Hi everyone. We are currently attempting to deploy Lync 2013 to our company. We have followed the deployment guide and have just finished settings up the front-end server and are ready to begin enabling users.
This is where we are running into issues. When using the Control Panel, we are unable to add any user. We receive the following error message:
Active Directory operation failed on "EVVEY-DC01.evvey.local". You cannot retry this operation: "Insufficient access rights to perform the operation00002098: SecErr: DSID-03150BB9, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0".You do not have the appropriate permissions to perform this operation in Active Directory. One possible cause is that the Lync Server Control Panel and Remote Windows PowerShell cannot modify users who belong to protected security groups (for
example, the Domain Admins group). To manage users in the Domain Admins group, use the Lync Server Management Shell and log on using a Domain Admins account. There are other possible causes. For details, see Lync Server 2010 Help.This appears no matter which account we try to add. I found that a workaround which is normally only required to enable domain admins is to use this command via the Lync Management Shell:
Enable-CsUser -Identity "Pilar Ackerman" -RegistrarPool "atl-cs-001.litwareinc.local"
-SipAddressType SamAccountName -SipDomain litwareinc.local
Each time I ran this, I received no error messages, when I run the Get-CSUser cmdlt it shows all accounts I enabled. When I log back into Control Panel, select the users tab, and hit "search", the only users which show up are those who are domain
admins. None of the normal users show it here.
Having users attempt to login to Lync again show that only the domain admins are able to. Other users, who again show enabled when the Get_CSUser command is run, receive an error that their sign-in address is does not exist.
I have chase down any suggestions I have already found on this forum already. I ensured the users were not flagged with the AdminCount attribute, I ensured their AD accounts were set to inherit from parent objects under Security>Advanced.
The really odd thing about this that I have not seen anyone else mention is that we are for some reason only able to enable domain admins, not regular users.
Any assistance here is appreciated.