- The Get-CsClientCertificate cmdlet provides a way for administrators to retrieve information about the Skype for Business Server client certificates that have been issued to their users. This information includes both the date and time that the certificate was issued in addition to the date and time when the certificate will expire.
- Dear Team, We have Skype for business server 2019 edge configured. We have our reverse proxy in place. All users except the MAC users are able join the conference using the Skype.
Skype for Business Online will be retired on July 31, 2021. If you haven't upgraded your Skype for Business Online users to Microsoft Teams before that date, they will will be automatically scheduled for an assisted upgrade. If you want to upgrade your organization to Teams yourself, we strongly recommend that you begin planning your upgrade.
With the many different types of endpoints and network configurations that organizations use, there can be different ways that users connect to their Skype for Business environment, and as such, different sources of issues when connecting. Microsoft has developed detailed instructions for IT administrators to diagnose the issues and fix the problems based on the root causes. Below are the instructions provided by Microsoft:
Scoping the problem
Let’s assume that you want to troubleshoot issues that occur when users try to join a Skype for Business Online (formerly Lync Online) meeting by using Lync 2010, Lync 2013, the Lync for Windows Store app, or Lync for Mac 2011. Before you start, ask yourself and any external users who are experiencing the issue the following questions:
- How many users does the problem affect?
- Are the users internal or external to your organization?
- Can the affected users reproduce the problem on a single computer or on multiple computers?
When you have the answers to these questions, see the following table to determine the kind of issue that you’re dealing with. This table is provided to help scope the problem to a certain category. However, some categories may be outside the technical support boundaries of a Skype for Business Online support engineer.
Read the table as in the following example: Multiple users… (but not a single user) …from outside our organization…Can’t join a Skype for Business Online meeting from multiple computers: (is usually caused by) Lync federation issue or external network issue.
Be aware that each column and each row are mutually exclusive. That is, the issue affects either a single user or multiple users, and the issue can be reproduced either on one computer or on multiple computers.
PROBLEM
Note Most of the issues can be resolved by following the Lync Meeting join guided walkthrough and troubleshooter that’s at the following Microsoft website:
The Lync Meeting join guided walkthrough and troubleshooter
If you don’t experience one of the symptoms that are listed in the following table, use the scoping table in the “Scope” section to narrow the problem to a specific kind of issue. Then, you can troubleshoot the issue by following the steps that are outlined here.
Troubleshooting Windows client issues
To resolve any client or computer issue, first make sure that the computer is up to date. The computer should have the latest operating system updates, audio and video drivers, and software application updates to make connecting to a Skype for Business Online meeting a successful experience. To do this, follow these steps:
- Run Windows Update, and then verify that all optional hardware updates are installed. Specifically, make sure that video, audio, and network drivers are up to date.
- Verify that Lync is up to date. Go to the following TechNet page for the latest Lync updates:
Lync Downloads and Updates
Select your version (2013 or 2010), and then select Lync client under Category.
Now that the computer is up to date and meets all minimum system requirements, clear any cached credentials or certificates from previous logons:
Verify that the user has the correct certificates in Certificate Manager. To do this, follow these steps:
- Open Windows Certificate Manager. To do this, click Start, click Run, type certmgr.msc, and then click OK.
- Expand Personal, and then expand Certificates.
- Sort by the IssuedBy column, and then look for a certificate that is issued by Communications Server.
- Verify that the certificate is present and that it isn’t expired.
- Delete the certificate, and then try to sign in to Skype for Business Online. If you can’t sign in to Skype for Business Online, go to step 2.
- Remove the user’s Skype for Business Online credentials from the Windows Credential Manager. To do this, follow these steps:
- Click Start, click Control Panel, and then click Credential Manager.
- Locate the set of credentials that are used to connect to Skype for Business Online.
- Expand the set of credentials, and then click Remove from Vault.
- Try to sign in to Skype for Business Online, and then type the new set of credentials.
Skype for Business Online falls back to “anonymous join” if it can’t authenticate. As long as anonymous participants aren’t explicitly blocked from joining the meeting, they should always be able to join the meeting.
Troubleshooting network issues
- Verify that the computer is connected to the network. Determine whether the computer can access other websites.
2409256 You can’t connect to Skype for Business Online, or certain features don’t work, because an on-premises firewall blocks the connection
Fixing OCSMEET file associations in Windows
Verify that Skype for Business Online is the default program that is used to open .ocsmeet files. To do this, follow these steps:
- Click Start, click Control Panel, and then click Default Programs.
- Click Associate a file type or protocol with a program.
- Scroll down to .ocsmeet, and then verify that Microsoft Lync is selected as the Current Default option.
- If step 1 doesn’t resolve the issue, perform an Office installation repair, or reinstall Lync 2010.
Troubleshooting Identity issues
This specific issue occurs when two users of the same Office 365 organization share the same user name (alias). Because of how Lync generates meeting URLs, two users on the same Office 365 organization who have the same user name will share the same meeting URLs. This causes the Skype for Business Online conference to become corrupted.
To resolve this issue, change the user name of one of the users who has the duplicate user name. For information about how to edit and change user accounts in Office 365, see the following Help topic:
Create or edit users
Troubleshooting Lync federation issues
If external users (and only external users) can’t join a Skype for Business Online meeting, first determine whether they’re trying to join as authenticated users or as anonymous users.
- If the user is trying to join as an authenticated user from another Lync or OCS organization:
- Your Skype for Business Online organization must have External Communications enabled, and external communication must be completely open. Or, the external user’s domain must be in the Allow list.
For help in enabling and troubleshooting domain federation, visit the guided walkthrough on Skype for Business Online External Communications:
Set up Skype for Business Online external communications
Configuring Federation support for a Skype for Business Online customer
- If the user is trying to join as an anonymous user from Lync Attendee, or if the Lync Web App or is dialing in to a Skype for Business Online conference with an ACP access number:
- For anonymous join to work, a specific DNS SRV record must be present in DNS.
- For various methods of confirming your Skype for Business Online DNS records, click the following article number to view the article in the Microsoft Knowledge Base:
2566790 Troubleshooting Skype for Business Online DNS configuration issues in Office 365
Joining meetings by using the Lync Web App
If these troubleshooting steps don’t resolve the issue, and if joining the meeting immediately is a bigger concern, use the Lync Web App. Be aware that the Lync Web App doesn’t include Voice over IP (VoIP) functionality. That means that participants can only view sharing sessions. To do this, follow these steps:
- Copy the Join URL from the meeting invite, and then paste it into Internet Explorer. (Warning: Don’t press Enter yet.)
Note You must have Silverlight installed to use the advanced features of the Lync Web App.
Troubleshooting issues with third-party software
If you’re using third-party software, you may be asked to update, disable, or remove the software as a troubleshooting step. If the issue is resolved after you take one of these actions, you may be referred to the third-party manufacturer for more help or to perform additional troubleshooting.
Sources: https://support.microsoft.com/en-us/kb/2423848#bookmark-troubleshooting%20network%20issues
https://support.office.com/en-us/article/Troubleshoot-Skype-for-Business-Lync-Audio-68d84cf2-5d8c-4c91-bda6-69755f3fa165
Martin Feehan, PEI
-->Important
Skype for Business Online will be retired on July 31, 2021. If you haven't upgraded your Skype for Business Online users to Microsoft Teams before that date, they will will be automatically scheduled for an assisted upgrade. If you want to upgrade your organization to Teams yourself, we strongly recommend that you begin planning your upgrade path today. Remember that a successful upgrade aligns technical and user readiness, so be sure to leverage our upgrade guidance as you navigate your journey to Teams.
To troubleshoot Skype for Business Online sign-in errors, start by eliminating the most common causes of sign-in difficulty. If necessary, you can then follow specific resolution steps based on the type of error. If the user still cannot sign in, collect additional information, and then seek additional help.
What do you want to do?
Check for common causes of Skype for Business Online sign-in errors
Most sign-in issues can be traced to a small number of causes, and many of these are easy to correct. The table below lists some common causes of sign-in errors and some steps you or the users can take to resolve them.
| Possible Cause | Resolution |
|---|---|
| During sign-in, a dialog box appears that contains the following phrase: cannot verify that the server is trusted for your sign-in address. Connect anyway? | Verify that the domain name in the dialog box is a trusted server in your organization—for example, domainName.contoso.com. Ask the user to select the Always trust this server check box, and then click Connect. Enterprise customers can prevent this message from appearing when a user signs in for the first time by modifying the Windows registry on each user's computer. For details, see Modify TrustModelData registry keys. |
| Mistyped sign-in address, user name, or password | Confirm that the user's sign-in name and password are correct. Verify that the user's sign-in name is formatted as follows: bobk@contoso.com. This may be different from the format you use to sign in to your organization's network. Ask the user to try signing in again. |
| Forgotten password | Reset the user's password and notify him or her of the new temporary password. |
| Not licensed to use Skype for Business Online | Confirm that the user is registered as a Skype for Business Online user. If not, register the user, and then ask him or her to sign in again. |
| Wrong version of Skype for Business Online installed | This issue is usually associated with an error message that contains the following phrase: the authentication service may be incompatible with this version of the program. Ask the user to uninstall and reinstall Skype for Business Online from the Microsoft 365 admin center. |
| Problem acquiring a personal certificate that is required to sign in | If the user's sign-in address has recently changed, they may need to delete cached sign-in data. Ask users to sign out, click the Delete my sign-in info link on the sign-in screen, and then try again. |
| You set up a custom domain name, and the changes may not have finished propagating through the system. | First, ensure that you have modified the Domain Name Service (DNS) records to reflect the change. If you have already made the necessary DNS changes, advise the user to try logging in later. DNS changes can take up to 72 hours to be reflected throughout the system. |
| System clock out of sync with server clock | Ensure that your network domain controller is synchronizing with a reliable external time source. For details, see the Microsoft Knowledge Base article 816042, How to configure an authoritative time server in Windows Server. |
To troubleshoot Skype for Business Online sign-in errors, start by eliminating the most common causes of sign-in difficulty. If necessary, you can then follow specific resolution steps based on the type of error. If the user still cannot sign in, collect additional information, and then seek additional help.
Follow resolution steps for a specific error (Enterprise only)
Important
These instructions are intended primarily for Microsoft Office 365 Plan E customers. If you are an Office 365 Plan P customer, continue to the following section, Collect more information and seek additional help.
If the user cannot sign in after you have tried the suggestions in the previous section, then you can do additional troubleshooting based on the type of error. The table below lists the most common error messages and possible causes. Following the table are detailed procedures to address each issue.
| Error message | Possible cause | Resolution |
|---|---|---|
| Sign-in address not found | Sign-in requests from the Microsoft Online Services Sign-On Assistant (msoidsvc.exe) are not going through your external firewall, or proxy server. | Add a firewall entry for msoidsvc.exe to your proxy server |
| Server is temporarily unavailable | If your organization has a custom domain, the necessary Domain Name System (DNS) settings may be missing or incorrect. | Update DNS settings |
| Server is temporarily unavailable | If your organization is using single sign-on with Active Directory Federation Services (ADFS), you may have used a self-signed Secure Socket Layer (SSL) certificate rather than one from a third-party certification authority. | Install a third-party SSL certificate on your ADFS server |
| Problem acquiring a personal certificate that is required to sign in | If you've already removed the cached server data used to sign in and the error continues to appear, the user's security credentials may be corrupted, or an RSA folder on the user's computer may be blocking authentication. | Update security credentials |
| A certificate trust dialog box appears when a user signs in for the first time. | This dialog box appears if your Skype for Business server is not yet listed in the TrustModelData registry key. | Modify TrustModelData registry keys |
| User is not SIP enabled | If your organization had a previous installation of Microsoft Office Communications Server or Microsoft Lync Server 2010, you may not have deleted your users from the server before decommissioning it. As a result, the msRTCSIP-UserEnabled attribute is still set to FALSE in Active Directory Domain Services. | Update user settings in Active Directory |
Add a firewall entry for msoidsvc.exe to your proxy server
This procedure is a possible fix for the following error message: Sign-in address not found.
Note
The following steps assume you are using Microsoft Forefront Threat Management Gateway (TMG) 2010. If you have a different web gateway solution, use the settings described in step 4 below.
To create an application entry for Msoidsvc.exe in Forefront TMG 2010, follow these steps:
In the Forefront left pane, click Networking.
Click the Network tab. Under the Tasks tab in the right pane, click Configure Forefront TMG Client Settings.
In the Forefront TMG Client Settings dialog box, click New.
In the Application Entry Setting dialog box, configure the following rules:
| Application | Key | Value |
|---|---|---|
| msoidsvc | Disable | 0 |
| msoidsvc | DisableEx | 0 |
For details, see the Microsoft Knowledge Base article 2409256, You cannot connect to Skype for Business Online because an on-premises firewall blocks the connection.
Update DNS settings
If your organization has a custom domain, this procedure is a possible fix for the following error message: Server is temporarily unavailable.
Contact your domain name registrar for information on how to add the following CNAME record to your domain:
DNS record type: CNAME
Name: sip
Value/Destination: sipdir.online.lync.com
For details, see the Microsoft Knowledge Base article 2566790, Troubleshooting Skype for Business Online DNS configuration issues in Microsoft 365 or Office 365.
Install a third-party SSL certificate on your ADFS server
To install a third-party SSL certificate on your Active Domain Federation Services (ADFS) server, follow these steps:
Obtain an SSL certificate from a third-party certification authority such as VeriSign or Thawte.
Install the certificate on your ADFS server by using the ADFS management console.
Update security credentials
This procedure is a possible fix for the error message Problem acquiring a personal certificate required to sign in.
To eliminate possible certificate or credential problems, first renew the user's certificate in Windows Certificate Manager. To do this, follow these steps:
Open Windows Certificate Manager. To do this, click Start, click Run, type certmgr.msc, and then click OK.
Double-click Personal, and then double-click Certificates.
Sort by the Issued By column, and then look for a certificate that is issued by Communications Server.
Right-click the certificate, and then click Delete.
Next, if the user is running Windows 7, remove their stored credentials in Windows Credential Manager. To do this, follow these steps:
Click Start, click Control Panel, and then click Credential Manager.
Locate the set of credentials that is used to connect to Skype for Business Online.
Expand the set of credentials, and then click Remove from Vault.
Sign in again and reenter the user's credentials.
Finally, if the user still cannot sign in after you've updated their credentials, try deleting the RSA folder on the user's computer, because it could be blocking completion of the user authentication process:
Sign in to the user's computer using an administrator account.
If necessary, turn on the folder view option Show hidden files.
Type the following into the address bar of File Explorer: C:Documents and SettingsUserNameApplication DataMicrosoftCryptoRSA, where UserName is your Windows sign-in name.
Delete any folder that begins with the name S-1-5-21- followed by a string of numbers.
Modify TrustModelData registry keys
When a user signs in for the first time, they may receive a dialog box that contains something like the following: Cannot verify that the server is trusted for your sign-in address. Connect anyway? This is a security feature, and not an error. However, you can prevent the dialog box from appearing by using a Group Policy Object (GPO) to update users' machines with your domain name before they sign in for the first time. To accomplish this, do the following:
- Create and deploy a GPO that appends your Skype for Business domain name—for example, domainName.contoso.com—to the current value of HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftCommunicatorTrustModelData.
Important
You must append your domain name to the existing value, not simply replace it.
For details, see the Microsoft Knowledge Base article 2531068, Skype for Business (Lync) cannot verify that the server is trusted for your sign-in address.
Skype For Business Mac Date Time Certificate Error List
Update user settings in Active Directory
If your organization had a previous installation of Microsoft Office Communications Server or Microsoft Lync Server 2010, you may not have deleted your users from the server before decommissioning it. As a result, the msRTCSIP-UserEnabled attribute is still set to FALSE in Active Directory Domain Services.
To fix this issue, follow these steps:
Update the msRTCSIP-UserEnabled attribute for all affected users to TRUE.
Rerun the Microsoft Online Services Directory Synchronization Tool (DirSync). For details, see AIntegrate your on-premises directories with Azure Active Directory.
To troubleshoot Skype for Business Online sign-in errors, start by eliminating the most common causes of sign-in difficulty. If necessary, you can then follow specific resolution steps based on the type of error. If the user still cannot sign in, collect additional information, and then seek additional help.
Use the Microsoft Support troubleshooting guide
If you're still not able to resolve the user's sign-in problems, review the suggestions in Microsoft Knowledge Base article 2541980, How to troubleshoot sign-in issues in Skype for Business Online.
Skype For Business Mac Date Time Certificate Error Codes
Collect more information and seek additional help
If you've followed the guidance above and still can't resolve your sign-in issues, you must collect additional information and contact technical support. To do this, follow these steps:
Obtain the log files and Windows Event log details from the user's machine. For step-by-step instructions, see the end-user help topic Turn on error logs in Lync.
Send the log files and detailed information about the error to Microsoft technical support.
Skype For Business Mac Certificate Error
You may be asked to supply additional diagnostic information by installing the Microsoft Online Services Diagnostic and Logging (MOSDAL) Support Toolkit on the affected user's machine. For details, see Using the MOSDAL Support Toolkit.
To troubleshoot Skype for Business Online sign-in errors, start by eliminating the most common causes of sign-in difficulty. If necessary, you can then follow specific resolution steps based on the type of error. If the user still cannot sign in, collect additional information, and then seek additional help.