Skype for Business Server 2015 Deployment – Part 2

June 19, 2015 by · 36 Comments 

Continuing from a previous post this article moves into the installation and configuration of the Skype for Business Server components for a Standard Edition Front End server.  As with the previous article any mandatory steps are identified by bulleted paragraphs while non-indented steps for validation and educational purposes are optional.


The second article in this series will cover the following deployment steps:

  • Defining the Topology
  • Deploying the Server Components
  • Verifying the Installation

Before performing these steps in this article make sure to successfully complete all of the prerequisite actions covered in Part 1 of this series.

Define Topology

Before installing any additional server components the Skype for Business topology must be defined.


Create New Topology

  • Launch the Skype for Business Server 2015 Topology Builder and then select New Topology.


    • Save a new .tbxml file with any desired name (e.g. 06072015.tbxml).

    • For the Primary SIP domain enter the desired domain namespace (e.g.

Add any additional desired SIP domains at this point , but a single SIP domain is sufficient for most deployments as well as this series of articles.

  • Select a Name for the first site to be created in the topology (e.g. Lab) and enter a Description if desired.

  • Specify the locality information associated with the first site and then complete the wizard.

At this point the Define New Front End Pool wizard should be automatically launched.

    • On the Define Front End Pool FQDN page select Standard Edition Server and then enter the Fully Qualified Domain Name (FQDN) of the Windows domain member server where the SFB prerequisites were installed (e.g.


  • Select the features which should be installed and enabled on this Front End server.  Later articles will cover the deployment of some of these additional features.


    • Retain the default enabled setting of Collocate Mediation Server on the Select Collocated Server Roles page.

    • On the Associate Server Roles with this Front End Pool page leave the option blank as an Edge Server does not yet exist.  This setting will be addressed when an Edge Server is deployed in a later article.

    • As this is a Standard Edition server then there will be no configurable options available on the Define the SQL Store page.  Take note of the automatically defined SQL Server store which is comprised of the server’s FQDN ( followed by the previously installed SQL Express instance name (RTC).


  • On the Define a File Store page enter the name of the Windows file share created in the previous section (e.g. SFBShare).


  • On the Specify the Web Services URL page the External Base URL will automatically be set to the same FQDN as the internal Front End server (e.g.  For the purposes of this article the default setting will be retained and in the future when external services are published this will be updated to reflect the external namespace.

  • The next page Select an Office Web Apps Server is used to either define a new OWAS pool FQDN or associate this server with an existing OWAS pool.  The next article will cover deploying this server role so simply uncheck this option and then click Finish to complete the wizard.  (Note that until this server is deployed that PowerPoint content sharing will be unavailable as this service is not handled by the Skype for Business Front End server role.)

    Upon completion the Topology Builder window should refresh and the defined settings will be populated as shown.


    • Back at the main Topology Builder window select Edit Properties on the Lync Server root-level object.  Highlight the Simple URLs section and enter the desired Administrative Access URL (e.g.  Technically his is an optional step as the administrative access URL is not required, but is a convenient way to access the Server Control Panel via a web browser internally.

    • Move down to the Central Management Server section and select the new Front End server (e.g. as the location to install the CMS component on.


Publish Topology

The final process is to publish the changes made to the topology into the Central Management Server database which also updates information in the RTC services container in Active Directory and sets up the folder structure and permissions on the file share.

  • From the Action menu select Publish Topology.  The local server FQDN for the Central Management Store location should already be populated in the drop-down menu due to the previous step.  If all configuration steps were performed correctly then the wizard should complete without any errors or warnings.


Deploy Server

Unlike most other Microsoft server platform products were installation of the actual server components is one of the very first steps, the Communications Server family has historically been different.  The server installation itself is quite hands-off and can be automated to a large degree.  The fair amount of activity up until this point has been geared around providing the backend components to store the overall configuration of the environment, which is now available for use by the server installation steps.


Install Skype for Business Server Components

The next step is to install a second SQL Express named instance called RTCLOCAL on the local server which will contain a replica of the existing RTC named instance.

Only the first Standard Edition server in the organization would contain the authoritative RTC instance installed in the previous article, while all other Front End Servers (and even Edge Servers) would contain their own RTCLOCAL instance to replicate the Central Management Store data.

As the Administrative Tools have already been installed on the server then the Skype for Business Server Deployment Wizard can be found in the Start Menu on the local server.  The installation media is no longer required as the installation files have been copied to the server.

  • On the Windows Start Menu search for ‘Deploy’ to locate and launch the Skype for Business Server Deployment Wizard.  From the main menu select Install or Update Skype for Business Server System.

  • On Step 1: Install Local Configuration Store select Run and leave the default setting of Retrieve the configuration data directly from the Central Management Store and complete the wizard.


Reviewing the results in the execution window should confirm that the second SQL Express instance of RTCLOCAL was installed as well as the core SFB Server components.

Checking prerequisite SupportedOSNoDC…prerequisite satisfied.
Checking prerequisite DotNet35…prerequisite satisfied.
Checking prerequisite SupportedSqlRtcLocal…prerequisite satisfied.
Checking prerequisite WMIEnabled…prerequisite satisfied.
Checking prerequisite NoOtherVersionInstalled…prerequisite satisfied.
Checking prerequisite PowerShell…prerequisite satisfied.
Checking prerequisite SqlUpgradeInstanceRtcLocal…prerequisite satisfied.

Secondly the Local CMS replica was instantiated by importing the configuration from the existing CMS database an then replicating the database data itself.

Import-CSConfiguration -FileName "C:\Users\ADMINI~1.JDS\AppData\Local\Temp\2\" -Verbose -LocalStore

> Enable local replica service

Enable-CSReplica -Verbose -Confirm:$false -Report "C:\Users\administrator.JDSKYPE\AppData\Local\Temp\2\Enable-CSReplica-[2015_06_08][13_17_14].html"

Additionally the replication of any certificates stored in the CMS is performed.  Although no certificates have been installed yet for this deployment had there been one then this action would have replicated any existing OAuthcertificates required for server to server MTLS communications.

> Replicate-CsCmsCertificates

Logging status to: C:\Users\administrator.JDSKYPE\AppData\Local\Temp\2\ReplicateCMSCertificates-[2015_06_08][13_17_14].html

To confirm the installation location of the RTCLOCAL database files on the server check the default SQL Server installation directory for the existence of the xds files.

%ProgramFiles%\Microsoft SQL Server\MSSQL12.RTCLOCAL\MSSQL\DATA


    • On the Skype for Business Server Deployment Wizard advance to Step 2: Setup or Remove Skype for Business Server Components and click Run to start the Set Up Lync server Components wizard.

Once again the Bootstrapper application will execute and perform a prerequisite check before installing additional components.  These include a third SQL instance called LyncLocal and additional Windows Speech components and foreign language packs.

Checking prerequisite KB2858668Installed…prerequisite satisfied.
Installing vcredist_11_x64.exe(/Q)…success
Installing WindowsFabric\v3\WindowsFabric.msi( REBOOT=ReallySuppress STARTUPTYPE=demand REMOVEDATA=yes IACCEPTEULA=yes TESTMODESKIPPREREQUISITECHECK=yes)…success
Installing MicrosoftIdentityExtensions.msi( REBOOT=ReallySuppress ALLUSERS=1)…success
Checking prerequisite SqlUpgradeInstanceLyncLocal…prerequisite satisfied.

Immediately following will be the installation of the Lync server components which make up the different services and roles on the Front End server (e.g. AVMCU, Mediation Server).


Verify that the installation task status was reported as successfully completed.


Create Default Server Certificate

Returning to the server deployment process the next step is to request and assign server certificates so that the Lync services can be started.

If using an Enterprise Windows CA make sure that before any server certificates are requested that the guidance mentioned in the Environment section of the previous article is followed.  In order to properly support PowerPoint file sharing to any Office Web App attendees which are on workstations which are not domain-joined then the default Windows Certificate Authority configuration must be modified.

  • Using the guidance covered in either of these two articles launch the Certification Authority (certsrv.exe) application and under the CA’s properties configure the CRL Distribution Point (CDP) and Authority Information Access (AIA) extensions to include the HTTP paths in any certificates issued and signed by this CA.

image     image

At this point any new certificate requests will include this critical information in the issued certificate.

    • Run Step 3: Request, Install or Assign Certificates and then expand the Default Certificate entry to verify that all roles are checked.  Click Request to start the Certificate Request wizard.


  • Populate the desired information making sure to select the SIP domain to add the sip.<sipdomain> record to the certificate.


The Friendly Name can be set to anything and is not actually part of the certificate request, it can even be changed after the certificate is returned and imported.  Note that although Lyncdiscover.<sipdomain> was not defined as an internal DNS record in the previous article the certificate wizard still includes this FQDN as a requirement for external support.

  • Submit the request to the online certificate authority and when the task completes successfully select the View Certificate Details button to validate the certificate status and that a private key was correctly associated.


  • Advance to the next wizard to perform the Certificate Assignment task.  In the event that the role assignment is accidentally lost between the request and assignment wizards then the assignment task might fail with an error that a Type has not been provided.  If that occurs simply cancel out of the wizard and return to the main wizard screen.  On the Certificate Wizard main screen If the checkboxes to the left of the Server Default, Web Service Internal, and Web Service External roles are no longer selected then reselect them and click Assign.

  • Verify that the proper certificate is highlighted (in the event that this server already has any other server certificates installed on it) and then complete the wizard, verifying that the task status is reported as Completed.


  • Back at the Certificate Wizard main screen the new certificate should now be listed on each of the three Default Certificate roles.


Create OAuth Certificate

As this is the first SfB server deployed into the environment then a new OAuth certificate needs to be created as well.  This is a one-time process as this certificate will be shared by any other SfB server which may be later installed.

  • On the Certificate Wizard main screen select the OAuthTokenIssuer role and then click Request.


  • Enter a descriptive Friendly Name and then submit the certificate request.


  • Advance through the assignment wizard to finish the OAuth certificate configuration in the same fashion as performed for the server certificate.

Start Services

In previous releases the services could be started directly from the deployment wizard as part of Step 4: Start Services.  With the addition of a new PowerShell cmdlet in SFB this task is now a manual one.  While SfB Server now includes a new cmdlet called Start-CsPool this is only intended for use with multiple node Enterprise Edition pools.  When dealing with a single server in a pool or a Standard Edition server as in this article then the previous guidance of using the CsWindowsService cmdlets still holds true.

  • Launch the Skype for Business Server Management Shell and execute the following Start-CsWindowsService cmdlet.



To validate the server status the Get-CsWindowsService cmdlet can be issued to list the individual SfB services.



Verify Topology

Utilizing the Skype for Business Server 2015 Control Panel the basic functionality of the new deployment can begun to be tested.


Before opening the Skype for Business Server 2015 Control Panel, just as with previous Lync Server releases, it is helpful to configure the local server’s Internet Options to bypass the the prompt for credentials whenever the tool is launched.

  • Open Internet Options, navigate to the Security tab, select Local Internet and click Sites, then click Advanced.

  • Enter the local server’s FQDN as a URL (e.g. and then save the changes.


  • If Silverlight is not already installed on the server than the Control Panel will report this fact.


  • Use the provided link to immediately download and install Silverlight on the local server.


  • Once the installation is complete the Home page of the control panel will be displayed.  Select the Topology menu and verify that the new server is listed and the Status and Replication fields are healthy.




With the conclusion of this article a functional Skype for Business Server should now be deployed and is ready for further configuration.  The next article in the series will cover enabling a test user account and then progress on with deploying additional server roles like the Office Web Apps Server.

About Jeff Schertz
Site Administrator


36 Responses to “Skype for Business Server 2015 Deployment – Part 2”
  1. Hey Jeff,

    Great write up as usual! You link at the top of the page appears to be broken “Continuing from a previous post”.


  2. Larry says:

    Since upgrading to S4B 2015, our Polycom HDX endpoints no longer have the ‘join now’ button, have you seen this issue?


    • Jeff Schertz says:

      Yes, this can be due to the wording in the invitation changing from “Join Online Meeting” to “Join Skype Meeting”. The HDX is unable to locate the Meeting URL because of that change. Given that the HDX platform is no longer under development I don’t know if it will be addressed or not in any future firmware updates.

  3. JP says:

    Hi Jeff,
    Will you also be publishing steps to enable Skype for Business is a hybrid configuration with Office 365?

  4. Sudhagar says:

    Hi Jeff..

    Always you are the first one in publishing artclies with implementation steps for Lync server.. Great stuff!!

    Thank you

  5. Bose says:

    Great article Jeff.

    Will it be possible for you to share some limitations/constraints in Sfb Server 2015. I know its too early, since SfB was RTM in May 2015 only. My area of interest currently lies in upgrade of Lync 2010 SBAs to SfB Server 2015 ( I know there is a direct upgrade path without going to Lync 2013 first). I want to know what all needs to be taken care when attempting this upgrade, what all is broken for which there is no CU/patch etc. Mainly focused around Cisco ISR SBAs.

  6. Todd Youngbauer says:


    We are deploying Skype for business 2015 in a multi-tenant deployment. We can get a CX500 and 600 phone to work on the root domain, but unable on the hosting domains for clients. Any ideas, we are struggling.


    • Jeff Schertz says:

      Todd, Lync Phone Edition devices are only supported by Microsoft for On-Premises single-tenant and Office 365 environments. Other multi-tenant hosted environments are not supported, the VVX model of phones can address this limitation.

  7. Marty van den Bosch says:

    I recently upgraded our Lync 2013 standard pool and edge server to Skype for business 2015.
    We had a Polycom DMA and RMX configured as per their doc (Trusted application pool in topology).
    Upgrading to Skype seem to have broken functionality – The Lync error suggests that it is not trying to hit the DMA by the Trusted app pool fqdn instead of the actual DMA fqdn specified – this all worked prior to upgrade. If I remove the multi-computer pool and instead create just a single computer pool and use the DMA’s fqdn that way – it works but of course, then the RMX fails (ICE/OCS reg failure)
    I have been working with Polycom but not getting anywhere.
    I will reach out to MS as well, but grimace that impending back and forth 🙂

    Have you experienced issues with Multi-Computer trusted application pools using Skype for Business? Any light you could shine on this would be great.

    • Jeff Schertz says:

      Usage of a multi-computer pool is still best practice and is required as both the DMA and RMX need to be defined. I’ve not seen this yet, but make sure that you are using the latest firmware on each component for official SfB support (DMA 6.3, RMX 8.6).

  8. Charl says:

    Anyone had the issue when deployed SFB 2015 edge server with single external IP and NAT enabled I get an SSL Certification error from “The Microsoft Connectivity Analyzer is attempting to obtain the SSL certificate from remote server on port 443.” I am using a wildcard Certificate and all services are running on my edge server. Any suggestions?

  9. Girish says:

    I am not able to install Web Components Server and Enterprise Web Application Server for Skype for Business Server 2015.
    Setup shows status as completed.

    Plz suggest.

  10. jennifer says:

    quick question Jeff. I want to do a swing migration (not really comfortable doing an in place migration and I have the hardware), is the process the same as when performing the upgrade from 2010 to 2013? only this time, have a 2013 enterprise pool and a Skype enterprise pool co-existing?

  11. Allen George says:

    Hi Jeff,

    I wanted to say thank you for the documentation. I used your stuff when we deployed our Lync pilot internally and now for the Skype upgrade. I have deployed a new pool and plan to migrate users from the Lync pool to the Skype pool.

    I just finished installation of Skype for Business, but now I cannot log into the Control Panel. It just accepts the credentials and then prompts again. I am a domain administrator, and in the proper RTC admin groups. After prompting 3 times I get a 401.1 error. I am trying to find something in the logs to point me in the right direction, but I haven’t found anything. Have you seen this before?

    Thanks in advance!


  12. Chris says:

    Hi Jeff,

    big thanks for this guide. I’m curious about the tnext series!

    Thanks again,

  13. Tolu says:

    Hi jeff,
    I have a sfb server and lync 2010 server running side by side. I also have one rmx2000 which has been integrated with lync server 2010. Currently I’m testing realconnect with sfb. Can I run all required sfb configuration script to the RMX without affecting Lync Server. I know RMX can only register to one SIP server at a time, but is there any impact configuring sfb to point to single rmx.

    • Jeff Schertz says:

      No that will be fine. Typically I remove the entire configuration in Lync and then reconfigure everything with the new SfB Front End pool as the Trusted Application’s next hop pool.

  14. howie says:

    What is the process for using a third party vendor for the cert I have not had much luck. I have done self assigned and been able to manually install cert on client and it works.


    • howie says:

      Upon importing the cert I get it does not match because of the .local which I am doing split DNS any suggestions? so the service wont run because of it not matching is there a way with powershell I can exclude or something??

      • Jeff Schertz says:

        I’m not sure what you are trying to do but if the FQDNs do not match exactly then the certificate will not be accepted.

        • howie says:

          Do you have any info on Application Web Proxy and ADFS for lync for outside access?
          I have setup ADFS and Web app proxy on my DMZ network.
          Just need to tie them together now

  15. Ryan says:

    I recently performed an in place upgrade and even though the upgrade went smoothly without any errors I can longer communicate with any of our federated partners. Their status shows as presence unknown.

    Federation was working fine before the upgrade.


  16. Paul L Fisher says:

    Something that is very important, you need to right click, ‘run as administrator’ for most of the functions. The one that is most important is the deploy step, otherwise the creation of the directory tree and it’s appropriate permissions for the shared folder will not work.

    Also, the databases will not create is the server name doesn’t match when installing Standard version.

    Other than that, a very comprehensive writeup.

  17. Will says:

    Hi Jeff,

    Awesome blog. Do you have any pointers for cross-forest migration of SFB where the namespace must remain the same?

  18. Gustavo says:

    Hi Jeff am from Guatemala and managed to successfully implement SFB through the tutorial you posted, but unfortunately I can not login in the client SFB, apparently tells me it’s a problem with certificates.

    In my domain controller I installed the important role of CA however have doubts about how I configure this service, Could you help me?

    • Jeff Schertz says:

      Gustavo, you can just follow the basic CA deployment articles available on Microsoft TechNet. Make sure you create the root CA certificate using SHA1 or SHA2 and no more than 4Kb in key length.


Check out what others are saying about this post...
  1. […] concludes the preparation of the environment and the next article in this series will address defining a new topology and installing the SfB Front End server […]

Speak Your Mind

Tell us what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!