locked
Move-CSManagementServer Permissions Required RRS feed

  • Question

  •  

    Hi,

    Can someone confirm the permissions required to move the CMS role.

    http://technet.microsoft.com/en-us/library/gg412921.aspx seems to indicate that membership of RTCUniversalServerAdmins is all that is required.

    However I am having issues with this unless running under domain admin level. However this could be my lab but I don’t want to try in production until I am confident.

    I have run the process in my lab a few times and if I run as member of RTCUniversalServerAdmins it fails ‘Error: Failed to create new instance of "CN=LS CentralMgmt Service" at "<FQDN>".’.

    This sounds like it creating a new instance which would then sound fair enough that domain admin level permissions is required.

    Background

    As I am sure is true for a lot of customers the original CMS was installed on a non-resilient OAT server.

    What do other do, move the CMS upfront or leave it and tackle\force the CMS move when the original CMS fails ?

    Regards

    Alistair


    Alistair

    Saturday, March 10, 2012 9:32 PM

Answers

  • I believe you would like to move your CMS from your test environment to production environment is this correct?

    i believe the production environment forest and test environment forest's are different, Is this correct

    Why do you want to move CMS from your test to production. Please correct me if i understood wrong

    As far as security is concerned in my previous article microsoft also have mentioned that you should be local administrator of the computer where you are doing this. also if your requirements are full fill with the domain admins then during this period of time would it matter to provide domain admins rights to that user, once it is done you can also remove your self from domain admins.

    As far as i remember to move CMS from one to another should be in the same forest.


    If answer is helpful, please hit the green arrow on the left, or mark as answer. Salahuddin | Blogs:http://salahuddinkhatri.wordpress.com | MCITP Microsoft Lync

    • Proposed as answer by SKHATRI Friday, March 16, 2012 8:00 AM
    • Marked as answer by Noya Lau Thursday, March 22, 2012 10:34 AM
    Sunday, March 11, 2012 9:41 PM
  •  

    Hi,

    By default, members of the following groups are authorized to run the Move-CsManagementServer cmdlet locally: RTCUniversalServerAdmins. You must also be a local administrator on the computer where the cmdlet is being run.

    You must meet those requirements at the same time.

    The local administrator does not exactly mean the local admin, but members own the same permission with local administrator in admin group. So it is ok under domain admin level.

    • Proposed as answer by Lisa.zheng Friday, March 16, 2012 2:10 AM
    • Marked as answer by Noya Lau Thursday, March 22, 2012 10:34 AM
    Monday, March 12, 2012 9:39 AM

All replies

  • Hi,

    Have you tried with these

    http://technet.microsoft.com/en-us/library/gg195644.aspx and http://blogs.technet.com/b/nexthop/archive/2010/12/20/change-a-pool-database-instance-when-the-pool-hosts-the-central-management-server.aspx as to move you first have to introduce Lync Standard server and then move to new sql and new fe server pool

    I didnt understand your last two lines

    As I am sure is true for a lot of customers the original CMS was installed on a non-resilient OAT server.

    What do other do, move the CMS upfront or leave it and tackle\force the CMS move when the original CMS fails ?

    Hope above helps


    If answer is helpful, please hit the green arrow on the left, or mark as answer. Salahuddin | Blogs:http://salahuddinkhatri.wordpress.com | MCITP Microsoft Lync

    Sunday, March 11, 2012 8:57 PM
  • Thanks for the URLs

    However the first one only states RTCUniversalServerAdmins required. However as stated, in my lab which is a fairly close mirror of production the move fails. If I run as a domain admin it works.

    The second article is interesting but doesn't go into the security side.

    My last two lines are just a general question. The CMS is installed on the first Lync server installed. So while this server will be around for some time, the box was installed as a proof of concept. (Enterprise edition, but only a single server in the pool. The server will now be used to test patching before rolling into full production and doesn't host users)

    So I could leave the CMS where it is but my inclination is to move it onto a procution Lync pool made of multiple enterprise edition servers in a pool. However I don't have to do this and was curious what other people do.


    Alistair

    Sunday, March 11, 2012 9:17 PM
  • I believe you would like to move your CMS from your test environment to production environment is this correct?

    i believe the production environment forest and test environment forest's are different, Is this correct

    Why do you want to move CMS from your test to production. Please correct me if i understood wrong

    As far as security is concerned in my previous article microsoft also have mentioned that you should be local administrator of the computer where you are doing this. also if your requirements are full fill with the domain admins then during this period of time would it matter to provide domain admins rights to that user, once it is done you can also remove your self from domain admins.

    As far as i remember to move CMS from one to another should be in the same forest.


    If answer is helpful, please hit the green arrow on the left, or mark as answer. Salahuddin | Blogs:http://salahuddinkhatri.wordpress.com | MCITP Microsoft Lync

    • Proposed as answer by SKHATRI Friday, March 16, 2012 8:00 AM
    • Marked as answer by Noya Lau Thursday, March 22, 2012 10:34 AM
    Sunday, March 11, 2012 9:41 PM
  •  

    Hi,

    By default, members of the following groups are authorized to run the Move-CsManagementServer cmdlet locally: RTCUniversalServerAdmins. You must also be a local administrator on the computer where the cmdlet is being run.

    You must meet those requirements at the same time.

    The local administrator does not exactly mean the local admin, but members own the same permission with local administrator in admin group. So it is ok under domain admin level.

    • Proposed as answer by Lisa.zheng Friday, March 16, 2012 2:10 AM
    • Marked as answer by Noya Lau Thursday, March 22, 2012 10:34 AM
    Monday, March 12, 2012 9:39 AM