Ok here is something we've struggled with since installing OCS 2007.

Our company's website is company.com

Our emails are dubRun@company.com

When the Domain was set up internally for active directory, something else was chosen

Internal Domain: company.local

And thus in AD the account email is first.last@company.local, not the same as their actual email address.

We installed Office Communicator Server 2007 and have the following FQDN for it:


Users can sign in just fine using the firstname.lastname@company.local and talk to other coworkers.

What I'd like to do is take advantage of Presence, which looks like the email account in outlook needs to match the email account in AD.

Tell me, ServerFault community, is this possible, or does the Active Directory need to be modified in some way to make this work?


There's no reason why your users should not be able to log in using their e-mail account identity provided OCS has been configured correctly to use the user@company.com SIP URI's and DNS is set up properly. There are number of configuration areas where you will need to check that but pay particular attention to the certificate configuration. I've seen this sort of failure when not all of the SAN's were correctly set up on the certs and when the various DNS SRV records were incorrect. You can find a brief outline of the steps you need to follow to get it all working here and there's some pretty OK simplified installation documentation at OCSPedia.

As it stands it's also possible that your end users just need to apply the Communicator Roll-up Hotfix from KB969694. Presence failures related to Outlook Integration can be resolved by this if the issues are simply a client side problem.

I'd still recommend you take a good look at the Cert\DNS configuration in your environment as you really should be able to get users to simply install Communicator and have it "just work".

The changes you need to make are:
Your internal (and external if you want external access) DNS settings must have A records for all of the OCS services (SIP, web-conferencing, AV etc). If Communicator is working at all then these are probably OK but worth checking. Ideally you should also have DNS SRV records for the autodiscovery names ( these are _sipinternaltls._tcp.company, _sipinternal._tcp.company.com, _sip._tls.company.com and _sip._tcp.company.com ) that point to the Front End server so that the auto-discovery process will work properly. The specifics are summarised here. Autodiscovery will still work even without SRV records provided you have the relevant aliases (_sipinternal.company.com etc) setup as A records in DNS. Communicator tries a number of alternatives before failing which is why you can get away without SRV records but it is best to create them if you can.

The DNS changes are reasonably straightforward if you are not using Certs but if you are using Certs (which you will have to for external access) then you will need to take care to configure the certs appropriately too - again the steps you need to follow for creating Certificate requests, installing and configuring the services to use them are available in this OCSpedia page. The definitive documentation for all of this from Microsoft can be downloaded from here and I'd recommend that you take time to work through it if you can, the OCSpedia and blog links should suffice but they are a simplified set of steps.

To change the name users log into communicator with from username@company.local you have to add company.com as a SIP domain in the Front End Server Pool. If you right click the Pool in the OCS Manager then you should be able to get into the Configure Pool/Server Wizard to do that.

|improve this answer|||||
  • Thanks alot for that post. Currently the server has to be manually entered in Communicator. So from what your saying, I'll need to change the dns to use communicator.company.com (or something like that) and also set the SIP to be user@company.com. When I change communicator to use company.com, will it change the option available in the 'Communicator' tab of a user in active directory? Currently I can change the first half of the SIP, but the @company.local is the only selection available in a drop down box. – dubRun Feb 2 '10 at 14:59
  • I've added some more info into the answer - you are broadly right but you need to make the right changes to put it into effect. – Helvick Feb 2 '10 at 16:35
  • Ok so I have changed my SIP properly on the front end and added the DNS for sip.company.com. I am having trouble with the Certificate now using the new SIP domain. Checking the links provided now, is there a trick to making a dual certificate? – dubRun Feb 10 '10 at 19:31
  • If by Dual certificate you mean the Subject Alternate Name (SAN or UC) certs the only trick is that you need to make sure you put the right extra names in the Subject Alternate Name field. The OCSpedia link above details the correct names for each of the certs you will need and explains when you need a cert to include them, and when you don't. – Helvick Feb 10 '10 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.