Administrator User cannot modify users from Lync Control Panel

Administrator user is unable to modify users from Lync Control Panel and receiving below error

"Active Directory operation failed on "***.contoso.com". You cannot retry this operation:
"Insufficient access rights to perform the operation
00002098 SecErr: DSID-031150889 problem 4003 INSUFF ACCESS RIGHTS) data 0

To resolve the problem, follow the below steps

Check the administrator user in which security group for which Lync Delegation has been provided
Go to user AD properties -> Security Tab -> Advance -> Permission -> Check the unchecked box "Include inheritable permissions from this object's parent.

After performing the above steps, issue got fixed.

Lync Delegation for Management and Administration for users on OU

Create a Universal Security Group in Active Directory with name "BLR-LyncUserAdmins"

RBAC roles used to define the management tasks that users allowed to carry out, and to determine the scope in which users will be allowed to perform these tasks.

Perform the following command from Lync Management Shell:

New-CsAdminRole -Identity "BLR-LyncUserAdmins" -ConfigScopes "site:1" -UserScopes "OU:ou=Users,dc=nl,dc=Contoso,dc=com" -Template CSUserAdministrator

BLR-LyncUserAdmins:- Name of Universal Security Group should be created by Windows Administrator. Please check if group has been created before running the above command.

CSUserAdministrator: - Administrator Security group that provide required permission to perform activities. Command will automatically create this group.

Get-CsAdminRole BLR-LyncUserAdmins (After running this command it will show below information)

Identity: BLR-LyncUserAdmins
SID: ******
IsStandardRole: False
Cmdlets: {Name=Disable-CSUser, Name=Enable-CSUser, Name=Get-CSAdUser, Name=Get-CSUser.....}
ConfigScopes: {Site:1}
UserScopes: {OU:ou=Users,dc=Contoso,dc=com}
Template: CSUserAdministrator

Lync Monitoring Server Error cannot impersonate user for data source

After i got access to Lync Infrastructure, i tried to access the monitoring reports dashboard by clicking 1-MonitoringServer-3 from Lync Control Panel

I received the below error

To fix the issue, i have verified the settings in CDRDB and QMSDB for credentials stored securely in the report server and found it is having another administrator details who left the organization. I have provided my user account details and clicked apply.

In order to modify the settings for those data sources we should access the reports configuration as below
http://monitoringServeFQDN/reports

After the modification of user details and credentials stored securely in the report server, i am able to successfully open the Dashboard of Monitoring Server Reports.

Creation of New Client Policy on Lync Server

The client policy can only be set by using the Lync Management Shell and not by the Lync Control Panel. Most of the settings that determine Microsoft Lync 2010 features and functionality are configurable through Microsoft Lync Server 2010 Control Panel. However, there are several essential policies and settings that significantly impact client functionality and that can be configured only by using Group Policy or Lync Server Management Shell.

The following CMDlets are used to manage the client policies:
Get-CsClientPolicy: Get the client policies which are configured, if you do not specify a name all client policies are returned.
Grant-CsClientPolicy: Assigns the policy to a level (Global, Site, Tag). If you do not specify an identity the client policy is applied Global.
New-CsClientPolicy: Creates a new client policy. Among other things, client policies help determine the features of Microsoft Lync 2010 that are made available to users; for example, you might give some users the right to transfer files while denying this right to other users.
Remove-CsClientPolicy: Removes an existing client policy. Among other things, client policies help determine the features of Microsoft Lync 2010 that are available to users; for example, you might give some users the right to transfer files while denying this right to other users.
Set-CsClientPolicy: Modifies the property values of an existing client policy. Among other things, client policies help determine the features of Microsoft Lync 2010 that are available to users; for example, you might give some users the right to transfer files while denying this right to other users.
New-CsClientPolicyEntry: Allows you to assign new options to the client policy.

Information on the settings and applying the policy can be found here: http://technet.microsoft.com/en-us/library/gg398300.aspx 

Open Lync Management Shell
Type New-CsClientPolicy "Test Policy"
Modify the policy with required settings by the below command
Set-CsClientPolicy "Test Policy" -AddressBookAvailability Filedownloadonly -Disablefeedstab $false -EnableExchangeContactSync $false -EnableCallLogAutoArchiving $false -DisableSavingIM $True -DisableCalendarPresence $true -DisableContactCardOrganizationTab $true -DisableEmailComparisonCheck $true -DisableMeetingSubjectAndLocation $true

Count how many users in OCS and Lync

OCS:

(Get-CsUser -OnOfficeCommunicationServer).Count 

Lync:

(Get-CsUser -OnLyncServer).Count

                 (or)

Get-CsUser -OnLyncServer | Measure

Counting Enterprise Voice Enabled Users in Lync:

(Get-CsUser -OnLyncServer -Filter {EnterpriseVoiceEnabled -eq $true}).count

Total number of Lync Enabled Users:

Get-CsUser -Filter {Enabled -eq $true} | Measure

Count the number of users pointing to the Lync Registrar Pool:

Get-CsUser | Where-Object {$_.RegistrarPool -match "Lync Pool FQDN"} | Measure

Extract the Lync user list based on the OU

I got a request to extract the Lync user list based on the Organizational Unit

Below is the script to extract the user list based on the Organization Unit

Get-Csuser | where {$_.identity -match "OUName"} | Select-

Object Identity, DisplayName, SipAddress, ConferencingPolicy,EnterpriseVoiceEnab

led,SamaccountName,ExternalAccessPolicy,DialPlan,PinPolicy | Export-csv -path D:\Lyncusers_OU.csv

Extended Support End Date for Exchange 2003 is April 2014

Microsoft Support Life Cycle

Products Released                   Lifecycle Start Date   Mainstream Support End Date                  Extended Support End Date

Exchange Server 2003 Enterprise Edition 9/28/2003 4/14/2009                          4/8/2014                                        5/25/2005

Exchange Server 2003 Service Pack 1 5/25/2004 Not Applicable                 Not Applicable                        1/8/2008

Exchange Server 2003 Service Pack 2 10/19/2005 Review Note                         Review Note

Exchange Server 2003 Standard Edition 9/28/2003 4/14/2009                          4/8/2014                                         5/25/2005