Cannot remove the Director Pool – Users or Contacts are associated to it.

While trying to decommissioning a Lync Server 2013 Director Pool we got the following error message when we publish the new topology:

This wasn’t expected since a Director Pool shouldn’t have users associated with it.

After troubleshooting the issue, we notice that some users had the attribute msRTCSIP-PrimaryHomeServer associated to the Lync Server 2013 Director Pool.
These users were previously moved to Skype for Business Online, during the move the attribute was updated to the Director Pool that was configured as federation route.
Please note that this behaviour can also happen if we have a Front End Server Pool in the federation route.

Because the msRTCSIP-PrimaryHomeServer attribute isn’t used by Skype for Business Online we can clear it.

The first step is to get the Pool Distinguished Name and the quickest way is using View Logs in the Publishing Wizard:

Then, we Expand all Actions and scroll down to Check Orphaned Users:

In this example the Pool Distinguished Name is:

CN=Lc Services,CN=Microsoft,CN=1:8,CN=Pools,CN=RTC Service,CN=Services,CN=Configuration,DC=uclobby,DC=com

And we assign it to a variable ($PoolDN):

$PoolDN=”CN=Lc Services,CN=Microsoft,CN=1:8,CN=Pools,CN=RTC Service,CN=Services,CN=Configuration,DC=uclobby,DC=com”
$PoolDN

Alternatively, we can use PowerShell to get the Pool Distinguished Name:

Import-module ActiveDirectory
$RTCDN = “AD:\CN=*,CN=Pools,CN=RTC Service,CN=Services,CN=Configuration,”+(Get-ADDomain).distinguishedname
$PoolDN=”CN=Lc Services,CN=Microsoft,”+(Get-ItemProperty -Path $RTCDN -Name dNSHostName,distinguishedname | ?{$_.dNSHostName -eq “<POOL FQDN>“}).distinguishedname

Now we can list the all users that have msRTCSIP-PrimaryHomeServer attribute associated to the pool:

Get-CsUser -LDAPFilter “(msRTCSIP-PrimaryHomeServer=$PoolDN)” | Select SamAccountName,DisplayName,SipAddress,HostingProvider | ft -AutoSize

Note: We can only use this workaround if the HostingProvider is sipfed.online.lync.com.

If we have few users we can simply clear the msRTCSIP-PrimaryHomeServer attribute manually:

Get-ADuser <USERACCOUNT> | Set-ADObject -Identity $_.distinguishedname -Clear “msRTCSIP-PrimaryHomeServer”

However, if we want to clear the attribute for all users associated to the Lync Server 2013 Director Pool we should use the following:

Get-ADObject -LDAPFilter “(& (msRTCSIP-PrimaryHomeServer=$PoolDN)(msRTCSIP-DeploymentLocator=sipfed.online.lync.com))” | Set-ADObject -Clear “msRTCSIP-PrimaryHomeServer”

Note: We added the msRTCSIP-DeploymentLocator since we can only clear the msRTCSIP-PrimaryHomeServer if the users were moved to Skype for Business Online.

After clearing the msRTCSIP-PrimaryHomeServer attribute we successfully remove the Lync Server 2013 Director Pool:

SfB Server 2015: Event 57005, LS User Store Sync Agent – Could not find stored procedure XdsQueryCriticalDocumentSignatures

While updating our SfB Server 2015 lab, we notice that a recently updated Front End server had multiple errors and warnings in the Event Viewer:

Log Name: Lync Server
Source: LS User Store Sync Agent
Date: 12/09/2017 21:54:33
Event ID: 57005
Task Category: (1061)
Level: Error
Keywords: Classic
User: N/A
Computer: sfbfe03.recore.lab
Description:
Error encountered pushing data to RtcXds Blob Store

#CTX#{ctx:{traceId:10006, activityId:”e40d8197-4293-4146-9d72-03c0c2957f6c”}}#CTX#
Push cycle identifier: [sfbfe03.recore.lab.2fd688f5-0f3a-407f-bab5-3fa5c3757443]
ItemCount: [0]
Error Message: [PushController: XdsQueryCriticalDocumentSignatures failed: System.Data.SqlClient.SqlException (0x80131904): Could not find stored procedure ‘XdsQueryCriticalDocumentSignatures’.
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose)
at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady)
at System.Data.SqlClient.SqlDataReader.TryConsumeMetaData()
at System.Data.SqlClient.SqlDataReader.get_MetaData()
at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)
at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, SqlDataReader ds)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean asyncWrite)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method)
at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method)
at System.Data.SqlClient.SqlCommand.ExecuteReader()
at Microsoft.Rtc.Common.Data.DBCore.Execute(SprocContext sprocContext, SqlConnection sqlConnection, SqlTransaction sqlTransaction)
ClientConnectionId:e597ef79-3a87-4d08-8561-8e8c0db10e37
Error Number:2812,State:62,Class:16]
Cause: Possible issues with back-end database.
Resolution:
Ensure the back-end is functioning correctly.

Log Name: Lync Server
Source: LS User Store Sync Agent
Date: 12/09/2017 21:54:33
Event ID: 57006
Task Category: (1061)
Level: Warning
Keywords: Classic
User: N/A
Computer: sfbfe03.recore.lab
Description:
RtcDb Sync Agent sproc failed

#CTX#{ctx:{traceId:10006, activityId:”e40d8197-4293-4146-9d72-03c0c2957f6c”}}#CTX#
Sproc: [XdsQueryCriticalDocumentSignatures]
Exception: [System.Data.SqlClient.SqlException (0x80131904): Could not find stored procedure ‘XdsQueryCriticalDocumentSignatures’.
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose)
at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady)
at System.Data.SqlClient.SqlDataReader.TryConsumeMetaData()
at System.Data.SqlClient.SqlDataReader.get_MetaData()
at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)
at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, SqlDataReader ds)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean asyncWrite)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method)
at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method)
at System.Data.SqlClient.SqlCommand.ExecuteReader()
at Microsoft.Rtc.Common.Data.DBCore.Execute(SprocContext sprocContext, SqlConnection sqlConnection, SqlTransaction sqlTransaction)
ClientConnectionId:e597ef79-3a87-4d08-8561-8e8c0db10e37
Error Number:2812,State:62,Class:16]

The error message mentions that XdsQueryCriticalDocumentSignatures store procedure is missing from RTCXDS database, after checking the version for this particular database, we notice that a new version was available:

Test-CsDatabase -ConfiguredDatabases -SqlServerFqdn sqlpool.recore.lab | Select SqlServerFqdn, SqlInstanceName, DatabaseName, InstalledVersion, ExpectedVersion | ft -AutoSize

A complete database version list for Skype for Business Server 2015 is available here:

Doug Deitterick’s Blog – How to Verify if Skype for Business Server 2015 Database Updates Completed Successfully
https://blogs.technet.microsoft.com/dodeitte/2015/05/10/how-to-verify-if-skype-for-business-server-2015-database-updates-completed-successfully/

Please note that XdsQueryCriticalDocumentSignatures store procedure was added in the May 2017 Cumulative Update for SfB Server 2015.

After we finish updating the remaining Front End servers and updated the RTCXDS database on the SfB Back End, we didn’t get more Errors/Warnings related to the missing XdsQueryCriticalDocumentSignatures store procedure.

We need to make sure that we follow the steps described for each Lync/SfB Server version:

Updates for Lync Server 2010
http://support.microsoft.com/kb/2493736

Updates for Lync Server 2013
http://support.microsoft.com/kb/2809243

Updates for Skype for Business Server 2015
http://support.microsoft.com/kb/3061064

SfB Server: Cannot install KB2982006 – This update is not applicable to your computer.

Update 2018/01/31 – Please note that the fix for this is included in the Skype for Business January 2018 Cumulative Update (CU6 HF1)

Prerequisite (KB2982006) not satisfied when you try to install Skype for Business Server 2015
https://support.microsoft.com/kb/4056288

In a recent deployment with all the Windows Updates installed, including the KB2919442 and KB2919355,  we couldn’t install the KB2982006:

We also got the same error in the Event Viewer > Windows Logs > Setup:

Log Name: Setup
Source: Microsoft-Windows-WUSA
Date: 04/09/2017 18:48:44
Event ID: 3
Task Category: None
Level: Error
Keywords:
User: RECORE\Administrator
Computer: sfbstd.recore.lab
Description:
Windows update could not be installed because of error 2149842967 “” (Command line: “”C:\Windows\system32\wusa.exe” “C:\UCLobby\Windows8.1-KB2982006-x64.msu” “)

The good news is we can use the DISM tool to manually add the KB2982006.

Before using DISM we need to make sure that KB2919442 and KB2919355 are already installed:

Get-Hotfix KB2919442,KB2919355,KB2982006

Please note that we cannot use a .msu file if we use the Online switch with DISM:

dism /Online /Add-Package /PackagePath:C:\UCLobby\Windows8.1-KB2982006-x64.msu

We have to expand the .msu file first using the steps described here:

How to use DISM to install a hotfix from within Windows
https://blogs.technet.microsoft.com/askcore/2011/02/15/how-to-use-dism-to-install-a-hotfix-from-within-windows/

An easy way is to create a folder and copy the Windows8.1-KB2982006-x64.msu file and also create a KB2982006 sub-folder:

Then we expand the .msu with the following cmdlet:

Expand -F:* C:\UCLobby\Windows8.1-KB2982006-x64.msu C:\UCLobby\KB2982006
https://technet.microsoft.com/en-gb/library/cc722332(v=ws.10).aspx

Since we have a .cab file we can proceed and manually add the KB2982006 with DISM:

dism /Online /Add-Package /PackagePath:C:\UCLobby\KB2982006\Windows8.1-KB2982006-x64.cab

With Get-Hotfix we confirm that KB2919442, KB2919355 and KB2982006 are installed:

Get-Hotfix KB2919442,KB2919355,KB2982006

Finally, we run Step 2 and confirm that the check for KB2982006 is successful:

 

Lync/SfB Server: Event 41026, LS Data MCU after May 2017 .NET Framework update

Update 2017/06/28 – In Workaround #1 we also need to request new Front End certificates with Client and Server authentication in the EKU.

Recently we notice that Lync Server 2010/2013 and Skype for Business Server 2015 Front Ends were generating the Events 41025 and immediately after the Event 41026:

Log Name: Lync Server
Source: LS Data MCU
Date: 5/23/2017 5:31:45 PM
Event ID: 41025
Task Category: (1018)
Level: Information
Keywords: Classic
User: N/A
Computer: sfbfe.uclobby.com
Description:
Connection to the Web Conferencing Edge Server has succeeded

Edge Server Machine FQDN: sfbedge.uclobby.com, Port:8057

Log Name: Lync Server
Source: LS Data MCU
Date: 5/23/2017 5:31:45 PM
Event ID: 41026
Task Category: (1018)
Level: Error
Keywords: Classic
User: N/A
Computer: sfbfe.uclobby.com
Description:
No connectivity with any of Web Conferencing Edge Servers. External Skype for Business clients cannot use Web Conferencing modality.

Cause: Service may be unavailable or Network connectivity may have been compromised.
Resolution:
Verify all Web Conferencing Edge Services in the topology are running, and network connectivity is available.

External Users also reported that couldn’t use WhiteBoard, Polls, Q&A or present PowerPoint with the following errors messages:

We can’t connect to the server for sharing right now.

Network issues are keeping you from sharing notes and presenting whiteboards, polls and uploaded PowerPoint files.

While this is still being investigated a KB article was release with the current workarounds:

LS Data MCU events 41025 and 41026 are constantly generated after you install the May 2017 .NET Framework
https://support.microsoft.com/kb/4023993

The issue is OS independent and affects Lync Server 2010, Lync Server 2013 and Skype for Business Server 2015 and here is a list of the .Net Framework KBs:

  • Windows Server 2008 R2

Description of the Security and Quality Rollup for the .NET Framework 3.5.1 for Windows 7 and Windows Server 2008 R2: May 9, 2017 (KB4014504)
Note: Lync Server 2010 only

Description of the Security Only update for the .NET Framework 3.5.1 for Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: May 9, 2017 (KB4014579)
Note: Lync Server 2010 only

Description of the Security and Quality Rollup for the .NET Framework 4.5.2 for Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1, and Windows Server 2008 Service Pack 2: May 9, 2017 (KB4014514)

Description of the Security Only update for the .NET Framework 4.5.2 for Windows 7 SP1, Windows Server 2008 R2 SP1, and Windows Server 2008 SP2: May 9, 2017 (KB4014599)

  • Windows Server 2012

Description of the Security and Quality Rollup for the .NET Framework 4.5.2 for Windows Server 2012: May 9, 2017 (KB4014513)

Description of the Security Only update for the .NET Framework 4.5.2 for Windows Server 2012: May 9, 2017 (KB4014597)

  • Windows Server 2012 R2

Description of the Security and Quality Rollup for the .NET Framework 4.5.2 for Windows 8.1 and Windows Server 2012 R2: May 9, 2017 (KB4014512)

Description of the Security Only update for the .NET Framework 4.5.2 for Windows 8.1 and Windows Server 2012 R2: May 9, 2017 (KB4014595)

  • Windows Server 2016

Windows 10 Version 1607 and Windows Server 2016: May 9, 2017—KB4019472 (OS Build 14393.1198)

This .NET Framework update adds an additional check to the certificate on Enhanced Key Usage (EKU), since all Lync/SfB Server by default use Web Server template, they will only have the Server Authentication in the EKU.

As mentioned in the KB4023993 we can use two workarounds:

Workaround #1

Request new Edge Internal and Front End Pool Certificate with Client and Server Authentication

This workaround requires that we request a new certificate on the Edge Server Internal Interface and in all Front End Servers.

Open the Certification Authority snap-in, right click on Certificate Templates, and then select Manage:

Now in the Certificate Templates Console window, locate the Web Server template, right-click it, and then select Duplicate Template:

In the New Template window select General and add a name:

Note: Please take note of Template Name – WebServerClientandServer. We need to use it to request the new certificate.

In the Extensions Tab , select Application Policies and Edit it:

Add the Client Authentication:

Both Authentication should be present:

Back in Certification Authority snap-in, right click on Certificate Templates > New > Certificate Template to Issue:

Select the new template:

Now that we have the template with Client and Server Authentication, we need to request a new Edge Server Internal Certificate with the recently created template.

Request-CsCertificate -New -Type Internal -Template WebServerClientandServer -FriendlyName “Edge Internal with Client and Server Auth” -Output C:\UCLobby\EdgeIntCliSrv.req

Note: We can also use the -PrivateKeyExportable $true switch to allow the private key to be exported.

In the Active Directory Certificate Services select Request a certificate:

Example: http://ca.gears.lab/certsrv/

Advanced certificate request:

Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

We need to select the new certificate template and submit:

We download the new certificate and copy it to the Edge Server and import it:

On the Edge Server import and assign the new certificate:

Import-CsCertificate -Path C:\UCLobby\EdgeIntCliSrv.cer
https://technet.microsoft.com/en-us/library/gg398688.aspx

Note: If we specify the -PrivateKeyExportable $true in the Request-CsCertificate we also need to add it to the Import-csCertificate.

Set-CsCertificate -Type Internal -Thumbprint 335d17df1520a5e30beee96406ffa53e20805342
https://technet.microsoft.com/en-us/library/gg398518.aspx

Please also request new certificates for the Front End Servers with Client and Server Authentication.

After restarting the Lync/SfB Edge and Front End Services the issues should be fixed and external users should be able to use WhiteBoard, Polls, Q&A or present PowerPoint without issues.

Workaround #2

Add a registry key to temporary disable the EKU check

On the all Lync/SfB Front Ends disable the check for the Web Conferencing Service.

Please note that these registry keys are for the default install locations. We can use the following script to assist adding the registry key in the correct location:

Lync/SfB Server: Disable EKU check for Web Conferencing Service
https://gallery.technet.microsoft.com/LyncSfB-Server-Disable-EKU-dab6cb88

Lync Server 2010

reg add HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\System.Net.ServicePointManager.RequireCertificateEKUs /v “C:\Program Files\Microsoft Lync Server 2010\Web Conferencing\DataMCUSvc.exe” /t REG_DWORD /d 0 /f

Note: Lync Server 2010 still uses the .NET 3.5 this is why we use v2.0.50727.

Lync Server 2013

reg add HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs /v “C:\Program Files\Microsoft Lync Server 2013\Web Conferencing\DataMCUSvc.exe” /t REG_DWORD /d 0 /f

Skype for Business Server 2015

reg add HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs /v “C:\Program Files\Skype for Business Server 2015\Web Conferencing\DataMCUSvc.exe” /t REG_DWORD /d 0 /f

After adding the registry key simply restart the Web Conferencing Service

PowerShell

Stop-CsWindowsService -InputObject RTCDATAMCU
Start-CsWindowsService -InputObject RTCDATAMCU

services.msc

Now the external users will be able to use WhiteBoard, Polls, Q&A or present PowerPoint without issues.

Lync/SfB Server: OAuthTokenIssuer, Assigned certificate not found or untrusted.

In a recent support case the OAuth certificate was missing in one of the Front Ends:

We also notice the Missing message in the Deployment Wizard Step 3, for the OAuth certificate:

And in PowerShell we had the following error when we tried to check the certificates:

Get-CsCertificate
https://technet.microsoft.com/en-us/library/gg398227.aspx

Get-CsCertificate : OAuthTokenIssuer: Assigned certificate not found or untrusted. Check that the certificate exists
in the certificate store, that it is not expired and that the certificate chain is valid.

Since the OAuth certificate is a Global setting and it’s replicated, we don’t need to request a new one.

To restore the OAuth certificate, we simply need to restart the Lync/SfB Server Replica Replicator Agent:

During start-up the Replica Replicator Agent will add the OAuth certificate again to the Computer Certificate Store:

We can also check the Deployment Wizard Step 3, to confirm that the correct certificate will be displayed:

For reference, here is the PowerShell output:

Get-CsCertificate -Type OAuthTokenIssuer

SfB Server 2015: Cannot install Cumulative Update – Failed to create network share. (-2147467259 xds-replica)

In a recent support case we couldn’t install the Skype for Business Server 2015 Cumulative Update on a Edge Server:

We checked the Skype for Business Core Components log file (OcsCore.msp-EDGESTD-[2017-03-21][15-30-48]_log.txt) located in %TEMP%:

The log showed that the Setup was aborted because it couldn’t create a file share:

CreateSmb: Error 0x80004005: failed to create share: ‘xds-replica’
MSI (s) (78!14) [15:32:19:981]: Product: Skype for Business Server 2015, Core Components — Error 26301. Failed to create network share. (-2147467259 xds-replica)

MSI (s) (78!14) [15:32:19:981]: Closing MSIHANDLE (193) of type 790531 for thread 3860
Error 26301. Failed to create network share. (-2147467259 xds-replica)

After checking the services running on the server we notice that Server Service (LanmanServer) was disabled:

Then we enable and started the service:

With Server Service running we were able to install the Skype for Business Cumulative Update:

Please note that if we try to repair the Skype for Business Server 2015 Core Components when the Server Service is disable we also get the following errors:

Failed to create network share. (-2147467259 xds-replica)

Failed to drop network share. (-2147022782 xds-replica)

SfB Server 2015: SIP/2.0 503 Service Unavailable

While working on a PSTN integration with Skype for Business Server 2015, we notice that the inbound calls were being rejected immediately with SIP/2.0 503 Service Unavailable:

TL_INFO(TF_PROTOCOL) [festd\festd]6984.23A4::03/06/2017-22:56:29.167.0000245B (S4,SipMessage.DataLoggingHelper:sipmessage.cs(801)) [4223311279]
>>>>>>>>>>>>Outgoing SipMessage c=[<SipTcpConnection_1ACDDA8>], 172.20.20.40:5068->172.20.15.39:56945
SIP/2.0 503 Service Unavailable
FROM: “Joule Adams”<sip:09920156101;phone-context=PrivateUnknown@recore.lab;user=phone>;tag=f0d14b5566;epid=8CE36BBBAB
TO: <sip:+449920207101@172.20.20.40;user=phone>;tag=9837f16c5d;epid=14123C3787
CSEQ: 12538 INVITE
CALL-ID: 49bfd2ea-8753-4651-a8aa-d7b48d066d93
VIA: SIP/2.0/TCP 172.20.15.39:56945;branch=z9hG4bKdab2e468
CONTENT-LENGTH: 0
SERVER: RTCC/6.0.0.0 MediationServer

The related SIP messages didn’t had any information why the Mediation Service immediately rejected the call.

However, in the Trace tab we found an error related to this call:

TL_ERROR(TF_COMPONENT) [festd\festd]6984.5B3C::03/06/2017-22:56:29.075.00002454 (MediationServer,ProxyCall.ProcessGatewayCallStateChanged:proxycall.cs(1446)) [25728949]
25728949Exception: System.MissingMethodException: Method not found: ‘Boolean Microsoft.Rtc.Internal.Collaboration.Media.SdpMediaDescription.ValidateMediaDescription()’.
at Microsoft.RTC.MediationServerCore.ProxySdpProcessor.InternalTryParseSdp[TGlobalDescription,TMediaDescription](SdpContentDescription cd, ProxyOfferAnswerInfo& offerAnswer, String& parsingError)
at Microsoft.RTC.MediationServerCore.ProxySdpProcessor.TryParseOffer(SdpContentDescription offer, Boolean bypassOffer)
at Microsoft.RTC.MediationServerCore.ProxyCall.ProcessGatewayCallStateChanged(Object sender, CallChangeEventArgs args)NULL

TL_INFO(TF_PROTOCOL) [festd\festd]6984.5B3C::03/06/2017-22:56:29.168.0000245C (MediationServer,ProxyCall.TerminateSession:proxycall.cs(3822)) [25728949]
25728949Terminating Proxy side call with session state: Idle, sip-response: 503, ms-diag: 10014, ms-diag reason: An internal exception received while processing the incoming request.NULL

This happened because the Enterprise Voice and Dialin Conferencing features were added after the Front End server update:

Then we update these components with the Skype for Business Server 2015 Update Installer:

Finally the inbound call will work without issues: