Enable/Disable Lync Through Group Membership?

Question

Is it possible to provision Lync access to users through group membership? For example, let's say we don't want to provide Lync to all users so we have a security group called "Lync Users". Is it possible, using a Business Rule, to enable Lync access for a user when they are added to that group and disable it if they are removed from the group?

Answer 1

Hello,

Yes, you can do this with the help of Business Rules. You can create two Business Rules, one triggered after adding a member to a group, and one triggered after removing a member from a group. Both the Business Rules will use PowerShell scripts to enable/disable users for Lync.

To create a Business Rule that enables users for Lync once they are added to a certain group:

1. Create a new Business Rule.

2. On the 2nd step of the Create Business Rule wizard, select Group and After adding a member to a Group.
   

3. On the 3rd step, add the Run a program or PowerShell script wizard and paste the following script in the Script field:
   

    $lyncPool = "lyncserver.domain.com" # TODO: Modify me
    $sipAddress = "sip:%mail%" # TODO: Modify me
    $telephonyOptions = "ADM_LYNCTELEPHONYMODE_PC2PC" # TODO: Modify me
    $lineUri = $null # TODO: Modify me
    $lineServerUri = $null # TODO: Modify me
   
    $newMember = $Context.BindToObjectByDN("%member%")
    $newMember.LyncEnable($lyncPool, $sipAddress, $telephonyOptions, $lineUri, $lineServerUri)
   

4. In the script:

   • $lyncPool - the fully qualified domain name (FQDN) of the Registrar pool where the user's Lync Server account will be homed,
   • $sipAddress - the user's SIP URI,
   • $telephonyOptions - specifies how Telephony Options must be configured for the user,
   • $lineUri - specifies the phone number assigned to the user,
   • $lineServerUri - the URI of the remote call control telephone gateway assigned to the user.

   Modify the script to your requirements. For more details, see the description of the LyncEnable method in our SDK.

5. Enter a short description for the script and click OK.

6. On the 4th step, click Add.

7. Double-click the group that will be used for users who need access to Lync.
   

8. In the Assignment Options dialog, check the This Group object option and uncheck the Members of this Group option.
   

9. Click OK two times and finish creation of the Business Rule.

To create a Business Rule that disables users for Lync once they are removed from a certain group:

1. Create a new Business Rule.

2. On the 2nd step of the Create Business Rule wizard, select Group and After removing a member from a Group.
   

3. On the 3rd step, add the Run a program or PowerShell script wizard and paste the following script in the Script field:
   

    $removedMember = $Context.BindToObjectByDN("%member%")
    $removedMember.LyncDisable()
   

4. Enter a short description for the script and click OK.

5. On the 4th step, click Add.

6. Double-click the group that will be used for users who need access to Lync.
   

7. In the Assignment Options dialog, check the This Group object option and uncheck the Members of this Group option.
   

8. Click OK two times and finish creation of the Business Rule.

Comments

Awesome! Thank you!