Disallow Microsoft Lync to automatically detect and securely communicate with SIP servers that have non-standard fully-qualified ...

Lync 2010

Disallow Microsoft Lync to automatically detect and securely communicate with SIP servers that have non-standard fully-qualified domain names (FQDNs).

Note: This policy setting takes effect only if Microsoft Lync uses "automatic configuration" to query DNS for a list of SIP servers, and only if Microsoft Lync communicates with the SIP server using the TLS transport. In this case, the set of supported server FQDNs depends on the SIP URI of the user who starts Microsoft Lync.

For example, if you disable or do not configure this policy setting, and the user's SIP URI is SIP:[email protected], Microsoft Lync can communicate with a SIP server in TLS transport only if its FQDN is either EXAMPLE.COM or SIP.EXAMPLE.COM. In other words, the FQDN of the server must exactly match the domain portion of the user's SIP URI, or else the FQDN must be "SIP." followed by the domain portion of the user's SIP URI. This prevents a "man-in-the-middle" security vulnerability: an attacker can detect the UDP message that the client uses to perform the DNS lookup, and respond to the client with the name of an unauthorized SIP server. The attacker could then impersonate a trusted user, or the server could cause the client to authenticate using weak encryption.

However, if you enable this policy setting, Microsoft Lync can communicate in TLS transport with any SIP server that has an FQDN that ends with the domain portion of the user's SIP URI. Continuing the previous example, by enabling this policy setting you allow Microsoft Lync to communicate with servers named SIP.DIVISION.EXAMPLE.COM or LC.EXAMPLE.COM. However, an attacker can respond to the initial DNS query with a response that contains the server name ATTACKER.EXAMPLE.COM.

Note: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.

Note: in Communicator 2.0 Beta 3, this is by-default disabled and Communicator might be vulnerable to man-in-the-middle attach. Enabling this policy is strongly recommended.

Delegates must be running Microsoft Office Communications Server 2007 R2 Attendant or another attendant console to answer ... Deleting a recording saved on another computer only removes the corresponding link from the Recording Manager. Deleting permanently ... did not receive your sharing invitation because the address is incorrect or this person is outside your company and not federated. ... Disallow Microsoft Lync to automatically detect and securely communicate with SIP servers that have non-standard fully-qualified ... Disallow Microsoft Lync to automatically detect and securely communicate with SIP servers that have non-standard fully-qualified ... Display my Out of Office information to contacts in my Friends and Family, Workgroup, and Colleagues privacy relationships ... Distribution group service is unavailable at this time. Please try again later. If the problem continues, please contact ... Do you want to end the call when you close this window? If you answer No, the window will close, but the call will continue ... Do you want to leave the call when you close this window? If you answer No, the window will close, but the call will continue ...