Topic Last Modified: 2010-11-08

To successfully complete this procedure you should be logged on as a user who is a member of the RTCUniversalServerAdmins group.

After creating the Kerberos account, you must assign it to a site. This is a Lync Server 2010 site, not an Active Directory site. You can create multiple Kerberos authentication accounts per deployment, but you can assign only one account to a site. Use the following procedure to assign a previously created Kerberos authentication account to a site. For details about creating the Kerberos account, see Create a Kerberos Authentication Account.

To assign a Kerberos authentication account to a site

  1. As a member of the RTCUniversalServerAdmins group, log on to a computer in the domain running Lync Server 2010 or on to a computer where the administrative tools are installed.

  2. Start the Lync Server Management Shell: Click Start, click All Programs, click Microsoft Lync Server 2010, and then click Lync Server Management Shell.

  3. From the command line, run the following two commands:

    Copy Code
    New-CsKerberosAccountAssignment -UserAccount "Domain\UserAccount" -Identity "site:SiteName"
    
    Copy Code
    Enable-CsTopology
    

    For example:

    Copy Code
    New-CsKerberosAccountAssignment -UserAccount "contoso\kerbauth" -Identity "site:redmond"
    
    Copy Code
    Enable-CsTopology
    
    Note:
    You must specify the UserAccount parameter by using the Domain\User format. The User@Domain.extension format is not supported for referring to the computer objects created for Kerberos authentication purposes.
    Important:
    After making any changes to Kerberos authentication, such as adding an account or removing an account, you must run Enable-CsTopology from the Lync Server Management Shell command prompt.