These Microsoft KB documents where updated on the last 24 hours, got me puzzled:
KB3080353 (25/09/2015): Description of the security update for Microsoft Lync Server 2013 (Web Components Server): September 8, 2015
“To install this security update, you have to install the latest July 2015 update Lync Server 2013.”
KB3098577 (24/09/2015): Sign-in and query errors after you install MS15-104 Security update for Microsoft Lync Server 2013 (Web Components Server)
“After you install security update 3080353 …, you experience one or more of the following symptoms in Microsoft Lync Server 2013:
- Users can’t sign in to your dial-in page.
- Lync Mobile clients can’t sign in.
- External clients can’t sign in.
- Address book web queries fail.
- Users are prompted for credentials for some web services after they sign in internally to Lync desktop clients.”
But below on the KB text:
“If you install Lync security updates by using the Cumulative Server Update Installer (LyncServerUpdateInstaller.exe), the installer should prompt you to install the correct prerequisites
Security update 3080503 (MS15-104: Security update for Microsoft Lync Server 2013 (Web Components Server): September 8) can be installed without previously installing the required July 2015 cumulative update 5.0.8308.920 for Lync Server 2013.”. A new version of LyncServerUpdateInstaller.exe is shipped together with the security update.
My concerns are:
- The issue is applying the September “WebComponents.msp” (you can find it separately on the download details) on the download patch without updating the one from July (ex: using windows update)
- The “LyncServerUpdateInstaller.exe” is basically a package of the most recent released .msp files for each components
- So, what WebComponents.msp version is inside the September LyncServerUpdateInstaller ?
Just for the safe side (since I have a large deployment with 4 pools and 28 Lync Servers), I will apply the July 2013 LyncServerUpdateInstaller and after that the September one.
Time to compare to the July and September 2015 updates. It all comes to the WebComponents.msp content. Beyond the ~1500 files with some date differences, we have this:
|Filename||Date||July 2015 CU||September 2015 SU|
|WebComponents.msp comparison||1511 Files total||1507 Files total|
|expressInstall.swf||29.04.2015||included in .msp||Not included in .msp|
|NAPImessage.swf||29.04.2015||included in .msp||Not included in .msp|
|Swfobject.js||29.04.2015||included in .msp||Not included in .msp|
|[Lync_Install_Dir]\Web Components\Web Scheduler\Ext\Scripts|
|jquery.js||21.07.2015||Not included in .msp||included in .msp|
These file are part of the puzzle, especially if they are not part of the first release of Lync. They ‘swf’ were introduced on the December 2014 CU, and update on May 2015 CU and July 2015 CU (check the file information section on each KB). This means that applying the Lync servers with September 2015 SU without the May 2015 CU, you will have any old version or even none (if you didn’t applied nothing before December 2014)