First, there is a hidden parameter allowing A/V federation to PIC only available through the Lync Management Shell. This example modifies the global policy to allow both Public IM and Public IM A/V traffic so change the scope appropriately if you’re limiting by site or users.

Set-CsExternalAccessPolicy Global -EnablePublicCloudAccess $true -EnablePublicCloudAudioVideoAccess $true

Secondly, the Windows Live network does not support SRTP encryption of the audio/video traffic, but Lync requires this encryption by default. We need to change Lync to support encryption instead of require it. Once that change is made Lync will prefer encrypted sessions and still negotiate those first, but will allow unencrypted media to be exchanged if it can’t agree on encryption. The other Lync default is to only allow VGA video quality, but you can do 720p to Windows Live if both endpoints support it. This example changes the media encryption and video quality at the global level.

Set-CsMediaConfiguration Global -EncryptionLevel SupportEncryption -MaxVideoRateAllowed Hd720p15M

That change should be picked up within 5 minutes on the Front-End. After that, sign out of your Lync client and back in. You can verify the change by holding down the CTRL key, right-clicking the Lync task tray icon, and selecting Configuration Information. The PC to PC AV Encryption should say “AV Encryption Supported” now.

If you don’t make this change you’ll see an error on Front-End servers when trying to initiate an A/V call that the encryption levels don’t match:

Start-Line: SIP/2.0 488 Not Acceptable Here
From: “Eddie Vedder”<sip:eddie@confusedamused.com>;tag=ed272dd714;epid=8e3ef28192
To: <sip:user@hotmail.com;mepid=F6333909B2AE4F60A2553FA59913B0A8>; tag=ab1e5513de
USER-AGENT: UCCAPI/4.0.7440.0 WLM/15.4.3502.0922 (Windows Live Messenger)
ms-client-diagnostics: 52017;reason=”Encryption levels dont match”

Also, keep in mind the Windows Live user must be using the Windows Live Messenger 2011 version to support Lync A/V federation. When you’re connecting a call the Windows Live client will recognize that you’re connecting to Lync:

Happy federating!

Right after we finished decommissioning our entire OCS 2007 R1 setup we received a batch of Communicator Phone Edition (Tanjay) devices from Microsoft that had a pre-R1 version of the firmware loaded – 1.0.199 (1.23).  Initially they wouldn’t even sign in to an R2 pool and when I changed the client version filter they were able to sign in, but then immediately generated a failure “Application DoMo.exe has performed an illegal operation and will be shut down”. The device would then exit DoMo.exe and dump you into the Windows CE desktop. Fun.

I found some references that the only way to get these suckers updated was to use an R1 pool and Update Server so I started building up a lab of R1 servers again and the joys (read: excruciating agony) of the update service.  Even still, no matter what I did I couldn’t get these phones to even sign in to an R1 pool. They never downloaded the certificate from AD using an Integrated Enterprise CA, and never picked up the time correctly from the time server. All my DNS entries and DHCP options were configured correctly, so what the heck, right?

Thankfully, I ran across a post in the OCS forums where someone detailed this ridiculous process of setting the time and date and installing the certificate manually so the Tanjay could sign in. Amazingly, it works. I’m reposting it here with a few notes of my own so it’s easier to find for anyone else that is so lucky to receive a device with this firmware.

I used VMware workstation with 3 VMs – A DC/CA/DNS/DHCP server, an OCS 2007 Standard Edition Front End, and a SharePoint Services 3.0 (not SP1) sever. I bridged the NIC on all of the VMs to my wired NIC and then plugged my wired NIC into a switch with the Tanjays on it. Be careful that you don’t bridge your VM with a live network that already has DHCP on it if you go this route.

1. Connect the Tanjay phone to a network with a DHCP server.
2. Ensure that you can ping the IP address assigned to the Tanjay phone. You can check the address leased from the DHCP server. The Tanjay’s MAC address should begin with 0016e3f1xxxx
3. When booted up for the first time, it would launch the Communicator 07 phone edition and it would attempt to sign in but the sign in would fail. Exit it by touching the relevant screen button.
4. There are two things we need to do, install the Root CA cert and change the system time. If you can’t see the screen properly, you can adjust the desktop theme by going into the display properties. (Tab and hold on the desktop – properties).
5. On the Win CE desktop, double tap on My Device. Go into the Control Panel and change the system time. WARNING: The time and date wwill reset to March 07 after every reboot. You will have to change the system time again if you need to power off the device.
6. Export your CA’s root certificate to a .cer format file. Place it in a file share. Give the file share Everyone read permissions and Everyone read ability on the security settings.
7. Next, on the Tanjay phone Control Panel, double tap "Owner" and go to the "Network ID" tab. Enter the username, password and domain to access the file share. The input panel tends to block the field you’re trying to type in, but you can drag the window slightly up or down to see what you’re entering.
8. Go back to the root of the device and select the "Network" folder.
9. Expose the address bar if it is not shown (View | Address bar)
10. On the address bar, type the UNC name of the file share where the root CA cert is stored.
11. After a while the share should open up. If it doesn’t double check your UNC name and also the password entered in the previous step. (Blank password is not allowed by default)
12. Highlight the .cer and choose File | Send To | My Documents.
13. Go back to Control Panel and open the Certificates panel. Under "Trusted Authorities", click on Import. Choose From a File and just browse to the cer file in the My Documents folder. You should now see it listed in the trusted root list.
14. To launch Office Communicator Phone Edition again go to the Windows directory and find a file/shortcut call DoMo.exe. Double tap on this to launch the OCPE software.
15. Now you should be able to sign in to your R1 pool.  Assuming your update server is properly working and you have the latest R1 ucupdates.cab files approved wait the phone should update in about 15 minutes.
16. Ok, so now you’ve got a phone at version 1.0.522.101 (1.23) which will be able to sign in to R2.
17. After you sign in to an R2 pool the phone should grab an interim update version 1.0.522.103 (1.23) and restart again.
18. Sign in one more time and the phone will now pick up the latest Tanjay bits which puts your device at 3.5.6907.0 (1.23).

Rui Silva has an awesome post on the R2 update process if you’re having trouble at that point: http://blogs.technet.com/ucspotting/archive/2009/03/11/troubleshooting-ocs-2007-r2-device-update-service-for-communicator-phone-edition.aspx