Resetting configuration data or rolling back the firmware on Lync IP phones is one of the most basic troubleshooting procedures, but at the core is also often misunderstood.  This article will cover the reset procedures as well as explain what is actually happening on the devices.

Although most of the instructions in this article have been covered in various past articles it may be difficult to locate when incorporated into separate, larger topics.  In an effort to provide a single resource for the simple task of resetting different Lync compatible Polycom IP phones, as well as explaining what the reset is actually doing, creating a separate dedicated article seemed logical.

The phones covered in this article fall into two separate categories: Lync Phone Edition (LPE) optimized CX devices and Third Party Interoperability Program (3PIP) qualified devices.

These categories are quite different in their design.  The Microsoft Lync product team designed and owns the LPE software and any devices running this are basically ‘dumb’ handsets which can do nothing until they are first successfully registered to a Lync server which will provide all possible configuration parameters in-band.  Meanwhile the Polycom 3PIP devices utilize Unified Communication Software (UCS) firmware which was designed prior to Lync compatibility so these devices are capable of much more and may only receive a subset of their possible configuration parameters during Lync registration.  Many other parameters can be set out-of-band using different methods which can then be stored in different configuration containers.  Additional background on these two different device families can be found in this recent article.

Lync Phone Edition

The common range of Polycom CX model phones which run LPE are very simple devices and actually performing a reset is straightforward.  But it is important to understand exactly what ‘resetting’ a device means and what happens when the events are triggered.

There are two types of reset procedures which accomplish different tasks in LPE.  In the official Microsoft documentation these procedures are described as either a Hard Reset or a Factory Reset, yet these terms can be a bit misleading.  Often people may refer to a partial reset as ‘soft’ but a full reset as ‘hard’ which already does not match up with the official terms.  Secondly in LPE the ‘factory reset’ process as it is called does not actually perform a factory reset in the traditional sense of the term.  These processes were originally documented in the article Externally Provisioning Lync Phone Edition.

Note that these reset processes are different between the Aries family of phones (CX500/600/3000) and the older Tanjay phone (CX700) models.

Wipe Configuration

The Hard Reset process performs one task: it wipes all configuration data currently cached into the phone.  It simply blows away the user credentials, downloaded root certificates, issued client certificates, in-band user configuration parameters, the cached device lock code, time zone setting, etc.  Basically everything expect the firmware version itself.  Whatever version was active before this process was triggered is left unchanged.

Polycom CX500 / CX600 / CX3000

• • To wipe the configuration simply press and hold both the * and # keys on the phone and then connect the power source to turn the device on.  Continue to hold the keys for approximately 10 seconds until the following message appears: “The operation you have requested will erase all user-created data.”

• Select Yes to confirm the action and the device will reboot, wiping the current configuration.

Polycom CX700

• To wipe the configuration data locate the physical, recessed reset button located on the bottom of the device between the USB and headset ports.

• While the device is already powered-on use a straightened paperclip or another small tool to depress and briefly hold the device reset button, releasing it after the reboot is triggered.

Revert Firmware and Wipe Configuration

The Factory Reset process performs two tasks: wiping the configuration data and reverting the firmware to the previously installed version.

It is important to understand that this process is not reverting the phone to the version of firmware that was preinstalled on the factory, unless the device has never been updated since it was originally installed.  This is the most commonly misunderstood concept of this topic.  This is why the term ‘Factory Reset’ is not an ideal name for the process.

Exactly what version it will be reverted to cannot be known until the phone reboots and the version number can be verified in the System Information menu.  The previously installed version could be older or newer depending on the update history of the phone.  In most cases where devices are systematically upgraded throughout each Cumulative Update (CU) released by Microsoft then it would most likely be one version older.

Polycom CX500 / CX600 / CX3000

• • To revert the firmware and wipe the configuration simply press and hold both the 4 and 6 keys on the phone and then connect the power source to turn the device on.  Continue to hold the keys for approximately 10 seconds until the following message appears: “The operation you have requested will reset your phone to factory default settings.”

• Select Yes to confirm the action and the device will reboot, wiping the current configuration, and reverting the firmware to the previously installed version.

Polycom CX700

• While the device is running use a straightened paperclip or another small tool to depress and briefly hold the device reset button, releasing it after the reboot is triggered.

• After the device reboots perform the screen calibration to complete the initial setup and then depress the button again in the safe manner before.

• Repeat this reset and calibration cycle a total of five times to trigger the phone to revert to the previously installed firmware.

This tedious manual process triggers the device’s built-in protection mechanism where a corrupted firmware load that causes the device to crash on bootup.  If this happens five times in a row then the device assumes the current firmware is longer longer functioning and will then revert to the last version.  Manually triggering this is the only way to revert the firmware, and this process was clearly simplified in the Aries family to a single step.

Firmware Storage Design

Most administrators would typically think of the ‘factory reset’ phrasing as synonymous with reverting a device back to the exact configuration it was shipped from the factory with, which might include both the parameter configuration and the version of firmware.  That type of reset is very common among networking devices for example, and is typically accomplished by the device having some read-only area of memory in which this original firmware is saved and can always be recalled.

Yet LPE was not designed this way at all.  Going back to the original Tanjay device running the first release of Lync Phone Edition all LPE devices use the same design of a dual-partition design consisting of an Active Partition and and Inactive Partition.  Each of the two areas are completely independent and can store a full, separate firmware image.  This design allows for two different firmware versions to be installed allowing the phone to switch between them when needed.  Note that LPE will never have the same version of firmware on both partitions, the other partition’s firmware must be unique whether it is a newer or older version.

For example a brand new device might leave the manufacturing line with only the original RTM firmware release installed and the inactive partition might still be blank.  (This example is solely for educational purposes and does not reflect what may or may actually be performed by device manufactures on brand new phones.)

An update is applied to the phone to bring it up to a more recent firmware version (e.g. 4.0.7577.4397).  This new version is applied into the other partition which now becomes the active partition.  The previous 4.0.7577.0 version remains intact in the original partition which is now deactivated.

When another firmware update is applied to the phone for an even newer version (e.g. 4.0.7577.4420) then the downloaded version is again installed into the inactive partition, overwriting the previously stored version (4.0.7577.0).  The phone reboots and swaps the active and inactive partitions.  The previously active 4.0.75774397 version is now the inactive partition and would be available if manually reverted using the process shown above.

At this point it should be evident that it only takes 2 updates to being purging older versions permanently from memory as the phone switches back and forth, overwriting each partition in turn.

The benefit of this design is that upgrades or downgrades will be applied to the inactive partition while the phone is running which minimizes any impact to the device user.  When the defined period of inactivity is reached then the device will reboot and switch to the other partition which only adds a few additional minutes to the normal reboot process.

One limitation of this design though is that there is no hardcoded original factory image saved in the phone, only the version that was last installed which exists on the now-inactive partition.  So as multiple upgrades are performed over time the older versions are overwritten.  In the unlikely event that a much older version is required on the phone for some reason then the device can not be rolled back to that version simply be performing a device reset.  Instead the older version of firmware must be uploaded into the Lync Server and approved which will trigger a downgrade process as the device locates the different version on the server, downloads it, and then installs it into the inactive partition.  All LPE devices (aside from the discontinued Tanjay CX700 model which is impacted by a certificate change) can be upgraded or downgraded from any version to any other version across the twelve packages released by Microsoft to-date since the original Lync 2010 RTM firmware.

Unified Communications Software

The larger range of Open SIP and Lync Compatible/Qualified Polycom IP phones in the SoundPoint IP, SoundStation IP, and VVX model lines all utilize the same Polycom-designed UCS firmware.  These phones are much more powerful in terms of configurability and thus the reset process can be a bit more complicated to understand.  This does depend on the environment configuration though so in many scenarios resetting a phone can be a one-step process, while in other deployments it may take a few reboots to completely wipe all configured parameters.

The biggest difference in the reset processes between these and LPE devices is that there is no way to change or rollback firmware directly from the phone itself.  These devices do not store any secondary firmware images so access to some type of provisioning server or hosted software server is required.  The web management UI included in UCS devices can be used to manually upgrade or downgrade the firmware from either the Polycom Hosted server on the Internet or a custom download server.

As there are multiple storage containers for different parameter types and configuration methods then there are also multiple options available for wiping portions or all of these.  The guidance is different depending on whether or not a central provisioning server is deployed and in use.  If there is no separate provisioning server in place and the phone receive all of their configuration data directly from the Lync Server during registration then resetting the phone is a basic one-step process.  But in the event that the phones are configured to use a central provisioning server then multiple steps may be required to insure that all settings have been permanently erased for a phone, which is a more advanced process.

This process was originally documented in the article Polycom Qualified Lync Phones with PIN Authentication.

Basic Reset

If you have no idea what a provisioning server is or you know that one is not defined on the network then all device parameters are stored on the phone only.  These can be a combination of settings defined directly on the phone, passed in-band from the Lync server during registration, set manually on the device’s web management user interface, or imported into the phone from a static configuration XML file.  Regardless of the method used a single action will be able to revert all of these settings to the factory default configuration.

• On the phone access the main menu from either the Home key or the Menu key, depending on the device family.

• Navigate to the Settings > Advanced menu and then enter the device administrator password, which is ’456’ by default, and select Enter.

• Then navigate to the Administration Settings > Reset to Defaults menu.

There are five available menu options which each perform different tasks, some of which can overlap.  These options will be explained in more detail in the next section but for now only the Reset to Factory option is needed as this will reset the entire configuration.

• Select [5] Reset To Factory and confirm the action by selecting Yes.  The phone will immediately reboot into the factory default configuration.

Alternatively there is also a shortcut to triggering the Reset to Factory option as shown in the steps above which can be used from basically any menu of the phone, even prior to the application software starting up when the phone is first powered on. The UCS firmware contains various different Multi Key Combination (MKC) codes which can be used to perform different functions or jump directly to some specific configuration menus.

As some models use different MKCs for the same actions the following table is provided as a quick reference for convenience..

Device	Factory Reset MKC
SoundPoint IP 321, 331, 335, 450 SoundStation IP 5000, Duo	1 3 5 7
SoundPoint IP 550, 560, 650 VVX 1500	4 6 8 *
VVX 300, 310, 400, 410, 500, 600	1 3 5

• Press and hold (in any order) the MKC for at least 3 seconds to trigger the reset process for the specified phone model.  (For example on a VVX 500 press and hold the 1, 3, and 5 keys.)

• Enter the device administrator password, which is ‘456’ by default, and select Enter.  The phone will trigger the reset and reboot immediately.

Advanced Resets

A lengthier process is applicable when a provisioning server is already in use and the phone has pulled some configuration settings down from this out-of-band server as well as uploaded some of the local settings back up to the server.  This read/write approach provides the phone the ability to have a central provisioning method for any required parameters (e.g. corporate background pattern) and also save any of the individual user’s customization (e.g. ringer volume).  Whenever settings are modified on the phone or via the Web UI then the phone will write these to files which are automatically created on the provisioning server.

Before addressing the full reset process it is important to understand the different menu options and how they apply to the device files saved on the provisioning server.  This helps to select the correct option for the desired reset process.

As covered in a previous articles the provisioning server is simply a file server which stores different shared and unique files for the phones.  Among these files are two types: manually created and automatically generated.  During the initial provisioning server configuration an administrator may choose to define one or more static configuration files to store both common and device-specific parameters.  These administrator-managed static files are not modified in anyway by the individual phones and are treated as read-only.  In the event that the provisioning server path is provided via DHCP to the phones then even after a full factory reset of the device it will automatically relocate the file server and reapply any configuration parameters defined in these static files.

The other file types used by the phone are automatically created the first time it connects to the assigned provisioning server.  Some of these files are used to store log data (*.log)while others are used to store backup configuration data (*.cfg).  The phone will create files using its MAC address with suffixes of  “-phone.cfg” and “-web.cfg” to store parameters assigned using different methods.

The phone stores all configuration data internally in one of three containers: Local, Web, and Device.

The first two containers are defined by the method used to define the parameters, meaning that any settings modified directly on the phone are stored in the Local Configuration container and any settings configured using the web management UI by connecting to the phone’s IP address using a browser are stored in the Web Configuration container.

The third container, Device Settings, is a special category of device.* parameters which are always stored here regardless of what method was used to actually define them.  An example of a device parameter would be the Base Profile setting which is accessible from both the phone menu and the web UI, but it does not matter where it was modified as it is always stored in the Device container, not the Local or Web container.

In the following screenshot the two configuration files are highlighted for a device with the MAC address of 0004f2831d71.

Viewing the 0004f2831d71-phone.cfg file shows that a user-selected ring tone volume has been saved back to the server.  This parameter was set on the phone itself and thus it was saved in the Local Configuration container.

Viewing the 0004f2831d71-web.cfg file shows that a user-selected ring tone pattern has been saved back to the server.  This setting was selected using the web management UI and therefor it was saved in the Web Configuration container.

Any of the special device parameters are not backed up to the server and are only stored in the phone’s memory.

This complex design provides granularity for various levels of reset methods for phones which have multiple sources of configuration data..

For one, if a device is malfunctioning the settings can be wiped from the phone itself but much of the customized settings would be left intact on the server so that after a reboot these settings will be downloaded and reapplied to the phone.

• Navigate to the Reset to Defaults menu as shown in the previous section.

• Select [5] Reset to Factory to wipe all configuration containers on the device.

After the phone reboots any local or web configuration which was previously saved to the provisioning server will still be intact and the phone should connect to the file server and reapplied these parameters into the phone.  Any of the device.* parameters would have been purged and if they were previously defined from either the phone or the web UI then they would be gone.

Alternatively if it is desired to permanently wipe all customized settings for a device then the phone can be told to erase the saved settings on the server as well as wipe them from local memory so that after the reboot there will no longer be any customized parameters on the server to apply.  Note that only the –phone and –web files can be overwritten by this process.  Any administrator-defined settings stored in the managed files will not be touched and will still be reimported into the phone after this process is completed.

• Navigate to the Reset to Defaults menu as shown in the previous section.

• Select [1] Reset Local Configuration to wipe any local settings both on the phone and on the provisioning server.  The phone will automatically connect to the file server to remove all override parameters in the MACADDRESS-phone.cfg within a few seconds.  If the phone automatically reboots wait for it to complete and then return to the Reset to Defaults menu.

• Select [2] Reset Web Configuration to wipe any web UI settings both on the phone and on the provisioning server.  The phone will automatically connect to the file server to remove all override parameters in the MACADDRESS-web.cfg within a few seconds.  If the phone automatically reboots wait for it to complete and then return to the Reset to Defaults menu.

Ignore the option to reset Device Settings as these settings will be cleared in the next step anyway.

Also make sure not to select the Format File System option as this will forcibly delete the application software on the phone, leaving only the BootROM.  If that happens the phone will no longer function correctly and will need to be pointed to a provisioning server in order to download the firmware and reinstall the application software portion.

• Select [5] Reset to Factory to wipe any remaining configuration on the device.  After the automatic reboot the phone will start with default settings plus any administrator-provisioned settings which may be statically defined on the file server.

To summarize the behavior of the various options the difference is that Reset to Factory will wipe all settings on the phone only, where as manually selecting options [1] and [2] first will forcibly delete any saved override settings on the server as well as wipe all settings saved in the phone itself.

Recovering a Locked Phone

Finally, a little known but important behavior to understand is how to recover a device in which the administrator password has been changed and forgotten.  Comparatively this problem cannot occur on LPE phones as the reset procedure clears all user data, including the device lock PIN which may have been set.

Because UCS devices include an administrative menu on the phone as well as the ability to change the default administrator password then it is possible to be locked out of a device.  In the event the password is unknown a factory reset can be triggered on the phone using the MAC address of the device as the password.  Note that this process can not be used at access or modify any protected administrative settings on the phone, it can only be used to trigger a factory reset and only when triggered in a certain way: during initial bootup of the phone.

• Power cycle the phone and watch for the message “Starting application, press Cancel to interrupt” to be displayed, and then quickly select the Cancel button as this menu will only appear for a brief moment.

• At the Welcome screen a countdown timer will begin.  Press and hold the About menu to locate and record the MAC address (or just flip the phone upside-down and look at the label on the bottom of the device).

• Release the About key to return to the Welcome menu and before the timer expires press and hold the reset MKC (listed in the table earlier in this article) and a new new should appear prompting for the password to reset the phone.

• Enter the device’s MAC address as the password and then select OK to reset the phone.  This will wipe settings exactly as described earlier in this article and in doing so will return the administrator password to the default value of ‘456’ allowing access back into the device to be provisioned again.

Entering the password in this menu is quite cumbersome, so the following guidance should be read closely before attempting this for the first time, otherwise this exercise may result in a phone being smashed into hundreds of little pieces.

When entering the password the first softkey (1->Aa) indicates the default character entry mode of Numeric (1) in front of the arrow (–>) which is followed by the other entry modes of Capital Letters (A) and Lowercase Letters (a).  Repeatedly tapping this softkey will infinitely scroll through the three different character input modes.  So if the MAC address starts with a number then simply tap the appropriate key(s).  If or when a letter is reached then use the softkey to toggle between numeric, capital letter, and lowercase letter modes.  For this purpose only the numeric (1->Aa) and capital letter (A->a1) modes are applicable.

When in numeric mode a single key press will only enter the number on that key and immediately advance the cursor.  But when in letter mode the key may need to be pressed multiple times to cycle to the desired letter assigned to that key.  So for example selecting the letter ‘A’ is as easy as tapping the ‘2’ key once.  But note that the cursor does not immediately advance in this mode as there is a 2 second delay while the phone waits for any additional keystrokes in the event the latter characters on that key are desired.  So make sure to wait until the blinking cursor reappears before entering the next character in the password.  In the instance that the letter ‘E’ is needed then the ‘3’ key would need to be depressed twice in rapid secession in order to scroll over the ‘D’ and stop on the ‘E’.

Because the entered string is hidden by stars there is no way to confirm the actual character being entered so it is critical to pay attention to the timing and order of keys pressed.  Most likely it will take multiple attempts to be successful, but it does get easier with practice.  Repeating this character entry in other phone menus which show the characters briefly before changing them to a star is helpful when trying to understand the input logic.

Here are the exact keystrokes to reset a phone with an example MAC Address of 00-04-F2-AA-81-4C:

Character	Actions
0	Press the ‘0’ key once
0	Press the ‘0’ key once
0	Press the ‘0’ key once
4	Press the ‘4’ key once
F	Select the input modifier once to toggle into capital letter mode Press the ‘3’ key three times quickly
2	Select the input modifier twice to toggle back into numeric mode Press the ‘2’ key once
A	Select the input modifier once to toggle into capital letter mode Press the ‘2’ key once Wait for two seconds for the blinking cursor to return
A	Press the ‘2’ key once
8	Select the input modifier twice to toggle back into numeric mode Press the ‘8’ key once
1	Press the ‘1’ key once
4	Press the ‘4’ key once
C	Select the input modifier once to toggle into capital letter mode Press the ‘2’ key three times quickly

The lesson learned in this last section is do not lose the administrator password and there should never be any need to do this 🙂