Resolving Licensing Errors Related to Remote Desktop

Reason. The licensing mode of the Terminal Server is set to "Per Device," while the license server is configured to issue Client Access Licenses (CALs) "Per User." If this is the cause, the license server issues only temporary licenses that cannot be renewed. A few days before the temporary license expires, the client's application event log records event ID 26 with the source listed as Application Popup. This event message indicates the number of days remaining until the temporary license expires. In this case, the Terminal Server's application event log records event ID 1011 with the Terminal Service as the source.

Solution. Set the Terminal Server licensing mode to "Per User" instead of "Per Device."

Warning!

Client Access Licenses (CALs) "Per User" are not managed by the Terminal Server. Even if a "Per User" CAL exists in the license server database, its usage is not tracked. Nevertheless, according to the licensing agreement requirements, administrators must have a valid Terminal Server CAL for each user. Failing to have a "Per User" CAL for each user, when "Per Device" licenses are not used, constitutes a violation of the licensing agreement.

Below is an excerpt from the licensing agreement for Windows Server 2003.

"Two different types of Terminal Server Client Access Licenses are available: 'Per Device' and 'Per User.' A 'Per Device' CAL allows one device (used by any user) to conduct Windows sessions on any server in the organization. A 'Per User' CAL allows one user (using any device) to conduct Windows sessions on any server in the organization. It is permissible to use a combination of 'Per User' and 'Per Device' licenses with the server software in this environment. The Terminal Server can request either a 'Per User' or 'Per Device' license (default), but not both simultaneously."

See also Configuring the Terminal Server Licensing Mode

Reason. The Terminal Server cannot locate the license server.

Solution. In this case, it is recommended to perform the following.

1. Verify that the license server is installed correctly.
2. Verify that the Terminal Server Licensing service is running on the license server.
3. Ensure that the client, terminal server, and license server can communicate with each other by verifying the Domain Name System (DNS) configuration on each computer. To verify the DNS configuration, run the ping command from each computer to all other computers using the IP address, fully qualified domain name, and NetBIOS name. If the ping command fails, check the DNS configuration on the network.
4. On the terminal server, specify the license server to connect to. This can be done using the registry or the Windows Management Instrumentation (WMI) script. In Windows Server 2003 with Service Pack 1, you can use Group Policy settings or terminal server configuration.

See also Installing the Terminal Server Licensing Tool; Determining the Primary License Servers for Terminal Server; Terminal Server License Server Roles

Solution. If the previous method did not resolve the issue, create a backup of the MSLicensing registry key and its subkeys on the client, and then delete the original key and subkeys as follows.

1. On the client, navigate to the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSLicensing.
2. Select MSLicensing.
3. In the Registry menu, select Export Registry File.
4. In the File name box, type mslicensingbackup, and then click Save.
5. If you need to restore this registry key in the future, double-click the mslicensingbackup.reg file name.
6. In the Edit menu, select Delete, and then click Yes to confirm the deletion of the MSLicensing registry subkey.
7. Close the Registry Editor and restart the computer.

After the client restarts, the missing registry key will be restored.

Warning!

Incorrect actions when modifying the registry can seriously damage the system. Before modifying the registry, create backups of all important data.

See also Removing Terminal Server Licenses from an RDP Client (http://go.microsoft.com/fwlink/?LinkId=38560). (May be in English.)

Reason. The terminal server cannot find the license server.

Solution. In this case, it is recommended to do the following.

1. Verify that the license server is installed correctly.
2. Verify that the Terminal Server Licensing service is running on the license server.
3. Ensure that the client, terminal server, and license server can communicate with each other by verifying the Domain Name System (DNS) configuration on each computer. To verify the DNS configuration, run the ping command from each computer to all other computers using the IP address, fully qualified domain name, and NetBIOS name. If the ping command fails, check the DNS configuration in the network.
4. On the terminal server, specify the license server to connect to. This can be done using the registry or the Windows Management Instrumentation (WMI) script. In Windows Server 2003 with Service Pack 1, you can use Group Policy settings or terminal server configuration.

See also Installing the Terminal Server Licensing Tool; Determining the Primary License Servers for Terminal Server; Terminal Server License Server Roles

Reason. The license server is running Windows 2000, and anonymous connections are disabled on it, except for connections from resources that have explicitly granted access to the server.

Solution. On the license server running Windows 2000, perform one of the following actions.

Warning!

Incorrect actions when modifying the registry can seriously damage the system. Before modifying the registry, create backups of all important data.

• In the registry, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous and set the RestrictAnonymous registry value to 1 or 0.
• In Local Security Policy, open the relevant policy, navigate in the console tree to "Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options". Then enable the Do not allow anonymous enumeration of SAM accounts and shares policy (equivalent to setting RestrictAnonymous to 1 or No), or Use default permissions (equivalent to setting RestrictAnonymous to 0).

Notes

• If the license server is a member of an Active Directory domain and a conflicting security parameter is configured in Group Policy, the Group Policy security setting overrides the local security setting. In this case, to ensure that the required security parameter is applied, configure it in Group Policy.
• In Windows Server 2003, the value 2 for the RestrictAnonymous parameter, which disallows anonymous connections, is not supported. To deny access rights that members of the "Everyone" group possess to anonymous users, set the Network access: Let Everyone permissions apply to anonymous users parameter in local security policies.

Solution. If the previous method did not resolve the issue, create a backup of the MSLicensing registry key and its subkeys on the client, and then delete the original key and subkeys as follows.

1. On the client, navigate to the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSLicensing.
2. Select MSLicensing.
3. In the Registry menu, select Export Registry File.
4. In the File name box, type mslicensingbackup, and then click Save.
5. If you need to restore this registry key in the future, double-click mslicensingbackup.reg.
6. In the Edit menu, select Delete, and then click Yes to confirm the deletion of the MSLicensing registry subkey.
7. Close the Registry Editor and restart the computer.

After the client restarts, the missing registry key will be recreated.

Warning!

Incorrect changes to the registry can seriously damage your system. Before modifying the registry, back up all important data.

See also Using the RestrictAnonymous registry setting in Windows 2000 (http://go.microsoft.com/fwlink/?LinkId=38561). (May be in English.)

Cause. If Internet Protocol Security (IPsec) is used to protect traffic transmitted between clients and terminal servers over the TCP protocol, packet fragmentation may occur. As a result, not all packets reach their destination, and the client connection to the terminal server fails.

Solution. Configure IPsec to protect traffic transmitted over the UDP protocol instead of TCP.

See also Defining IPSec Policies

Cause. There are no “Per Device” Client Access Licenses (CALs) remaining on the licensing server.

Solution. Use the Terminal Server Licensing tool to determine how many CALs remain on the licensing server. To open the Terminal Server Licensing tool, click Start, then select Programs, Administrative Tools, and Terminal Server Licensing. If the licensing server has no CALs available to issue to clients, purchase and install the required number of client access licenses.

See also Acquiring Client Access Licenses; Installing Client Access Licenses; Acquiring and Installing Client Access Licenses on the Terminal Server Licensing Server

Cause. The terminal server licensing mode on the terminal server is set to “Per Device,” but the licensing server only has “Per User” Client Access Licenses. If this is the cause, the licensing server issues only temporary licenses that cannot be renewed. A few days before the temporary license expires, the client’s Application event log displays event ID 26 with the source listed as Application Popup. This event message indicates the number of days remaining until the temporary license expires. In this case, the terminal server’s Application event log records event ID 1011 with the Terminal Service as the source.

Solution. Select the “Per User” terminal server licensing mode instead of “Per Device.”

Warning!

“Per User” Client Access Licenses are not managed by the terminal server. Even if a “Per User” CAL exists in the licensing server database, its usage is not tracked. Nevertheless, in accordance with licensing agreement requirements, administrators must have a valid Terminal Server CAL for each user. Failing to have a “Per User” CAL for each user when “Per Device” licenses are not in use constitutes a violation of the licensing agreement.

The following is an excerpt from the licensing agreement for Windows Server 2003.

“Two different types of Terminal Server Client Access Licenses are available: ‘Per Device’ and ‘Per User.’ A ‘Per Device’ CAL allows one device (used by any user) to run Windows sessions on any server in the organization. A ‘Per User’ CAL allows one user (using any device) to run Windows sessions on any server in the organization. You may simultaneously use a combination of ‘Per User’ and ‘Per Device’ licenses with the server software in this environment. The Terminal Server can request either a ‘Per User’ or ‘Per Device’ license (by default), but not both simultaneously.”