Step 1

On the Windows domain controller and server(s) running Exchange, choose Start > Administrative Tools > Local Security Policy.

Step 2

Navigate to Security Settings > Local Policies > Security Options.

Step 3

Choose Network Security: Minimum session security for NTLM SSP based (including secure RPC) servers.

Step 4

Verify that the Require NTLMv2 session security check box is unchecked.

Step 5

If the Require NTLMv2 session security check box is checked, complete the following steps:

1. Uncheck the check box Require NTLMv2 session security.

2. Click OK.

Step 6

To apply the new security settings reboot the Windows domain controller and server(s) running Exchange.

Step 1

Log in to the Exchange Server 2007 user interface using a service account that has been delegated the Exchange View Only Administrator role.

Step 2

In the left pane, under Security Settings, navigate to Local Policies > User Rights Assignments.

Step 3

In the right pane of the console, double-click Allow Log On Locally.

Step 4

Choose Add User or Group then navigate to the service account that you created and choose it.

Step 5

Choose Check Names, and verify that the specified user is correct.

Step 6

Click OK.

Step 1

Log in to Exchange Server 2007 using a service account that has been delegated the Exchange View Only Administrator role.

Step 2

Choose Start.

Step 3

Type gpmc.msc.

Step 4

Choose Enter.

Step 5

Open the Domain Controller Security Settings window on the Exchange Server.

Step 6

In the left pane, under Security Settings, navigate to Local Policies > User Rights Assignments.

Step 7

In the right pane of the console, double-click Allow Log On Locally.

Step 8

Ensure that the Define these policy settings check box is checked.

Step 9

Choose Add User or Group and navigate to the service account that you previously created and choose it. Then click OK.

Step 10

Choose Check Names, and verify that the specified user is correct. Then click OK.

Step 11

Click Apply then click OK in the Allow Log On Locally Properties dialog box.

Step 12

Determine if your users SMTP address is alias@FQDN. If it is not, you must impersonate using the user principal name (UPN). This is defined as alias@FQDN.

Step 1

Open the Exchange Management Shell (EMS) for command line entry.

Step 2

Run this Add-ADPermission command to add the impersonation permissions on the server.

Step 1

Open the Exchange Management Shell (EMS).

Step 2

Run this Add-ADPermission command in the EMS to add the impersonation permissions on the server for the identified service account (for example, Exchange 2007).

Step 3

Run this Add-ADPermission command in the EMS to add the impersonation permissions to the service account on each mailbox that it impersonates:

Step 1

Open the Exchange Management Shell (EMS).

Step 2

Run this Add-ADPermission command in the EMS to grant Send As permissions to the service account and all associated mailbox stores:

Step 1

Open the Exchange Management Shell (EMS).

Step 2

Run this Add-ADPermission command in the EMS to grant impersonation permissions on the service account all associated mailbox stores:

Step 1

In the Exchange Management Console (EMC) on Exchange Server 2007, right-click Active Directory Sites and Services in the console tree.

Step 2

Point to View, and then choose Show Services Node.

Step 3

Expand the service node, for example, Services/MS Exchange/First Organization/Admin Group/Exchange Admin Group/Servers.

Step 4

Verify that the Client Access Server (CAS) is listed for the service node that you chose.

Step 5

View the "Properties" of each CAS, and under the Security tab, verify that:

1. Your service account is listed.

2. The permissions granted on the services account indicate (with a checked check box) that the Exchange Web Services Impersonation permission is allowed on the account.

Step 6

Verify that the service account (for example, Ex2007) has been granted Allow impersonationpermission on the storage group and the mailbox store to enable it to exchange personal information and to Send As and Receive-As another user account.

Step 7

You may be required to restart the Exchange Server for the changes to take effect. This has been observed during testing.

Step 1

From Administrative Tools, open Internet Information Services and choose the server.

Step 2

Choose Web Sites.

Step 3

Choose Default Web Site.

Step 4

Right-click EWS directory folder and choose Properties.

Step 5

Choose the Directory Security tab.

Step 6

Under Authentication and access control, click Edit.

Step 7

Under Authentication Methods, verify that the following check box is unchecked:

Step 8

Under Authentication Methods Authenticated Access, verify that both of the following check boxes are checked:

Step 9

Click OK.

Step 1

On the Windows domain controller and server(s) running Exchange, choose Start > Administrative Tools > Local Security Policy.

Step 2

Navigate to Security Settings > Local Policies > Security Options.

Step 3

Choose Network Security: Minimum session security for NTLM SSP based (including secure RPC) servers.

Step 4

Verify that the Require NTLMv2 session security check box is unchecked.

Step 5

If the Require NTLMv2 session security check box is checked, complete the following steps:

1. Uncheck the check box Require NTLMv2 session security.

2. Click OK.

Step 6

To apply the new security settings reboot the Windows domain controller and server(s) running Exchange.

Step 1

Create the account in Active Directory.

Step 2

Open the EMS for command line entry.

Step 3

Run the New-ManagementRoleAssignment command in the EMS to grant a specified existing domain service account (for example, Ex2010) the permission to impersonate other user accounts:

Step 4

Run this New-ManagementRoleAssignment command to define the scope to which the impersonation permissions apply. In this example, the Ex2010 account is granted the permission to impersonate all accounts on a specified Exchange Server.

Step 5

Run the New-ThrottlingPolicy command to create a new Throttling Policy with the recommended values in the table below.

Step 6

Run the Set-ThrottlingPolicyAssociation command to associate the new Throttling Policy with the service account used in Step 2.

Step 1

Create the account in Active Directory.

Step 2

Open the EMS for command line entry.

Step 3

Run the New-ManagementRoleAssignment command in the EMS to grant a specified existing domain service account (for example, Ex2013) the permission to impersonate other user accounts:

Step 4

Run this New-ManagementRoleAssignment command to define the scope to which the impersonation permissions apply. In this example, the Ex2013account is granted the permission to impersonate all accounts on a specified Exchange Server.

Step 5

Run the New-ThrottlingPolicy command to create a new Throttling Policy with the recommended values defined in the below table:

Step 6

Run the Set-ThrottlingPolicyAssociation command to associate the new Throttling Policy with the service account used in Step 2.

Step 1

On the Active Directory Server, verify that the Impersonation account exists.

Step 2

Open the Exchange Management Shell (EMS) for command line entry.

Step 3

On the Exchange Server verify that the service account has been granted the required Impersonation permissions:

1. Run this command in the EMS:

   Get-ManagementRoleAssignment -Role ApplicationImpersonation

2. Ensure that the command output indicates role assignments with the Role ApplicationImpersonation for the specified account as follows:

   Example Command Output

   Name - - - -	Role - - -	Role AssigneeName-	Role AssigneeType-	Assignment Method- - -	Effective UserName
   _suImpersonate RoleAs	Application Impersonation	ex2010	User	Direct	ex2010

Step 4

Verify that the management scope that applies to the service account is correct:

1. Run this command in the EMS:

   Get-ManagementScope _suImpersonateScope

2. Ensure that the command output returns the impersonation account name as follows:

   Example Command Output

   Name - - -	Scope RestrictionType	Exclusive	Recipient Root - -	Recipient Filter -	Server Filter- - -
   _suImpersonate Scope	ServerScope	False	User	Direct	Distinguished Name

Step 5

Verify that the ThrottlingPolicy parameters match what is defined in the below table by running this command in the EMS.

Step 1

On the Active Directory Server, verify that the Impersonation account exists.

Step 2

Open the Exchange Management Shell (EMS) for command line entry.

Step 3

On the Exchange Server verify that the service account has been granted the required Impersonation permissions:

1. Run this command in the EMS:

   Get-ManagementRoleAssignment -Role ApplicationImpersonation

2. Ensure that the command output indicates role assignments with the Role ApplicationImpersonation for the specified account as follows:

   Example Command Output

   Name - - - -	Role - - -	Role AssigneeName-	Role AssigneeType-	Assignment Method- - -	Effective UserName
   _suImpersonate RoleAs	Application Impersonation	ex2010	User	Direct	ex2010

Step 4

Verify that the management scope that applies to the service account is correct:

1. Run this command in the EMS:

   Get-ManagementScope _suImpersonateScope

2. Ensure that the command output returns the impersonation account name as follows:

   Example Command Output

   Name - - -	Scope RestrictionType	Exclusive	Recipient Root - -	Recipient Filter -	Server Filter- - -
   _suImpersonate Scope	ServerScope	False	User	Direct	Distinguished Name

Step 5

Verify that the ThrottlingPolicy parameters match what is defined in the below table by running this command in the EMS.

Step 6

Verify that they ThrottlingPolicy has been associated with the Exchange Account.

Step 1

From Administrative Tools, open Internet Information Services and choose the server.

Step 2

Choose Web Sites.

Step 3

Choose Default Web Site.

Step 4

Choose EWS.

Step 5

Under the IIS section, choose Authentication.

Step 6

Verify that the following Authentication methods are enabled:

Step 7

Use the Enable/Disable link in the Actions column to configure appropriately.

Step 1

Choose Start > Control Panel > Add or Remove Programs.

Step 2

In the Add or Remove Programs window, choose Add/Remove Windows Components.

Step 3

Complete the Windows Component wizard:

1. In the Windows Components window, check the check box for Certificate Services and click Yes when the warning displays about domain partnership and computer renaming constraints.

2. In the CA Type window, choose Stand-alone Root CA and click Next .

3. In the CA Identifying Information window, enter the name of the server in the Common Name field for the CA Server. If there is no DNS, type the IP address and click Next.

   Note	Remember that the CA is a third-party authority. The common name of the CA should not be the same as the common name used to generate a CSR.

4. In the Certificate Database Settings window, accept the default settings and click Next.

Step 4

Click Yes when you are prompted to stop Internet Information Services.

Step 5

Click Yes when you are prompted to enable Active Server Pages (ASP).

Step 6

Click Finish after the installation process completes.

Step 1

Choose Start > Administrative Tools > Server Manager.

Step 2

In the console tree, choose Roles.

Step 3

Choose Action > Add Roles.

Step 4

Complete the Add Roles wizard:

1. In the Before You Begin window, ensure that you have completed all prerequisites listed and click Next.

2. In the Select Server Roles window, check the check box for Active Directory Certificate Services and click Next.

3. In the Introduction Window window, click Next.

4. In the Select Role Services window, check these check boxes and click Next.

   • Certificate Authority
   • Certificate Authority Web Enrollment
   • Online Responder

5. In the Specify Setup Type window, click Standalone.

6. In the Specify CA Type window, click Root CA.

7. In the Set Up Private Key window, click Create a new private key.

8. In the Configure Cryptography for CA window, choose the default cryptographic service provider.

9. In the Configure CA Name window, enter a common name to identify the CA.

10. In the Set Validity Period window, set the validity period for the certificate generated for the CA.

    Note	The CA issues valid certificates only up to the expiration date that you specify.

11. In the Configure Certificate Database window, choose the default certificate database locations.

12. In the Confirm Installation Selections window, click Install.

13. In the Installation Results window, verify that the Installation Succeeded message displays for all components and click Close.

    Note	The Active Directory Certificate Services is now listed as one of the roles on the Server Manager.

Step 1

From Administrative Tools, open Internet Information Services.

1. Right-click Default Web Site.

2. Choose Properties.

Step 2

Choose the Directory Security tab.

Step 3

Choose Server Certificate.

Step 4

Click Next when the Web Server Certificate wizard displays.

Step 5

Complete the Server Certificate wizard:

1. In the Server Certificate window, choose Create a new certificate and click Next.

2. In the Delayed or Immediate Request window, choose Prepare the request now, but send it later and click Next.

3. In the Name and Security Settings window, accept the Default Web Site certificate name, choose 1024 for the bit length, and click Next.

4. In the Organization Information window, enter your Company name in the Organization field, the organizational unit of your company in the Organizational Unit field, and click Next

5. In the Your Site's Common Name window, enter the Exchange Server hostname or IP address and click Next.

   Note	The IIS certificate Common Name that you enter is used to configure the Presence Gateway on the IM and Presence Service, and must be identical to the Host (URI or IP address) you are trying to reach.

6. In the Geographical Information window, enter your geographical information, as follows, and click Next.

   • Country/region
   • State/province
   • City/locality

7. In the Certificate Request File Name window, enter an appropriate filename for the certificate request, specify the path and file name where you want to save your CSR, and click Next.

   Note	Make sure that you save the CSR without any extension (.txt) and remember where you save it because you need to be able to find this CSR file after. Only use Notepad to open the file.

8. In the Request File Summary window, confirm that the information is correct in the Request File Summary window and click Next.

9. In the Web Server Certificate Completion window, click Finish.

Step 1

From Administrative Tools, open the Internet Information Services (IIS) Manager window.

Step 2

Under Connections in the left pane of the IIS Manager, choose the Exchange Server.

Step 3

Double-click Server Certificates.

Step 4

Under Actions in the right pane of the IIS Manager, choose Create Certificate Request.

Step 5

Complete the Request Certificate wizard:

1. In the Distinguished Name Properties window, enter the following information:

   • In the Common Name field, enter the Exchange Server hostname or IP address.
   • In the Organization field, enter your company name
   • In the Organizational Unit field, enter the organizational unit that your company belongs to.

2. Enter your geographic information as follows and click Next.

   • City/locality
   • State/province
   • Country/region

   Note	The IIS certificate Common Name that you enter is used to configure the Presence Gateway on the IM and Presence Service, and must be identical to the host (URI or IP address) you are trying to reach.

3. In the Cryptographic Service Provider Properties window, accept the default Cryptographic service provider, choose 2048 for the bit length, and click Next.

4. In the Certificate Request File Name window, enter the appropriate filename for the certificate request and click Next.

   Note	Make sure that you save the CSR without any extension (.txt) and remember where you save it because you need to be able to find this CSR file later. Only use Notepad to open the file.

5. In the Request File Summary window, confirm that the information is correct and click Next.

6. In the Request Certificate Completion window, click Finish.

Step 1

Copy the certificate request file to your CA Server.

Step 2

Open one of the following URLs:

Step 3

Choose Request a certificate.

Step 4

Choose advanced certificate request.

Step 5

Choose Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

Step 6

Using a text editor like Notepad, open the CSR that you generated.

Step 7

Copy all information from and including

Step 8

Paste the content of the CSR into the Certificate Request text box.

Step 9

(Optional) By default the Certificate Template drop-down list defaults to the Administrator template, which may or may not produce a valid signed certificate appropriate for server authentication. If you have an enterprise root CA, choose the Web Server certificate template from the Certificate Template drop-down list. The Web Server certificate template may not display, and therefore this step may not apply, if you have already modified your CA configuration.

Step 10

Click Submit.

Step 11

In the Administrative Tools window, choose Start > Administrative Tools > Certification > Authority > CA name > Pending Request to open the Certification Authority window. The Certificate Authority window displays the request you just submitted under Pending Requests.

Step 12

Right click on your request, and complete these actions:

Step 13

Choose Issued certificates and verify that your certificate has been issued.

Step 1

In Administrative Tools, open the Certification Authority. The Certificate Request that you issued displays in the Issued Requests area.

Step 2

Right click the request and choose Open.

Step 3

Choose the Details tab.

Step 4

Choose Copy to File.

Step 5

When the Certificate Export wizard displays, click Next.

Step 6

Complete the Certificate Export wizard:

1. In the Export File Format window, choose Base-64 encoded X.509 and click Next.

2. In the File to Export window, enter the location where you want to store the certificate, use cert.cer for the certificate name, and choose c:\cert.cer.

3. In the Certificate Export Wizard Completion window, review the summary information, verify that the export was successful, then click Finish.

Step 7

Copy or FTP the cert.cer to the computer that you use to administer the IM and Presence Service.

Step 1

From Administrative Tools, open Internet Information Services.

Step 2

Complete the following steps in the Internet Information Services window:

1. Right-click Default Web Site.

2. Choose Properties.

Step 3

In the Default Web Site Properties window, complete the following steps:

1. Choose the Directory Security tab.

2. Choose Server Certificate.

Step 4

When the Web Server Certificate wizard window displays, click Next .

Step 5

Complete the Web Server Certificate wizard:

1. In the Pending Certificate Request window, choose Process the pending request and install the certificate and click Next.

2. In the Process a Pending Request window, click Browse to locate your certificate and navigate to the correct path and filename.

3. In the SSL Port window, enter 443 for the SSL port and click Next.

4. In the Web Server Certificate Completion window, click Finish.

Step 1

From Administrative Tools, open the Internet Information Services (IIS) Manager window.

Step 2

Under Connections in the left pane of the IIS Manager, choose the Exchange Server.

Step 3

Double-click Server Certificates.

Step 4

Under Actions in the right pane of the IIS Manager, choose Complete Certificate Request.

Step 5

In the Specify Certificate Authority Response window, complete these actions:

1. To locate your certificate, choose the ellipsis [...].

2. Navigate to the correct path and filename.

3. Enter a user-friendly name for your certificate.

4. Click Ok. The certificate that you completed displays in the certificate list.

Step 6

In the Internet Information Services window, complete the following steps to bind the certificate:

1. Choose Default Web Site.

2. Under Actions in the right pane of the IIS Manager, choose Bindings.

Step 7

Complete the following steps in the Site Bindings window:

1. Choose https.

2. Choose Edit.

Step 8

In the Edit Site Binding window, complete the following steps :

1. Choose the certificate that you just created from the SSL certificate drop-down list. The name that you applied to the certificate displays.

2. Click Ok.

Step 1

Log in to your CA Server user interface and open a web browser.

Step 2

Open the URL specific to your Windows platform type:

1. Windows Server 2003 – http://127.0.0.1/certserv

2. Windows Server 2008 – https://127.0.0.1/certsrv

Step 3

Choose Download a CA certificate, certificate chain, or CRL.

Step 4

For the Encoding Method, choose Base 64.

Step 5

Click Download CA Certificate.

Step 6

Save the certificate, certnew.cer, to the local disk.

Step 1

Use the Certificate Import Tool in Cisco Unified CM IM and Presence Administration to upload the certificate:

Step 2

If the Certificate Import Tool indicates that certificates are missing (typically the CA certificate is missing on Microsoft servers), manually upload the CA certificate(s) using the Cisco Unified OS Admin Certificate Management window.

Step 3

Return to the Certificate Import Tool (Step 1) and verify that all status tests succeed.

Step 4

Restart the CiscoPresence Engine and SIP Proxy service after you upload all Exchange trust certificates. Log in to the Cisco Unified IM and Presence Serviceability user interface. Choose Tools > Control Center - Feature Services.