Modify the configuration of an existing Cloud Connector deployment

Article
01/25/2023

Important

Cloud Connector Edition will retire July 31, 2021 along with Skype for Business Online. Once your organization has upgraded to Teams, learn how to connect your on-premises telephony network to Teams using Direct Routing.

Follow the steps in this article to modify the configuration of an existing Skype for Business Cloud Connector Edition 1.4.1 or later deployment.

Modify the configuration of a single site

If there's only one appliance in the site, when you want to change the configuration settings after the appliance is deployed, you can modify the CloudConnector.ini file and start the deployment again.

Run the following cmdlet to uninstall all existing virtual machines on the host server:
```
Uninstall-CcAppliance
```
Run the following cmdlet to unregister the appliance:
```
Unregister-CcAppliance
```
Update the CloudConnector.ini file in the Appliance Directory.
Run the following cmdlet to update the configuration: (This step is only applicable for version 2; for previous versions, skip to the next step.)
```
Import-CcConfiguration 
```
Run the following cmdlet to register the appliance again:
```
Register-CcAppliance
```
Run the following cmdlet to install Skype for Business Cloud Connector Edition:
```
Install-CcAppliance
```

If there's more than one appliance in the site, you need to follow these steps, modify the CloudConnector.ini file, and redeploy the appliances one by one.

Run the following cmdlet to uninstall all existing virtual machines on the current appliance:
```
Uninstall-CcAppliance
```
Run the following cmdlet to unregister the appliance:
```
Unregister-CcAppliance
```
Update the CloudConnector.ini file in the Appliance Directory.
Run the following cmdlet to update the configuration: (This step is only applicable for version 2; for previous versions, skip to the next step.)
```
Import-CcConfiguration 
```
Run the following cmdlet to register the appliance again:
```
Register-CcAppliance
```
Run the following cmdlet on all other appliances in the site to pick up the latest configuration:
```
Publish-CcAppliance
```
Run the following cmdlet to redeploy Cloud Connector on the current appliance:
```
Install-CcAppliance
```

Modify the configuration of multiple sites

To modify the configuration for multiple sites in a deployment, follow the steps for a single site, updating one site at a time.

Modify the configuration of your Microsoft 365 or Office 365 organization to enable automatic updates

To enable operating system automatic updates and Bits automatic updates, you must use the Skype for Business tenant admin account for online management and use tenant remote PowerShell as follows.

If you disabled operating system automatic updates or Bits automatic updates, your host and virtual machine might miss important Windows updates, and Cloud Connector won't upgrade to the new version automatically. It's highly recommended that you enable automatic updates.

The EnableAutoUpdate property of the site needs to be set to true (the default value). Run the following cmdlet to make sure EnableAutoUpdate is set to true:
```
Get-CsHybridPSTNSite -Identity <SiteName>
```
Create auto update time window for the tenant.

The time window can be daily, weekly and monthly. All the time windows need a start time and a duration.
- For a daily time window, only start time and duration are needed.
- For a weekly time window, days of week are needed, which can be a single day or multiple days.
- For a monthly time window, there can be two types. The first type is to specify the day of the month, which can be a single day. The second type is to specify the weeks of the month, along with days of the week, which both can be a single item or multiple items.
- Each tenant can have 20 time windows defined. The default time window is created for a new tenant as the default time window for operating system update and Bits update. Run the following cmdlet(s) to set the daily, weekly or monthly time window:
```
New-CsTenantUpdateTimeWindow -Identity Night -Daily -StartTime 22:00 -Duration 6:00
```
```
New-CsTenantUpdateTimeWindow -Identity WeekdayNight -Weekly -DaysOfWeek Monday,Tuesday,Wednesday,Thursday,Friday -StartTime 22:00 -Duration 4:00
```
```
New-CsTenantUpdateTimeWindow -Identity FirstAndLastWeekend -Monthly -WeeksOfMonth First,Last -DaysOfWeek Sunday,Saturday -StartTime 0:00 -Duration 10:00
```
```
New-CsTenantUpdateTimeWindow -Identity MidDayOfMonth -Monthly -DayOfMonth 15 -StartTime 0:00 -Duration 1.00:00
```
- Assign update time windows to the site.
  
  The Bits update time and OS update time windows are configured separately. Both of them can be assigned single or multiple time windows. Each time window can be assigned to different sites and different purpose (Bits update and OS update). Run the following cmdlet to set the time window for the site:
```
Set-CsHybridPSTNSite -Identity <SiteName> -BitsUpdateTimeWindow @{add="MidDayOfMonth","WeekdayNight"} -OsUpdateTimeWindow @{replace="Night"}
```

Update the dedicated tenant admin credentials

Administrative changes in the Microsoft 365 or Office 365 organization for Cloud Connector are made from an account with the needed permissions. In Cloud Connector versions before 2.0, that account is a dedicated global tenant admin account. In Cloud Connector versions 2.0 and later, that account can be a Microsoft 365 or Office 365 account with Skype for Business Administrator rights.

If your admin account credentials change in Microsoft 365 or Office 365, you also need to update the locally cached credentials in Cloud Connector by running the following Administrator PowerShell command on each Cloud Connector appliance you have deployed:

Set-CcCredential -AccountType TenantAdmin

Update the password for the host server

Note

This section is applicable to Cloud Connector version 2.0 and later.

All Cloud Connector credentials are stored in the following file: "%SystemDrive%\Programdata\Cloudconnector\credentials.<CurrentUser>.xml". When the password on the host server changes, you need to update the locally stored credentials.

To update the locally stored credentials on the Cloud Connector appliance, use the Get-CcCredential and Set-CcCredential cmdlets and follow these steps:

Run the following commands to retrieve the passwords you need later:
- Get-CcCredential -AccountType DomainAdmin -DisplayPassword
- Get-CcCredential -AccountType VMAdmin -DisplayPassword
- Get-CcCredential -AccountType CceService -DisplayPassword
Change the password of your account on the host server.
Restart the host server.
Delete the following file: "%SystemDrive%\Programdata\Cloudconnector\credentials.<CurrentUser>.xml".
Launch a PowerShell console as administrator, and then run "Register-CcAppliance -Local" to re-enter the passwords following the description. Be sure you enter the same password you entered before for the Cloud Connector deployment.

By default, VmAdmin and DomainAdmin use the same password as CceService. If the DomainAdmin, VMAdmin, and CceService passwords returned in step 1 are different, you must perform the following steps:

Run Set-CcCredential -AccountType DomainAdmin as follows:
When prompted for the old account credential, enter the credential you used for the CceService password.
When prompted for the new account credential, enter the password for the DomainAdmin password returned in step 1.
Run Set-CcCredential -AccountType VmAdmin as follows:
When prompted for the old account credential, enter the credential you used for the CceService password.
When prompted for the new account credential, enter the password for the VmAdmin password returned in step 1.

Update the password for the CceService account

Note

This section is applicable to Cloud Connector version 2.0.1 and later.

The Cloud Connector service runs the Cloud Connector Management service. The CceService account is created during the Cloud Connector Edition deployment and stored in the following files: "%SystemDrive%\Programdata\Cloudconnector\credentials.<CurrentUser>.xml" and "%SystemDrive%\Programdata\Cloudconnector\credentials..CceService.xml".

To ensure that all appliances can access the site directory share, the password for the CceService account must be the same on all appliances deployed within the site. Keep the following in mind:

By default, the CceService account is configured as "Password never expires". When you update the password, Microsoft recommends keeping this configuration.
You should update the password during non-peak usage periods and outside of automatic update time windows for bits or Windows updates. When you update the password, the appliance needs to be drained and restarted, which takes some time. Restarting the appliance will interrupt automatic update operations.
When you change the CceService account password, you will need to specify all the credentials and update them in the locally stored file.

For each appliance that belongs to the same PSTN site, you will need to specify the following:

Run the following commands to retrieve the account names and passwords that you will use later:

Get-CcCredential -AccountType TenantAdmin -DisplayPassword
Get-CcCredential -AccountType TenantAdmin
Get-CcCredential -AccountType OMSWorkspace -DisplayPassword
Get-CcCredential -AccountType OMSWorkspace 
Get-CcCredential -AccountType ExternalCert -DisplayPassword
Get-CcCredential -AccountType CABackupFile -DisplayPassword
Get-CcCredential -AccountType CceService -DisplayPassword
Get-CcCredential -AccountType VMAdmin -DisplayPassword
Get-CcCredential -AccountType DomainAdmin -DisplayPassword

Run the Enter-CcUpdate cmdlet to drain the appliance and move it into manual maintenance mode.
Update the password of the CceService account on the host server.
Restart the host server.
Run the Restore-CcCredentials cmdlet to re-enter the passwords following the description.

Be sure you enter the same password you entered before for the Cloud Connector deployment except for the CceService account. For the CceService account, enter your new password. Be sure the new password for the CceService account is the same for all appliances in the PSTN site.
By default, VmAdmin and DomainAdmin use the same password as CceService. If the DomainAdmin, VMAdmin, and CceService passwords returned in step 1 are different, you must perform the following steps:
Run Set-CcCredential -AccountType DomainAdmin as follows:
- When prompted for the old account credential, enter the credential you used for the CceService password.
- When prompted for the new account credential, enter the password for the DomainAdmin password returned in step 1.
Run Set-CcCredential -AccountType VmAdmin as follows:
- When prompted for the old account credential, enter the credential you used for the CceService password.
- When prompted for the new account credential, enter the password for the VmAdmin password returned in step 1.
Run the Exit-CcUpdate cmdlet to move the appliance out of manual maintenance mode.
After you complete these steps on all appliances in the same PSTN site, delete the following files in the site root directory:
- CcLockFile
- Site_<Edge External Sip Pool fqdn>
- Tenant_<Edge External Sip Pool fqdn>
- TenantConfigLock_<Edge External Sip Pool fqdn>

Add a new SIP domain

To add a new SIP domain (or multiple SIP domains) to your existing Cloud Connector deployment, do the following:

Make sure you've completed the steps to update your domain in Microsoft 365 or Office 365 and have the ability to add DNS records. For more information about how to set up your domain in Microsoft 365 or Office 365, see Add a domain to Microsoft 365 or Office 365.
Update the Cloud Connector configuration file with the new SIP domain or domains.
Request a new Edge external certificate with additional SAN names for sip.domain for each SIP domain defined in your Cloud Connector configuration.

Set the path for the new Edge external certificate as follows:

Set-CcExternalCertificateFilePath -Path <Full path to External certificate>

Follow the instructions to Modify the configuration of a single site or Modify the configuration of multiple sites.

Modify the primary SIP domain

If you need to change the primary SIP domain in your Cloud Connector deployment, do the following:

Make sure you've completed the steps to update your domain in Microsoft 365 or Office 365 and have the ability to add DNS records. For more information about how to set up your domain in Microsoft 365 or Office 365, see Add a domain to Microsoft 365 or Office 365.
Update the Cloud Connector configuration file with the new SIP domain.
Request a new Edge external certificate with additional SAN names for sip.domain for each SIP domain defined in your Cloud Connector configuration.