Abstract: This short howto explains the needed steps to configure a computer objects to provide Kerberos authentication for an Skype for Business environment.
At the time of this writing Microsoft didn´t released an article for enabling Kerberos on Skype for Business (SfB). But as all steps are the same you can nearly follow the Microsoft howto here, or use the steps below:
Step 1:
Create an Kerberos Authentication account via:
New-CsKerberosAccount -UserAccount “Domain\SfB_Kerb_Id” -ContainerDN “OU=Users,DC=domain,DC=com”
Note:
– The name from the account couldn´t be longer then 14 char
– An computer account will be created (regardless if you use “UserAccount” above) [as written here]. So do not expect an user object!
– You can create Kerberos authentication accounts for each site or you can create a single Kerberos authentication account and use it for all sites [as written here]
Step 2:
Get the names from all SfB sites:
Get-CsSite | fl identity
Step 3:
Assign the Kerberos Authentication account to an SfB site:
New-CsKerberosAccountAssignment -UserAccount “Domain\SfB_Kerb_Id” -Identity “Site:Contoso”
Step 4:
Enables the most recently published Skype for Business Server topology via:
Step 5:
Now locates each server running Web Services in a site that has been assigned a Kerberos account, and then updates the Internet Information Services (IIS) configuration settings on each of those servers. To do that run the following on the frontend server you wish to assign an Kerberos account to.
set-CsKerberosAccountPassword -UserAccount “Domain\SfB_Kerb_Id”
Step 6:
Enables the most recently published Skype for Business Server topology via:
Step 7:
Verifies the configuration of the Kerberos account assigned to a site via:
Test-CsKerberosAccountAssignment -Identity “site:Contoso” -Report “c:\temp\report.htm” -Verbose
then check if the report contains any errors/problems
