Common Issues with Terminal Server Licensing in W2K/W2k3

inemds — Tue, 02 Sep 2008 06:18:00 GMT

WINDOWS NT 4.0 TERMINAL SERVER EDITION

Troubleshooting

Event ID 1003 may occur in the event log

General Information

Terminal Server Licensing is not enforced in Windows NT 4.0 Terminal Server Edition.

In this version of Terminal Server, Citrix uses the Microsoft event IDs to generate errors in their product. If any licensing-related events occur after you apply the SRP, contact Citrix to resolve them.

Event ID 1003 may appear in the event log

To resolve this problem, apply the SRP for Windows NT 4.0 Terminal Server Edition.

References

294326 - Event ID 1003: Terminal Service client has provided an invalid license
https://support.microsoft.com/?id=294326

WINDOWS NT 4.0 DOMAIN OR WORKGROUP

Windows 2000 TS and Windows 2000 TSL Server

Troubleshooting

Make sure that Terminal Server and Terminal Server Licensing are on Service Pack 4 or a later version

Terminal server cannot find the terminal server license server or Event ID 1010 in the system event log

Client errors when they try to connect to the terminal server

License server is issuing only temporary licenses

Event ID 1004 is generated on the terminal server

General Information

When you run the Terminal Server service on Windows 2000 in a Windows NT 4.0-based domain, you must have Terminal Server Licensing installed on a server that is running Windows 2000 Server. This section discusses only Windows 2000.

Windows 2000 and Windows XP Professional Edition clients will receive a built-in CAL from the terminal server license server. The license server must be activated to issue this kind of CAL.

In this environment, the license server is discovered by using a mailslot broadcast. Because many networks do not allow broadcasts, we recommend that you add the following registry key information about the Windows 2000-based terminal server so that the discovery process for the license server will work:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters

Name: DefaultLicenseServer

Data type: REG_SZ

Data value: <ServerName>

<ServerName> is a placeholder for the NetBIOS name or for the IP address of the license server that you want to use. (Do not use \\servername.)

Make sure that Terminal Server and Terminal Server Licensing are on Service Pack 4 or a later version

Your Windows 2000 Terminal Server Licensing-enabled license server must be running Service Pack 4 or a later version.

Apply the hotfixes that are mentioned in the following Microsoft KB articles.

· Apply the following hotfix to the Terminal Server Licensing server:
https://support.microsoft.com/?id=837321

· Apply the following hotfix to the terminal server:
https://support.microsoft.com/?id=829395

Terminal Server licenses that are issued after the release of Service Pack 3 have an expiration date. Licenses will be reissued or given back to the Terminal Server CAL pool at a random interval between 52 and 89 days.

This setting is not configurable.
Licenses are renewed seven days before they expire.
Any CALs that were issued before Service Pack 3 was released do not have an expiration date. To return the licenses to the pool, you must delete the license certificate from the client computers, and then call the Product Activation Group (Microsoft Clearinghouse) to recover the license.

To remove the license from the client, delete the following registry key:

HKLM\Software\Microsoft\MSLicensing

Any downlevel clients must have TS CALs available. Therefore, you must make sure that TS CALs are installed on the activated Terminal Server Licensing-enabled license server. According to the end-user license agreement (EULA), if you are using a licensed version of Windows 2000 or Windows XP Professional Edition, you do not have to purchase a Windows Server Terminal Services Client Access license to connect to a server that is running Windows 2000 Server Terminal Services. However, you must still deploy and activate a server that is running Terminal Services Licensing.

Verify that Terminal Server Licensing is installed. To do this, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Licensing.

If Terminal Server Licensing is not listed, follow these steps to install Terminal Server Licensing:

1. Click Start, point to Settings, and then click Control Panel.

2. Double-click Add/Remove Programs.

3. Click Add/Remove Windows Components.

4. Click Terminal Services Licensing, and then click Next.

To connect to the terminal server by using downlevel clients, such as Windows 95/98, Windows NT, Thin Clients, or Windows XP Home and Windows XP Embedded clients, or Macintosh or UNIX clients, follow these steps:

1. Click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Licensing.

2. Under All Servers, click the name of your server.

3. A list of all installed CALs appears in the right pane. Verify that Windows 2000 Terminal Services Client Access License appears.

If downlevel clients connect to the terminal server and Windows 2000 Terminal Services Client Access License does not appear, purchase and install CALs to enable downlevel clients to connect.

Terminal server cannot find the terminal server license server or Event ID 1010 in the system event log

To troubleshoot this problem, follow these steps:

1. Try to open Terminal Server Licensing. If you are prompted for the name of the license server, discovery is not working. Add the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters

Name: DefaultLicenseServer

Data type: REG_SZ

Data value: <ServerName>

<ServerName> is a placeholder for the NetBIOS name or for the IP address of the license server that you want to use. (Do not use \\servername.)

2. Determine whether licensing has been installed in the domain role or in the enterprise role. In this environment, licensing must be in the domain role:

HKLM\System\CurrentControlSet\Services\TermServLicensing\Parameters\Role

REG_DWORD 0x00000000

0 = Domain Role

1 = Enterprise Role

3. Make sure that the Remote Registry service is enabled on the terminal server license server.

4. Verify the registry key for RestrictAnonymous on the terminal server license server:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA

Value: RestrictAnonymous

Value Type: REG_DWORD

Value Data: 0x2 (Hex)

5. If this value is set to 2, follow these steps to verify the Group Policy settings on the terminal server licenses server:

a. Click Start, point to Programs, point to Administrative Tools, and then click Local Security Policy.

Note If Administrative Tools does not appear in the Programs list, click Start, point to Settings, point to Control Panel, click Administrative Tools, and then click Local Security Policy.

b. Under Security Settings, double-click Local Policies, and then click Security Options.

c. Double-click Additional restrictions for anonymous connections, and then click No access without explicit anonymous permissions under Local policy setting.

Important After this registry key or policy is changed, you must restart the server for changes to take effect.

6. Verify that the admin shares are shared on the terminal server license server:

a. At a command prompt, type net share, and then press ENTER.

b. Make sure that the default shares, such as C$, Admin$, and IPC$, are returned.

7. Verify that File and Printer Sharing is bound to the Network Adapter and that the internal Network Adapter is at the top of the binding order.

8. Test by using the RDP client. If the RDP client works but the ICA client is still failing, see the "Citrix ICA Client and MetaFrame" section.

9. Test deleting the whole MSLicensing key:

HKEY_LOCAL_MACHINE\Software\Microsoft\MSLicensing

10. Verify the permissions on the following key:

HKEY_LOCAL_MACHINE\Software\Microsoft\MSLicensing

Users must have at least read permissions.

Client errors when they try to connect to the terminal server

A client that is trying to connect receives the following error message:

Because of a security error, the client could not connect to the Terminal server.

Make sure that you are logged on to the network, and then try to connect again.

To resolve this issue, see the following Microsoft KB article:

323597 - Windows XP clients cannot connect to a Windows 2000 Terminal Services server
https://support.microsoft.com/?id=323597

For Windows 9x clients to connect to the terminal server, the domain name in the TCP/IP properties must be blank or must match the domain that the terminal server belongs to.

License server is issuing only temporary licenses

Some bugs exist that are related to expired temporary licenses. An expired temporary license does not upgrade if the license server is different from the original license server. To resolve this issue, install Service Pack 4 on both the terminal server and the license server. Delete the current license from the client computer by deleting the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\MSLicensing

Make sure that TS CALs are available

A temporary license is issued the first time that any user connects. A permanent license will not be issued until the second authentication (if Service Pack 3 or a later version is installed). The client must connect to the terminal server at least two times to obtain a permanent license.

If Windows-based thin clients cannot connect, see the following Microsoft KB article:

825027 - Terminal Services Licensing denies your connection to your terminal server from your WBT device
https://support.microsoft.com/?id=825027

If Windows-based thin clients have expired temporary licenses that were not upgraded to permanent TS CALs, see the following Microsoft KB article:

827355 - Event ID 1004 is logged when a thin client tries to obtain a Terminal Services license
https://support.microsoft.com/?id=827355

If the clients who cannot obtain a permanent license are remote to the network, such as VPN users, run the following command:

ping -l 1472 -f

If this command fails, use the following Microsoft KB article to troubleshoot a black hole router issue by using network traces:

159211 - Diagnoses and treatment of black hole routers
https://support.microsoft.com/?id=159211

Verify the permissions on the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\MSLicensing

Users must have at least read permissions.

Event ID 1004 is generated on the terminal server

Event ID 1004 is generated on the terminal server every time that a client tries to connect. Terminal Server cannot issue a client license. This error may occur for many reasons. Most of the reasons are not related to licensing.

To rule out a licensing problem, try to connect from the terminal server by using the RDP client. If the RDP client receives a license, a networking problem is probably causing the event. To verify that a networking problem is causing the event, do all of the following:

· Verify the permissions on the MSLicensing key:

HKEY_LOCAL_MACHINE\Software\Microsoft\MSLicensing

Users need at least read permissions

· Make sure that the following command works:

ping -l 1472 -f <IP address>

For more information, see the following Microsoft KB article:

274805 - "Terminal Server has ended the connection" error message
https://support.microsoft.com/?id=274805

· Verify that you have applied the hotfixes that are mentioned in this section. These hotfixes resolve the problem of the expired or old licenses not cleaning themselves up correctly. For more information, see the following Microsoft KB article:

813508 - Cannot connect to a terminal server from a Windows-based terminal
https://support.microsoft.com/?id=813508

References

287687 - Terminal Services Licensing enhancements
https://support.microsoft.com/?id=287687

291795 – How to locate a phone number for the Microsoft Clearinghouse
https://support.microsoft.com/?id=291795

187614 - Removing Terminal Server licenses from an RDP client
https://support.microsoft.com/?id=187614

237801 - Windows 2000 Terminal Services requires licensing service
https://support.microsoft.com/?id=237801

291807 - Terminal Services Licensing server required for Windows Server Terminal
https://support.microsoft.com/?id=291807

244749 - Licenses required when using Terminal Services client software
https://support.microsoft.com/?id=244749

Windows 2000 TS and Windows Server 2003 TSL Server

Troubleshooting

Terminal Server cannot locate the license server

Windows Server 2003-based license server

Windows 2000-based terminal server

License server issues only temporary licenses

Errors during activation of the license server

General Information

Windows 2000 and Windows XP Professional Edition clients will receive a built-in CAL from the terminal server license server. The license server must be activated to issue this kind of CAL. Downlevel clients must have TS CALs to connect to the terminal server.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters

Name: DefaultLicenseServer

Data type: REG_SZ

Data value: <ServerName>

<ServerName> is a placeholder for the NetBIOS name or for the IP address of the license server that you want to use. (Do not use \\servername.)

Apply the following hotfix to the Windows 2000-based terminal server:
https://support.microsoft.com/?id=829395

Terminal Server cannot locate the license server

Windows Server 2003-based license server
(Event ID 1010 on the terminal server):

To locate the license server, use one of the following methods:

· Use the Terminal Server License Server Viewer tool (LSView.exe) that is included with the Windows Server 2003 Resource Kit. This tool will enumerate all the license servers that the computer that you run it on can locate. To obtain LSView.exe, visit the following Microsoft Web site:

https://www.microsoft.com/downloads/details.aspx?FamilyID=4d6541a6-d9dd-4f93-9ec2-7ea0e3968628&displaylang=en

· Start the License Manager Microsoft Management Console (MMC). If the license server is populated on the left side, the server was found successfully. If the server was not found, License Manager prompts you to enter the server name. Typically, when you type the name of the server in the dialog box, License Manager will successfully enumerate the server.

If you cannot locate the license server by using either of these methods, add the LicenseServers registry key to the license server. To do this, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.

2. Locate, and then click the following key in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters

3. On the Edit menu, point to New, and then click Key.

4. Name the new key LicenseServers.

5. Locate and then click the following key in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters\LicenseServers

6. On the Edit menu, point to New, and then click Key.

7. Name the new key <ServerName> where <ServerName> is a placeholder for the NetBIOS name of the license server, and then press ENTER.

Note The only data value required in this registry key is one of the following:

The NetBIOS Name of the server

The fully-qualified domain name (FQDN) of the server

The IP Address of the server

8. Restart the server.

For more information, see the following Microsoft KB article:

279561 - How to override the license server discovery process in Windows Server 2003 Terminal Services
https://support.microsoft.com/?id=279561

Run LSView.exe again to determine whether discovery is now working as expected.

If discovery is still not working, verify that the Terminal Server Licensing service is started. If it is not started, make sure that Terminal Server Licensing has been installed on the terminal server.

To make sure that the license server has been activated, follow these steps:

1. Click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Licensing.

2. Click All Servers. In the right pane, a list of any Terminal Services Licensing-enabled servers appears, together with their activation status.

3. If the status is not activated, right-click the server name, and then click activate server.

4. Follow the instructions in the licensing wizard to activate the server.

If errors occur when you try to activate the license server, see the "Errors during activation of the license server" section. Examine the event log for errors. Event ID 43 is a known problem. To work around this problem, make the following registry key change:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TermServLicensing\Parameters

Value name: MaxVerPages

Data type: REG_DWORD

Radix: Decimal

Value data: 1024

Range is from Minimum 256 to Maximum 2048

Windows 2000-based terminal server:

1. Add the following registry key on the terminal server:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters

Name: DefaultLicenseServer

Data type: REG_SZ

Data value: <ServerName>

<ServerName> is a placeholder for the NetBIOS name or for the IP address of the license server that you want to use. (Do not use \\servername.)

2. Make sure that the Remote Registry service is enabled on the terminal server license server.

3. Verify that the admin shares are shared on the terminal server license server:

a. At a command prompt, type net share, and then press ENTER.

b. Make sure that the default shares, such as C$, Admin$, and IPC$, are returned.

4. Verify that File and Printer Sharing is bound to the Network Adapter and that the internal Network Adapter is at the top of the binding order.

License server issues only temporary licenses

Make sure that terminal server client access licenses are available. These licenses can be Windows 2000 Per Device CALs or Windows Server 2003 Per Device CALs. This kind of license is required for Windows NT, for Windows 9x, and for Thin Clients. Windows Server 2003 Terminal Server Licensing-enabled license servers have built-in “Existing Windows 2000” licenses for Windows XP clients and for Windows 2000 clients.

A temporary license is issued the first time that any user connects. A permanent license will not be issued until the second authentication. The client must connect to the terminal server at least two times to obtain a permanent license.

If the clients who cannot obtain a permanent license are remote to the network, such as VPN users, run the following command:

ping -l 1472 -f

If this command fails, use the following Microsoft KB article to troubleshoot a black hole router issue by using network traces:

159211 - Diagnoses and treatment of black hole routers
https://support.microsoft.com/?id=159211

Verify the permissions on the following key:

HKEY_LOCAL_MACHINE\Software\Microsoft\MSLicensing

Users must have at least read permissions.

Errors during activation of the license server

The product ID that the wizard generated does not work. To resolve this issue, obtain the hotfix that is mentioned in the following Microsoft KB article:

832794 - Terminal Server License Server Activation Wizard generates a product ID that does not work
https://support.microsoft.com/?id=832794

References

279561 - How to override the license server discovery process in Windows Server 2003 Terminal Services
https://support.microsoft.com/?id=279561

306622 - How to activate a license server by using Terminal Services Licensing in Windows 2000
https://support.microsoft.com?id=306622

310122 - Terminal Services Licensing service may not start and Event ID 43 may be Logged
https://support.microsoft.com/?id=310122

Event ID 1004 is logged when a thin client tries to obtain a license from a Windows Server 2003-based terminal server

https://support.microsoft.com/default.aspx?scid=KB;EN-US;884570

Windows Server 2003 TS and Windows 2000 TSL Server

Troubleshooting

Windows 2000 Terminal Server Licensing-enabled license servers cannot install Windows Server 2003 Client Access Licenses

General Information

Although it is technically possible to set up this configuration through the GUI, Windows Server 2003-based terminal servers must have Windows Server 2003 Terminal Server Licensing-enabled license servers. Windows 2000 Terminal Server Licensing-enabled license servers cannot install Windows Server 2003 CALs and cannot issue any licenses to a Windows Server 2003-based terminal server. Therefore, this configuration will not work.

Windows 2000 Terminal Server Licensing-enabled license servers cannot install Windows Server 2003 Client Access Licenses

To work around this problem, install a Windows Server 2003 Terminal Server Licensing-enabled license server.

Windows Server 2003 TS and Windows Server 2003 TSL Server

Troubleshooting

Terminal Server cannot locate the license server

Terminal Server license server issues only temporary Per Device CALs

No licenses are being issued from the available licenses

Clients receive an error message that a temporary license will expire in x number of days

Errors during activation of the license server

General Information

To run Terminal Server for Windows Server 2003 in a Windows NT 4.0-based domain, you must have Terminal Server Licensing installed on a server that is running Windows Server 2003.

If a server has the Terminal Server service enabled, and the server is a member of a workgroup or of a Windows NT 4.0-based domain, you must configure the LicenseServers registry key. To do this, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.

2. Locate, and then click the following key in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters

3. On the Edit menu, point to New, and then click Key.

4. Name the new key LicenseServers.

5. Locate and then click the following key in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters\LicenseServers

6. On the Edit menu, point to New, and then click Key.

7. Name the new key <ServerName> where <ServerName> is a placeholder for the NetBIOS name of the license server, and then press ENTER.

Note The only data value required in this registry key is one of the following:

The NetBIOS Name of the server

The fully-qualified domain name (FQDN) of the server

The IP Address of the server

8. Restart the server.

Important If you use Add/Remove Windows Components in Control Panel on a Windows Server 2003-based terminal server, the license mode will reset back to Per Device mode if you have not applied hotfix 834651.

You can set the RestrictAnonymous registry value to 2 if both the license server and the terminal server are Windows Server 2003-based servers.