Why SfB fails to join meetings?

It’s time to explain the logic of a Skype for Business client joining a meeting and a ‘hidden secret’. I will not go throw all the details. Some parts of the process are not include to keep the content less boring and confusing.

Nowadays, with the majority of users in Homeoffice environments, the company networks have ‘extended’ and included different type of secure/VPN remote access. They were also forced to open SfB external access for collaboration with employees and business partners.

This has exposed one particular behavior to the end-user thats your SfB infrastructure has a problem while connecting to meetings.

The SfB Join meeting logic

A typical and formal SfB meeting has the following sequence. Here’s an overview of the process before the detailed explanation:

SfB-meetingProcess

(1) The presenter creates an Outlook invitation (using the SfB meeting plugin). This generates a meeting link url where participants can click and join. The presenter can also (should) adjust the meetings settings and permissions and then (2) send the email to the participants.
SfB-meetingInvite

(3) The participants just need to press the link to join the meeting (or dial the phone numbers), right?
Now it all depends on a series of factors from the computer software to the network where the user is. The meeting url is a web link, so 99,5% of the participants will be able to open it. What happens next is ‘SfB sweet magic’

  • If you have a SfB client installed it will launch it to join. If not, then the participant can use the web browser to install and launch the ‘Skype Meeting app’ plugin to join the meeting
  • If you are using a personal computer at home, or the SfB client on your mobile, the probability to join the meeting is very high
  • If you are joining a meeting from a colleague and you have a company computer the probability is also very high
  • If you are joining a meeting hosted by another company, then a series of conditions will trigger the SfB client behaviour.

This last situation is the one I want to explain, either if you are a SfB user or system administrator to understand why sometimes you will not be able to join the meetings.
The SfB federation/meeting guest policies define if and how the users can join meeting.

(3a) If both companies SfB are allowed to federate, the participant SfB client will try to reach the SfB servers (throw the Edge server and then to the internal servers hosting the conference)

(3b) one or both companies are not allowing federation with each other, but the the meeting policies allow guest participants, then the SfB client will try to join as a guest. Internally it launches an instance as anonymous so it can bypass server validation. You can see this on the Client logs (at it also appears on the Monitoring reports)
SfB-meetingAnonymous

(3c) of course, if neither federation and meetings guest access is allowed, then participants from other companies will be unable to join.

The ‘security and network policies’ factor

As you could read, SfB has a lot of resources to be able to help users to join a meeting. But the scenario 3b presents a new challenge when the user is behind the company network security architecture:

  • If you connect to your company network ‘on-demand’ (you can connect/disconnect the VPN) or if you have a split-tunnel VPN in place, the probability to join the meeting from other companies is very good
  • But if you inside your company network of if you have a allway-on VPN (you cannot disconnect it and use you home internet connection) with a forced Tunnel (all your computer traffic must go throw the company network firewall), then the probability to join the meeting from other companies is very low

To explain this let’s use the same meeting flow diagrams with the network.

With federation allowed between companies, users will join the conference. The audio and video will go either directly (homeoffice) or throw the SfB Edge servers (VPN and LAN users)
SfB-meetingFlow-WithFed

But if federation is not allowed between companies, the SfB client will try to join as a guest. But now the audio/video must go directly to the Presenter Edge server as it cannot use the Participant’s Edge servers (not authenticated).
Why? because the companies network firewalls usually block any desktop client attempts to access directly the internet. Understandable, because the audio and video ports are sometimes dynamic and cannot be properly inspected.
SfB-meetingFlow-NoFed

The bad image

As an IT engineer you now know why the client will fail joining meetings.
But for the less informed user, all that he sees is the yellow warning/error information when SfB fails to join a meeting. And since the initial part of the joining is web traffic, the client might actually open and join, but then the audio fails and the meeting ‘dies on the beach‘.

For Sysadmins the SfB is working fine, but for the frustrating Presenters and Participants SfB is just failing: ‘SfB is a *”&*√ß%, VIPs escalate incidents,…

Many companies rushed users to homeoffice, asked the network teams for VPN access but forgot to involve the UCC teams on the process, flooding them with tickets and complains

The workaround

There is no 100% solution for this and the issue is actually related to processes:

  • Allow federation between companies
    If not using open federation, you need to allow it the domain that is blocking it
  • Solve the internal firewall blocking
    It’s more a political/security issue than a technical one ūüôā
  • (or) allow VPN Split tunnel
    it might solve not just this, but other issues when trying to join meetings from other 3rd parties
  • Sometimes it takes two sides to solve the problem
    Ex: you SfB sysadmin might solve the problem of you to join external meeting, but for external parties to join your meetings it requires solution from the SfB/network admins from the other party
  • Keep the 1st line of enduser support aware of the new network complexity and how to troubleshoot
    They now have not just to check the LAN and VPN, but also any mix of homeoffice internet access, private computers,… ūüė¶

Final note: “Microsoft Teams is better” (?)

By this time and after these and other ‘issues’ every SfB Admin already heard everyone commenting: “MS Teams is better”. “I don’t have these problems with Teams”, “other companies are better with teams… we are stuck with this limited SfB”

Well, this particular “issue” will also happens if you use Teams and if your network is configured the same way.
And it would be even worse: You would not be able to use audio or conferencing!
Why? because the Teams client also uses the same audio/video logic for ports. The firewall will block the same way as is does for SfB.

Because of this, a participant that doesn’t have Teams or SfB will not be able to join any meeting invitation if they are inside their company LAN/VPN.
(There are actually companies that use other UCC solutions other than MS, you know ūüėČ ?)

But it’s not failing, why?

This is the unfortunately difference between the company SfB engineer and an Official Microsoft consultant.

Microsoft has documented pre-requisites for Office365 and Cloud services. Between them, the requirement to allow audio/video ports access from internal networks to O365 media servers.
No one will block/object this against MS, but the SfB engineer as to struggle internally to get the same results.

 

 

Workplace contingency plans: the hidden issue

iStock-920982208-AndreyPopov-1200x600-600x300The Covid-19 pandemic caused an worldwide cause for concern. The best way to contain it is to reduce people direct interaction.
Some governments already imposed travel bans, forbid crowded events and closing schools.
Companies also limited travelling and ultimately send people to home office.

This is a great case scenario for companies to have the right UCC solution in place.
People can still collaborate, arrange meetings on the ‘safety’ of their home without the risks of public transport travelling, office doors knobs, next desk colleague or customer meetings.
Now, Skype for Business and others become a critical tool for companies.

But there is a ‘unexpected catch’ for companies to send half or more of their workers home: How do workers access the company internal resources? usually using a VPN.

Suddenly, companies have a large number of people using the internet speed and bandwidth to fighting for access to the systems (and also the Internet) -and it’s probably not the 1Gpbs per user as on the office LAN –

Now this old feature topic raised again.

The issue

Besides the issue of available bandwidth (including the one at home), how this can this get worth?

Sound_featureSome companies have VPN policies (either to security reasons or simplified administration) to enforce all their managed PC to send all the traffic throw the VPN (let’s call it ‘Forced-tunnel VPN’).
This includes applications traffic, emails, files, internet browsing including video content and… Skype for Business (SfB)!

As you already imagine people expect audio, video and the shared contents to be real-time but the SfB client is competing with:

  • Other applications loading files, email, video from the same tunnel
  • Double encryption/decryption: SfB encrypts his traffic and the VPN encrypt the traffic that is sent over the internet

If not well planned or prepared, IT support is going to have a flood of disgruntled users complaining about voice quality issues, failures, and unsuccessful meetings.

‘Force-tunnel VPN’ creates an additional problem for real-time protocols. Instead of delivering the packets to the shortest route possible, it will take a very long path in some cases. Let’s use the following picture to show you that:

Sfb-ForcedTunnel

There are two evident situations:

  • The calls between two home office worker of the same company will go first to the VPN server. And the call might get encrypted/decrypted twice
  • If another ‘SfB enabled’ company also uses Forced-tunneling the traffic will (1) get encrypted/decrypted until the SfB Edge server (2) to the other company Edge server and encrypted/decrypted again.

Now you have SfB traffic getting encrypted on an (overloaded) VPN tunnel traveling between several other systems and networks.

End user calling: “Skype for Business is a sh***. Totally useless”

Is there a solution?

Ask the CFO that you need to increase the internet bandwidth ūüôā

Or… implement a Split-tunnel VPN.
SfB takes advantages of protocols like ICE and STUN/TURN to pass through routers and firewalls and get the shortest path to the other endpoint.

Let’s see the same picture now, where users don’t use a VPN or there is a complete Split-tunnel configuration:

Sfb-SplitTunnel

Differences?:

  • Home Office calls are going directly throw the Internet and encrypted only once (native done by SfB)
  • The other SfB call and conferencing will go to the internal LAN throw the SfB Edge server (and encrypted only once)
  • All SfB traffic will not consume VPN bandwidth

Is it important? as the Covid-19 continues to spread, more and more companies will adopt, someway or another, home office policies.
If 5% of home office of the users complaining about calls issues might not be important, but if you suddenly have 50-75% of your staff at home a SfB issue would make you look at a different perspective.

How to implements a split-tunnel for SfB?

There are many resources on the Internet to implement split-tunneling. I will not enumerate them because you need to understand how your VPN is implemented and the Windows configurations in place (local firewall, group policies, QoS)

The main concept is to ensure that all the SfB traffic can bypass the VPN. You need to:

  • Ensure that the home office client can reach and route traffic to the Edge servers
  • Block media ports from reaching the internal front-end servers
  • And let the SfB client do the rest!

Almost there! this will get you a ‘half-split-tunnel’. Unless your VPN client is smart enough to allow the SfB client to reach any public IP address, the above solution allows them to reach the Edge servers. The traffic will bypass the VPN, and it will use the Edge servers:

HalfSfb-SplitTunnel

To get to the complete split-tunnel solution, you actually need to configure the VPN client to route only the internal company addresses and let the remaining apps to reach the internet.
Advantages: your VPN will only have traffic for the internal applications, Skype for Business calls will go throw the fastest path.

This solution also place another challenge for companies with stricter security rules: ‘all companies PC traffic must go throw the VPN’. A good opportunity to rethink on newer security solutions ūüėČ

And before you decide to optimize the SfB calls,¬† here’s my IT usual recommendations:

  • test first before rolling out to users: worst than some call quality issues is having no calls at all
  • Ensure that you have enough resources on the help-desk to support users troubleshooting their Home LAN and the router

You can now a happy ‘home office quarantine’ ūüôā

Final notes:

  • This is not an issue/solution specific for SfB. You will face the same situation either if you are using Cisco on-premises, MS Teams, Webex, ….
  • Keep safe! Careless is as bad as Panic.

 

The importance of knowing about certificates

Deploying and managing a Lync/Skype for Business environment demands you to know a lot more about technologies and protocols. Their communications are encryption which means that you need to deploy certificates and specially to maintain them over time. One wrong, forgotten or misplaced certificate can give you lot of headaches.

The following issue I faced recently, on a Lync 2013 environment is a good example of how a simple misplaced CA certificate can cause unexpected behaviours.

ISSUE and symptoms

After restarting the servers, the Lync services start reporting connection errors and denials due to certificate validation.

As a consequence, the users experience several issues:

  • Contacts presence status unknown
  • Address book unavailable
  • Unable to schedule, start or join meetings
  • External users unable to join/dial-in meetings

They are still able to sign-in, send IM’s and perform peer-to-peer calls (including video and desktop sharing) and PSTN inbound/outbound calls.

On the servers you will find from several others, eventID 32042 errors ‘Invalid incoming HTTPS certificate’ and eventID 30998 ‘Sending HTTP request failed’

Cause

The clue came from some informational events of services receiving invalid client certificates.EventID-61029

The last description line ‚ÄėCertificate error: 21482049809.‚Äô¬†¬†translates to error code 0x800b0109, which is defined as CERT_E_UNTRUSTEDROOT. Lync server could not trust the¬†subordinate CA that was installed on the local machine store ?!

Turns out that a new PKI has been deployed, and I found a subordinate CA¬†incorrectly installed on the ‘Trusted Root Certificate Authorities’ of the servers.
(a subordinate CA can be easily identified because it‚Äôs not self-signed (‚ÄėIssue To‚Äô name doesn‚Äôt match the ‚ÄėIssued By‚Äô)

subCA-on-TrustedCAstore

Windows Server 2012 (and higher)¬†implements checks for a higher level of trust for certificate authentication.¬†By finding¬†the invalid certificate, doesn’t provide any¬†Trust Root CA list and therefore the services cannot to validate¬†the certificates presented to them.

SOLUTION

  1. Delete the subCA from the Trusted Root CA store of the server
  2. Reboot the server so it can load correctly the Trusted Root CA list.

Final notes

The issue will only start after a server reboot, so it can take quite some time to associate the¬†cause/effect…. especially if you have just install a OS update !! (and blame it, uninstall, …)

Only after knowing exactly the issue, I manage to¬†‘google-fu’ a 4 years-old¬†KB2795828 with a similar situation.
From that one I got a very usefull powershell script that help us to find any non self-signed CA on the Trusted Root CA store of the machine

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Format-List *

UCaaS: Part #1 – planning to provide Skype for Business as a service?

Over the¬†years of consulting services,¬†managing and deploying UCC solutions,¬†virtualization,… you¬†might have thought several times¬†about: why not provide them to all my customers from¬†as a packed service?.
It’s nothing new nowadays – you called it ‘cloud’, hosting services, …

cmn_en_fig_services_vvc_sip_02

I’ve been planning and designing it¬†for quite some years. So why not just share some memories, experience¬†and concepts?
I decided to call it, since the 0 day, UCaaS – Unified Communications as a Service. Looks a clich√© now, but it’s short and easy to catch ūüôā but also much broader than just providing Skype for Business

In this first part, I will just do a global overview that applies to any XaaS. I will focus on Lync/Skype4B on later posts.
Look at¬†this one¬†as a cooking lesson, starting by the main topic: the Kitchen ūüôā

#1 It’s a service, so you need to see more then installing a couple of servers and connect the users! Before getting to that stage think, discuss and question¬†about everything that comes to your mind.
Why? because we are about to run a business, any resource costs something and you need to count them on your selling price !

#2 We can go this way:
* buy a server, put on your basement or garage,¬†connect to the internet, rent/create a webstore site and ready! (it can actually work)… or,
* everything below this line (more or less complex and as a existing company you might already have)

I like to group things to be easy to read and explain . Be aware that you might not need to own or have all on your side (you can just rent datacentre space,¬†VM’s, backups).
UCaaS-model

datacenterBase infrastructure

The ‘hardware’,¬†where you place it and how you reach it: Servers, Storage, Backup robots,¬†Switching, Routing, ¬†Firewalls, Load Balancers, Rack/Datacentre space, energy, internal and external connectivity (cabling, telecommunications, internet), …
By the way:¬†all these¬†also have something called ‘yearly maintenance¬†costs’ if purchased and you will need to allocate some earnings¬† to replacement them when it’s time.

if planning big, consider consulting¬†Hardware¬†providers¬†that support ‘pay as you grow model’. Many of them¬†have¬†cloud-ready solutions from small footprint up to large scale (and you can find some nice surprises on less-known brands)

virtualization-and-nos-150x150Support infrastructure

Some invisible, but¬†‘must have’¬†systems:

  • Virtualization- of course¬†you will use it ūüôā and on this one we can even have mixed scenarios as the¬†group above (virtual firewall, load balancers,…)
  • grafana-150x150Monitoring – Ever heard of an SLA ? if you are providing a service you will have to agree on an uptime. How can you measure and show to the customer? How can you¬†detect failures or¬†when you need more resources?
  • Backup and DR – Are you ready to loose your data? what about the customers data?
  • cybersecurity-590x393-150x150Security – you will need to manage patching and upgrades, antivirus, IDS, IPS… it’s a dangerous world outside, waiting to steal your customer data or take down you business.

 

management-dashboard-500x311Customer interfaces

This¬†is¬†your front porch and you should not hide it. If the prospective customers don’t like it, will¬†they trust the inside of the housing?

  • Customer infrastructure connectivity – the way that the customer systems and users will connect to your services. The simplest way is the internet, but it would¬†require for¬†some services, WAN, private¬†networks and¬†interoperability/integration solutions.
  • The customer portal/tools – This can be from a simple status/account/billing view¬†up to a self-provisioning, self-management
  • Ticket / support handling –¬†five customers might be easy to deal with phone calls and emails, but what about 30,100,…?

Softwaresoftware-icon-150x150

I include on this section separately, because not everybody is aware of some legal aspects. Let’s take a look at Microsoft products: you cannot just buy a Windows license, install on your server and charge¬†it to one (or more)¬†customer(s) for a running service there.
Microsoft is clear on this: if you are a Hosting/Service Provider, you need to buy licensing throw a SPLA .
Like Microsoft, VMware and many other vendors provide (or enforce) this model and is not a bad option:

  • The advantage is that it allows you to pay monthly for what you really use –
    this is the pay-as-you-use model
  • The inconvenient is that you need to report the usage periodically¬†and¬†allow auditing to your business

My advice is:

  • as a Service Provider, contact¬†the vendor and explain your intentions. They will help you to find the most profitable solution… most of the times.
  • ¬†Don’t try to find ‘loopholes’…trust me: it will cost you much more later!

xml-formShared services

Here you put all the platforms and services that can be shared between multiple.
Great examples are web servers hosting multiple websites. But pushing your skills to the limit, you can have a lot more. Multitenant solutions also would fit on this group.

Dedicated your best resources planning them! This is where your cost savings make a difference.

140912_cloud_phoneDedicated services

This is what your best customers are looking and willing to pay for.
It’s your cash cow – the more you have here, the quicker your revenue increases. These business models have more opportunities, specially¬†combined with standardized offers.

It has every group of systems serving unique customers:

  • It should be a¬†‘block model’¬†– same deployment and standardized procedures, automation and self service tools,¬†will keep operational costs low and predictable.
  • But you can also include very ‘$pecific $olutions’¬†– these one¬†gives you the¬†opportunity to upsell¬†consulting and managed services.

Skype for Business services model¬†would¬†fit¬†on this group… but it might also¬†fit for the group above? ūüėČ

desperate-business-broker-face-bad-investment-concept-48317142Not there yet

If you already own a company then this is known to you:¬†Work office place, furniture, energy, personal computers, HR, billing / account management, mobile devices, transportation/gas… you also pay for that, right

All done! What now?

presentation-screen-with-business-activities-download-royalty-free-vector-file-eps-14696After joining and calculating all the pieces, test yourself doing at least these questions:

  • What is the cost per service/per user? How much a VM with a specific size costs?
    This is the lowest value will charge for your service.
    => Capitalism rule: to earn money you need to sell it for more than you pay for
  • What is¬†the break even point?
    simulate, over and over the time! Be ready to answer: how many customers (or users) do you need to have to cover all the costs made so far?
    Whomever is going to put money on this will make do that question before writing the checks (even yourself if you got the money)
  • What is the ROI?
    Investors, banks or stake holders will look for this (and many other tools).
    If you need financing you need to promise when and how much will you pay back.
  • Psychological one: are you an entrepreneur?
    It needs investment analysis, financial control, technical know-how, purchasing/selling/negotiation skills, HR management, and so on. As the business creator you need deal with of them.
    This will not be a one-man-show for long. Sooner or later you need help trust and delegate to others. Starting with someone it will look less difficult.

This might seem directed to start-ups guys, but it applies to existing companies. Product and/or Business developers need also to assume the above challenges, the problems, assume risks and responsibilities.

You are putting you neck and reputation on it and get ready to accept failure.
But of you planed all (not just a suicidal gambler), showed you the balls, and if successfully, the personal reward is priceless.

It’s still not over! there are some more strategic decisions for¬†a go-to-market, on part 2 (writing in progress).

 

The minimal amount of servers for a full HA Enterprise Pool: less than 4

By the end of 2015, I started enumerating some challenges that the Lync/Skype topology presents when you just need minimal resources and provided some answers. Since the beginning of Microsoft UC and the more I dig inside the product versions, I came with some out-of-the-box personal challenges:
–¬†4/Feb/2012 – Installed¬†a Standard Edition Lync 2010¬†in a Domain controller (DNS, CA) – LyncIn1Box
–¬†11/Dec/2016 – Installed Skype for Business 2015¬†in a Windows Server Core – The smallest Skype for Business front-end¬†server

As strange as it sounds, there are some small companies around the world¬†that depend¬†on¬†Lync/Skype¬†for critical business mission but don’t have enough resources.¬†Companies with small amount of users can go for¬†Office365, but¬†it might no¬†cover all the features of the on-premises. Pool pairing (1 STD Edition + 1 STD edition)¬†might also not be possible if there is no feasible secondary location.

A short technical review of what roles you need to cover for High Availability (HA):
* Front End Lync/Skype server roles
* Back-end databases  Рyou need a SQL mirror or a Cluster/Always-On
* File Share Рcan be provided by a DFS or a File Share cluster

Now we can start asking: how many resources do I need to deploy the above HA ?
Here some possible answers. Note that ‘something’ means that a SQL HA needs¬†2 Instances and a sort of a witness (either a SQL server or a File Share/disk quorum)

Microsoft recommended: 5.x (5 servers + something)

Following Microsoft recommended practices, you will need 3 front-end servers and a redundant back-end database. File Share can be easily deployed on the Back-end servers.

MS-recommend-EE

Microsoft minimum: 4.x

As Microsoft allow the usage of two Front end server, but: “This small pool will not provide a robust high-availability solution like a larger pool would, and needs extra care in managing“.

MS-minimal-EE
My recommended PoC: 3.0

By joining all the roles across 3 windows servers, you can have one server down and the built-in automatic failover mechanisms will take care of that.

MY-recomended-EE

My minimum PoC : 2.x (2 servers + something)

Redundant means at least two systems, so this is the absolute minimum :). It has the same risks as Microsoft states for two servers.

MY-minimal-EE
The main reason is the fabric quorum: If you unexpectedly loose a server, the fabric cannot elect the owner of the several roles… even if there is only that server. There will be the need of a ‘soft’ quorum reset (manually or a triggered task)
But if you shutdown a server/services gracefully all services will be transferred to the working node.

About the 2.x equation:
* If you use a SQL mirror, a SQL witness is required (which actually means an additional/existing Windows server)
* If you use SQL clustering/Always On,¬†you¬†will need: (1)¬†a file share witness¬†-doesn’t have to be a Windows but can count as a server :)- (2) a quorum disk (share storage) – and this is the ‘true’ 2.x

Final thoughts

Deploying this ‘minimalist’ solution¬†is more about ‘out-of-the-box-thinking’ than tweaking (actually it’s only one). The normal Skype for Business setup wizard will install normally all the roles defined on the topology.

Notes about this ‘minimal counting’:
* It’s about adding Skype services:¬†it assumes that you have a Windows Domain, a CA and a sort of Load Balancer.
* SQL Clustering/AlwaysOn is still on test stage, but the service failover should behave similar as the Mirroring.
* If you already have a SQL HA in place at the datacentre, you can reuse it. This will make MY and MS minimal requirements equal to 2.
* At this time I excluded the Edge, Office Web App roles or Persistent Chat. The first one will required more resources, the second role… is for an updated post ūüėČ

Skype4B interoperability: Cisco Expressway

Cisco Expressway “offer users outside your firewall simple, highly secure access to all collaboration workloads, including video, voice, content, IM, and presence. Collaborate with people who are on third-party systems and endpoints or in other companies. Help teleworkers and Cisco Jabber mobile users work more effectively on their device of choice. Cisco Expressway allows you to do all this and more.” (source)

Using¬†Skype for Business¬†terminology, this is the¬†“Edge Server” of Cisco. But it besides the described functions, it has one that allows you the integrate Cisco Video¬†endpoints (desktop client, video conference rooms up to telepresence system) with Lync/Skype for Business clients that allows SIP dialling from both sides with audio and HD video:¬†search for¬†the contact and¬†press the call button.

 

The infrastructure configuration is based on a ‘dedicated expressway’ configured as a Skype for Business ‘trusted application’. The rest is all about¬†SIP domain ‘static routing’.

CiscoExpressway-Interoperability
Expressway topology for on-premises Skype for Business and Cisco video endpoints 

Great features of this integration:

  • IM & presence is possible between systems;
  • Desktop sharing is supported;
  • Both Cisco and Microsoft can share a single¬†SIP domain;
  • Skype for Business remote clients can use the Expressway on the DMZ (TURN server)¬†for audio traffic with Cisco endpoints;
  • Skype for Business clients can make and receive audio/video calls with external parties whom the Cisco¬†has federation with.

There are also some limitations:

  • Presence is based on SIP simple. Only can have the status ‘Available’ and ‘Busy’;
  • Skype for Business clients can join a multipoint conference in Cisco, but Cisco endpoints cannot join Skype meetings.

 

In conclusion, although it’s not a better solution than Polycom, the Expressway leverages the existing investment ¬†already done on Cisco infrastructure and can be extended to a complete 3rd interoperable federation solution:

CiscoExpressway-Federation

Lync (Skype for Business) November 2016 update – duplicate IM’s

ISSUE

On November 2016, Lync 2013 (Skype for Business 2015) customers start reporting cases of  duplicate of IM messages.

CAUSE

The issue started appearing after the installation of November 2016 client update (KB3127934) and it affects the receiver only.

skyp4b-kb3127934-issue3

duplicate-imsSteps to recreate the issue (credits go to Alex) :

  1. Send an IM to an user
  2. Do not open the IM toast on the receiving user
  3. Send another (or more) IM the that user
  4. Open the notification toast of the receiving user and you will noticed that only the first IM line sent is not repeated

The issue does not occur when the IM conversion window is open.

Applying the December 6, 2016, update for Skype for Business 2015 (Lync 2013) (KB3127976) also causes the same issue.

Skype for Business 2016 clients are also affected on the same way by their corresponding monthly cumulative updates. There is an oldest thread on Microsoft community that was reopened by another 2 persons that report the same behaviour and uninstalling the KB3127934 would solve the issue.

SOLUTION

Apply the January 3, 2017 update for Skype for Business 2015 (Lync 2013) (KB3141468) or Skype for Business 2016 (KB3128049).
It is mentioned on the resolved issue list (no root cause provided):
“Assume that you send continuous instant messages (IMs) to a user in Microsoft Skype for Business 2015 (Lync 2013). Then you allow the toast notification window to be auto accepted. In the conversation window, you find every item but first gets duplicated. Also, in the¬†Conversation History¬†in Microsoft Outlook, you find that the conversation window shows duplicated IMs.¬†“

I successfully tested and confirmed that it solves.