Global Test Device.  Enter anything for the Name (e.g. Test CX500) and select the MAC address Identifier Type.  For the Unique Identifier enter the MAC address of the phone with no separator characters. The MAC is most easily viewable directly from the device on the System Information menu pulled up in Step 1 of this process.



4. Trigger Update

At this point a reboot of the phone can help kick things off a bit quicker as well as make it easy to track the progress though server logs which may be full of activity from other devices in use on the network.  But understand this is not necessary and now that the Test Device is created the associated device will update on it’s own after a period of inactivity (typically 10 minutes).  The reboot simply triggers the phone to look for an update without waiting as long.

  • Make a note of the current time and reboot the device.  It will automatically sign-in with the current user account and immediately lock.  This starts the inactivity timer.
  • Now, do nothing. Seriously, just leave the phone alone.  Don’t unlock it or push any buttons.  Don’t even look at it.  In fact, go to lunch.

Review Server Logs

While waiting the IIS server logs on the Lync Server can be viewed to see what the phone is up to, as well as keep an eye out for the update version check.  There are two different logs which will contain device request details, the IIS logs and the Lync Device Update logs.

  • In the default inetpub directory locate the most recent W3SVC log file and scroll to the end of the file to view the latest activity.  (Here is a tip: close the LSCP when working with the IIS logs as it will create a large amount of “POST /Cscp” entries which must be wade-through to find the device connection entries.)



  • When the phone signs-in to Lync Server a number of log entries will appear from the IP address of the device showing the login process utilizing web tickets and a Location Information Service (LIS) data.  The current firmware version (4.0.7457) can be seen in the client requests.

2011-01-23 17:39:21 POST /RequestHandler/ucdevice.upx – 443 – Microsoft+UCPhone+Device+(lcs_se_w14_main:824457:2010/10/21:23:13:00) 200 0 0 42

2011-01-23 17:39:21 POST /WebTicket/WebTicketService.svc/cert – 443 – OCPhone/4.0.7457.0+(Microsoft+Lync+2010+Phone+Edition) 200 0 0 36

2011-01-23 17:39:21 POST /RequestHandler/ucdevice.upx – 443 – Microsoft+UCPhone+Device+(lcs_se_w14_main:824457:2010/10/21:23:13:00) 200 0 0 160

2011-01-23 17:39:21 POST /locationinformation/liservice.svc/WebTicket_Bearer – 443 – OCPhone/4.0.7457.0+(Microsoft+Lync+2010+Phone+Edition) 200 0 0 130

  • Immediately after the device will perform two HTTP GET requests for the NBT and CAT files of the latest firmware version allowed for its device type.  Because the MAC address for this device matches the Test Device created earlier the Device Update server passes files for version 4.0.7577.107 to the device request.

2011-01-23 17:40:26 GET /RequestHandler/Files/UCPhone/POLYCOM/CX500/Rev-4/ENU/4.0.7577.107/CPE/CPE.nbt – 80 – Microsoft+UCPhone+Device+(lcs_se_w14_main:824457:2010/10/21:23:13:00) 200 0 0 63991

2011-01-23 17:40:26 GET /RequestHandler/Files/UCPhone/POLYCOM/CX500/Rev-4/ENU/4.0.7577.107/CPE/ – 80 – Microsoft+UCPhone+Device+(lcs_se_w14_main:824457:2010/10/21:23:13:00) 200 0 0 17

  • Once the device completes downloading and installing the new firmware it waits for additional inactivity time before rebooting.  This allows the updates process to run in the background, yet the device will not reboot while it’s in use.  since the device in this example has been locked throughout the process happens pretty fast.  In this log it was 7 minutes later when the device rebooted and the web ticket request now shows the updated version number.

2011-01-23 17:47:16 POST /CertProv/CertProvisioningService.svc/mex – 80 – OCPhone/4.0.7577.107+(Microsoft+Lync+2010+Phone+Edition) 200 0 0 9

Okay, now the phone can be used. Go ahead.  Unlock it and check the System Information menu to see the new version number reported.


The Device Update Update server logs can also be used, which show even more detail.  But unless a device ‘checks-in’ for an update nothing will appear in these logs so starting with the IIS logs is a good troubleshooting habit.

  • Browse to the Lync Server’s DeviceUpdateLogs directory which is stored in the Lync File Share and open the RequestHandlerAuditLog_lync_xxxxxxxx.log for the current day.



Within the log two distinct entries should be seen for the specific CX500 device which was updated.  The first line shows the device on it’s original 7457 build asking for the internal and external URLs to download an approved update from.  Also note that the device’s specific hardware revision (Rev-4) is listed in the request.  This information is later used to select which packages should be approved for updates in the specific environment.

01/23/2011 11:39:21,,,UCPhone,1/23/2011 11:39:18 AM,”0004F2953DFC”,”0004f2953dfc”,”POLYCOM”,”CX500″,”Rev-4“,”ENU”,cpe.nbt;
4.0.7457.0;12/24/2010 8:11:02 AM,
3:15:24 AM

Less than 10 minutes later a second entry from the same device appears, this time reporting that it is running the latest 7577 build.  The device is again asking for a download package, but since it is now on the latest approved no URL response is given by the Lync Server.

01/23/2011 11:47:19,,,UCPhone,1/23/2011 11:47:18 AM,”0004F2953DFC”,”0004f2953dfc”,”POLYCOM”,”CX500″,”Rev-4″,”ENU”,cpe.nbt;
4.0.7577.107;1/11/2011 3:33:08 PM,

Approve Updates

After some time has passed and sufficient testing has been completed in the environment then each of the supported device updates should be approved so any device can be updated automatically.  The Test Device object can be retained for later use or deleted if no longer testing with that specific device.

  • From the Lync Server Control Panel navigate to Clients > Device Updates, highlight the desired devices and select the Approve action.


As my test environment contains Polycom production Aries devices then only the Rev-4 package was selected for approval.  Notice that the previously approved 7576 version is now configured as the Restore Version. Additionally the latest Tanjay package has not yet been installed, but the previous RTM version of 7576 is already approved.


By Jeff Schertz

Site Administrator

141 thoughts on “Updating Lync Phone Edition Devices”
  1. Hi Jeff,

    Many thanks for this great article, it saved a lot of my time.
    Shame on me, even with such detailed description I managed to get an issue 🙂
    The problem is that both of our test devices (Polycom CX3000 and Aastra 6725ip) cannot download the update.
    In the RequestHandlerAuditLog files I can see the following:

    01.28.2011 16:46:17,,,UCPhone,28.01.2011 16:46:17,"0004F2A6508C","343030303661326663383035","POLYCOM","CX3000","Rev-3","ENU",cpe.nbt;4.0.7192.0;29.12.2010 16:46:17 ,;;4.0.7577.107;11.01.2011 15:33:08

    I checked the path using web browser and account — the .nbt file is accessable and downloadable. What else can I do to troubleshoot the issue?

    1. I'm working on another article for troubleshooting this process but in the meantime what does the IIS log show when the device tries to 'GET' the update? And are the devices connected internally or externally (via Edge)?

      1. Hello jeff,

        Nice arctile as always. I followed your artcile and successfully updated 2 test devices Cx600 & Cx3000.
        Now we bought a new Cx3000 differnet MAC ofcourse, which is not part of the test device and it also got updated.

        In the device update tab i see cx3000 3 times (rev-3, 4, 5) actually approved for all. The question is even if the phones are not listed in the test device section will the phones still update.

  2. Excellent article Jeff! I'm so glad someone posted a detailed walkthrough on the process since the TechNet documentation was fragmented.

    I recently enabled external updates two weeks ago to our users and also have some tips. First, on the Polycom CX600 (or other Tanjay devices) do NOT support wildcard certificates (* for updates/provisioning or for exchange calendaring/autodiscover lookups. The full Lync client might give you a false sense of security everything is working, but external updates and full calendaring (to join concalls from your device without entering a meeting code) on your Tanjay device work best using SAN certificates.

    Another tip is the front end pools external device logging won't show any connections since the session will terminate at negotiation (invalid certificate) in this scenario.

    Hope this saves someone the their Saturday afternoon 😉

    John G.

  3. hi jeff, excellent blog. I got a problem with the update. I’ve a cx600 and when I run the update the phone runs fine the new firmware but is stuck in the “connecting to lync server…” window.

    do you see this before? is there a way to write log files (i’m seeing the log update, but everything seems normal)

    thanks in advanced.

    1. Christian, Microsoft has an open PSS case right now related to some phones getting stuck at the sign-in process after being updated to the CU1 4.0.7577.107 release. In the meantime I would suggest you roll-back the update until the root cause is determined. I'll update this post when I get an update on the case.

      1. Hi Christian,

        i also did have this issue after updating to 4.0.7577.107. I was able to resolve ist by resetting the CX 600. To reset, unplug the phone, wait 10 seconds, keep * and # pressed while plugging into power again. Device will ask you if you wish to erase all user data, which should be answered with ‘yes’. Now it takes some time until the device comes up again, you will have to do initial setup of the phone one more time.

        Hope it works for you!

        1. Just an FYI that this was an issue resolved in CU2. So if you update to CU2 you will no longer have this issue.

  4. Hi Jeff,__Thanks for your excellent blog. How can you rollback to a previous version of the phone edition, when its not listened under "restore version". We have a problem with an Aastra6725ip phone. We get the error code 0xd/200…seems is has something to do with the flash.
    Maybe you can help me with that question.
    Thank you

    1. The phone will store its previous firmware version locally and can be reverted using the factory-reset key combination of holding 4 and 6 while booting the phone.

  5. Hi Jeff,

    thanks for your great lync blog.
    I have a problem, updateing aastra 6725ip. Our Polycom phones update perfectly, but the aastra doesn´t work.
    The current version is 4.0.7313.501 and I tryed to update to 4.0.7577.107 and to 4.0.7577.250. Both went wrong.
    The IIS Log looks ok for me:

    2011-04-06 13:30:39 GET /RequestHandler/Files/UCPhone/AASTRA/6725ip/A/ENU/4.0.7577.107/CPE/CPE.nbt – 80 – Microsoft+UCPhone+Device 200 0 995 12
    2011-04-06 13:32:07 GET /RequestHandler/Files/UCPhone/AASTRA/6725ip/A/ENU/4.0.7577.107/CPE/CPE.nbt – 80 – Microsoft+UCPhone+Device 200 0 0 87184
    2011-04-06 13:32:07 GET /RequestHandler/Files/UCPhone/AASTRA/6725ip/A/ENU/4.0.7577.107/CPE/ – 80 – Microsoft+UCPhone+Device 200 0 0 4
    2011-04-06 13:32:07 GET /RequestHandler/Files/UCPhone/AASTRA/6725ip/A/ENU/4.0.7577.107/CPE/ – 80 – Microsoft+UCPhone+Device 200 0 0 3

    Server Log is looking good too. Did I make a mistake?

    Thanke you Peter

    1. Peter,

      I've only tested this process with the Polycom devices, but the current version you state (4.0.7313.501) is an older beta release of Lync Phone Edition, some of which did not yet work with the Lync Device Update service. So you may not be able to update that phone depending on the hardware version; I would contact Aastra support foassistancece.

      1. That release (4.0.7313.501) can be updated with an RTM pool but I was only able update to RC bits (4.0.7457). Once at RC, I was able to update to RTM and then to the latest 7577.250.

        1. Jamie, thanks for the info on that. I haven't had a chance to test all the different version iterations so good to know there are some workarounds for those pre-release versions still floating around out there.

    2. Hi Peter,

      I've got about 46 Aastra 6725ip phones that are running 4.0.7313.501 that I would like to try and apply the gradual update to and get them up to date, unfortunately I cannot find the earlier versions of the phone software.

      Looking to 4.0.7457.0 or 4.0.7576.0. Any idea where I might find them?



  6. Jeff, can you shed some light on the revision of each update? I installed the latest package released the other day for the Polycom phones and it appears the same update is listed as revision 3, revision 4 and revision 5… can you explain what is going on with that?

    1. Each the software revisions are mapped to specific hardware revision of each device type, so you don't need to worry about the different software packages in each folder. Just enable each revision for each specific device that you have in your environment and the phone will actually ask for the correct software revision it needs.

  7. Jeff, looking forward to your debugging article. In our case, we don't see the phone asking for the update. I've checked that the MAC address is correct in the test device as a Global test device. I also found the reskit and ran the logging tool with snooper. I found a line that said IsTestDevice: False.

    Any pointers would be appreciated. Keep up the great work. You stuff is by far the best information available.

  8. As usual, thx for the very thorough posts. I still find it funny that non-MSFT blogs such as yours are usually more detailed than the actual TechNet documentation, and thus save lots of time for those of us scratching our head. For example, specifying the MAC address without the dashes, little things like that sometimes waste time when they fail to clarify a bit more.

  9. We have a bunch of cx700’s. We have deployed the newest firmware. We lost power over the weekend. The phones reverted to the previos version. How can I make them stop reverting?

    1. David,

      If the CX700 is rebooted 5 times in a row in a short period of time the device will protect itself by reverting to the other partition with the previous firmware installation. So if power was on/off a number of times this may have happened. Since the original partition still has the newer firmware version then the phones will not update themselves to the approved version as it will never install the same version on both partitions. In this case you’ll need to either approve an even newer firmware version (if one exists) or you’ll have to manually reset the phones 5 times in a row with the reset button on the button of the device (using a paperclip).

  10. Jeff you're blog has been invaluable to me for helping me not only setup the VLAN tagging but also in updating my CX500/600/3000 devices.

    I had been fighting to get my devices to operate on Layer 3 and pass the switch port on the CX600 to my data VLAN, while my phone resided on my voice VLAN. After calls to Dell (using their new 7000 series enterprise switches) when it didn't work, I tried updating my phone from RTM (build 107) to CU3 (build 296) using your instructions and my phone as the test device. Sure enough, after the reboot the phone was finally reading the MSCPEClient option 10 properly and landing on the voice VLAN, and my laptop hanging off the back was on the data VLAN.

    So after 2 days I can finally breathe and know that in the future the first thing I do in my Lync deployments is setup the updates on the server so when they boot for the first time they update. Maybe then I don't waste hours of time trying and retrying your instructions!

  11. Hello Jef,
    I however still have a problem updating Polycom CX600 phones. All was functioning fine till we received the last series of CX600 phones. They are having onboard version 4.0.7577.107. They don't upgrade to version 296. All the older phones have upgraded without issue. I have noticed there is also a difference in the hardware. The older ones are Rev-4. They are working without issues. The newer ones are Rev-5. None of them are upgrading… Any suggestions ?

    1. Kurt, make sure that you have also approved the updates in the Lync Control Panel for the Rev-5 devices as well. Each different revision has a separate entry in the Device Update for each revision per device model, so it's possible you have the UCPhone/CX600/Rev-4 entry approved but not the UCPhone/CX600/Rev-5 entry.

  12. Hi Jeff, you blog is great and so helpfull. One question, we have a bunch of CX600 and when trying to update them and checking the IIS logs, I do not see any GET for any of those devices. I do have an astra and can see that device log with some GET but not the CX600 🙁 Any idea?


    1. If you do not see a GET entry then the device is not attempting to download the update. What is the "Last Update Status" code shown on the phone's system information menu? Either device cannot locate the donwload URL or it's not attempting to download the update since it may not think it's needed. If the devices were rolled back and the other partition already contains the same update version approved on the server the device will not install the same version on both partitions. I have a new article coming out soon which will address the troubleshooting processes in more detail.

  13. Jeff,

    I have completed all of the major steps here, but when looking at the logs, I don't see any GET requests at all for my phones. The phone is an old Tanjay, build 3.5.6907.56. It logs in just fine on the phone and I can place/receive calls just fine. However, it never updates, and I can never see any logs on the Lync server showing it tried to connect to get updates.

    1. What is the Last Update Status code on the phone? You can try flipping to the other firmware partition (reset with paper-clip 5 times in a row) to see what the other version is and if that will update correctly.

  14. Hey Jeff,

    great article as always. You may want to add a note for the later added HP Aries devices.


  15. Let's see if I can throw a new wrench into the works…we just approved CU5 for our devices and need it since the three new CX600's are on .296 and reboot when coming out of hibernation. The rest of our devices are Aastra 6725's and 6721's on CU4 (.4047).
    All phones show they are reaching out for updates with "Last update Status" 0x0/200.
    The server logs show that it is communicatiing with the clients "03/30/2012 11:02:54,,,UCPhone,3/30/2012 11:04:27 AM,"0004F296F37B","0004f296f37b","POLYCOM","CX3000","Rev-5","ENU",cpe.nbt;4.0.7577.4047;11/9/2011 5:32:04 PM,"
    The UC files and approved updates have been removed, deleted and re-pushed to the server.
    IIS logs do not seem to be showing any GET requests and only Post requests for lcs_se_w14_main

    I've been reading your blogs most of the day..
    What am I missing?

    1. If the device log file does not show the download URL in the entry then the server has decided that the device does not need an update. Make sure you have CU5 approved for the the proper revision of the CX600, or try using a Test Device with the phone's MAC address to force the update.

      1. I've had the situation where i was testing phone update to RU6 (I have upgraded phones to RU5 using test VM environment), but couldn't get it to work because in logs there wasn't URL included in response to the phone:
        10/25/2012 14:25:39,,,UCPhone,10/25/2012 5:25:36 AM,"001B9E2CD22C","1108007563","Polycom","CX700","A","ENU",cpe.nbt;4.0.7577.4066;2/19/2012 6:15:06 PM,

        I have added test device using the MAC 001B9E2CD22C (in the log above) but I have added it as Global – since I was in the middle of OCS 2007 RTM to Lync migration, i still had BackCompatSite in my UC environment.
        Adding test device as SITE TEST DEVICE instead of Global solved my missing updates download URL! 🙂

        Logging DateTime,User Name,User Host Address,Device Type,Request DateTime,Mac Address,Serial Number,Vendor,Model,Revision,Locale,Requested<FileName;Version;TimeStamp>[# Seperated for Multiple],Response<Internal FileName;External FileName;Version;TimeStamp>[# Seperated for Multiple]
        10/29/2012 07:59:13,,,UCPhone,10/28/2012 11:59:06 PM,"001B9E2CD170","1108007367","Polycom","CX700","A","ENU",cpe.nbt;4.0.7577.4066;2/19/2012 6:15:06 PM ,;;4.0.7577.4100;5/26/2012 5:34:06 PM

  16. Hi Jeff,

    Can this be done to all devices that are connecting from outside through the Edge?


    1. Yes, LPE can update itself externally as long as the external web services are published correctly via a Reverse Proxy or equivalent configuration.

  17. Hi Jeff,

    I have a CX700 running 3.5.6907.222 (2.1) in a Lync environment. I have approved update 4.0.7577.410 and the phone downloads ucdevice.upx, CPE.nbt, and with code 200 in the IIS logs. However, the phone does not update and reports status 0x2/0. I have not been able to find much information about this error. Any ideas? I have CX3000 devices in the network that update perfectly. Just can't seem to figure out this CX700.


    1. Mike, has this same environment been upgrading phones across previous versions without issue or is this a new deployment?

      1. Jeff,

        Phones are new to our Lync deployment. We currently only have CX3000s and those have updated without issue. The CX700 was recently purchased. It did complete one update to 3.5.6907.222, however this was only after I switched the device to the partition that had 3.5.x.x on it. The first partition running 1.0.522.115 has never updated. It always show 0x0/200 but never applies the update. I have verified that it downloads all files just doesn't apply them.


    2. I am having the same issue. I have 3 new IP8540 phones that shipped with 3.5.6907.35(2.1) and I can see in the logs that they are connecting and getting version 4.0.7577.4100 advertised to them. They are downloading the CPE.nbt, and files according to the IIS logs with code 200, but then fail to install with the with error 0x2/0. From what I can find that error indicates ERROR_FILE_NOT_FOUND according to….. I have CX600 and 6725ip devices and they update just fine. The environment has been around for about 6 months and was migrated from OCS, but these are the first phones we have of this model and we are trying to update them.

  18. Hi Jeff,

    Great article however i have an issue…..

    I have Lync 2010 and have just ended up with some CX700's running 1.0.522.0 (1.23), when I try to get these devices to update i see them download the version 4 software and never install it, they do not seem to make any attempt to download the interim software (1.0.522.103).

    any ideas?

    Many thanks,


  19. Hello,

    Is it possible to integrate Polycom CX500,600,700,3000 phones with Lync Environment based in Microsoft Office 365?

    1. Ivaylo, Microsoft does not currently support any Lync phones with O365 due to a number of limitations. Mainly the ADFS (OAuth) authentication protocols rewuired by O365 are not included in the Lync Phone Edition client yet, be also O365 does not yet support Enterprise Voice (another requirement to use LPE devices). With the latest Cumulative Update (June 2012) Microsoft has added wildcard support in the phones so the first step in connecting to O365 (which uses wildcard entries on the Edge Servers) has been addressed. Only USB devices like the CX100 or CX5000 which do not require EV will work with O365 today as they can be connected to a Lync client on a workstation which has the O365 sign-in assistant installed.

  20. I am having the same issue with a CX700 – Does the updates then I get status 0x2/0. The logs of the phone show an error with the update but nothing helpful.

    If anyone has any insight please let me know.

  21. Hi Jeff,

    I have a dozen CX700 running 3.5.6907.222 (2.1) in a Lync environment. I have approved update 4.0.7577.4100 and the phone downloads ucdevice.upx, CPE.nbt, and with code 200 in the IIS logs. However, the phone does not update and reports status 0x2/0. I have not been able to find much information about this error. Any ideas?
    My opinion is that the leap from 3.5.6907.222 to 4.0.7577.4100 is not allowed, and I argued this during my update experience with some Aastra 6215ip delivered with 4.0.7313.501 (pre-beta), which did not directly upgraded. So, I advertised an "interim" 4.0.7400.0 (whic did succeed), and then to 4.0.7577.4100 with no issue.
    The real tough thing, is that I could get the 4.0.4700.0 build (Aaastra only) just only thanks to a blogger (sorry can't remember the name) who had a stored copy somewhere and passed it. But now, no previous build is available/reachable on MS sites, and ANY backlink leads to the most recent build.
    Any chance you have in your archives some lower than 4100 to give it a try?

    Just to point it out, the environment is MS "approved" (DNS records ok, services up, certs ok…)

  22. Is there a way I can get the version that each of the phones are running on from a scripting perspective rather than having to sift through log files? This would be nice via the Lync Server Management Shell.


  23. I followed this article but with no luck. My import fails. I have tried various ways to do import but … 🙁 Maybe someone have any ideas? There is output

    Import-CsDeviceUpdate -Identity -FileName

    Import-CsDeviceUpdate : Object reference not set to an instance of an object.
    At line:1 char:22
    + Import-CsDeviceUpdate <<<< -Identity -FileN
    + CategoryInfo : NotSpecified: (:) [Import-CsDeviceUpdate], NullR
    + FullyQualifiedErrorId : System.NullReferenceException,Microsoft.Rtc.Mana

  24. Jeff.
    Thanks for this article. Have sucessfully managed to update all phones within our organisation to the latest revision of the software this being 4.0.7577.4366. Have noticed however that when depressing the * and # keys to wipe the phone if need be for whatever reason the user can no longer authenticate with the lync server and gets an error logging in message. The nonly way to clear this I have found is to completely re set the phone to factory defaults by depressing 4 and 6 on start up and letting it go back to a previous version of the firmware. The user can then log ion as normal. After then leaving the phone for 10 mins it updates to the latest version. Have you ever seen this before?

    Your help is greatly appreciated.



  25. Hi Jeff,
    Nice blog, it's very usefull.
    I follow your advice, and we try the last version of cx600 on test devices. But it doesn't download the last firmware:

    2013-01-11 09:53:02 GET /abs/handler/ – 443 OC/4.0.7577.4356+(Microsoft+Lync+2010) 200 0 0 10
    2013-01-11 09:53:02 GET /abs/handler/ – 443 OC/4.0.7577.4356+(Microsoft+Lync+2010) 200 0 0 5
    2013-01-11 09:53:03 GET /abs/handler/ – 443 OC/4.0.7577.4356+(Microsoft+Lync+2010) 200 0 0 110
    2013-01-11 09:53:03 POST /RequestHandler/ucdevice.upx – 443 – Microsoft+UCPhone+Device+(lcs_se_w14_main:1131444:2012/05/25:17:05:27) 200 0 0 10
    2013-01-11 09:53:03 POST /RequestHandler/ucdevice.upx – 443 – Microsoft+UCPhone+Device+(lcs_se_w14_main:1131444:2012/05/25:17:05:27) 200 0 0 105
    2013-01-11 09:53:03 POST /groupexpansion/service.svc/WebTicket_Bearer – 443 – OC/4.0.7577.4356+(Microsoft+Lync+2010) 200 0 0 105

    Do you have any ideas on it?

  26. Hi Jeff,

    there's a Problem with the 4366 Update for Polycom CX500, CX600, and CX3000.
    KB2737911 link is down.

    1. This is correct, the original CU7 package for Polycom Aries phones contained a bug in the display driver update and was causing screen display issues on a small percentage of devices. Microsoft has removed that package and will post a new version when the problem is resolved.

  27. Hi Jeff, we have an issue where contact's Lync display pictures do not show up on our Polycom CX600 devices & never have one. I thought they should show by default? Running .4100 firmware, had upgraded to .4366 but rolled it back due to a handful of display issues.will try the latest firmware revision this week. However, if this is by default this should be working on the .4100 already & our contact pictures should show already??

    1. The photos should appear on the CX600 regardless of the firmware version as that feature has been supported since the original RTM release. I would suspect a configuration problem on the server side which is preventing the device from retrieving the photo data. Try looking at the IIS logs on your Front End server to see if the device client is requesting the photo images as HTTPS downloads.

  28. Hi Jeff,
    after upgrade to 4366 we have the problem that we cannot change users. You can´t login a new user after log out the first one. After reset with 4/6 back to the old firmware it looks good.

    1. If the new user happens to be hosted on a different Lync Server/pool than the originally signed-in user then this can happen in the event that the certificate CA chains are different between the servers. LPE does not download CA certificates again after the initial sign-in, so a soft-reset (*,#) would be required. If this is not your case and you must use a hard-reset to rollback the firmware then please contact support to track this issue.

      1. Hi folks.
        We are experiencing the same issues as Fritz described. It was necessary to rollback to the previous firmware.

  29. Hi Jeff, I have an issue where we have an SE active/active environment in two seperate geo locations. We have Polycom CX600's in both offices. I have imported the update cab's into the exact same place on both FE's All phones sign in fine even the CX500's in the boardrooms the problem is updates. The phones in the site that was built first that houses the CMS and the federated Edge update perfectly the phones at the other site request updates daily but never seem to complete the process. I have of course homed the users/phones to thier local FE's. Is this potentially a cert error ? have I missed something? Lync mobility works perfectly for everyone all other connectivity if fine. I have already tried a soft reset, not sure how to progress.

    1. All devices should be able to update themselves from their local pool so I'd have to guess something is wrong with the configuration of the new pool, but no ideas what that could be.

    1. No the schedule is not customizable, the behavior is hard-coded into the LPE clients. To prevent updates in the middle of the day you could schedule a process to run the PowerShell cmdlets twice a day (before/after work hours) to approve and unapprove the updates in Lync. In theory this should prevent daytime updates, but it not typically necessary as LPE will only reboot to update after a period of inactivity (e.g. user is away from desk/phone for extended period of time).

  30. hi jeff, i have a CX600 version 4387, when call ring (with better together) the client lync 2013 sound, but the phone only make a beep. Do you know this issue?

  31. Greate article. After deploying a couple hundred of polycom cx600 phones and upgrade to the latest version, I found a strange behavior. The phone will sign out and sign in automatically each time it perform a update request (default is every 24 hours based MS documentation). Is it a normal behavior or some known issues? For some users, it's quite annoying to see the phone sign out/in automatically.

    1. As far as I know it's not possible for LPE to automatically sign a user out and back in. Any sign-out procedure will purge the user credentials, making it impossible to sign back in again. I believe what you are seeing is the standard reboot process that is triggered when the phone updates the firmware. Because the new software is installed in a secondary partition then it must reboot itself to 'flip' over to the other partition to utilize the new version. This reboot will only occur after a specific amount of idle time is reached on the phone, so it can't happen while the phone is actively in a call.

  32. How do we obtain previous release firmwares? – the KB articles all end up pointing to the same latest firmware.

    1. There is no official repository of older firmware updates. Microsoft only provides the most recent cumulative update package for each device online.

      1. So what can we do when the newest one breaks phones? I have a load of CX-3000 phones with screens that won’t work on the newest firmware, but no way to get older firmware.

  33. Hi Jeff

    I have had call quality issues since the July 2013 was applied to my CX600 phones, specifically when a device come off of hold. Can you advise if you have seen this issue in the field or had any similar reports?

    1. I have not heard of this issue but if it's attributed to the firmware release then you should open a support ticket with Microsoft to find out what change in that version may be causing your problems and how to resolve them.

  34. Hey Jeff,

    All the download links for CX700 v4.0.7577.x are pointing to the latest version 4.0.7577.4411. Can you pls fix this issue?


    1. That is correct, there is nothing 'fix'. As explained in the article Microsoft only provides the latest packages on their download server. You cannot download older releases from them once a newer CU has been published, they retire the older packages.

  35. Thanks for keeping the page updated, sucks that the links for downloads end up in the most recent. FYI, 4414 is an updated release to 4411 (Oct 2013) but we're seeing an issue on a number of CX600's with them rebooting several times a day. Really wish I had maintained a library history…

  36. Where kan i download early version for the polycom CX 600 because the laterst firmware did not work fine for me. And my telephone is from 2011 and i can not use this phone then for lync 2013.

    Thank you in advance

    1. If you have issues with the latest firmware release I suggest contacting Microsoft support. They can assist with troubleshooting the issue if it is in fact due to the latest update, and can even provide an older version in the meantime if needed. There is no online repository of older, replaced versions.

  37. HI Jeff, We recently updated our firmware to version 4.7577.4420 from 4100. I kicked-off off the update on a Saturday morning after comfirming the test device update worked fine. The following Monday, on checking the devices, about one quarter din't recieve the update. Out of 200 phone, 53 did not update. I had one of my techs bounce the ethernet switch port on a phone that did not update and it successfully updated the firmware. Any idea on why some phone recieved the updated and some did not. They are all internal and are not specific to one switch or location. Thanks.

    1. The phones will update on a arbitrary schedule to prevent flooding the web server with requests so there are a couple possibilities. Typically I wouldn't assume that 100% of the devices would be updated over a single evening as sometime a reboot is required for a handful of devices to trigger the update. A 75% success rate is not uncommon on the first try.

      1. Jeff, Thanks for your response. It is now day 5 since I kicked off the update. The same devices are not updated. Is this normal or should all phones have updated by now? My concern is that this is manageable with 50 plus phones but when our inventory of phones gets into the thousands, 25% is a very large number to deal with. I am also concerned as to why the phones didn't update. Any insight is greatly appreciated. Thanks.

  38. Anyone having any issue using a CX3000 with firmware version 4.0.7577.4372 and logging into Lync 2013 running the January 2014 CU. All of our CX3000's running 4.0.7577.4372 can NOT login while all CX3000's running 4.0.7577.4420 have no problem.

    We can not update the 4.0.7577.4372 because it needs to be logged into lync to get the updated version.

  39. Hello Jeff,

    your Blog is really helpful. Thank you.
    One question from my side:
    Is there a Lync phone edition emulator (or someting else) to be able getting screenshots?
    I will create training documents.

    Thank you.

    1. None that I've ever seen, although Microsoft may have one internally. I just use a camera for my images 🙂

  40. this was very helpful, I just wanted to point others who may show up here:

    since many of you probably aren't running ocs 2007 (or r2) anymore

    the above trial from Microsoft worked perfectly, the only trick was changing the clock back on all the VMs to before December 2013 since all of the certs were expired, I was able to upgrade to 3.5 from this hyper-v environment after that did the 2 step CU5 to CU7 via lync 2013.

  41. Jeff, Avid reader.
    how to you remove an update all together? We have an instance where we have an old cx700 with OCS firmware coming on and we have all our systems updated to the latest Lync 2013 firmware, suggestions?

  42. I have a polycom cx3000 and I’m actually looking to bypass Lync on it – to just use as a plug and play conference phone. I’ve been told it can be done, but don’t know the steps to doing so. Has anyone succeeded with this and know the best method?


  43. Hi all,

    I realize this is a little left of the blog-subject – and I hope you will accept my apologies and appeal for help. We are trying to configure a Polycom CX3000 with the latest firmware to display the calendar of an Exchange 2010 (BPOS-D) resource mailbox. Of course, we know this is not normally allowed because the underlying AD account cannot log into the mailbox.

    I have read several posts on this subject, but we are not clear on how to steer around this. If we are using a separate Global AD Domain from the BPOS-D domain – is there a way to give the CX3k AD/Exchange credentials that will allow us to display the room resoure calendar?

    Thanks so much for your help…


    1. Tim, third party device support for O365-Dedicated customers is per-tenant so you’ll need to contact your Microsoft support team to find out what devices are allowed and supported in your hosted deployment.

  44. I just started here and they had bought These CX600 and Sangoma boxes. I have finally gotten lync installed but I have this Exchange UM error I am advised to update the phone to the latest firmware but what is the latest and where can I get the latest if I do not have the latest? Is there a way outside of Lync to update the phones?

  45. Hello,

    Ploycom CX 700 sign in Skype for business Server 2015,Fail.

    Do you use Ploycom CX 700 sign in Skype for business Server 2015 ?

    How to setting Ploycom CX 700 sign in Skype for business Server 2015 ?

    1. Make sure to upgrade the CX700 to the latest Lync Phone Edition client and you should be able to sign-in as long as you have the required licenses and user accounts enabled in your O365 tenant. I have a CX700 phone registered to one of my O365 accounts right now, running the latest .4463 firmware.

      1. Thank you reply my questions!

        I have a cx700 and I don’t hvae public certifice and I hvae a Skype for business Server 2015 on IDC (SFBFE01,SFBEdge01,SFBBE01,SFBPC01…..)!

        SFB for PC on internet login OK!

        Lync 2013 for iphone,android on internet login OK!

        But Lync 2013 for CX700 on interent login Fail !

      2. Hmmm – we are in the o365 preview with Skype for Business. The problem is the CX600 I just picked up to test shipped with an older firmware, not the .4463 that will allow me to sign in to O365. So I’m in a catch 22, how do I get a firmware update to the phone so it can start logging in to O365 so it can get updates….? We don’t have an on-prem I can use to push the firmware from, we’re all cloud.

        1. I’m not sure how this is being addressed in the future but in the meantime a separate environment will need to be accessible to update the phone’s firmware. You can contact our Polycom reseller for assistance with this.

  46. Hi and thanks for the greate article. we have a problem with some of CX500 phones. we can sign in using windows client version but cant sign using PIN authentication from CX500 phones. I have downloaded the updates and imported the updates successfully, since i cant login to phones, will the phone download the updates without signing in?. when i try to sign in it says “Certificate web service cannot be found”, but windows clients works fine. regards

  47. Hello,

    We have Polycom CX600 type phones on Lync 2010 EE server back end, which are in generic areas e.g. Print Room where multiple people access the same phone and since they wanted to have ability to have call forwarding and Voice mail – we created generic service accounts in AD and had them Lync enabled instead of setting them up as Common Area Phone.

    The phones, do however, get locked which is expected since it is there on Site Device configuration – and this is little annoying to users.

    Is it possible to disable phone lock on a per user / phone basis while keep the site policy of locking intact ?

  48. Hi Jeff,

    Big Fan! Wonder if you could advise on a query please. We have some CX500 (Firmware: 4.0.7577.4451) trying to connect to a SfB on prem installation. I noticed that platform compatibility on your Phone Edition chart ( does not start until (4.0.7577.4463).

    The CX500’s currently will not sign in, however I believe all the settings are correct as we have some RealPresence Trio 8800’s which can sign in using PIN auth. I’ve downloaded the latest UCUpdates cab for this version and created a test device using MAC to try and update, nothing happens. I’ve also looked through the logs (still reviewing) and reviewed comments above for any pointers. Is there a separate process to bring the CX500 inline with the correct firmware for SfB? If a more up to date firmware version is needed for compatibility, if that is indeed the case in terms of inclusion of “SfB” in the firmware version chart from the other post I mention?



    1. Hi Jeff,

      Got the CX500 phone to sign in using PIN Auth. SRV records were pointing to the FQDN of the FE these had been changed as per which is reference within the PDF for the RealPresence Trio setup. However I’d made the mistake of using the internal domain as opposed to the SIP domain in the FQDN. The Trios had been signing in without issue so assumed this was OK.

      On reviewing another one of your articles: this raised itself as the issue. I then changed the A records referenced by the SRV back to and all is fine. Phone has also updated the firmware.

      Many Thanks.


    2. Matt, that version should probably still work with SfB Server, so most likely there is something still not correct with your DHCP configuration supporting PIN Authentication.

  49. Hi Jeff,

    I’m struggling to use a Polycom CX3000 conference phone with our Lync Server. On the phone, the Firmware 4.0.7577.4451 is installed and when I want to connect to the Lync Server, the phone shows an error, that the domain “Andreas P…” could not be found. Obviously the phone is the username as domain, not the domain it self.

    Is there a way that the firmware of the phone can be updated even when the domain name is wrong?

    Thanks for any ideas!



  50. Hi Jeff.
    I’m having trouble updating CX600 devices to the latest FW. Have followed all your instructions, and I think it all boils down to a problem mentioned earlier in this thread that I don’t seem to find an answer to.
    The devices never perform a GET towards the update URL. Do you have any idea as of what might be the cause?

    Kind regards
    Tom R.

  51. Hi Jeff, thanks for this amazing round-up!

    I have just one question: Is it somehow possible to update the phones before connecting them to the skype for business-server? Because currently I’m getting the error “cannot download certificate because domain is not accessible”. Jaap Wesselius has covered this problem in his blog and his final solution was a firmware update of the phones:

    But I cant do this, as the phones receive this error even before they going to check for an update :-/

    Thanks in advance,

    Cheers, Carsten

  52. Jeff,

    I have a bunch of CX600 for a small non-profit that I am setting up with Skype for Business Online (Cloud PBX). A few of the devices work fine, but a few keep giving me errors that indicate problems with sign-in. The common thread seems to be the version number, the non-working ones haven’t ever been used and have a firmware version of 4.0.7577.250 while the ones that work have a much newer version of 4.0.7577.4531. Based on my research it looks like the only way to upgrade the firmware is by signing in.

    Is there any other way for a Cloud PBX only shop to update these phones to make them usable? Also I have also seen some notes that this phone will stop working (or at least if it does stop working won’t be supported) at the end of this month. I think we can replace the phones, but want to provide as much runway to make that shift, since we are currently switching to SfB.

    Any recommendations?


    1. That is correct, updates are provided post-registration, and yes all Lync Phone Edition devices are no longer supported by Microsoft and will stop functioning with Office 365 when TLS 1.2 is enforced on October 31.

Leave a Reply

Your email address will not be published. Required fields are marked *