If your watcher node lies outside the perimeter network, you must add the Network Service account to the RTC Local Read-only Administrators group on the watcher node computer. To do this, complete the following procedure on the watcher node:

1. Click Start, right-click Computer, and then click Manage.

2. In Server Manager, expand Configuration, expand Local Users and Groups, and then click Groups.

3. In the Groups pane, double-click RTC Local Read-only Administrators.

4. In the RTC Local Read-only Administrators Properties dialog box, click Add.

5. In the Select Users, Computers, Service Accounts, or Groups dialog box, click Locations.

6. In the Locations dialog box, select the name of the watcher node computer, and then click OK.

7. In the Enter object names to select box, type Network Service, and then click OK.

8. In the RTC Local Read-only Administrators Properties dialog box, click OK, and then close Server Manager.

Restart the watcher node computer.

After the watcher node computer has restarted, your next step is to run the file Watchernode.msi. To run this file, open the Lync Server 2013 Management Shell by clicking Start, clicking All Programs, clicking Lync Server 2013, and then clicking Lync Server Management Shell. In the Lync Server Management Shell, type the following command and then press ENTER (be sure and specify the actual path to your copy of Watchernode.msi):

	Copy Code
C:\Tools\Watchernode.msi Authentication=Negotiate

Note:
As noted previously, Watchernode.msi can also be run from a command window. To open a command window, click Start, right-click Command Prompt, and then click Run as administrator. When the command window opens, type the same command as shown earlier.

The Negotiate mode is used any time the watcher node cannot be set up as a trusted application pool. In this mode, administrators will need to manage test user passwords on the watcher node.