OCS Front-End service stopped with service-specific error 3286842403 (0xC3E93C23), due to Windows update KB974571

[Short url for this article - http://doiop.com/ocsFE_issue]

I am sure you must be facing this issue suddenly in your OCS production environment. This is quite interesting. I’m just sharing my experience. It’s also quite funny that Microsoft releases ‘Security updates’ and ends up bringing down a production server. One of the Windows security update KB974571 has broken OCS R2; that’s why OCS Front-End service Stopped.

My OCS Server, LiveMeeting; Group Chat environment was working fine until Yesterday. But Today when i have tried to login to OCS, I was not able to login. Then i checked for my OCS Server; found that all of the OCS Services are in started state except OCS Front-End service.
I tried to restart my OCS FE, but i ended with the following service specific error 3286842403 (0xC3E93C23).

Log Name: System
Source: Service Control Manager
Date: 10/15/2009 11:22:54 AM
Event ID: 7024
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: FTI-360-VM1.ima64.com
Description:
The Office Communications Server Front-End service terminated with service-specific error 3286842403 (0xC3E93C23).
Event Xml:

7024
0
2
0
0
0×80000000000000

54887

System
FTI-360-VM1.ima64.com

Office Communications Server Front-End
3286842403 (0xC3E93C23)

I was just clueless for a moment. I was not ready to accept that something has gone wrong with my OCS Server as nobody has access rights; also it was working fine till late night yesterday. I did not know how to proceed from there for a moment.

I took a dip breath; then restarted my system. But still the same issue was there.
Then i started thinking what might went wrong in last 8 hours. Suddenly i thought let me check for updates happened in my system last night.

Then after half an hour I figure it out, that One of the Windows security update KB974571 has broken OCS R2; that’s why OCS Front-End service Stopped.

I removed this Windows update & restarted my OCS Front End Service.
Then it worked fine for me.

It’s a bug in windows update….. They have managed bring down a critical product service with the release of a windows update.

This could happen for LCS & OCS R1 deployments also.

Please also note of another complexity that affects end users -

Auto-upgrades are enabled on end user desktops as well. Security Update KB974571 will be applied on end user desktops. Hence users will not be able to login to OCS though the FE Server is up, after removing the offending update from the FE Server.

But the users without this Security update will be able to login to OCS. To address this issue, end users too need to uninstall this update from their desktops. This is applicable for LCS as well.

Unable to upload files in OCS Group Chat

If you are a regular user of OCSR2 Group chat, you will find this ever interesting. Have you ever tried File transfer ( i.e. Upload / Download ) in OCS Chat room?. If you say yes, then you must be facing the issue with file transfer; I am sure you are unable to upload the file. You must be getting either one the following errors during File Upload in OCS Chat room.

i) A file transfer error occured.Server was unable to process request.—> Object reference not set to an instance of an object.

ii) A file transfer error occured.System.Web.Services.Protocols.SoapException: Server was unable to process request; System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.Rtc.Chat.MgcCommon.Logging.ParlanoLogger.get_IsInfoEnabled()
at Microsoft.Rtc.Internal.Chat.Server.MGCWebService.Provider.ConfigureEverytime()
at Microsoft.Rtc.Internal.Chat.Server.MGCWebService.MGCWebService..ctor()
—End of inner exception stack trace—

I would say it’s a MS bug & just ask me why? Here is the answer. I just want to share this, which may helpful for all.

Case -1

1.OCS Group Chat Web Service ( i.e. MGCWebService ) is responsible for File Upload & Download.
2.Go to run & type “inetmgr” in OCS GC machine & you will find this website is running under Local Computer (i.e. AS-64b-VM1) –> Web Sites –> Default Web Site –> MGCWebService.
3.Right Click on MGCWebService & then go to Properties –> Directory Security –> Authentication and Access Control –> Edit
4.You will get the user name as “IUSR_MCName” (i.e. IUSR_AS-64B-VM1) & this is member of the Guests group of the local machine.

Case -2

1.When we configure OCS Group Chat Web Service we provide a share folder to specify the “Root directory used to store files that are uploaded to any instance of the Web service”.
2.This shared folder name can be found once we open the GC Server Config Tool à File Repository tab.
3.Now go to the properties of the File Repository folder (i.e. \\AS-64b-VM1\GCCWebService ) & check for NTFS permissions (Security Tab) of this File Repository folder.
4.You will find that Guests group is not present in its Access Control List, but the MGCWebService account needs Full Permission (Read / Write) on this File Repository folder, inorder to file upload happens.
5.Hence you need to choose one domain account that is having Full Permission for this folder. Additionally this account should be member of RTCComponentUniversalServices as the account needs to access the file repository as well as Message Queuing.
6.You can say OCS GC Channel service account OR OCS Group Chat Admin service account are the right candidate for this are they are natively ready with all these permissions.

Case -3

1.Now you need to change the user name from “IUSR_MCName” (i.e. IUSR_AS-64B-VM1) to OCS GC Channel service account ( i.e. 64AS\GCManage ).
2.Also change the password accordingly w.r.t this new account.
3.Make sure that Enable Anonymous Access check box is selected under Authentication Methods dialog box.
4.Now reboot the OCS Group Chat Server
5.Try file upload after the server is up & ENJOY with File Transfer. Finally you are able to make it work.

New features in OCS 2007 R1

There are new features added in OCS 2007 R1 apart from LCS 2005 and they are –
• On-Premise Web Conferencing
• Enhanced Presence
• Federation Enhancements
• Deployment and Administration Improvements
• On-Premise Web Conferencing

Office Communications Server 2007 introduces the capability for enterprise users both inside and outside the corporate firewall to create and join real-time Web conferences hosted on internal corporate servers. These “on-premise” conferences, or meetings, can be scheduled or unscheduled, and they can include IM, audio, video, slide presentations, and other forms of data collaboration.

Multimedia Capabilities:
OCS 2007 provides rich multimedia capabilities like group IM, audio and video, multiparty audio conferencing. For these it includes 4 servers—
IM Conferencing Server
Web Conferencing Server
A/V Conferencing Server
Telephony Conferencing Server

OCS 2007 also includes multimedia conferencing with external users – For this it includes edge servers to be configured in the perimeter network.

There are 4 main types of multimedia conferencing –
? Group IM
? Data Collaboration
? Audio/Video
? PSTN Connectivity

Group IM
This refers to IM conversation among 3 or more parties. We can send IM to a group and when replying back the IM will be delivered to that group.
We can invite other person to IM when the conversation is happening between 2 members.

Data Collaboration
OCS 2007 Web Conferencing support a rich mix of data collaboration which includes—
Power point Support, Application Sharing, Microsoft Office Document Imaging Support, Web Page, multimedia, snapshots etc.

Audio/Video
OCS 2007 support multi party audio/video support. Users can specify a/v when scheduling a conversation or to an existing IM conversation.

PSTN Connectivity
When a user places a call from an enterprise voice client
1) Server normalizes the number to E.164 format and invokes routing rules based on the location profile and user policy and directs calls to Mediation Server.
2) Mediation Server performs any necessary media transcoding and routes call to IP-PSTN gateway.
3) Gateway, based on topology applies local dialing rules or PBX dialing rules and passes call to the PSTN or PBX.

For Enterprise Voice, this uses 2 protocols –
SIP (Session Initiation Protocol) for Signaling and
RTP (Real Time Protocol) for Voice.

Enhanced Presence
This provides infrastructure to enable client application to publish extended presence information. This infrastructure includes Categories and Containers.
Categories include presence information like status, location and calendar state.
Containers are logical buckets into which clients publish instances of various categories of presence information.

Federation Enhancement

OCS 2007 had made some federation enhancements which include –
Federated Conferencing – Users in federated domains are considered to be authenticated for the purpose of joining on-premise conference.
Support for partners with multiple domain name – Enhanced federation now uses SANs (Subject Alternate Names) in certificate to support enterprise with multiple domain names.

Deployment and Administration Improvements
OCS 2007 has come up with new set of management tools which made administrative and deployment task simpler.

Universal Group Support
OCS 2007 supports the native mode universal groups in the Microsoft Windows Server 2003 and Windows 2000 Server operating systems. Members of universal groups can include other groups and accounts from any domain in the domain tree or forest and can be assigned permissions in any domain in the domain tree or forest. For example, it is no longer necessary to add one domain to another in order to enable an administrator to manage both. Eliminating the domain-add requirement also simplifies deployment.
Enhanced in-band provisioning
Office Communications Server 2007 administrators need to be able to customize clients in accordance with the requirements of their particular deployments.
Office Communications Server 2007 uses in-band provisioning to convey the following categories of information to the client:
• User Identity includes display name and e-mail address.
• Server Configuration includes such information as Address Book Service download URLs, group expansion Web Service URLs, console installation URLs, and conference troubleshooting URLs.

Integrated Address Book Server
Address Book Server daily provides global user information to Communicator clients. In Live Communications Server 2005 with SP1, Address Book Server was optional and had to be installed separately from the server. But in OCS 2007 Address Book Server is required and which is installed as part of Standard and Enterprise Edition Setup.

Call Detail Records
Call Detail Records (CDRs) provide a way to collect both IM and meeting data, and generate reports on usage characteristics, which can be used to determine network bandwidth load, employee usage patters, and return on investment. CDRs capture user logons and logoffs, IM conversations, and conference starts and joins.

Support for Globally Routable User Agent URI (GRUU)
OCS 2007 has improved the routing capabilities by introducing support for GRUU technology.
A GRUU uses the following syntax:
sip:ted@contoso.com;opaque=epid:qIIWS2j5AVeD_HxnQdxmlwAA;gruu
The “opaque” parameter makes this URI unique even though the prefix of the URI is still the user address (ted@contoso.com).
In summary, a GRUU is a URI for a specific device whereas ted@contoso.com is a SIP URI that refers to Ted as a user. The Communicator client running on Ted’s laptop will have its own GRUU that allows other applications to route messages specifically to that device.

Conference Protocols Used in OCS 2007
• SIP(Session Initiation Protocol) – This is used for initiating, managing, and terminating sessions between one or more participants.
• HTTP(HyperText Transfer Protocol) – This use in OCS for communication between the focus and conferencing server, downloading address book server updates to clients, and downloading meeting content to users.
• CCCP(Centralized Conference Control Protocol) – A custom protocol for communicating conference creation and control commands from clients to OCS 2007.
• PSOM(Persistent Shared Object Model) – A custom protocol for transporting web conferencing content.
• SRTP(Secure Real-Time Transport Protocol) – This used for securely transporting audio and video content to various media devices.
• RTCP(Real-Time Control Protocol) – This used in conjunction with SRTP to convey information about the signal quality of an audio-video conferencing session to various media devices.

Questions and Answers (FAQ)

1) When we are done with a IM Conference, where is the History stored ?
After the IM Conversation, all the conversation details will be there in “Conversation History” Folder in Microsoft Outlook .

2) When we are doing a Group IM , all the members in the group can receive the message, but can they reply to the same message.
We can go with the Group IM feature, and when the members in the group will receive the message and when replying for the message it will received by all members in the group.
3) We can transfer a file to a single person in the conversation but not to a group.
4) We can have a audio between the 2 members and in a conversation.
5) In OCS 2007 , Presence Information is—
Status, Location, Calendar date, Display Names, Title, mobile phone, home phone, company, meeting location, meeting subject etc.
6) PSTN Connectivity –
In LCS 2005 Front-End Server will connect to CTI(Computer Telephony Interface) and then to PBX to PSTN-gateway and to phone.
In OCS 2007, Mediation server has been introduced. From here it connects to IP-PSTN gateway and there to PSTN to Phone.
Signaling for phone calls coming from the PSTN is converted to SIP by the Media(IP-PSTN) gateway