Lync User Create and Apply Policy

Question

I have pieced together a some powershell to enable Lync for a user and then try to apply policies. The user is created but the policies are not:

# Get domain controller FQDN
$domainName = $Context.GetObjectDomain("%distinguishedName%")
$rootDSE = $Context.BindToObject("Adaxes://$domainName/rootDSE")
$domainControllerFQDN = $rootDSE.Get("dnsHostName")

$lyncServer="coplyncpool."
$registrarPool="coplyncpool."

$sessionOptions = New-PSSessionOption -SkipRevocationCheck -SkipCACheck -SkipCNCheck
$session = New-PSSession -ConnectionUri https://$lyncServer/ocspowershell -SessionOption $sessionOptions -Authentication NegotiateWithImplicitCredential

Import-PSSession -session $session -AllowClobber

#Enable Lync User
Enable-CsUser -Identity "%displayName%" -RegistrarPool $registrarPool -SipAddress "sip:%userPrincipalName%" -DomainController $domainControllerFQDN

# Sets policies
Grant-CsConferencingPolicy -identity "%displayName%" -PolicyName NoConferencingWithExternalUsers
Grant-CsClientPolicy -identity "%displayName%" -PolicyName NoClientSideArchiving
Grant-CsArchivingPolicy -identity "%displayName%" -PolicyName NoServerSideArchiving
Grant-CsExternalAccessPolicy -identity "%displayName%" -PolicyName NoExternalAccess
Grant-CsMobilityPolicy -identity "%displayName%" -PolicyName NoMobility

Remove-PSSession -Session $session

Here is the error while the policies are trying to be created.:

Management object not found for identity "Geary Eppernator".

Management object not found for identity "Geary Eppernator".

The term 'Grant-CsArchivingPolicy' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

Management object not found for identity "Geary Eppernator".

Management object not found for identity "Geary Eppernator".

Thanks

Comments

Hello,

Management object not found errors: how many domain controllers do you have for the domain of the user?

Error with the Grant-CsArchivingPolicy cmdlet: the user whose credentials are used to run the script is not a member of any of the role groups that allow running the cmdlet. By default, only members of the RTCUniversalUserAdmins role group can run it. For details, see the following article by Microsoft: https://technet.microsoft.com/en-us/lib ... 15%29.aspx.

---

We have 3 DC's and the user is member of that group.

Thanks

Answer 1

Management object not found errors: most probably, when assigning the policies, the Lync Server connects to a different DC than when enabling the user for Lync. Since the commands are executed within a short time frame, there is not enough time to replicate information on the new Lync user to the other DCs. To remedy the issue, append information on the domain controller used every time you call a cmdlet for assigning a policy:

...
Grant-CsConferencingPolicy -identity "%displayName%" -PolicyName NoConferencingWithExternalUsers -DomainController $domainControllerFQDN
Grant-CsClientPolicy -identity "%displayName%" -PolicyName NoClientSideArchiving -DomainController $domainControllerFQDN
Grant-CsArchivingPolicy -identity "%displayName%" -PolicyName NoServerSideArchiving -DomainController $domainControllerFQDN
Grant-CsExternalAccessPolicy -identity "%displayName%" -PolicyName NoExternalAccess -DomainController $domainControllerFQDN
Grant-CsMobilityPolicy -identity "%displayName%" -PolicyName NoMobility -DomainController $domainControllerFQDN
...- - - - - -

Error with the Grant-CsArchivingPolicy cmdlet: we've checked with documents available from Microsoft, but the only possible reason for such an error seems to be that the user doesn't have sufficient permissions to call the cmdlet. Please re-check that the user specified in the Run As setting of the action that runs this script is a member of the RTCUniversalUserAdmins role group. Also, try logging in to your Lync Server as that user and running the cmdlet directly from the Lync Shell.

For more information, see Planning for role-based access control in Lync Server 2013.