Step 1

On the Windows domain controller and server(s) running Exchange, choose Start > Administrative Tools > Local Security Policy.

Step 2

Navigate to Security Settings > Local Policies > Security Options.

Step 3

Choose Network Security: Minimum session security for NTLM SSP based (including secure RPC) servers.

Step 4

Verify that the Require NTLMv2 session security check box is unchecked.

Step 5

If the Require NTLMv2 session security check box is checked, complete the following steps:

1. Uncheck the check box Require NTLMv2 session security.

2. Click OK.

Step 6

To apply the new security settings reboot the Windows domain controller and server(s) running Exchange.

Step 1

Create the account in Active Directory.

Step 2

Open the EMS for command line entry.

Step 3

Run the New-ManagementRoleAssignment command in the EMS to grant a specified existing domain service account (for example, Ex2016) the permission to impersonate other user accounts:

Step 4

Run this New-ManagementRoleAssignment command to define the scope to which the impersonation permissions apply. In this example, the Ex2016account is granted the permission to impersonate all accounts on a specified Exchange Server.

Step 5

Run the New-ThrottlingPolicy command to create a new Throttling Policy with the recommended values defined in the below table:

Step 6

Run the Set-ThrottlingPolicyAssociation command to associate the new Throttling Policy with the service account used in Step 2.

Step 1

On the Active Directory Server, verify that the Impersonation account exists.

Step 2

Open the Exchange Management Shell (EMS) for command line entry.

Step 3

On the Exchange Server verify that the service account has been granted the required Impersonation permissions:

1. Run this command in the EMS:

   Get-ManagementRoleAssignment -Role ApplicationImpersonation

2. Ensure that the command output indicates role assignments with the Role ApplicationImpersonation for the specified account as follows:

   Example Command Output

   Name - - - -	Role - - -	Role AssigneeName-	Role AssigneeType-	Assignment Method- - -	Effective UserName
   _suImpersonate RoleAs	Application Impersonation	ex2016	User	Direct	ex2016

Step 4

Verify that the management scope that applies to the service account is correct:

1. Run this command in the EMS:

   Get-ManagementScope _suImpersonateScope

2. Ensure that the command output returns the impersonation account name as follows:

   Example Command Output

   Name - - -	Scope RestrictionType	Exclusive	Recipient Root - -	Recipient Filter -	Server Filter- - -
   _suImpersonate Scope	ServerScope	False	User	Direct	Distinguished Name

Step 5

Verify that the ThrottlingPolicy parameters match what is defined in the below table by running this command in the EMS.

Step 6

Verify that they ThrottlingPolicy has been associated with the Exchange Account.

Step 1

From Administrative Tools, open Internet Information Services and choose the server.

Step 2

Choose Web Sites.

Step 3

Choose Default Web Site.

Step 4

Choose EWS.

Step 5

Under the IIS section, choose Authentication.

Step 6

Verify that the following Authentication methods are enabled:

Step 7

Use the Enable/Disable link in the Actions column to configure appropriately.

Step 1

Choose Start > Administrative Tools > Server Manager.

Step 2

In the console tree, choose Roles.

Step 3

Choose Action > Add Roles.

Step 4

Complete the Add Roles wizard:

1. In the Before You Begin window, ensure that you have completed all prerequisites listed and click Next.

2. In the Select Server Roles window, check the check box for Active Directory Certificate Services and click Next.

3. In the Introduction Window window, click Next.

4. In the Select Role Services window, check these check boxes and click Next.

   • Certificate Authority
   • Certificate Authority Web Enrollment
   • Online Responder

5. In the Specify Setup Type window, click Standalone.

6. In the Specify CA Type window, click Root CA.

7. In the Set Up Private Key window, click Create a new private key.

8. In the Configure Cryptography for CA window, choose the default cryptographic service provider.

9. In the Configure CA Name window, enter a common name to identify the CA.

10. In the Set Validity Period window, set the validity period for the certificate generated for the CA.

    Note	The CA issues valid certificates only up to the expiration date that you specify.

11. In the Configure Certificate Database window, choose the default certificate database locations.

12. In the Confirm Installation Selections window, click Install.

13. In the Installation Results window, verify that the Installation Succeeded message displays for all components and click Close.

    Note	The Active Directory Certificate Services is now listed as one of the roles on the Server Manager.

Step 1

From Administrative Tools, open the Internet Information Services (IIS) Manager window.

Step 2

Under Connections in the left pane of the IIS Manager, choose the Exchange Server.

Step 3

Double-click Server Certificates.

Step 4

Under Actions in the right pane of the IIS Manager, choose Create Certificate Request.

Step 5

Complete the Request Certificate wizard:

1. In the Distinguished Name Properties window, enter the following information:

   • In the Common Name field, enter the Exchange Server hostname or IP address.
   • In the Organization field, enter your company name
   • In the Organizational Unit field, enter the organizational unit that your company belongs to.

2. Enter your geographic information as follows and click Next.

   • City/locality
   • State/province
   • Country/region

   Note	The IIS certificate Common Name that you enter is used to configure the Presence Gateway on the IM and Presence Service, and must be identical to the host (URI or IP address) you are trying to reach.

3. In the Cryptographic Service Provider Properties window, accept the default Cryptographic service provider, choose 2048 for the bit length, and click Next.

4. In the Certificate Request File Name window, enter the appropriate filename for the certificate request and click Next.

   Note	Make sure that you save the CSR without any extension (.txt) and remember where you save it because you need to be able to find this CSR file later. Only use Notepad to open the file.

5. In the Request File Summary window, confirm that the information is correct and click Next.

6. In the Request Certificate Completion window, click Finish.

Step 1

Copy the certificate request file to your CA Server.

Step 2

Open one of the following URLs:

Step 3

Choose Request a certificate.

Step 4

Choose advanced certificate request.

Step 5

Choose Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

Step 6

Using a text editor like Notepad, open the CSR that you generated.

Step 7

Copy all information from and including

Step 8

Paste the content of the CSR into the Certificate Request text box.

Step 9

(Optional) By default the Certificate Template drop-down list defaults to the Administrator template, which may or may not produce a valid signed certificate appropriate for server authentication. If you have an enterprise root CA, choose the Web Server certificate template from the Certificate Template drop-down list. The Web Server certificate template may not display, and therefore this step may not apply, if you have already modified your CA configuration.

Step 10

Click Submit.

Step 11

In the Administrative Tools window, choose Start > Administrative Tools > Certification > Authority > CA name > Pending Request to open the Certification Authority window. The Certificate Authority window displays the request you just submitted under Pending Requests.

Step 12

Right click on your request, and complete these actions:

Step 13

Choose Issued certificates and verify that your certificate has been issued.

Step 1

In Administrative Tools, open the Certification Authority. The Certificate Request that you issued displays in the Issued Requests area.

Step 2

Right click the request and choose Open.

Step 3

Choose the Details tab.

Step 4

Choose Copy to File.

Step 5

When the Certificate Export wizard displays, click Next.

Step 6

Complete the Certificate Export wizard:

1. In the Export File Format window, choose Base-64 encoded X.509 and click Next.

2. In the File to Export window, enter the location where you want to store the certificate, use cert.cer for the certificate name, and choose c:\cert.cer.

3. In the Certificate Export Wizard Completion window, review the summary information, verify that the export was successful, then click Finish.

Step 7

Copy or FTP the cert.cer to the computer that you use to administer the IM and Presence Service.

Step 1

From Administrative Tools, open the Internet Information Services (IIS) Manager window.

Step 2

Under Connections in the left pane of the IIS Manager, choose the Exchange Server.

Step 3

Double-click Server Certificates.

Step 4

Under Actions in the right pane of the IIS Manager, choose Complete Certificate Request.

Step 5

In the Specify Certificate Authority Response window, complete these actions:

1. To locate your certificate, choose the ellipsis [...].

2. Navigate to the correct path and filename.

3. Enter a user-friendly name for your certificate.

4. Click Ok. The certificate that you completed displays in the certificate list.

Step 6

In the Internet Information Services window, complete the following steps to bind the certificate:

1. Choose Default Web Site.

2. Under Actions in the right pane of the IIS Manager, choose Bindings.

Step 7

Complete the following steps in the Site Bindings window:

1. Choose https.

2. Choose Edit.

Step 8

In the Edit Site Binding window, complete the following steps :

1. Choose the certificate that you just created from the SSL certificate drop-down list. The name that you applied to the certificate displays.

2. Click Ok.

Step 1

Log in to your CA Server user interface and open a web browser.

Step 2

Open the URL specific to your Windows platform type:

1. Windows Server 2008 – https://127.0.0.1/certsrv

Step 3

Choose Download a CA certificate, certificate chain, or CRL.

Step 4

For the Encoding Method, choose Base 64.

Step 5

Click Download CA Certificate.

Step 6

Save the certificate, certnew.cer, to the local disk.

Step 1

Use the Certificate Import Tool in Cisco Unified CM IM and Presence Administration to upload the certificate:

Step 2

If the Certificate Import Tool indicates that certificates are missing (typically the CA certificate is missing on Microsoft servers), manually upload the CA certificate(s) using the Cisco Unified OS Admin Certificate Management window.

Step 3

Return to the Certificate Import Tool (Step 1) and verify that all status tests succeed.

Step 4

Restart the CiscoPresence Engine and SIP Proxy service after you upload all Exchange trust certificates. Log in to the Cisco Unified IM and Presence Serviceability user interface. Choose Tools > Control Center - Feature Services.