Share via

Event ID 4141 — Terminal Services License Server Security Group Configuration

  • Article

Applies To: Windows Server 2008

When the TS Licensing role service is installed on the server, the Terminal Server Computers local group is created. The license server will respond only to requests for TS CALs from terminal servers whose computer accounts are members of this group if the Computer Configuration\Administrative Templates\Windows Components\Terminal Services\TS Licensing\License server security group Group Policy setting has been enabled and applied to the license server. By default, the Terminal Server Computers local group is empty.

When the TS Licensing role service is removed from the server, the Terminal Server Computers local group is deleted.

Event Details

Product: Windows Operating System
ID: 4141
Source: Microsoft-Windows-TerminalServices-Licensing
Version: 6.0
Symbolic Name: TLS_E_LICENSE_ISSUANCE_ACCESS_DENIED
Message: A license could not be issued to "%1" because it is not a member of the Terminal Server Computers group.

Resolve

Add the terminal server to the Terminal Server Computers local group on the Terminal Services license server

To resolve this issue, add the computer account for the terminal server to the Terminal Server Computers local group on the Terminal Services license server.

Note:  When the License server security group Group Policy setting is enabled and applied to a license server, the license server will respond only to license requests from terminal servers whose computer accounts are a member of the Terminal Server Computers local group. This Group Policy setting can be found in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\TS Licensing.

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To add the computer account for the terminal server to the Terminal Server Computers group:

  1. On the license server, open the Local Users and Groups snap-in. To open Local Users and Groups, click Start, click Run, type lusrmgr.msc, and then click OK.
  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  3. In the left pane, click Groups.
  4. In the right pane, right-click the Terminal Server Computers group, and then click Properties.
  5. Click Add.
  6. In the Select Users, Computers, or Groups dialog box, click Object Types.
  7. Select the Computers check box, and then click OK.
  8. Locate and then add the computer account for the terminal server that you want to add.
  9. Click OK to close the Select Users, Computers, or Groups dialog box, and then click OK to close the Terminal Server Computers Properties dialog box.

Note:  If the license server is installed on an Active Directory Domain Services (AD DS) domain controller, use the Active Directory Users and Computers snap-in to add the computer account for the terminal server to the Terminal Server Computers group. To add the computer account for the terminal server to the Terminal Server Computers group on a domain controller, you must have membership in the Domain Admins group in AD DS, or you must have been delegated the appropriate authority. To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK.

Verify

To verify that the Terminal Server Computers local group is correctly configured on the license server, use the Local Users and Groups snap-in.

Note: If the license server is installed on an Active Directory Domain Services (AD DS) domain controller, use the Active Directory Users and Computers snap-in to verify that the Terminal Server Computers group is properly configured. To use Active Directory Users and Computers on a domain controller, you must have membership in the Domain Admins group in AD DS, or you must have been delegated the appropriate authority. To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK.

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To verify that the Terminal Server Computers group is properly configured:

  1. On the license server, open the Local Users and Groups snap-in. To open Local Users and Groups, click Start, click Run, type lusrmgr.msc, and then click OK.
  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  3. In the left pane, click Groups.
  4. In the right pane, the Terminal Server Computers group should be listed. If the License Server security group Group Policy setting is enabled for the license server, the group should contain a list of computer accounts for terminal servers.

Note: If the TS Licensing role service has been removed from the server, the Terminal Server Computers local group should not be listed.

Terminal Services License Server Security Group Configuration

Terminal Services