In a locked-down Active Directory environment where permissions inheritance is disabled, domain preparation does not set the necessary ACEs on the containers or organizational units holding Users or InetOrgPerson objects within the domain. In this situation, you must run the Grant-CsOuPermission cmdlet on each container or OU that has User or InetOrgPerson objects for which permissions inheritance is disabled. If you have a central forest topology, you must also perform this procedure on the containers or OUs that hold contact objects. For details about central forest topologies, see Supported Active Directory Topologies in the Supportability documentation. The ObjectType parameter specifies the object type. The OU parameter specifies the organizational unit.

This cmdlet adds the required ACEs directly on the specified containers or OUs and the User or InetOrgPerson objects within the container.

You need user rights equivalent to Domain Admins group membership to run this cmdlet. If the authenticated user ACEs have also been removed in the locked-down environment, you must grant this account read-access ACEs on the relevant containers or OUs in the forest root domain as described in Authenticated User Permissions Are Removed or use an account that is a member of the Enterprise Admins group.

1. Log on to a computer joined to the domain with an account that is a member of the Domain Admins group or that has equivalent user rights.

2. Start the Lync Server Management Shell: Click Start, click All Programs, click Microsoft Lync Server 2010, and then click Lync Server Management Shell.

3. Run:

   	Copy Code
   Grant-CsOuPermission -ObjectType <User | Computer | InetOrgPerson | Contact | AppContact | Device> -OU <DN name for the OU container relative to the domain root container DN> [-Domain <Domain FQDN>]

   If you do not specify the Domain parameter, the default value is the local domain.

   For example:

   	Copy Code
   Grant-CsOuPermission -ObjectType "User" -OU "cn=Redmond,dc=contoso,dc=net" -Domain "contoso.net"

4. In the log file, look for <Success> Execution Result at the end of each task to verify that the permissions were set, and then close the log window. Or, you can run the following command to determine whether the permissions were set:

   	Copy Code
   Test-CsOuPermission -ObjectType <type of object> -OU <DN name for the OU container relative to the domain root container DN> [-Domain <Domain FQDN>] [-Report <fully qualified path and name of file to create>]

   For example:

   	Copy Code
   Test-CsOuPermission -ObjectType "User" -OU "cn=Redmond,dc=contoso,dc=net" -Domain "contoso.net" -Report "C:\Log\OUPermissionsTest.html"

In a locked-down Active Directory environment where permissions inheritance is disabled, domain preparation does not set the necessary ACEs on the containers or OUs that hold Computer objects within the domain. In this situation, you must run the Grant-CsOuPermission cmdlet on each container or OU that has computers running Lync Server where permissions inheritance is disabled. The ObjectType parameter specifies the object type.

This procedure adds the required ACEs directly on the specified containers.

You need user rights equivalent to Domain Admins group membership to run this cmdlet. If the authenticated user ACEs have also been removed, you must grant this account read-access ACEs on the relevant containers in the forest root domain as described in Authenticated User Permissions Are Removed or use an account that is a member of the Enterprise Admins group.

1. Log on to the domain computer with an account that is a member of the Domain Admins group or that has equivalent user rights.

2. Start the Lync Server Management Shell: Click Start, click All Programs, click Microsoft Lync Server 2010, and then click Lync Server Management Shell.

3. Run:

   	Copy Code
   Grant-CsOuPermission -ObjectType <Computer> -OU <DN name for the computer OU container relative to the domain root container DN> [-Domain <Domain FQDN>][-Report <fully qualified path and name of output report>]

   If you do not specify the Domain parameter, the default value is the local domain.

   For example:

   	Copy Code
   Grant-CsOuPermission -ObjectType "Computer" -OU "ou=Lync Servers,dc=litwareinc,dc=com" -Report "C:\Logs\OUPermissions.xml"

4. In the example log file C:\Logs\OUPermissions.xml, you would look for <Success> Execution Result at the end of each task and verify that there are no errors, and then close the log. You can run the following cmdlet to test permissions:

   	Copy Code
   Test-CsOuPermission -ObjectType <type of object> -OU <DN name for the OU container relative to the domain root container DN> [-Domain <Domain FQDN>]

   For example:

   	Copy Code
   Test-CsOuPermission -ObjectType "user","contact" -OU "cn=Bellevue,dc=contoso,dc=net" -Domain "contoso.net"

   Note:

   If you run domain preparation on the forest root domain in a locked-down Active Directory environment, be aware that Lync Server requires access to the Active Directory Schema and Configuration containers. If the default authenticated user permission is removed from the Schema or the Configuration containers in AD DS, only members of the Schema Admins group (for Schema container) or Enterprise Admins group (for Configuration container) are permitted to access the given container. Because Setup.exe, Lync Server Management Shell cmdlets, and Lync Server 2010 Control Panel require access to these containers, Setup and installation of the administrative tools will fail unless the user running the installation has user rights equivalent to Schema Admins and Enterprise Admins group membership. To remedy this situation, you must grant RTCUniversalGlobalWriteGroup group Read, Write access to the Schema and Configuration containers.