As provided in the past this series of basic deployment articles will be used to capture a specific environment used as the foundation for many other Lync Server 2013 specific deployment articles.  Starting with a single Standard Edition Lync Server in a fresh Active Directory forest future articles will build on this deployment with additional component installation like Group Chat, Edge Services, Exchange Server integration, etc.

Throughout this series of articles the same basic instructional flow is used as in other articles.  Although it may not have been obvious, the usage of bulleted items is intentionally specific.  Steps starting with a bullet are typically mandatory to reach the same level of installation completion as the article intends to provide at the end.  Yet normal paragraphs without bullets may include optional steps intended to provide a deeper understanding of a previous action or cover the installation of optional tools or components used to aid in knowledge transfer of the topic at hand.  This format aids in skimming through the article for repeated installations.


    For these articles specific to Lync Server 2013 a new lab environment has been created which is nearly identical to the one used in previous Lync Server 2010 articles.  One important change worth noting is that the internal Active Directory namespace is now configured as as opposed to the previously used schertz.local domain name.  This was done to match newer best practices of moving away from using invalid Top Level Domain (TLD) names which would prevent the ability to issue public certificates for those internal services, as described in this previous article.  The primary SIP domain namespace will continue to be throughout all articles.

  • Physical Host: Windows Server 2008 R2 Hyper-V running on a Core2 Duo desktop-class system with 8GB RAM.
  • Domain Controller: A single Windows Server 2012 x64 Standard Edition guest promoted to a domain controller for the new Active Directory forest root domain of
  • Lync Server: A second virtual guest running Windows Server 2012 x64 Standard Edition and joined to the domain.
  • The default domain administrator account used to perform all steps is a member of the Domain Admins, Enterprise Admins, and Schema Admins domain security groups.
  • The Forest and Domain functional levels were set to Windows Server 2012.
  • A Windows Enterprise Certificate Authority was deployed on the domain controller to provide SSL certificates for internal services. The CA configuration was updated to provide access to the Certificate Revocation List via HTTP, as explained in this article.

Server and Forest Preparation

Before installation any of the Lync Server components it is best to install any prerequisite components on the targeted server so that steps like Active Directory preparation are easily dealt with.

  • Mount the Windows Server 2012 installation media on the server to an available drive letter as some of the components to be installed will need to be read from the installation media as provided by the Source parameter in the following cmdlet (e.g. D:\sources\sxs).
  • Launch Windows PowerShell by selecting ‘Run As Administrator’ and enter the following cmdlet to quickly install the .NET Framework package, the Remote Server Administrative Tools, and all additional prerequisites followed immediately by a required server reboot. (The Telnet Client is not a requirement but is helpful to have installed when troubleshooting any connectivity issues.)

Install-WindowsFeature RSAT-ADDS, Web-Server, Web-Static-Content, Web-Default-Doc, Web-Http-Errors, Web-Asp-Net, Web-Net-Ext, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Http-Logging, Web-Log-Libraries, Web-Request-Monitor, Web-Http-Tracing, Web-Basic-Auth, Web-Windows-Auth, Web-Client-Auth, Web-Filtering, Web-Stat-Compression, Web-Dyn-Compression, NET-WCF-HTTP-Activation45, Web-Asp-Net45, Web-Mgmt-Tools, Web-Scripting-Tools, Web-Mgmt-Compat, Windows-Identity-Foundation, Desktop-Experience, Telnet-Client, BITS -Source D:\sources\sxs -Restart


  • After the server finishes rebooting disconnect the Windows Server media and mount the Lync Server 2013 installation media.
  • Launch the Lync Server 2013 Deployment Wizard from the following path and then select Yes if prompted to install the Microsoft Visual C++ Runtime package.


  • Confirm the default Installation Location or change the path to a different directory if desired.

C:\Program Files\Microsoft Lync Server 2013

  • At the main menu of the deployment wizard select Prepare Active Directory and then click Run on Step 1: Prepare Schema.

If deploying in an environment with a single domain controller there is no need to run the optional verification processes.

  • Select Run on Step 3: Prepare Current Forest and select the Local Domain as the Universal Group Location if desired.  If Lync is being installed into a multiple domain forest and the universal groups need to be stored in a domain other than the domain that the current server is a member of then enter the desired domain FQDN.
  • Advance to Step 5: Prepare Current Domain to complete the Active Directory preparation steps.

To confirm some of the changes which were applied in these steps a few items can be spot checked.

  • Run adsiedit.msc and connect to the Schema container to view the properties for the following object.  Confirm that the UpperRange attribute value is set to 1150 (which was incremented up from 1100 in Lync Server 2010).



  • Run dsa.msc to open Active Directory Users and Computers and then browse to the default Users container.  Look for a number of groups starting with ‘CS’ and ‘RTC’ in their names.  These groups were created during the Forest preparation step in the chosen domain.


  • Run adsiedit.msc and connect to the Configuration container and browse to the following path.  Notice that a number of empty containers have been created where some of the Topology configuration will be stored when later published.

CN=RTC Service,CN=Services,CN=Configuration,DC=schertz,DC=name


Lync Server Preparation

This process will install the SQL Native Client and SQL Server Express components, as well as configure Windows Firewall exceptions for remote SQL connectivity. Mostly importantly it also deploys a SQL Express named instance, simply called RTC.  This instance will be the default location for the Central Management Store which is where Lync will store the majority of the global (forest-wide) configuration data.  The RTC Service container shown above in the AD Configuration partition is still used to store some data, but mainly for coexistence with previous versions of OCS.

  • Return to the main menu of the deployment wizard and select Prepare First Standard Edition server.  It is normal for the installation to take a few minutes to complete during this step.


A quick glance at the Programs and Features control panel shows all of the components which were installed on the server once this process is completed.


The SQL Server Configuration Manager can be used to verify that the local SQL services are properly installed and running.


The newly installed SQL Server Express instance default database files can be found in the following location.

%ProgramFiles%\Microsoft SQL Server\MSSQL11.RTC\MSSQL


  • Before moving further the domain Administrator account used throughout this process should be added as a member to the domain security groups CsAdministrator and RTCUniversalServerAdmins


  • This user account should then logoff and back on to the Windows Server where Lync is being installed to update the associated security token.  Once logged back on use the following whoami commands in the Windows Command Prompt to verify the new group membership.

whoami /groups /fo list | findstr /i CsAdmin
whoami /groups /fo list | findstr /i RTC


The final preparation step is to manually create a file share on the server which will later be referenced during the Lync Server topology configuration.

  • Create a new folder on the server (e.g. lyncshare) anywhere on the server.  The following path was used in this lab deployment.


  • Verify that the local Administrators group is already granted Full Control at the file permission level and then enable sharing for this folder.  Provide a name for the new share (e.g. lyncshare) and then assign Full Control share permissions to the administrator account currently being used to perform the installation.  These permissions will be more granularly defined when the Topology is published in a later step.


Deployment and Administration Tools Installation

Now that the first Lync server in the environment has been fully prepared the next step is install and run the Topology Builder tool.

  • Return to the main menu of the Lync Server 2013 Deployment Wizard and select the Install Administrative Tools option.  An installation window will briefly appear followed by a green check box next to the component name in the wizard, indicating the installation was complete.

To verify the installation is is complete simply search the Windows Start Menu for “lync” to see the administrative tools.


Outside of the installation media Microsoft also provides a handful of great administrative and troubleshooting tools for Lync Server 2013.  It is recommended to download and install each of these packages on the server as they include some important tools used in other blog articles like OCSLogger, Snooper, or DBAnalyze.

If all of the above packages are installed into the default directory then the tools can be found and launched from their respective installation directories.

%ProgramFiles%\Microsoft Lync Server 2013


Additionally it can be helpful to have access to the SQL Express database management tools on the local server.  Normally this is not needed but can be used for following some of the validation steps throughout these articles.  (Download and install only the SQLManagementStudio_x64_ENU.exe package from the following Microsoft Download page.)

Topology Definition

This section covers creating a new Lync Topology in a new Active Directory forest and domain.

  • Launch the Lync Server 2013 Topology Builder application and select New Topology from the initial prompt.
  • Save a new .tbxml file with any desired name (e.g. lynctopo.tbxml).
  • For the Primary SIP domain enter the desired domain namespace (e.g. 

Add any additional desired SIP domains at this point , but a single SIP domain is sufficient for most deployments as well as this series of articles.

  • Select a Name for the first site to be created in the topology (e.g. Chicago) and enter a Description if desired.
  • Specify the locality information associated with the first Lync site and then complete the wizard.

At this point the Define New Front End Pool wizard should be automatically launched.

  • On the Define Front End Pool FQDN page enter the Fully Qualified Domain Name (FQDN) of the Windows domain member server where the Lync Front End services will be hosted.  This would be the same server that all of the prerequisite components have been installed on.  Make sure that the server’s FQDN is correctly configured so that it matches exactly what is entered into the topology as this is how the later installation process identifies which components to install on the server.

image  image

  • Select Standard Edition Server and advance to the next page.


  • On the Select Features page choose the desired options for this installation.  To start only Conferencing and Enterprise Voice features will be selected, with additional components to be addressed in later articles.


  • Retain the default enabled setting of Collocate Mediation Server on the Select Collocated Server Roles page.
  • On the Associate Server Roles with this Front End Pool page leave the option blank as an Edge Server does not yet exist.  This setting will be addressed when an Edge Server is deployed in a later article.
  • As this is a Standard Edition server then there will be no configurable options available on the Define the SQL Store page.  Take note of the automatically defined SQL Server store which is comprised of the server’s FQDN ( followed by the previously installed SQL Express instance name (RTC).


  • On the Define a File Store page enter the name of the Windows file share created in the previous section (e.g. lyncshare).


  • On the Specify the Web Services URL page the External Base URL will automatically be set to the same FQDN as the internal Front End server (e.g.  For the purposes of this article the default setting will be retained and in the future when external services are published this will be updated to reflect the external namespace.
  • The next page Select an Office Web Apps Server is new to Lync Server 2013 and is used to either define a new OWAS pool FQDN or associate this server with an existing OWAS pool.  As a later article will cover deploying OWAS simply uncheck this option and then click Finish to complete the wizard.  (Note that until this server is deployed that PowerPoint content sharing will be unavailable in Lync conferences as this is no longer performed by the Front End server.)


Upon completion the Topology Builder window should refresh and the defined settings will be populated as shown.


  • Back at the main Topology Builder window select Edit Properties on the Lync Server root-level object.  Highlight the Simple URLs section and enter the desired Administrative Access URL (e.g.  Technically his is an optional step as the administrative access URL is not required, but is a recommended way to access the Lync Server Control Panel via a web browser internally.
  • Move down to the Central Management Server section and select the new Front End server (e.g. as the location to install the CMS component on.


The final process is to publish the changes made to the topology into the Central Management Server database which also updates information in the RTC services container in Active Directory and sets up the folder structure and permissions on the file share.

    • From the Action menu select Publish Topology.  The local server FQDN for the Central Management Store location should already be populated in the drop-down menu due to the previous step.  If all configuration steps were performed correctly then the wizard should complete without any errors or warnings.


As indicated by the To-Do List shown under Next Steps a couple of DNS records will need to be manually created to match the FQDN set in the Lync Server topology.

  • Create new DNS Host (A) records for the Simple URLs on the internal DNS server’s forward lookup zone which match the SIP domain used.  Each record should point to the static IP address used by the server where the Standard Edition roles will be deployed, thus the same IP address as the server is used for all records.


To validate and understand the changes the Topology Builder has applied to Active Directory there are a number of places to look throughout the various results logs, within Active Directory, and the SQL databases themselves.

  • Use adsiedit.msc to connect to the Configuration context and browse to the path shown below and notice that the previously empty containers are now populated with child objects and attributes.

CN=RTC Service,CN=Services,CN=Configuration,DC=schertz,DC=name


  • The SQL Server Management Studio tool (if installed) can be used to connect to the RTC instance on the Lync Server to view the databases new xds and lis databases.


  • The raw database files can be found on the Lync Server in the default installation directory shown below.


  • Additionally the defined file share is now populated with the new folder structure and the required share permissions.



At this point all organization preparation steps have been completed and the next article in the series will focus on installation of the actual Lync Server components to the Standard Edition Front End server.

By Jeff Schertz

Site Administrator

65 thoughts on “Lync Server 2013 Deployment – Part 1”
  1. Hey Schertz,

    What you your advice be on upgrading from 2010 to 2013 Lync. I have a standard edition and edge server setup. I'm little bit stuck on servers names as the old and the new servers will be in the same domain while the migration happens. I don't want to name the new servers different names and have to buy new certs!

    Any advice would be appreciated.



    1. You'll have to define new FQDNs for the 2013 servers as you cannot perform an in-place upgrade of the individual servers. Most certificate authorities should let you request a new certificate with new names, revoking the old certificate in the process, at no cost.

    1. No, but you can just follow the TechNet documentation for supported migration paths. If you are talking about the original release of OCS and not R2 then a direct migration is not supported and the recommended path is a two-phase migration to get all the way to Lync 2013.

  2. Hey Jeff Great article as always
    I had a question about the prerequisites and why you do add Desktop-Experience and not Server-Media-Foundation
    According to Technet… in the powershell part they mention Desktop-Experience but if you read through the section Windows Desktop Experience they mention, and I quote.
    "Windows Server 2012 requires Microsoft Media Foundation."


    1. Markus, the TechNet documentation is sort of misleading here, and a bit inaccurate. I think it's a carry-over from the Lync 2010 documentation which was not properly updated for 2013. The Desktop Experience is still part of Windows Server 2012 (it was moved under the 'User Interfaces and Infrastructure' feature) and installing it will automatically install the prerequisite 'Media Foundation' (as well as the 'Ink and Handwriting Server') components. So it's redundant to include Media Foundation. You'll notice that the PowerShell cmdlet in the same TechNet same does not include Media Foundation either.

  3. Hi Jeff Schertz,
    This is a great step-by-step.
    Question: I have installed Lync 2013, on windows server 2013, however, the front-end services is on 'starting' state and does not start.
    Event viewer throughs the following error:
    Server startup is being delayed because fabric pool manager has not finished initial placement of users.

    Currently waiting for routing group: {8EC325CB-B512-587D-9D03-E940E7CC1490}.
    Number of groups potentially not yet placed: 1.
    Total number of groups: 1.

    Note: am using a self-signed certifcate

    1. Self-signed certificates are not supported in Lync Server, you must use a certificate issued by some type of certificate authority.

  4. Hi Great Article a bit confused in the Server and Forest Prep area. In the 1st bullet you stated the Windows server 2010 media is needed. Please clarify?


  5. Hi Jeff,

    I have followed your docs and they were a great help. it is working great and mobility is also configured. however I am not able to enable the checkbox against conferencing. as soon as I check it ok get greys out.


  6. Hi Jeff,
    How can I define the domain name in the SIP pool? It is because when I build the AD, I need to provide the domain name for internal use, let says "abc.local", When I install the Lync and configure the topology. I need to input the SIP domain for internal, when I input the "abc.local" on it, In the control panel I cannot enable the user. Any suggestion to me for define the domain name in internal or external.


    1. I don't quite follow what you are trying to do. Also anything with a.local is not a fully supported SIP domain as it would not work for external or federated communications.

  7. Hi Jeff
    the problem is that i cannon change the central management server to the lync2013 front end from the topology builder, even using cmdlets (Enable-CsTopology, Move-CsManagementServer)>

    I am still stuck with the lync 2010 FE CMS.

    please help and advice

  8. Hi Jeff,

    Can you please advise..I would like to publish and access the LYNC Services from external. Is the internal CA certificates will be enough or do i need to get from a trusted CA certificate to get LYNC client connected to the LYNC 2013 Server? For. E.G LYNC Mobile clients for iphone and etc. Does your Step-by-Step Guide will allow me to do so or do you perhaps know any good reference about publishing and accesing LYNC server from external network?

    1. An Edge server is required for proper external access, which I have not yet covered. You can refer to the Edge Server deployment section in the TechNet documentation for Lync or search around for some other related articles from other bloggers.

  9. Hi Jeff,

    Can you post the steps for accessing the LYNC server externally? especially the certificates requirement.

  10. Jeff, I am preparing for a greenfield implementation of Office365 and in preparation I would like to request my CA-SSL Cert prior to beginning the installation. The Cert will contain SAN entries for Exchange, WebApps, Lync and SharePoint. What SAN entries should I include for my Lync Deployment?

  11. It I want to test Lync in my environment with just a single server, would that server then need to be converted to a FE or BE once we decide to deploy it enterprise wide? Or do we just setup the new servers and start back from the top (excluding preparing AD)?

    1. You cannot convert servers from Standard Edition to Enterprise Edition, so you have two choices. Either deploy a single SE now, and then when ready for production deploy a full EE Pool and simply move the Lync users to the new pool, decommissioning the SE once it's no longer needed. Or deploy a single EE server in a new pool (complete with new or existing backend SQL database server) and then simply add additional server nodes to the same pool when moving to production. If you can handle the SQL requirements now for an EE pool then I suggest this route as it's less work in the end.

  12. Excellent article, Jeff. I ran into ACL errors when publishing the topology. Evidently, assigning the logged on user Full Control share permissions to the file share directory was not sufficient; I used the following resource to manually specify the necessary share permissions, which then allowed me to publish the topology successfully:

    1. In a normal environment this should work as I've described, but if there are customized permissions defined on administrator accounts then it may be required to added some additional entires, as that article has covered.

    1. I'm not sure in what context you mean, but there is no need for SSL offloading when dealing with load balancing of web traffic (HTTP/HTTPS) to internal front-end servers. Typically it is not recommended in Lync 2013 as there is no more use of cookie-based affinity in the mobility web services.

  13. Hello Jeff,

    I had a query for you.

    We have 5 separate domains in a Single Forest with two-way trust between domains. We are planning to deploy Lync 2013 On-Premise across all domains.

    1) What would be best possible approach to deploy Lync Servers ?

    2) We are planning to get 16000 Users (spread across 5 different domains) on Lync account, Can we have a Single pool managing all users ?

    3) What high availability options should we opt for ?

    1. A single pool can easily support 16,000 users if sized correctly, but you may want to look at running two pools (with ~8000 users each) to provide for pairing redunandancy as well as a localized arrangement for half of the users if it fits your network topology.

      1. Thanks so much for your response Jeff. We had another domain (in a different forest) that we need to add to the existing pool. Both the forests have two way transitive trust. Below is one such scenario i need answer for…

        We have two seperate forests and with two way trust enabled. We have multiple domains within the forests. Can we have one Lync enterprise pool in one of the domains within forest and have multiple SIP domains added to the same irrespective of the forest.

  14. Hi Jeff,

    Your articles are extremely useful and I have used them as a based for installing Lync 2010 and no we are looking to install Lync 2013. I just wondered if the cmdlet used to add the roles to a Windows 2008R2 (not 2012) server to prepare it for a Lync 2013 install are similar to that which you outlined in the Lync 2010 Deployment guide – Part 1. Obviously the role listed above for 2012 do not correspond 100% with a 2008R2 server.

    Many thanks

    1. The TechNet documentation covers the prerequisite components for both Windows Server versions, as they are slightly different.

  15. Hi Jeff,

    I have been looking for the reason why you install BITS (Background Intelligent Transfer Service) as a pre-requesite on the Lync server, but so far I have been unable to find a mention on it need for Lync 2013. Can you explain why this feature is installed?

    Many thanks

  16. Hi All,

    We have 2 enterprise lync 2013 server deployed with two building and both server are part of same Pool.

    Current configuration: = = =

    if lync-fe01 goes down we have to manually change the ip to

    So if 2 lync server are deployed with 2 site with good connectivity does DNS round robin will work fine or we have to configure Hardware load balancer?



    1. That is not a proper HA/DR configuration as spanned Lync pools are not supported like that. You should deploy one of the supported resiliency models like Pool Pairing. Also a 2 server Lync 2013 pool is not recommended; 3 servers is the recommended minimum for a single pool due to the new quorum design.

  17. Hi Jeff…
    Thanks for this article and the others that follow up to this one. I've had no problems following the instructions so far, but when checking ADSI Edit to verify the creation of the empty containers and then again to see what had been populated in them, I'm not seeing the CN = RTC Service container at all?? Everything else is checking out fine, just not seeing this container? What am I doing wrong??

    1. You may not have the Advanced view enabled, but I wouldn’t worry about finding it if everything else is working. If you have major issues with the deployment then this would be worth a closer look.

      1. Hi Again Jeff…
        When doing the deployment in my production domain, my first attempt to publish the topology 'completed with errors'. The deployment log showed several 'ACLError:Access permission error.' 'Error: Failed to save permissions on "\server.domain.comLyncShare". I manually set the permissons on the file share for the various domain RTC users/groups and was then able to successfully publish the topology. I also noticed that the Local RTC users/groups were not created in the Local Administrator groups on the server? Do you have any idea why and what I need to do to fix this problem??

  18. Hi,

    where can I find the Topology Builder logs? I want to review the "Next Steps" from the last Topology published.

    Thanks in advance,


  19. thanks for your post. but am getting “this product cannot be installed on a domain controller” message after running the “intall or update lync server system” on the deployment wizard.

  20. Ok I need help…I’m in the dark recesses of SQL.

    My environment is Im trying to deploy Lync 2013 in a small office environment on a single server. I run Server 2012 Hyper-V with two Server 2012 VMs, one is Lync and one will be WebApps

    I follow the above but I run into a problem when I publish the topology. It gives me an SQL error of:

    Install-CsDatabase – InstallDatabaseCmdlet.CreateDatabaseForFeature: An error occurred: “” “cannot open database “xds” requested by the login. The login failed. Login failed for user xx\xxxx.”

    I’m not really sure how the train came off the tracks, nor how to fix. I verified CsAdministrator and RTCServer Admins roles…any thoughts?

    1. If you are using the same domain administrator account for all installation steps then this should work. You may need to assign admin rights to that account manually in SQL if the SQL installation had a problem.

    2. Recently our installation of SfB 2015 started give me this error. Both with the account that was used to setup SfB and another account. both have CSadmin and RTCUniversal… membership. Nothing has changed that i know of yet i now get the errors.

  21. Hi Jeff,
    You touched on usage and downloading the BPA for Lync server. I’m trying to setup a powershell script that will call the BPA and pass it options for our domain and a location to write the results in. I’m having problems finding documentation IF there’s a way to pass rtcbpa.exe some command-line switches to accomplish this. Please let me know of a resource I can try (or cover it in a blog post!). Any help is appreciated.


  22. Do you need to have a Domain Controller for each Lync Site? Lync Pool? Pool01 is physically located in City01, and Pool02 is physically located in City02. Do they need to have separate domain controllers on their own physically location (City01 and City02 respectively)?

    1. DC deployment is unrelated to Lync/SfB pool in terms of functionality. Placement is dependent on the overall network design and desired resiliency and response time, as long as there is sufficient connectivity between all sites.

  23. Hi Jeff,
    Your articles have always been a great help but I couldn’t find any answer to a scenario that was presented recently to me.
    We have an existing Lync 2013 Ent. Deployment for a domain A, which is running fine. We also have domain B and C within the same forest and would like to provision users from those additional domains without creating additional SIP domain in the topology. What is the easiest way to achieve the integration of those domains within existing Lync topology?
    At this time those users (domains B and C) cannot be searched when trying to enable them for Lync.

    1. I’m not sure what you are tying to do but you must define additional SIP domains if you want to use SIP domains for those users in the same domain they currently use. If you are trying to move the users in domains B/C into SIP domain A you’ll need to migrate their Primary SIP URIs to the desired namespace.

Leave a Reply

Your email address will not be published. Required fields are marked *