Testing and deploying updates   Retrieve updates from Microsoft and upload them to Device Update Web service. Test, and then approve or reject, specific updates for deployment to your organization’s IP phones to make sure that all updates are valid and functional, instead of having to troubleshoot after deployment.

Important:
Updates are not automatically copied over. The updates need to be uploaded to each server in the pool.

Rolling back an update   Roll back a defective update and retain a tested prior update as the latest update. The device goes back to the backup tested update, which is always stored on the device as a backup.

Introducing new device models   Make available all software updates relevant to a new model of an IP phone that is being introduced to the market.

Inventory management for devices in organizations   Use the log files and audit information stored in the Device Updates folder to view the IP phones in your organization and information about them, such as the current firmware version.

The device request handler performs the following tasks:

• Receives requests for software updates from IP phones.
  
  
• Receives device logs and stores them on the server.
  
  
• Generates audit logs for device update activity.
  
  

Microsoft makes updates available in cabinet (.cab files) that you can download from the Microsoft Help and Support website. An update .cab file contains updates for one or more unified communications (UC) devices. After obtaining the .cab file, you upload it to Device Update Web service by using the Lync Server Management Shell.

The following file types are contained in an update:

• .cat: Security catalog
  
  
• .nbt: Software image
  
  
• .xml: Description file
  
  

In Microsoft Lync Server 2010 Control Panel, use the following to manage the Device Update Web service on the Clients page:

• Device Update   Provides the ability to view updates in the device update store, create device update rules in Central Management store and approve or reject device updates for deployment, approve or reject updates for test devices, and roll back updates to a previous version.
  
  
• Test Device   Provides the ability to specify the devices that are to receive pending updates for testing purposes.
  
  

The device updates file store serves as the central repository for the update information, logs, and audit information. It provides the installation point for devices that require updates.

In Lync Server 2010 Standard Edition, this folder is automatically created by the installer and located in the Web Services folder, under the installation folder. The default path is as follows:<share>\<Webservice instance>\DeviceUpdateLogs\Server\Audit\ImageUpdates.

Note:

This is located on every web server. If you are looking for device upload log files, the default path is as follows:<share>\<Webservice instance>\DeviceUpdateLogs\Client\. You will need to check every Front End Server in the pool, as the user’s logs could have been updated to any one of them (the routing algorithm determines this based on load). You can also check to the file store path using the Topology Builder: Select the site, and then select FileStore. The path will be listed.

In Lync Server 2010 Enterprise Edition, prior to installation, the administrator creates a shared folder to contain both client and device update files. The administrator then specifies the location of this folder in the Create Front End Pool wizard during deployment.

Important:

We recommended that you create a quota on the Device Update Web service log file store at %ProgramFiles%\Microsoft Lync Server\Web Services\DeviceUpdateFiles, using the File Server Resource Manager. A quota will help to ensure that the number of log files does not increase greater than the size of the file store, which could cause problems on the Web Services role. The Device Update Web service log file store is installed as part of the Front End Server role, and we recommend that you set up the quota whether or not you are using the Device Update Web service. For details about setting up a quota using the File Server Resource manager, see "File Server Resource Manager Step-by-Step Guide for Windows Server 2008" at http://go.microsoft.com/fwlink/?LinkId=201142.

If device is inside the organization’s firewall and the user is signed in, the Device Update Web service returns a response that contains one of the following:

Important:
To update devices inside the organization’s firewall the following Internet Information Services (IIS) virtual directory must be set to the following: http://<Internal FQDN>/DeviceUpdateFiles_Int

• If no approved updates exist for the current version of the firmware, or if the current version of the firmware matches the version of the approved update, the response contains NumOfFiles = 0. For test devices, pending updates are also considered.
  
  
• If an approved update is available for the current firmware version, the response contains the path to the location from where the update can be downloaded.
  
  

If the device is outside the organization’s firewall, and the user is signed in, the Device Update Web service returns a response indicating that anonymous access is not supported. The device then sends an HTTPS update request over port 443 to the Device Update Web service. The Device Update Web service returns one of the responses listed previously in the internal case.

Important:
To update devices outside the organization’s firewall, Lync 2010 Phone Edition upgrade files are required when publishing websites using a reverse proxy server. Publishing websites typically requires the following reverse proxy certificates: Subject Name = ExternalWebFarmFQDN (for example, ocsrp.contoso.com)

If the device is outside the organization’s firewall, and the user is not signed in, the Device Update Web service denies the request.

When the update is complete, the device uses the update as its current version, and the previous version is stored in the firmware as a backup.

When the device is turned on for the first time, it sends a DNS lookup request to ucupdates-r2.<DNSDomainNameProvidedByDHCP> to obtain internal URL of the server running the Device Update Web service. The device will then make a HTTPS request to request for device updates.

Dependencies for this function:

• The phone must be on the corporate network.
  
  
• UCUpdates-R2 must be configured in DNS.
  
  
• Device Update certificate must have SAN entries containing ‘UCUpdates-R2’ (hostname) and ‘UCUpdates-R2.contoso.com’ (FQDN).
  
  
• The server running the Device Update Web service must have a certificate trusted by Lync 2010 Phone Edition.
  
  
  • Refer to the Trusted Authorities Cache for a list of publicly trusted certificates.
    
    
  • If you use a private enterprise certificate, the device will not receive updates. To work around this, have the user attempt sign-in on the device. Regardless of whether or not the sign-in is successful, the sign-in process will trigger the bootstrapper and download the root certificate from the server.
    
    
• Network Time Protocol (NTP) must be configured correctly for the device. For details, see Using NTP to Set the Correct Time and Date for Devices.