{管理信息化CRM客戶關(guān)系}mscrm布署微軟crm的應(yīng)用技術(shù)文檔MICROSOFTHowtoconfigureanInternet-FacingDeploymentforMicrosoftDynamicsCRM4.022009ThisdocumentisintendedtocoverhowtosetuptheMicrosoftDynamicsCRM4.0WebsitetomakeitavailablefromtheInternet.ThisdocumentwillcoverthefollowingInternet-FacingDeployment(IFD)scenariosforMicrosoftDynamicsCRM4.0.InstallorUpgradeMicrosoftDynamicsCRM4.0throughtheuserinterface(UI)setupInstallorUpgradeMicrosoftDynamicsCRM4.0withaconfigurationfileTableofContentsOverview3Usingaconfigurationfileorthe“CRM40IFDTool”3SetuptestDNSrecord4MicrosoftDynamicsCRMDataConnectorforSQLServerReportingServices5Scenario1:InstallorUpgradeMicrosoftDynamicsCRM4.0throughtheuserinterface(UI)setup5Scenario2:InstallorUpgradeMicrosoftDynamicsCRM4.0withaconfigurationfile6HowtousetheCRM40IFDTool9Stepstorunthetool9MoreInformation12ISAServer12TurnoffIFD12LogFile12InstallingCRMwithIFDenabledagainstanexistingwebsitewithHostheadersoraCertificateenabledonthewebsite.13SplittingOutServerRoles14TroubleshootingInformation16FAQ18SendFeedbackonthearticle24HowtoconfigureanInternet-FacingDeploymentforMicrosoftDynamicsCRM4.0ThisdocumentwillcoverthefollowingInternet-FacingDeployment(IFD)scenariosforMicrosoftDynamicsCRM4.0.InstallorUpgradeMicrosoftDynamicsCRM4.0throughtheuserinterface(UI)setupInstallorUpgradeMicrosoftDynamicsCRM4.0withaconfigurationfileThisdocumentisintendedtocoverhowtosetupMicrosoftDynamicsCRM4.0tomakeitreadytobeaccessedfromtheInternet.ThisdocumentwillnotcoverthestepsthatyoumustpletetomakeaserveravailablefromtheInternet.TherewillbeadditionalstepsdependingonifyouareusingISAserver,firewallsoranythingelseinyourenvironmentthatmayneedtobeconfiguredtogetyourserveraccessiblefromtheinternet.OverviewUsingaconfigurationfileorthe“CRM40IFDTool”TosuccessfullysetupaMicrosoftDynamicsCRM4.0IFDenvironment,thereareseveralitemsthatmustbesetforauthenticationtoworkcorrectly.TheseoptionsaresetwhenyouinstallMicrosoftDynamicsCRM4.0byusingaconfigurationfileorbyusingthe“CRM40IFDTool”afterMicrosoftDynamicsCRMisinstalledtoenableIFD.EnablingIFDdoesthefollowing:Thefilecontainsanauthenticationstrategyparameter.Thisparameterwillbeupdatedto“ServiceProviderLicenseAgreement”Forexample,youwouldseethefollowingparameterinthefile:<authenticationstrategy=”ServiceProviderLicenseAgreement”/>TheEnableanonymousaccessauthenticationmethodontheMicrosoftDynamicsCRM4.0Websiteismarked.Note:TheIntegratedWindowsauthenticationmethodmustremainmarkedforinternaluserswhodonotaccesstheMicrosoftDynamicsCRMWebsitebyusingtheIFDdeployment.TheDeploymentPropertiestableintheMSCRM_ConfigSQLdatabasehasthreevaluesthatareupdated.oIfdRootDomainScheme.httporhttpsoIfdSdkRootDomainoIfdWebApplicationRootDomainTheIfdInternalNetworkAddressregistrykeyontheMicrosoftDynamicsCRMserverisupdated.ThisregistrykeydetermineswhethertheuserisloggingintotheMicrosoftDynamicsCRMWebsitefromtheInternetorIntranet.ThisregistryvaluethendetermineswhethertheuserusesCRMticketauthentication(Internet)orIntegratedWindowsauthentication(Intranet).oTheIfdInternalNetworkAddressregistrykeyislocatedhere:oHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRMoThiskeyholdsanexampleofanipaddressandthesubnetofthedomain.Forexample,thekeymayholdthefollowingipaddressandsubnetvalue:.6-oIfyouhavemorethan1subnet,youcanaddmultiplevaluestotheregistrykey.oNote:Thevaluesmustbeseparatedbyama..-,-Keyencryptionwillbeenabled.oForausertologontotheMicrosoftDynamicsCRMWebsitewiththeCRMTicketAuthentication,theCRMTicketKeymusttobeenabled.Withoutatickettheauthenticationwillfail.oThekeyencryptionisenabledbysettingthe<ifdsettingsenabled="true">optionintheconfigurationfilewhenyouinstallorupgradetoMicrosoftDynamicsCRM4.0.Youcanalsousethe“CRM40IFDTool”toenablethekeyencryptionaftertheinstallorupgrade.SetuptestDNSrecordAfteryouhavepletedtheinstallationorupgradebyusingaconfigurationfileorthe“CRM40IFDTool,”youmustsetupaDNSrecordforeachorganizationthatwillbeaccessedexternallyfromtheInternet.SettinguptheDNSrecordenablestheWebsitetocorrectlyresolveexternally.WhenMicrosoftDynamicsCRM4.0isinstalled,orwhenyoucreateaneworganization,youprovideaDisplayNameandaNameforeachorganization.TheNamefieldisauniquenamethatmustbelessthan30charactersandcannotcontainspacesorotherspecialcharacters.ThisNameisusedintheURLaddresswhenyouopentheMicrosoftDynamicsCRMWebsite.TheDNShostrecordthatneedstobesetupisfortheNameofeachorganizationyouneedtoaccessthroughIFD.oForexample,assumetheDisplayNamevalueisMicrosoftCRMandtheNamevalueisMicrosoft.ToopentheMicrosoftDynamicsCRMWebsiteforanIDFdeployment,theURLaddresswouldbe..YouwouldneedtocreateaDNShostrecordcalledMicrosoft.oNote:ThisexampleassumestheDNSrecordsaresetuptocorrectlyresolvethisURLaddressexternally.MicrosoftDynamicsCRMDataConnectorforSQLServerReportingServicesYoumustinstalltheMicrosoftDynamicsCRMDataConnectorforSQLServerReportingServicesontheMicrosoftSQLServerReportServerifuserswillrunMicrosoftDynamicsCRMreportswhenaccessingMicrosoftDynamicsCRMoverIDF.Note:MicrosoftSQL2005WorkgroupEditiondoesnotsupportcustomdataextensionsforSQLServerReportingServices.Therefore,theMicrosoftDynamicsCRMDataConnectorforSQLServerReportingServiceswillnotworkwheninstalledontheMicrosoftSQL2005WorkgroupEdition.Formoreinformation,seethefollowingMicrosoftKnowledgebase(KB)article:.946753Scenario1:InstallorUpgradeMicrosoftDynamicsCRM4.0throughtheuserinterface(UI)setupTherearenooptionstoenabletheMicrosoftDynamicsCRM4.0IDFdeploymentintheSetupWizard.ThereforetheCRM40IFDToolmustbeusedtoenableIFDafterMicrosoftDynamicsCRM4.0isinstalled.InthisexampleCRMhasbeeninstalledorupgradedtoCRM4.0andouruniqueOrganizationNameiscalledMicrosoftPostInstallationTasksforScenario1:1.Runthe‘CRM40IFDTool’toenabletheIFDenvironment.ThistoolisavailablefordownloadinthefollowingMicrosoftKBarticle:.948779Forinformationonhowtorunthe‘CRM40IFDTool’seethe‘HowtousetheMicrosoftDynamicsCRMInternetFacingDeploymentConfigurationTool’sectioninthisdocument.2.CreateaHostorAliasrecordinDNSforeachMicrosoftDynamicsCRMorganizationthatwillbeaccessedexternallyontheInternet.FortheURLaddresstoresolvecorrectly,youmustcreateaDNSHostorAliasrecordforthefortheuniqueorganizationnameinMicrosoftDynamicsCRM.Forexample:.wouldneedaDNShostoraliasrecordcalledMicrosoft.a.TocreateaDNShostoraliasrecordfollowthesesteps:b.OnyourDNSserverclickStart,clickRunandtypeinc.ExpandForwardLookupZonesandrightclickyourfolderandchooseNewHost(A)orNewAlias(CNAME)d.IntheNamefieldorAliasnamefieldtypetheuniqueorganizationnameyouspecifiedwhensettingupCRM.e.Note:IfyoudonotknowtheuniquenameyoucancheckthisinDeploymentManagerontheMicrosoftDynamicsCRMServerbyselectingtheOrganizationsnodeandthenrightclickonyourOrganizationnameandchooseproperties.f.ThentypeintheIPaddressoftheCRMServerifyouarecreatingahostrecordandclickAddHost,thenclickOKandclickDone.IfyouareaddinganAliasclickBrowseandaddtheMicrosoftDynamicsCRMserverandclickOK.Scenario2:InstallorUpgradeMicrosoftDynamicsCRM4.0withaconfigurationfileYoucancreateIFDsettingsintheconfigurationfile.Then,youcanusetheconfigurationfileduringtheMicrosoftDynamicsCRMinstallationorupgradetoenableIFD.Thefollowingoptionsareavailableintheconfigurationfile:<ifdsettingsenabled="true"/"false">ThisoptionshouldonlybeusedforInternet-facingdeployments.Setenabled="true"tonotifyMicrosoftDynamicsCRMServerSetuptoconfigurethedeploymentforInternetaccess.Ifthe<ifdsettings>elementisnotspecified,theenabledattributevalueissettofalse.<internalnetworkaddress>IPNetworkAddress-SubjectMask</internalnetworkaddress>IPaddressandsubnetmask,suchas05-.ThisistheinternalIPaddressandtheassociatedsubnetmaskofthesubnetwhereyourinternalusersreside.ThesubnetsyouenterherewillbefortheputersthatyouwanttobeconsideredasinternalandyoudonotwanttheuserstologinthroughtheIFDenvironmentwhentheyareonthesesubnets.ToentermultiplesubnetsuseamatoseparatethevaluesintheconfigurationfileNote:Ifyouleavethiselementblank,allmunicationtotheMicrosoftDynamicsCRMserverwillbeconsideredasinternalanduserswilldefaulttowindowsauthenticationwhenhittingtheMicrosoftDynamicsCRMwebsite.<rootdomainscheme>https/http</rootdomainscheme>Mustbehttps,whichwillusesecuresocketslayer(SSL),orhttp,whichwillusethenonsecureHTTPprotocol.Note:SetupdoesnotrequireSSLontheWebsitewhereMicrosoftDynamicsCRMisinstalled.Westronglyremendthatyouspecifythehttpsvalueintherootdomainschemeelement.Inaddition,afterSetupisplete,tohelpprotectinformationthatistransmittedbetweenusersandMicrosoftDynamicsCRMServer,weremendthatyouconfiguretheWebsitetorequireSSL.FormoreinformationabouthowtouseSSL,seetheInternetInformationServices(IIS)ManagerHelp.<sdkrootdomain></sdkrootdomain>SpecifiesthedomainnamethatwillbeusedforapplicationsthatusethemethodsdescribedintheMicrosoftDynamicsCRM4.0SoftwareDevelopmentKit(SDK).ThevaluethatissetherewillbeprefixedbyyouruniqueorganizationnametoformtheURLsoyouonlyneedtoputinthe<webapplicationrootdomain></webapplicationrootdomain>SpecifiesthedomainnamethatwillbeusedfortheMicrosoftDynamicsCRMWebapplicationandMicrosoftDynamicsCRMforOutlook.ThevaluethatissetherewillbeprefixedbyyouruniqueorganizationnametoformtheURLsoyouonlyneedtoputintheNote:IfyouaregoingtosplitoutyourserverrolesseetheMoreInformationsectionattheendofthisdocument.ThefollowingconfigurationfileexamplecontainsanIFDsection:<ifdsettingsenabled="true"><internalnetworkaddress>-</internalnetworkaddress><rootdomainscheme>https</rootdomainscheme><sdkrootdomain></sdkrootdomain><webapplicationrootdomain></webapplicationrootdomain></ifdsettings>NOTE:Formoreinformationaboutconfigurationfileinstallations,seetheMicrosoftDynamicsCRM4.0ImplementationGuide.Aftertheinstallationisplete,whenyoulogontotheMicrosoftDynamicsCRMWebsitefromaputerthatisoutsidethesubnetzone(s)youspecifiedintheIFDInternalNetworkAddressregistrykey,youwillgetredirectedtothesigninpagelikeinthescreenshotbelow.PostInstallationTasksforScenario2:1.CreateaHostorAliasrecordinDNSforeachMicrosoftDynamicsCRMorganizationthatwillbeaccessedexternallyontheInternet.FortheURLaddresstoresolvecorrectly,youmustcreateaDNSHostorAliasrecordforthefortheuniqueorganizationnameinMicrosoftDynamicsCRM.Forexample:.wouldneedaDNShostoraliasrecordcalledMicrosoft.a.TocreateaDNShostoraliasrecordfollowthesesteps:b.OnyourDNSserverclickStart,clickRunandtypeinc.ExpandForwardLookupZonesandrightclickyourfolderandchooseNewHost(A)orNewAlias(CNAME)d.IntheNamefieldorAliasnamefieldtypetheuniqueorganizationnameyouspecifiedwhensettingupCRM.e.Note:IfyoudonotknowtheuniquenameyoucancheckthisinDeploymentManagerontheMicrosoftDynamicsCRMServerbyselectingtheOrganizationsnodeandthenrightclickonyourOrganizationnameandchooseproperties.f.ThenifyouarecreatingahostrecordtypeintheIPaddressoftheMicrosoftDynamicsCRMServerandclickAddHost,thenclickOKandclickDone.IfyouareaddinganAliasclickBrowseandaddtheMicrosoftDynamicsCRMserverandclickOK.HowtousetheCRM40IFDToolStepstorunthetool1.DownloadtheCRM4IFDToolfromthefollowingMicrosoftKBarticle:.9487792.OntheputerthatisrunningtheserverinstallationofMicrosoftDynamicsCRM4.0,extracttheCRM4IFDTooltothefollowingdirectory:3.drive:\ProgramFiles\MicrosoftDynamicsCRM\Tools4.RuntheCRM4tool.5.ClicktheAuthenticationStrategylistandclickIFD+OnPremise.6.TypetheIPAddressandthesubnet.Note:TheIPaddressisjustanexampleofavalidIPaddressonthespecificsubnet.ItdoesnothavetobetheIPaddressfortheMicrosoftDynamicsserver.Youcanentermorethanonesubnet.ThesubnetsyouenterherewillbefortheputersthatareinternalandyoudonotwanttheuserstologinthroughtheIFDenvironmentwhentheyareonthesesubnets.7.ClicktheIFDDomainSchemelist,andthenclickeitherHTTPorHTTPS.8.TypetheIFDAppRootDomainandIFDSDKRootDomain.Thiswillonlybethedomainname.Forexample,typeor.Note:TheIFDsettingswillbehowtheclientputerswillaccesstheMicrosoftDynamicsCRM4.0WebsitewhennotloggedonthelocalIntranet.ThedomainnameenteredherewillbeprefixedbytheuniqueorganizationnametoformthefullURLoftheIFDenvironmentwhentheuserisloggingin.9.TheADDomainSchemeshouldalreadybefilledinfromwhenyouinstalledCRM.10.TheADAppRootDomainandADSDKRootDomainwillalsoalreadybefilledinfromwhenyouinstalledCRM.However,youcanusethistooltochangethemifneeded.Note:DonottypehttporhttpsasthatisalreadyselectedintheADDomainSchemelist.Note:TheADsettingswillbehowtheclientputerswillaccesstheMicrosoftDynamicsCRM4.0WebsitewhenloggedonthelocalIntranetandnotloggingonthroughIFD.11.ClickFile,andthenclickApplyChanges.MoreInformationTheCRM4IFDTooltoolwillenableIFDforMicrosoftDynamicsCRM4.0.However,youmustcreatetheDNSrecordandverifytheserverandMicrosoftDynamicsCRM4.0websiteareaccessiblefromtheInternet.TheCRM40IFDToolwillonlychangethesettingsneededtogetMicrosoftDynamicsCRM4.0readytobeaccessedexternally.ISAServerIfyouareconfiguringIFDinanenvironmentwhereanISAServer2006isbeingusedpleaserefertothisblogpostformoreinformation..archive07publishing-microsoft-crm-4-0-through-isa-server-2006.aspxTurnoffIFDYoucanalsoturnoffIFDbyselectingtheOnPremiseoptionintheAuthenticationStrategylist,andthenclickApplyChanges.IMPORTANT:BeforemakinganychangestotheOnPremiseoption,youmustverifythevaluesintheADDomainScheme,ADAppRootDomainandADSDKRootDomainarecorrectlyset.OtherwiseifthesettingsareleftblankandyouclickApplyChanges,thosesettingswillbeupdatedwithanullvalueintheMSCRM_Configdatabase.ThiswillresultinusersnotbeingabletologintotheMicrosoftDynamicsCRM4.0Website.LogFileTolookatthelogfilecreatedwhenyouruntheCRM4IFDToolfollowthesesteps:1.ClickStart,clickRun,type%appdata%\Microsoft\MSCRM\Logs,andthenclickOK.ThefileiscalledCRM40InstallingCRMwithIFDenabledagainstanexistingwebsitewithHostheadersoraCertificateenabledonthewebsite.IfyouhaveanexistingwebsitewithhostheadersoraCertificateenabledandyouchosetoinstallMicrosoftDynamicsCRMagainstthewebsiteandenableIFDthefollowingchangesneedstobemade.1.DNSChangesneeded:a.OnyourDNSserverclickStart,clickRunandtypeinb.ExpandForwardLookupZonesandexpandyour.FindyourcurrentaliasforthewebsiteyouinstalledMicrosoftDynamicsCRMtoanddeleteit.c.RightclickyourfolderandchooseNewHost(A)d.Typeintheuniqueorganizationnameandthehostheadername.e.Example:ifyouruniqueorganizationnameisMicrosoftandyourhostheaderorcertificateonthewebsiteis.thenyouwouldenterfortheHostrecordf.EntertheIPAddressoftheCRMServerandclickAddHostthenclickOKandclickDone.2.IISchangesneededforhostheadersa.OnyourMicrosoftDynamicsCRMserverclickStart,clickRunandtypeininetmgrb.ExpandWebSitesandrightclicktheMicrosoftDynamicsCRMwebsiteandclickproperties.c.ClickontheWebsitetabandthenclickontheAdvancedbuttond.IfyouruniqueorganizationiscalledMicrosoftandyouraliasiscrmandyourdomainisenterahostheaderusingthefollowingformat.Note:IfyouhavemultipleIP’sassignedtotheCRMservermakesuretopointhostheadertotheIPspecifiedinstep1.e3.IISchangesneededforcertificates4.Ifyourcurrentcertificateis.youwouldneedtogetanewcertificatethatwouldbecalled.orawildcardcertificatefor*..5.Note:WildcardcertificateswillbeneededifyouplantohavemorethanoneorganizationenabledforIFD.6.Runthe‘CRM40IFDTool’toenabletheIFDenvironment.ThistoolisavailablefordownloadinthefollowingMicrosoftKBarticle:.948779Forinformationonhowtorunthe‘CRM40IFDTool’seethe‘HowtousetheMicrosoftDynamicsCRMInternetFacingDeploymentConfigurationTool’sectioninthisdocument.7.ThevaluesyouwillspecifyintheCRM40IFDToolwillbe8.IFDAppRootDomain–.9.IFDSDKRootDomain–.10.ADAppRootDomain–crmserver:8011.ADSDKRootDomain–crmserver:80SplittingOutServerRolesTheAppRootDomainandSDKRootDomainvaluesneedtobedifferentifyouhavesplitouttheserverroles.TheAppRootDomainistheApplicationServerRole.SKDRootDomainisthePlatformServerRole.IfyouhavetwoserversonefortheApplicationRolecalledAppServerandoneforthePlatformRolecalledPlatserverthenyouwouldsetthevaluestosomethinglikethefollowingIFDAppRootDomain–.IFDSDKRootDomain–.Note:hostheaderwillbeavaluethatwillbeaddedinDNSalongwiththeuniqueorgnametodifferentiatetheAppRootDomainfromtheSDKRootDomain.ForexampleifmyhostheadernamewasappandmyuniqueorganizationnamewasMicrosofttheninDNSIwouldcreateahostrecordcalledADAppRootDomain–AppServer:80ADSDKRootDomain–PlatServer:80Note:Whentheserverrolesaresplitoutyouwillneed2certificatesonefortheAppServerandoneforthePlatformServer.TheAppServerwouldneedawildcardcertificateifyouplantohavemorethanoneorganizationbeaccessedthroughIFD.Forexample*...ThePlatformServerwouldjustneedacertificatefortheurl.Forexample..TheplatformrolecontainsthediscoveryserviceandthatisneededfortheMicrosoftDynamicsCRMClientsforOutlook,MicrosoftDynamicsCRMEmailRouter,MicrosoftDynamicsCRMDataMigrationManagerandanycustomapplicationsaccessingMicrosoftCRMthroughIFD.DNScheckToverifytheorganizationnameinMicrosoftDynamicsCRM4.0canberesolvedinDNS,clickToolsandthenclickCheckDNS.ThiswillcheckallorganizationsthatarelistedinthetextboxintheCRM4IFDTool.TroubleshootingInformationIssue:UnabletologonafterenteringcredentialsonthepageResolution:VerifytheMicrosoftCRMAsynchronousServiceisrunning.IfthisserviceisnotrunningtheCRMTicketKeyswillnotbegeneratedandtheEnableanonymousaccessauthenticationwillfailforuserswhotrytologonexternallybyusingtheInternet.Issue:WhenopeningMicrosoftDynamicsCRMandbeingre-directedtothesign-inpage,thepagewillnotresolve.Additionally,theURLis.Resolution:ChecktheDeploymentPropertiestableintheMSCRM_Configdatabase.Whenyouareredirectedtothesign-inpage,MicrosoftDynamicsCRMusestheorganizationnameandthevaluethatisstoredintheIfdWebapplicationRootDomainrecordtocreatetheURLaddress.IfthevalueintheDeploymentPropertiestableisincorrect,thesign-inpagewillnotresolvecorrectly.Issue:WhenyouclickApplyChangesorwhenyouusetheconfigfiletoenableIFD,AnonymousAccessisgettingsetontheMicrosoftDynamicsCRM4.0Website.IfyouhaveSQLServerReportingServicesunderthesameWebsiteasMicrosoftDynamicsCRM4.0,AnonymousAccesswillbecheckedontheReportsandReportServervirtualdirectories.YoumustmanuallyremoveAnonymousAccessfromtheReportsandReportServervirtualdirectories,andanyothernoneCRMrelatedvirtualdirectoriesthatyoumayhaverunningundertheMicrosoftDynamicsCRM4.0Website.Resolution:VerifyAnonymousAccessisnotsetonadditionalvirtualdirectories:1.ClickStart,clickRun,typeinetmgrandthenclickOK.2.Expandtheservername,expandwebsites,andthenexpandtheMicrosoftDynamicsCRMwebsite.3.Rightclickthevirtualdirectory.Forexample,expandReportsorReportServer,andthenclickProperties.4.ClicktheDirectorySecuritytab,clickEditontheAuthenticationandaccesscontrolsection5.UnmarkEnableanonymousaccess.Tip:DownloadtheFiddlertoolfromtohelptroubleshootauthenticationissues.Tip:CreateasimpletestpageattherootoftheMicrosoftDynamicsCRMWebsitetohelpwithtroubleshootingDNSissues.Ifyoucanaccessthetestpage,DNSandIISaresetupcorrectly.AnyadditionalissuesmayberelatedtothesetupofMicrosoftDynamicsCRMandvaluesthatarestoredintheMSCRM_Configdatabase.Tip:CleartheDNScacheontheDNSserverandflushtheDNScacheonthelocalserverwhenyoutroubleshootanyIFDissues.OntheDNSServer1.ClickStart,clickAdministrativeTools,andthenclickDNS.2.Right-clicktheDNSServerName,andthenclickClearCache.OntheMicrosoftDynamicsCRMServerandtheclientputer1.ClickStart,clickRun,andthentypecmd.2.Typeipconfig/flushdns.Tip:IfyoumakeanymanualchangestotheMSCRM_Configdatabase,youmustrestartIIS.1.ClickStart,ClickRun,andthentypeiisreset.Issue:IFDToolisnotenablingIFDsuccessfullyandnoerrorisbeingthrown.Thestatusbaratthebottomwilleithernotmoveatallormovehalfwaythruandstop.Resolution:.Whenthishappensthetoolisnotmakingthechanges.ThiscanbequicklyverifiedbycheckingintheIFDInternalNetworkAddressregistrykeytoseeifitiscreatedorchangedthevalues.Ifitisnotherearetwothingstoresolvetheissue.1.Thewebsiteidentifiermatchthewebsiteintheregistry.a)IntheregistryunderHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRMb)CheckthewebsiteregkeyandpareitwiththeWebsiteIdentifier.c)LaunchIISandclickonthewebsitefoldertoseethelistofwebsiteschecktheIdentifiertabandthenupdatethewebsiteregkeyfoundinstepbtothecorrectvalue.2.TheWebSitePathmatchtheLocalpathoftheHomeDirectoryinIISFAQQ1:WhatisInternetFacingDeploymentConfigurationTool?A1:InternetFacingDeploymentConfigurationToolconfiguresInternetFacingDeployment(IFD)forMicrosoftDynamicsCRM4.0afteryouhavealreadyinstalledorupgradedtoMicrosoftDynamicsCRM4.0.ThisconfigurationallowsadministratorstoconfigureMicrosoftDynamicsCRM4.0tobeaccessedovertheInternet.ThistoolisalsousedforchangingtheIFDsettings.Q2:WherecanIobtaintheInternetFacingDeploymentConfigurationToolandhowtoconfigureit?A2:ThefollowingarticleexplainshowtodownloadthefilefromtheMicrosoftDownloadCenteraswellhowtoconfigureInternetFacingDeployment(IFD)forMicrosoftDynamicsCRM4.0:948779HowtousetheMicrosoftDynamicsCRMInternetFacingDeploymentConfigurationtoolQ3:DuringIFDconfiguration,I’vecheckedtheDNSandthefollowingwarningmessageboxwasshown:‘DNSCouldNotResolve.’in‘CheckDNS’optioninthe‘Tools’menu.Whatthismessagemeans?A3:InternetFacingDeploymentConfigurationToolchecksDNSresolutionfortheInternetnamethatwillbeavailableforInternetusersbyappendingtheOrganizationnamewiththeIFDAppRootDomainnameaccordinglytothefollowingexample:Organizationname:MicrosoftIFDAppRootDomain:IFDConfigurationToolwillcheckDNSresolutionfor‘.’TheIFDAppRootDomainwillbetheDNSnamespaceusedforInternetusersaccessingCRMthroughIFD.ItishighlyremendedtoconfigureDNSresolutionforbothinternal(ADAppRootDomain)andexternal(IFDAppRootDomain)DNSnamespaces.Q4:IwouldliketoconfigureInternetFacingDeploymentforallmyCRMorganizationsinmyMicrosoftDynamicsCRM4.0Enterpriseeditionserver.DoIhavetoconfigureIFDforeachorganization?A4:No.InternetFacingDeploymentconfigurestheCRMDeploymentforIFDwhichincludesalltheorganizationinthedeployment.TheonlytaskrequiredistocreatetheDNSHostoraliasrecordforexternalDNSforeachOrganizationaccordinglytothefollowingexample:Enabledorganizationnames:Microsoft,AdventureWorksandFabrikam.IFDAPPRootDomain:RequiredInternetExternalDNSHostnames:‘.’,‘.’,and‘.’.Q5:WhatisthedifferencebetweenIFDDomainSchemeoptions?ShouldIuseHTTPorHTTPS?A5:IFDDomainschemeoptionallowsconfiguringtheaccesstoMicrosoftDynamicsCRM4.0bymeansofaHTTPconnectionoraHTTPSconnection.DatatransmittedoveraHTTPconnectionisinsecureanddatatransmittedoveraHTTPSconnectionissecuredbyanencryptionestablishedbetweenclientandserver.It’shighlyremendedwhenpublishingCRMthoughtheInternetoncecorporatedomainlogonauthenticationdataistransmitted.DependingontheWebPublishingstrategyandhowSSLcertificateisconfigured,aspecificconfigurationhastobesetforIFDDomainSchemeasfollows:a)HTTP:Thisoptionshouldbeselectedwhen:?MicrosoftDynamicsCRM4.0websitewillNOTbeaccessedonlybymeansofaHTTPconnection.?TheISAServerwillhandletheSSLcertificateandrespectivesession/negotiationinsteadtheCRMServer.b)HTTPS:Thisoptionshouldbeselectedwhen:?ASSLcertificateisconfiguredintheMicrosoftDynamicsCRM4.0websiteandtheIISwillhandletheSSLcertificateandrespectivesession.Q6:WhatmodificationsarechangedinmyMicrosoftDynamicsCRMServerafterrunningInternetFacingDeploymentConfigurationTool?A6:SeetheOverviewSectiononPage3ofthisdocuments.Q7:IhaveuserslocatedinadifferentnetworksubnetthatshouldauthenticatetoMicrosoftDynamicsCRMWebSiteusingWindowsIntegratedauthentication.Whatwillchangefortheseusers?A7:AllusersloggedintothedomainthatbelongtodifferentnetworkssubnetsfromtheCRMServerwillbeabletoauthenticatetoMicrosoftDynamicsCRMWebSitebymeansofaIntegratedWindowsAuthentication,buttherespectivenetworkssubnetshavetobeconfiguredinthe“IFDInternalNetworkAddressandSubnetMask”optioninthe“InternetFacingDeploymentConfigurationTool”.Q8:WhatdoesenablingIFDdoforMicrosoftDynamicsCRMOutlookclientusers?A8:ThemobilityforMicrosoftDynamicsCRMOutlookclientusersisnowincreasedduetothefactInternetFacingDeploymentpermitsbothLaptopandDesktopversionstoconnecttoMicrosoftDynamicsCRMthoughInternet.Q9:WhenpublishingMicrosoftDynamicsCRM4.0thoughISAServer2006wehavetheoptiontoselecttheClientAuthenticationMethodintheISAWebListener,AuthenticationDelegationandSingleSignOnsettings.WhatIshouldselect?WhatisthedifferencebetweenausualwebpublishingandaMicrosoftDynamicsCRMWebpublishing?A9:MicrosoftDynamicsCRM4.0configuredwithInternetFacingDeploymentallowsInternetuserstoaccesstheapplicationbyauthenticationtoaASPXForminsertingtheirvalidCRMusercredentialsandtheauthenticationmustbehandledonlybyCRMServer.TheuserauthenticationhastobemanagedbytheCRMServerinsteadoftheISAServerifyouwanttheMicrosoftDynamicsCRMClientforOutlooktobeabletoconnectoverIFD.ISAServer2006offerssomefeaturesforauthenticationlikeClientAuthenticationMethod,AuthenticationDelegationandSingleSignOnandtoproperconfigurethemforMicrosoftDynamicsCRM,thementionedsettingshavetobesetasfollows:a)Publishingrule:?AuthenticationDelegation:Nodelegation,butclientmayauthenticatedirectlyb)WebListener:?ClientAuthenticationMethod:Noauthentication.?SingleSignOnSettings:DisabledFormoreinformationsee.archive07publishing-microsoft-crm-4-0-through-isa-server-2006.aspxIfyouarenotusingtheMicrosoftDynamicsCRMClientforOutlookyoucanhaveISAmanagetheauthenticationandCRMnotsetupforIFD..archive11iag-sp2-securely-publishing-dynamics-crm-4-0.aspxQ10:HowcanImeasurehowmanyusersareauthenticatingusingWindowsIntegratedAuthenticationandhowmanyareauthenticatingusingtheASPXFormAuthentication(IFD)?A10:Youcanuse“CRMAuthentication”PerformanceObjectsinPerformanceMonitortomeasurehowmanyusersareauthenticatingtoMicrosoftDynamicsCRM.Inexample,tomeasurehowmanyusersaretryingtoauthenticatetoMicrosoftDynamicsCRMthoughInternetFacingDeployment,wecanusethe“CrmPostAuthenticationAttemptsInTheLastminute”performancecounterandtomeasurehowmanyusersaretryingtoauthenticatetoMicrosoftDynamicsCRMusingWindowsIntegratedAuthentication,wecanusethe“WindowsAuthenticationAttemptsInTheLastminute”performancecounter.“CRMAuthentication”PerformanceObjectsmeasurethefollowingobjects:?ConfidDBWindowsAuthenticationAttemptsInTheLastminute?ConfidDBWindowsAuthenticationFailuresInTheLastminute?CrmPostAuthenticationAttemptsInTheLastminute?CrmPostAuthenticationFailuresInTheLastminute?PassportAuthenticationAttemptsInTheLastminute?PassportAuthenticationFailuresInTheLastminute?WindowsAuthenticationAttemptsInTheLastminute?WindowsAuthenticationFailuresInTheLastminuteQ11:HowcanInternetFacingDeploymentsettingsbepartofmybackupplan?A11:TheInternetFacingDeploymentinformationsettingsaresetonregistryhives,MSCRM_Configdatabase,filefortheMicrosoftDynamicsCRMwebsite,andetc.Although,theregistrycanbeexportedandthedatabasecanbepartofanexistingbackupplan,theremendationistore-runtheInternetFacingDeploymentConfigurationtoolaftertheserverhadbeenrecoveredfromadisaster.Q12:WhenconfiguringtheMicrosoftDynamicsCRMClientforOutlooktoaccessCRMoverIFDwhatoptionshouldIchoose?A12:IfyourMicrosoftDynamicsCRMClientforOutlookuserswillbebothInternalandExternalattimesweremendthatyouconfiguretheMicrosoftDynamicsCRMClientforOutlookwiththeMypanyoptionwhiletheyarewithinthesubnetspecifiedintheIFDInternalNetworkAddressregkey.ThatwayyoucanspecifyboththeIntranetaddressandtheExternalIFDWebaddresswhileconfiguringtheclient.IfyourMicrosoftDynamicsCRMClientforOutlookuserswillonlybeExternalthenyoucanconfiguretheMicrosoftDynamicsCRMClientforOutlookwiththeAnonlineserviceprovideroption.ThenyouwouldonlyspecifytheExternalWebaddresswhenconfiguringtheclient.WhenconfiguringtheMicrosoftDynamicsCRMClienttoaccessCRMifthe“Anonlineserviceprovider”optionisselected,theclientwillaccessthediscoveryservicewiththisURL<ifdurl>2007.Thiswebservicewillrejectt