With the introduction of the new Lync Phone Edition client in Lync Server 2010 there is now a way to support basic telephony functionality without having to login as a regular user to a standalone handset.  In Office Communications Server this experience was limited to using an executive-class CX700 (Tanjay) with a dedicated user account signed into the phone.  Neither these devices nor the extended communication modalities provided by a full OCS user account were really the best solution for a phone in an unsecured, common area.

In order to support the use of Common Area Phone (aka Hotdesking) the Lync Server environment first needs to be configured to support PIN Authentication for the Aries family of Lync Phone Edition devices (Polycom’s CX500, CX600, CX3000 and Aastra’s 6721ip, 6725ip).  This topic is covered in-depth in this previous blog article: Configuring Lync Server for Phone Edition Devices.  Once Enterprise Voice enabled Lync user accounts can successfully sign in using PIN Authentication then the steps in this article can be applied.

As my modus operandi revolves around adding content and (hopefully) simplifying topics covered in the TechNet documentation, this article is no exception.  While the official Configuring Common Area Phones documentation does already cover a majority of the content there are important items omitted.  Some of this information is not clearly explained and is located different chapters of the documentation.  If the underlying operation is not already understood by the reader beforehand then it may not be clear what the missing pieces are, thus following the configuration steps verbatim may not produce the desired results.

So this article covers two scenarios: a simple cut-to-the-chase approach to getting a Common Area Phone configured as easily as possible, and a more detailed approach with customized policies.  The Lync Server Control Panel cannot be used for the majority of this configuration, so all steps in either scenario will be shown using the PowerShell-based Lync Server Management Shell.

Scenario A: Simple

Making the assumption that a working Lync Server environment is available and PIN Authentication is currently working then this process is very simple.  This is for those who don’t care to read or understand how it all works, they just want to get it done and working.  The second scenario will be much more verbose so skip to that section for the good stuff.

Enable Hotdesking

By default Hotdesking is turned off in Lync Server 2010.  The default Global policies contains Common Area Phone specific settings which will be applied to all devices signed-in using one of these accounts.

• Enter the following string in the command shell to enable hotdesking on the default Global client policy.

Set-CsClientPolicy -Identity Global -EnableHotdesking $TRUE

Create Common Area Phone Account

A Common Area Phone is defined by an Active Directory Contact which is not SIP-enabled through the normal means that a contact would be.  This new contact object is created automatically by the New-CommonAreaPhone cmdlet.

• Enter the following string in the command shell using the desired phone number, display name, and description.  The RegistrarPool value is the FQDN of the Lync Front-End server or pool.  The OU value is were the new contact should be created in AD.  (The DisplayNumber format must be able to be normalized by Lync server otherwise the LineURI value will be shown on the phone’s home screen.)

New-CsCommonAreaPhone -LineUri “tel:+13125557521” -RegistrarPool “lync.schertz.local” -OU “OU=Contacts,OU=JDS,DC=schertz,DC=local” -Description “Common Area Phone” -DisplayName “Lobby Phone 1” -DisplayNumber “(312) 555-7521”

Set Device PIN

Just as a normal user must have a PIN defined for authentication so must a Common Area Phone contact.  But again this cannot be performed using the Control Panel.

• Enter the following string in the command shell using the desired PIN.

Set-CsClientPin –Identity “Lobby Phone 1” -Pin 123123

Once these three simple steps are completed then sign in to an Aries phone using the extension of the new common area contact.  The bare interface will indicate that the majority of normal user features are not available.

Scenario B: Less Simple

As promised this scenario will go into greater detail.  The biggest issue with the example process in the TechNet documentation is that although the configuration of various custom (yet optional) polices is covered, there is minimal direction on how to actually assign these polices to the Common Area Phone contacts.

The benefit of defining specific policies allows for a more granular level of control of devices in different user or site populations.

New Client Policy

A new client policy can be used to either define different parameter values than what the default global policy has or to just organizationally separate the Common Area Phones.  As mentioned in the previous section it is acceptable to enable hotdesking on the global policy but in larger deployments it is recommended to create multiple policies for different group of devices that all may require unique settings.

• Enter the following string in the command shell to create a new client policy called CommonAreaClient using the desired HotdeskingTimeout value for how long to wait before automatically signing out an inactive Lync user and reverting to the Common Area Phone contact number. (The default value is 5 minutes.)

New-CsClientPolicy -Identity CommonAreaClient -EnableHotdesking $True -HotdeskingTimeout 00:10:00

New Voice Policy

Creating a new voice policy is important when the common area phones should be limited to internal calling or need to have a different level of external dialing then standard Lync users may.

• First identify the currently defined PSTN usages in Lync Server.

Get-CsPSTNUsage

• Create a new voice policy named CommonAreaVoice which limits usage of only the Internal PSTN usage as also disables all other calling features.

New-CsVoicePolicy -Identity CommonAreaVoice -PstnUsages @{add=”Internal”} -AllowSimulRing $FALSE -AllowCallForwarding $FALSE -Name CommonAreaVoice -EnableDelegation $FALSE -EnableTeamCall $FALSE -EnableCallTransfer $FALSE -AllowPSTNReRouting $FALSE -Description “Feature-Restricted Common Area Phone Policy”

Additionally the Voice Policy could be created or modified using the Lync Server Control Panel, under Voice Routing > Voice Policy.

New Conferencing Policy

Although some of the features in the Conferencing Policy do not apply to Lync Phone Edition devices the example documentation recommends that all of these modalities are disabled for common area devices.

• Create a new conferencing policy called CommonAreaConf and disable all of the configurable parameters.

New-CsConferencingPolicy -Identity CommonAreaConf -AllowIPAudio $FALSE -AllowIPVideo $FALSE -EnableFileTransfer $FALSE -EnableP2PFileTransfer $FALSE -EnableDataCollaboration $FALSE

Additionally the Conferencing Policy could be created or modified using the Lync Server Control Panel, under Conferencing > Conferencing Policy.

New PIN Policy

In this example a less restrictive PIN policy is defined then what the global PIN policy has by default.  Alternatively a more restrictive PIN policy could be used to force a complex PIN on common area phones to prevent users from signing in as that account on other phones as typically only IT would manage the common devices default account.  Either approach has merits in a real-world deployment.

• Create a new PIN policy called CommonAreaPIN which reduces the minimum PIN length to 4 digits and allows for the usage of common patterns.

New-CsPINPolicy -Identity CommonAreaPIN -Description “Common Area Phone
Authentication PIN Policy” -MinPasswordLength 4 -AllowCommonPatterns $TRUE

Create Common Area Account

A Common Area Phone is defined by an Active Directory Contact which is not SIP-enabled through the normal means that a contact would be.  This new contact object is created automatically by the New-CommonAreaPhone cmdlet.

• Enter the following string in the command shell using the desired phone number, display name, and description. The RegistrarPool value is the FQDN of the Lync Front-End server or pool. The OU value is were the new contact should be created in AD. (The DisplayNumber format must be able to be normalized by Lync server otherwise the LineURI value will be shown on the phone’s home screen.)

New-CsCommonAreaPhone -LineUri “tel:+13125557521” -RegistrarPool “lync.schertz.local” -OU “OU=Contacts,OU=JDS,DC=schertz,DC=local” -Description “Common Area Phone” -DisplayName “Lobby Phone 1” -DisplayNumber “(312) 555-7521”

The new contact object can be found in Active Directory and a peak at the raw attributes shows that it only contains a subset of the normally populated Lync attributes.  Also the SIP URI (msRTCSIP-PrimaryUserAddress) is a dynamically created value that is not utilized by end-users.

Set Device PIN

Just as a normal user must have a PIN defined for authentication so must a Common Area Phone contact. But again this cannot be performed using the Control Panel.

• Enter the following string in the command shell using the desired PIN.

Set-CsClientPin –Identity “Lobby Phone 1” -Pin 123123

Assign Policies

At this point there a number of new policies defined, but none have been assigned to anything yet.  The screenshot above shows that there are empty parameters for the four applicable policies.  An assumption could be made that the Set-CsCommonAreaPhone cmdlet would be used to define those parameters, but that would be incorrect.  Each policy type has its own Grant- cmdlet which is used to assign objects to the policy.

• Enter the following cmdlets individually to assign the new Common Area Phone object to each of the newly created policies.

Grant-CsClientPolicy -PolicyName CommonAreaClient -Identity “Lobby Phone 1”

Grant-CsVoicePolicy -PolicyName CommonAreaVoice -Identity “Lobby Phone 1”

Grant-CsConferencingPolicy -PolicyName CommonAreaConf -Identity “Lobby Phone 1”

Grant-CsPINPolicy -PolicyName CommonAreaPIN -Identity “Lobby Phone 1”

• Use the Get-CsCommonAreaPhone cmdlet to verify that the newly assigned policies have been applied to the contact.

Get-CsCommonAreaPhone –Identity “Lobby Phone 1”

Bulk Actions

Most likely more than a single common area account would be created and thus there is a quick way to assign all Common Area Phone contact objects to the same policy in a single action.

• Use the Get cmdlet to pass the results (all existing Common Area Phone accounts) through the pipe (|) to the desired Grant cmdlet.  Run the command for each of the four policy types.

Get-CsCommonAreaPhone -Identity “Lobby Phone 1” | Grant-CsClientPolicy -PolicyName CommonAreaClient

Additionally PointBridge’s Keenan Crockett has a blog article covering how to create a single script for mass account creation and configuration.

Test Authentication

Prior to signing in on a device the process can be tested with the same emulate cmdlet that was covered in the previous blog article on phone configuration.

• Enter the following cmdlet to test the PIN Authentication process from the Lync Server.

Test-CsPhoneBootstrap -PhoneOrExt 7521 -PIN 1234

Sign-In to Device

If the test passes successfully then the same credentials should also work from a phone.  The phone will be shown in the Lync address book when searched by name (an Update-CsAddressBook can be trigger to speed up the process).