UM Integration Fails with “Insufficient Privileges” Error

I recently added a new SBA to an existing Lync 2010/2013 (hybrid) deployment and found the usually routine process of adding the new SBA/Gateway to UM failed. The integration script ExchUCUtil.ps1 reported the following error, sending me on a wild goose chase.

Pool: <SBA-FQDN>

A UMIPGateway doesn't exist in Active Directory for the Office Communications Server Pool. A new UM IP gateway is being created for the Pool.

The Exchange UMIPGateway objects weren't created. Please verify that you're a member of the Organization Management role group or have sufficient privileges to write to this Active Directory container.Additional information:You cannot call a method on a null-valued expression.

[PS] C:\Program Files\Microsoft\Exchange Server\V14\Scripts>

It turns out that the author of the script took a little shortcut. The script displays that message if the “new-UmIpGateway” command fails – regardless of the REAL reason for the failure. And in my case it was because the numeric ID it had decided to use as the name for my new IP Gateway was already in use.  In hindsight I suspect the “Additional information:You cannot call a method on a null-valued expression” is the real failure message – but it wasn’t very helpful anyway.

The Fix

The fix was simple enough – once I’d stopped chasing non-existent permissions issues.

  • Review the existing IP Gateways in the Exchange Control Panel:Exchange-UmIpGateways
  • Find a spare number in the “Name” field above. In the capture from my Lab system above, you could choose 1, 2 or anything from 5 and up
  • Manually create the Gateway in the Exchange Shell, using the number you determined above. (Don’t worry – the Lync site IDs and the Exchange Gateway names don’t need to align. That they’re already out of alignment in this deployment is I think what derailed the script in the first place)
    new-umipgateway –Name “5:1” –Address <SBA-FQDN>
  • Now re-run the script. It now finds the Gateway already exists, and goes on to create the Hunt Group and link it to your Dial Plan.
  • Voila!

 

G.

Leave a Reply

Your email address will not be published.

... and please just confirm for me that you're not a bot first: Time limit is exhausted. Please reload the CAPTCHA.

This site uses Akismet to reduce spam. Learn how your comment data is processed.