Securing Clients for Lync Server 2010

Topic Last Modified: 2011-07-17

When you configure clients prior to deploying an Microsoft Lync Server 2010 network, take the following recommended measures to enhance client security:

• Use Windows 7, Windows Vista, or Windows XP with the latest service pack.

• Configure client policies for media encryption and other functionality. Some of these key policies are client bootstrapping policies that specify, for example, the default servers and security mode that the client should use until sign-in is complete. Because these policies take effect before the client signs in and begins receiving in-band provisioning settings from the server, they must exist in the client computer’s registry before initial sign-in. You can use Group Policy to configure these policies. There are also certain settings that you should configure by using Lync Server Management Shell before client deployment. For details about these policies and settings, see Key Client Policies and Settings in the Planning documentation.

• Configure Lync 2010 to use TLS, which provides encrypted signaling. The confidentiality even of otherwise encrypted communications, such as media, is not protected when a user connects to the server using TCP. The encryption key can be intercepted by an attacker and used to decrypt the message. If you must allow client connections over TCP, be aware of this vulnerability.

• File transfer between users is peer-to-peer. All file transfers are encrypted by default. Instruct users to run a virus check before opening transferred files.

• Consider restrictions on client connections and messages.

• Isolate users according to usage requirements.

• Run antivirus software on the client.

• Frequently check and apply updates and security updates.

• Use strong password best practices.

• Run only necessary services and applications.

• Enable the Require SIP high security mode Group Policy setting for the users GPO.

In general, you control access for a user account by enabling and disabling each user account in Active Directory. However, if a user is signed into Lync Server 2010 when you disable the user account, the user continues to have access until sign out. Also, a user can sign in for up to 180 days (default Lync certificate expiration time) after the user account is disabled in Active Directory. To prevent this, you can disable certificate-based authentication or reduce the certificate expiration time. To help ensure that only users with appropriate credentials can access Lync Server 2010, you can also do the following:

• If you disable a user in Active Directory and want to ensure that that the user cannot access Lync Server 2010, use Lync Server Management Shell to run the Disable-CsUser cmdlet. This forces the sign out of the user, if the user is signed in, and prevents the user from signing in again unless you re-enable the user.

  Warning

  Running the Disable-CsUser cmdlet deletes user data. If you need to maintain user data, do not use this cmdlet. Instead Set-CSUser -Enabled $false -Identity <userIdentity> to disable all Lync functionality (not just certificate authentication), but still retain the user data. You can also use the Revoke-CsClientCertificate to prevent client access.

• If a user has a password that may have been compromised and you reset it in Active Directory, use Lync Server Management Shell to run the Revoke-CSClientCertificate cmdlet. This revokes the client certificate and helps ensure that the previous password cannot be used to sign-in to the account in the future.

For details about the use of these cmdlets, see the specific cmdlet in the Lync Server Management Shell section of the Operations documentation.