Microsoft Windows Server 2003 Terminal Server

Licensing
Microsoft Corporation
Published Ma! 2003
Abstract
This white paper provides an introduction to Terminal Server Licensing" the client license
management service for the operating s!stems in Microsoft# Windows Server$ 2003 famil!% The
Terminal Server Licensing service wor&s with Terminal Server to provide" catalog" and enforce license
polic! among Terminal Server clients%
This paper e'amines the &e! features and components of Terminal Server Licensing and e'plains how
this service affects computing in an enterprise%
The information contained in this document represents the current view of
Microsoft Corporation on the issues discussed as of the date of publication.
Because Microsoft must respond to changing market conditions, it should not
be interpreted to be a commitment on the part of Microsoft, and Microsoft
cannot guarantee the accuracy of any information presented after the date of
publication.
This document is for informational purposes only. MICR!"T M#$%! &
'#RR#&TI%!, %()R%!! R IM)*I%+, #! T T,% I&"RM#TI& I&
T,I! +C-M%&T.
Complying with all applicable copyright laws is the responsibility of the user.
'ithout limiting the rights under copyright, no part of this document may be
reproduced, stored in or introduced into a retrieval system, or transmitted in
any form or by any means .electronic, mechanical, photocopying, recording,
or otherwise/, or for any purpose, without the e0press written permission of
Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or
other intellectual property rights covering sub1ect matter in this document.
%0cept as e0pressly provided in any written license agreement from
Microsoft, the furnishing of this document does not give you any license to
these patents, trademarks, copyrights, or other intellectual property.
2 3445 Microsoft Corporation. #ll rights reserved.
Microsoft, #ctive +irectory, 'indows, the 'indows logo, and 'indows
!erver are either registered trademarks or trademarks of Microsoft
Corporation in the -nited !tates and6or other countries.
The names of actual companies and products mentioned herein may be the
trademarks of their respective owners.
Contents
Contents................................................................................................... i
Introduction............................................................................................ iii
The Terminal Server Licensing Model..................................................1
License Server...............................................................................1
Terminal Server.............................................................................2
Supported Licenses.......................................................................2
Summary of Features and Benets.....................................................!
Service "eployment................................................................................!
Terminal Server #race $eriod.............................................................!
Licensing Service Installation.............................................................%
Licensing Service &ctivation...............................................................%
'pgrading a (indo)s 2*** License Server........................................+
License $urchase................................................................................+
License Installation.............................................................................,
Licensing Service "iscovery...............................................................,
(or-group./on0&ctive "irectory "omain "iscovery......................,
&ctive "irectory "iscovery............................................................1
Conguring License Servers for 2igh &vaila3ility...............................1
License To-en &nnouncement..........................................................1*
Terminal Server Licensing Mode.......................................................1*
Licensing $rocess..................................................................................1*
Client License "istri3ution $er "evice..............................................1*
Client License "istri3ution $er 'ser..................................................11
Client License "istri3ution for 45ternal Connector...........................11
&dditional Server Conguration.............................................................12
License Server Bac-up.....................................................................12
$revent License 'pgrade $olicy........................................................12
License Server Security #roup $olicy...............................................16
&dministration.......................................................................................16
Terminal Server Licensing Tool..........................................................1!
Terminal Server License 7eporting Tool............................................1%
Terminal Server Client License Test Tool...........................................1%
Terminal Server License Server 8ie)er Tool......................................1+
$referred License Server (MI Scripts...............................................1+
#lossary................................................................................................ 11
Summary............................................................................................... 11
For More Information........................................................................19
Windows Server 2003 Terminal Server Licensing Technology White Paper ii
Introduction
The Windows Server 2003 operating s!stem famil! provides a client license management s!stem
&nown as Terminal Server Licensing% This s!stem allows terminal servers to obtain and manage
terminal server client access license (TS C)L* to&ens for devices and users connecting to a
terminal server% Terminal Server Licensing is a component service of Microsoft#
Windows Server$ 2003" Standard +dition, Windows# Server 2003" +nterprise +dition, and
Windows Server 2003" -atacenter +dition% .t can manage unlicensed" temporaril! licensed" and
client/access licensed clients" and supports terminal servers that run Windows Server 2003 as
well as the Microsoft Windows# 2000 Server operating s!stem% This greatl! simplifies the tas&
of license management for the s!stem administrator" while minimi0ing under/ or over/purchasing
of licenses for an organi0ation% Terminal Server Licensing is used onl! with Terminal Server and
not with 1emote -es&top for )dministration%
Terminal Server for Windows Server 2003 (&nown as )pplication Server mode in Windows 2000
Server* provides application deplo!ment and management for users on a variet! of devices
through its application server mode% +ach device or user who initiates a session on a terminal
server running Windows Server 2003 must be licensed with one of the following
1. Windows Server 2003 Terminal Server -evice Client )ccess License%
2. Windows Server 2003 Terminal Server 2ser Client )ccess License%
3. Windows Server 2003 Terminal Server +'ternal Connector%
3ote that additional licenses might be needed" such as Microsoft or other application" operating
s!stem" and Client )ccess licenses% The licenses in the preceding list are re4uired even if other
add/on products are used on top of Windows Server 2003%
The Terminal Services Licensing service is onl! associated with licensing for a terminal server
client% .t is not used to license an! other application or service" and does not replace or
interoperate with the licensing service for an! other component" or alter !our rights and
obligations under an! +nd 2ser License )greement (+2L)*% The Terminal Server Licensing
service is not a replacement for purchasing a TS C)L b! using the appropriate sales channels%
TS C)L to&ens are electronic representations of real licenses" but the! are not actual licenses
themselves% Therefore if a license to&en is lost" it does not mean that !ou have lost an actual
license% .f !ou have the documentation to prove that !ou have bought an actual license" the
license to&en can be re/issued% Conversel!" 5ust because !ou have a license to&en does not mean
that it necessaril! maps to an actual legal license%
Terminal Services Licensing is designed to manage these license to&ens to allow an administrator
to more accuratel! assess an organi0ation6s licensing re4uirements% 7owever" there are a few
situations in which a license to&en will not map to an actual license% The administrator should
ma&e his best effort to determine if this is the case" and if necessar!" purchase e'tra licenses (but
not install the corresponding license to&ens* to account for this discrepanc!%
Windows Server 2003 Terminal Server Licensing Technology White Paper iii
The Terminal Server Licensing Model
Terminal Server Licensing operates between several components as shown in 8igure 9% The
Terminal Server Licensing/enabled license server" the Microsoft Certificate )uthorit! and
License Clearinghouse" one or more terminal servers" and terminal server clients% ) single license
server can support multiple terminal servers% There can be one or more license servers in a
domain" or throughout a site%
Figure 1 The Terminal Server Licensing model
Product
Infrastructure Microsoft
Windows Server 2003
Terminal Server
License Server
Microsoft
Certificate Authority &
License Clearinghouse
Windows Server 2003 and
Windows 2000 Terminal
Servers
Clients
Customer
Microsoft Certificate )uthorit! and License Clearinghouse
The Microsoft Clearinghouse is the facilit! Microsoft maintains to activate license servers and to
issue client license &e! pac&s to license servers% ) client license &e! pac& is a digital
representation of a group of client access license to&ens% The Microsoft Clearinghouse is
accessed through the Terminal Services Licensing administrative tool% .t might be reached
directl! over the .nternet" through a Web page" or b! phone%
License Server
) license server is a computer on which Terminal Server Licensing is installed% ) license server
stores all TS C)Ls license to&ens that have been installed for a group of terminal servers and
trac&s the license to&ens that have been issued% :ne license server can serve man! terminal
servers simultaneousl!% ) terminal server must be able to connect to an activated license server in
order for permanent license to&ens to be issued to client devices% ) license server that has been
installed but not activated will onl! issue temporar! license to&ens%
Terminal Server
) terminal server is a computer on which the Terminal Server service is installed% .t provides
clients access to Windows;based applications running entirel! on the server and supports
multiple client sessions on the server% )s clients connect to a terminal server" the terminal server
determines if the client needs a license to&en" re4uests a license to&en from a license server" and
then delivers that license to&en to the client%
Supported Licenses
) license server that runs Windows Server 2003 supports the following t!pes of licenses and
manages their corresponding to&ens associated with Windows Server 2003 Terminal Server and
Windows 2000 Terminal Services as of this writing
Windows Server 2003 Terminal Server evice !lient Access Licenses. These licenses are
purchased for &nown devices that connect to a terminal server running Windows Server 2003%
Windows Server 2003 Terminal Server "ser !lient Access Licenses. These licenses are
purchased for &nown users that connect to a terminal server running Windows Server 2003%
Windows Server 2003 Terminal Server #$ternal !onnector Licenses. These licenses are
purchased to allow unlimited connections to a terminal server running Windows Server 2003 b!
e'ternal users (for e'ample" business partners*% .t is important to note that there is currentl! no
support for installing +'ternal Connector to&ens on a license server%
Windows 2000 Terminal Services !lient Access Licenses. These licenses are purchased for
&nown devices that connect to a terminal server running Windows 2000%
Windows 2000 Terminal Services %nternet !onnector Licenses. These licenses are
purchased to allow up to 200 simultaneous anon!mous connections to a terminal server running
Windows 2000 b! non/emplo!ees across the .nternet%
Windows 2000 &'ilt(in Licenses. Clients that are running Windows 2000 Professional or its
successor operating s!stem(s* are issued a to&en from the built/in pool of license to&ens when
connecting to a terminal server running Windows 2000%
Temporary Licenses. When a terminal server running Windows Server 2003 re4uests a
Windows Server 2003 Terminal Server Licensing Technology White Paper 2
/ote
&ll devices connecting to a terminal server running (indo)s
Server 2**6 are re:uired to have a (indo)s Server 2**6 TS
C&L. /o operating system; including (indo)s 2*** $rofessional
or successor operating system<s= )ill 3e issued a to-en from the
3uilt0in pool.
Windows Server 2003 Per -evice TS C)L to&en" or when a terminal server running
Windows 2000 re4uests a Windows 2000 TS C)L to&en" and the license server has none to
give" it will issue a temporar! to&en to the connecting client (if the client device has no e'isting
to&en*% The license server trac&s the issuance and e'piration of these% These temporar! to&ens
are designed to allow ample time for the administrator to install license to&ens on the license
server% The! are not designed to provide for a period of <free= access to the terminal server% Per
the Windows Server +2L)" licenses are re4uired to be purchased to access a terminal server%
There is no provision in the +2L) for accessing a terminal server without the appropriate
licenses%
Important
Windows Server 2003 Terminal Server Licensing Technology White Paper 3
&lthough it is possi3le to install all the preceding license to-en
types on a terminal server running (indo)s Server 2**6; the
to-en types for (indo)s 2*** are only valid for use 3y clients
connecting to a terminal server running (indo)s 2***.
(indo)s Server 2**6 to-ens are re:uired for connecting to a
terminal server running (indo)s Server 2**6.
Summary of Features and Benets
The Terminal Services Licensing service includes the following features and benefits
Centrali0ed administration for TS C)Ls and the corresponding to&ens
License accountabilit! and reporting
Simple support for various communication channels and purchase programs
Minimal impact on networ& and servers
The remainder of this document e'plores the design goals and implementation of Terminal
Server Licensing for Windows Server 2003" and e'plains how an enterprise can ma&e use of this
service%
Service "eployment
The Terminal Server Licensing service is a separate entit! from the terminal server% .n most large
deplo!ments" the license server is deplo!ed on a separate server" even though it can be co/
resident on the terminal server in some smaller deplo!ments%
Terminal Server Licensing is a low/impact service% .t re4uires ver! little CP2 or memor! for
regular operations" and its hard dis& re4uirements are small" even for a significant number of
clients% .dle activities are negligible% Memor! usage is less than 90 megab!tes (M>*% The license
database will grow in increments of ? M> for ever! @"000 license to&ens issued% The license
server is onl! active when a terminal server is re4uesting a license to&en" and its impact on server
performance is ver! low" even in high/load scenarios%
) terminal server running Windows Server 2003 does not communicate with a terminal server
licensing server running Windows 2000% .t is" however" possible for a terminal server licensing
server running Windows Server 2003 to communicate with a terminal server running
Windows 2000 Server% Therefore" when upgrading terminal servers running Windows 2000" !ou
need to install and activate a licensing server that runs Windows Server 2003" which
communicates with terminal servers that run both Windows 2000 and Windows Server 2003%
Terminal Server #race $eriod
) terminal server allows clients to connect without license to&ens for 920 da!s before it re4uires
communicating with a license server% This period is &nown as the license server grace period" and
begins the first time a terminal server client connection is made to the terminal server% This grace
period is designed to allow ample time for the administrator to deplo! a license server% .t is not
designed to provide for a period of <free= access to a terminal server% Per the Windows
Windows Server 2003 Terminal Server Licensing Technology White Paper )
Server 2003 +2L)" licenses are re4uired to be purchased in order to access a terminal server%
There is no provision in the +2L) for accessing a terminal server without the appropriate
licenses%
The license server grace period ends after 920 da!s" or when a license server issues a permanent
license to&en through the terminal server" whichever occurs first% Therefore" if the license server
and terminal server are deplo!ed at the same time" the terminal server grace period will
immediatel! e'pire after the first permanent license to&en has been issued%
Licensing Service Installation
To install the license service" choose Terminal Server Licensing during product setup" or at an!
time b! choosing <)dd or 1emove Programs= from Control Panel" then <)ddA1emove Windows
Components=%
.n Windows Server 2003" the licensing service can be installed on a wor&group;based server" a
member server" or a domain controller%
-uring the installation of the Terminal Server Licensing service" !ou need to choose between the
following modes of the license server
Bour entire enterprise (enterprise license server*
Bour domain or wor&group (domainAwor&group license server*
These options determine how and when a license server will be discovered b! terminal servers%
.n a wor&group or non/)ctive -irector! domain" !ou must choose <Bour domain or wor&group%=
.n this scenario" a license server is automaticall! discovered b! an! terminal server within the
same subnet as the license server%
.n an )ctive -irector!;based domain" !ou might choose either option% )n enterprise licensing
server is automaticall! discovered b! an! terminal server within the same site as the license
server% ) domain licensing server is automaticall! discovered b! an! terminal server that is a
member of the same domain as the license server%
Licensing Service &ctivation
) license server must be activated in order to certif! the server and allow it to issue client license
to&ens% ) license server is activated using the )ctivation Wi0ard in the Terminal Server Licensing
administration tool% To activate a license server" choose Activate Server from the Action menu
while the server is highlighted% 8or more information" see <Terminal Server Licensing= in 7elp
and Support Center for Microsoft# Windows# Server 2003%
There are three connection methods to activate !our license server
%nternet *A'tomatic+ The 4uic&est and easiest wa! to activate and install licenses and is the
one recommended b! Microsoft% This method re4uires .nternet connectivit! from the device
running the Terminal Server Licensing admin tool. .nternet connectivit! is not re4uired from
Windows Server 2003 Terminal Server Licensing Technology White Paper ,
the license server itself% The internet method uses TCPA.P (TCP port CC3* to connect directl! to
the Clearinghouse%
Web The Web method should be used when the device running the Terminal Server Licensing
admin tool does not have .nternet connectivit!" but !ou do have access to the Web b! means of
a Web browser from another computer% The 21L for the Web method is displa!ed in the
)ctivation Wi0ard%
Phone The phone method allows !ou to tal& to a Microsoft Customer Service 1epresentative to
complete the activation or license installation transactions% The appropriate telephone number is
determined b! the countr!Aregion that !ou chose in the )ctivation Wi0ard and is displa!ed b!
the wi0ard%
When !ou activate the license server" Microsoft provides the server with a limited/use digital
certificate that validates server ownership and identit!% Microsoft uses the D%?0E industr!
standard certificate for this purpose% 2sing this certificate" a license server can ma&e subse4uent
transactions with Microsoft and receive client license &e! pac&s% ) client license &e! pac&
contains multiple license to&ens for distribution b! the license server%
) license server must be activated onl! once% While waiting to complete the activation or license
to&en installation processes" !our license server can issue temporar! to&ens for clients that allow
them to use terminal servers for up to E0 da!s%
'pgrading a (indo)s 2*** License
Server
When upgrading a license server that runs Windows 2000 to run Windows Server 2003" the
license database and installed license to&ens will be preserved% 7owever" it ma! be necessar! to
re/activate the license server after the upgrade has been completed% To re/activate !our license
server that is upgraded from Windows 2000" start the Terminal Server Licensing tool and choose
-e(activate Server from the Action menu while the server is highlighted% 8or more information"
see <Terminal Server Licensing= in 7elp and Support Center for Windows Server 2003%
License $urchase
The process for purchasing TS C)Ls for Windows Server 2003 remains the same as for
purchasing other Microsoft Client )ccess licenses% Windows Server 2003 Terminal Server
Licensing technolog! does not alter the purchase process% Customers might purchase these
licenses b! obtaining a Microsoft License Pa& (MLP*" Microsoft :pen License" or through one
of Microsoft6s volume licensing programs" such as Microsoft Select%
Windows Server 2003 Terminal Server Licensing Technology White Paper .
Important
License Installation
License to&ens must be installed on !our license server in order to deplo! them to client devices%
)fter !ou have purchased TS C)Ls" !ou can then install the corresponding license to&ens b!
using the C)L .nstallation Wi0ard" which is located in the Terminal Server Licensing tool%
.nstalling license to&ens supports the three connection methods that are supported for license
server activation% When !ou install license to&ens" !ou will be as&ed for information regarding
!our purchase of the licenses% -epending on how !ou obtained !our licenses" the information
re4uested might include !our Microsoft +nterprise or Select +nrollment number" !our Campus"
School" Services Provider" Multi/Bear :pen" or :pen Subscription )greement number" !our
:pen License and )uthori0ation numbers" or !our 2?/character License Code if !ou purchased a
License Pa&% .f !ou obtained !our licenses from a program or b! a method not listed earlier in
this paper" consult !our program documentation for more information%
Licensing Service "iscovery
Terminal servers use a discover! process to locate license servers% The process begins when the
Terminal Server service starts% The discover! process varies based on the environment the
terminal server is currentl! in%
.t is also possible to override this discover! process b! specif!ing a preferred license server (or
multiple license servers* on a terminal server b! using a WM. script% 8or three scripts that !ou
can use to set preferred license servers" delete preferred license servers" or 4uer! preferred
license servers" see <)dministration= later in this document%
(or-group./on0&ctive "irectory "omain "iscovery
.n a wor&group or non/active director! domain" a terminal server first attempts to contact an!
license servers specified in the LicenseServers registr! &e!% .f unsuccessful" it performs a
mailslot broadcast" which locates an! license servers in its subnet%
Windows Server 2003 Terminal Server Licensing Technology White Paper /
If you purchase your TS C&Ls 3y means of a Microsoft License
$a-; note that Microsoft added some additional components to
the ML$ for TS C&Ls; starting )ith (indo)s 2***. $reviously;
the contents of a ML$ included 4'L&s. The (indo)s Server
2**6 TS C&L ML$; li-e the (indo)s 2*** Server TS C&L ML$;
)ill include the 4'L&s as )ell as a ne) component called a
license addendum. This license addendum contains a 2%0
character alphanumeric code; called a license code; )hich
represents the :uantity of TS C&Ls purchased. The system
administrator uses this license code and chooses a licensing
program called 7etailto install the ML$ TS C&L to-ens on the
license server.
&ctive "irectory "iscovery
.n an )ctive -irector!;based domain" a terminal server first attempts to contact an! license
servers specified in the LicenseServers registr! &e!% .f unsuccessful" it attempts to locate an!
enterprise license servers b! performing a Lightweight Directory Access Protocol (L-)P*
4uer! for the following ob5ect in the )ctive -irector!
LDAP://CN=TS-Enterprise-License-Server,CN=<site-
name>,CN=sites,CN=configuration,DC=<omainname>,DC=com
The terminal server then attempts to locate an! domain license servers b! 4uer!ing all domain
controllers within its site" and then all domain controllers within its domain%
Important
The terminal caches the names of license servers that it locates in the following locations of the
registr!
!"E#$L%CAL$&AC!'NE(Soft)are(&icrosoft(&SLicensing(Parameters(EnterpriseServer&u*t
i ,Enterprise *icense servers-
!"E#$L%CAL$&AC!'NE(Soft)are(&icrosoft(&SLicensing(Parameters(DomainLicenseServer&
u*ti ,Domain *icense servers-
.f no license server is found" the terminal server attempts a discover! once ever! hour% )fter a
license server is located" no discover! will be attempted until all of the cached license servers in
the Terminal Server registr! are unavailable%
Conguring License Servers for 2igh
&vaila3ility
.n determining the location of a license server" discoverabilit! is the most critical factor% )
domain" site" or wor&group that hosts terminal servers must also host a license server% The
recommended method of configuring license servers for high availabilit! is to install at least two
license servers that have available Terminal Services C)Ls% +ach server will then advertise in
)ctive -irector!# director! service as enterprise license servers with regard to the following
LDAP: //CN=TS-Enterprise-License-Server,CN=site name,CN=sites,CN=configuration-
container.
+ach license server should contain ?0F of the C)Ls that !ou use for load balancing% .f a license
server does not have valid C)Ls" then that license server will attempt to refer to other license
Windows Server 2003 Terminal Server Licensing Technology White Paper 0
&lthough it is possi3le for non0domain controllers to 3e license
servers in (indo)s Server 2**6; it is important to note that
domain license servers are not automatically discovered. >ou
must congure a preferred license server on all terminal servers
that need to communicate )ith non0"omain controller license
servers congured as domain license servers. 4nterprise
domain license servers deployed on non0domain controllers are
automatically discovered.
servers with valid C)Ls for license issuance% (This applies to both enterprise license servers and
domain license servers%*
The following table provides a summar! of high/availabilit! scenarios for issuing temporar! and
permanent licenses%
Ta3le 1 License Issuance Matri5
License
Server & 0
&vaila3le
License
Server & 0
"o)n
License
Server B 0
&vaila3le
License
Server B 0
"o)n
License
Server &
and
License
Server B
"o)n
/e) Client
License
Issue
temporary
license for
9* days
Failover to
License
Server B
Issue
temporary
license for
9* days
Failover to
License
Server &
Fail to
connect
45isting
Temporary
License
Issue
permanent
license for
%2019 days
Failover to
License
Server B
Issue
permanent
license for
%2019 days
Failover to
License
Server &
&llo)
connection
until
e5pired
45pired
Temporary
License
Issue
permanent
license for
%2019 days
Failover to
License
Server B
Issue
permanent
license for
%2019 days
Failover to
License
Server &
Fail to
connect
45isting
$ermanent
License
&llo)
connect?
)ill reissue
license at
, days
3efore
e5piration
Failover to
License
Server B
&llo)
connect?
)ill reissue
license at
, days
3efore
e5piration
Failover to
License
Server &
&llo)
connect?
)ill fail
)hen the
C&L
e5pires
45pired
$ermanent
License
7eissue
license
)ith ne)
e5piration
Failover to
License
Server B
7eissue
license
)ith ne)
e5piration
Failover to
License
Server &
Fail to
connect
45isting
(indo)s
2***
License
&llo)
connection
&llo)
connection
&llo)
connection
&llo)
connection
&llo)
connection
+ach client will begin a license re4uest and upgrade G da!s prior to the license e'piration date%
This should allow sufficient time to address an! issues with individual license servers% .f all
license servers are down at the same time" new clients or clients with e'pired licenses will be
denied access% .n addition" license servers should be separated b! networ& subnets to ensure that
a networ& outage does not prevent users from connecting to a license Server%
Windows Server 2003 Terminal Server Licensing Technology White Paper 1
8inall!" administrators should use the Terminal Server Licensing Tool to ensure that at least 90F
of their C)Ls are available on each license server% 7owever" if available licenses are limited to a
single license server that suffers an outage" clients with e'pired licenses will be denied access
immediatel!" and clients with licenses that e'pire within the ne't G da!s will be denied access on
their e'piration dates%
License To-en &nnouncement
.n certain cases" license servers will notif! each other when license to&ens are added or removed
from their databases% This notification s!stem allows license servers to redirect license to&en
re4uests to other license servers when the! have no license to&ens to issue% Listed below are the
supported configurations and topologies
>etween domain license servers in the same domain
>etween enterprise license servers in the same site and domain
8rom enterprise license servers to domain license servers
8rom license servers running Windows 2000 to Windows Server 2003
Terminal Server Licensing Mode
Terminal server in Windows Server 2003 supports the following licensing modes
Per evice License to&ens are assigned to each device that connects to a particular terminal
server
Per "ser License to&ens are assigned to each user that connects to a particular terminal server
.n order to use a combination of 2ser" -evice" and +'ternal Connector licenses on single
terminal server" !ou should configure !our server in Per 2ser mode%
>! default" a terminal server running Windows 2000 that is upgraded to Windows Server 2003 is
placed in Per -evice mode% 7owever" if the terminal server running Windows 2000 is in .nternet
Connector mode" the server is placed in Per 2ser mode%
Windows Server 2003 Terminal Server Licensing Technology White Paper 10
Licensing $rocess
Client License "istri3ution $er
"evice
)ll communication during the licensing process occurs between the client and the terminal
server" and between the terminal server and the license server% The terminal server client never
communicates directl! with the license server%
When a client device attempts to connect to a terminal server in Per -evice mode" the terminal
server determines if the client has a license to&en% Terminal server clients store license to&ens in
the following location
!"E#$L%CAL$&AC!'NE(Soft)are(&icrosoft(&SLicensing
.f a client has no license to&en" the terminal server attempts to contact a license server from its
list of discovered license servers% .f no contact is made" the terminal server restarts the discover!
process% .f no license server responds" the device can not connect to the terminal server unless it
is operating within the terminal server grace period%
When a license server responds" the terminal server re4uests a temporar! to&en for the device
because this is the first time the device has connected to a terminal server% The terminal server
then pushes this temporar! to&en to the device% )fter a user has provided valid credentials
resulting in a successful logon" the terminal server instructs the license server to mar& the issued
temporar! to&en as validated%
The ne't time a user attempts to connect to a terminal server in Per -evice mode from this
device" the terminal server re4uests a Windows Server 2003 TS -evice C)L to&en for this
device% .f the license server has available TS -evice C)L to&ens" the license server removes one
to&en from the available pool" mar&s it as issued to the device" logs the device name" the user
name of the device" and the date issued" and then pushes this TS -evice C)L to&en to the device%
.f the license server has no TS -evice C)L to&ens" it will first loo& to an! other license server in
its domain" wor&group" or site% License servers maintain information about where other
accessible license servers e'ist" and if the! have license to&ens% .f another license server is
accessible that does have inventor!" the first license server will re4uest a license to&en from the
second license server and deliver it to the terminal server" which then passes the to&en to the
client device% .f there are no available TS -evice C)L to&ens" the device will continue to connect
with the temporar! to&en%
Temporar! to&ens allow devices to connect for E0 da!s" and will then e'pire% TS -evice C)Ls"
while representing perpetual licenses" are set to e'pire ?2/HE da!s from the date the! are issued%
The terminal server alwa!s attempts to renew these to&ens G da!s prior to their e'piration% This
purpose of this is to recover TS -evice C)L to&ens that are lost due to events such as hardware
failure or operating s!stem reinstallation%
Windows Server 2003 Terminal Server Licensing Technology White Paper 11
Client License "istri3ution $er 'ser
When a terminal server is configured in Per 2ser mode" the terminal server must be able to locate
a license server after the grace period has e'pired% While it is possible to install TS Per 2ser C)L
to&ens on a license server" there is currentl! no method of assigning a TS Per 2ser C)L to&en to
a particular user account%
Client License "istri3ution for
45ternal Connector
There is currentl! no support in Terminal Server Licensing or the Microsoft Clearinghouse for
the +'ternal Connector% .n order to use an +'ternal Connector license" !ou will need to configure
!our terminal server in Per 2ser mode%
&dditional Server
Conguration
License Server Bac-up
Choose the following options within 3tbac&up when bac&ing up a license server
License server directory *by de2a'lt3 4systemroot45system325lserver+
-epair directory *by de2a'lt3 4systemroot45-epair +
System state
.n order to move or replace an e'isting license server" perform the following tas&s
1. .nstall and activate a license server on the new computer%
2. .nstall the number and t!pe of TS C)L to&ens" e4ual to the number and t!pe installed on the
original license server that is being replaced% Bou might use an! of the three available
connections methods available% -epending on how !ou purchased !our TS C)Ls" it might be
necessar! to phone a Microsoft Customer Service 1epresentative if both the )utomatic and
Web methods fail%
3. +nsure that the new license server is discoverable b! !our terminal servers% 8or e'ample" if
!ou previousl! configured !our terminal servers to re4uest to&ens from the old license server"
!ou need to modif! them to re4uest to&ens from the new license server%
). 2ninstall or deactivate the old license server if !ou are replacing an active license server%
Windows Server 2003 Terminal Server Licensing Technology White Paper 12
Clients that were issued to&ens b! the retired license server will continue to use those to&ens
until the! e'pire% )s to&ens e'pire" clients will be assigned new to&ens from the new license
server%
$revent License 'pgrade $olicy
Computer ConfigurationA)dministrative TemplatesAWindows ComponentsATerminal
ServicesALicensing
) license server attempts to provide the most appropriate Client )ccess License (C)L* for a
connection% 8or e'ample" a license server provides a Windows 2000 TS C)L to&en for clients
connecting to a terminal server running Windows 2000 and a Windows Server 2003 8amil! Per
-evice TS C)L to&en for a connection to a terminal server running Windows Server 2003%
>! default" this per/computer setting allows a license server to suppl! a Windows Server 2003
8amil! -evice TS C)L to&en" if available" to a terminal server running Windows 2000 if there
are no Windows 2000 TS C)L to&ens available%
.f the status is set to +nabled" when a terminal server running Windows 2000 re4uests a license"
but no Windows 2000 TS C)L to&en is available" a temporar! C)L is issued if the client has not
alread! been issued a temporar! C)L% :therwise" no C)L is issued and the client is refused
connection" unless the terminal server is within its grace period%
License Server Security #roup $olicy
Computer ConfigurationA)dministrative TemplatesAWindows ComponentsATerminal
ServicesALicensing
Bou can use this setting to control which servers are issued licenses% >! default" a terminal server
license server issues a license to an! computer that re4uests one%
8or e'ample" this polic! might be useful in a departmental deplo!ment in which each department
purchases its own TS C)Ls and terminal servers% This polic! allow a department to control
which terminal servers are able to re4uest TS C)L to&ens from their license server(s*%
.f the status is set to +nabled" the terminal server license Server grants licenses onl! to computers
whose computer accounts are placed in the Terminal Services Computers local group% When the
license server is a domain controller" this group is a domain local group%
Windows Server 2003 Terminal Server Licensing Technology White Paper 13
/ote
This policy only applies to "evice C&L to-ens; as there is only
one version of 'ser C&L to-ens.
&dministration
The primar! tool used to manage the licensing service is the Terminal Server Licensing admin
tool" which is installed b! default% This tool is used to activate the license server" install licenses
to&ens" view the data contained in the license database" and generall! administer the license
server% The other tools" including the Terminal Server License 1eporting tool" Terminal Server
Client License Test tool and the Terminal Server License Server Iiew tool are described below%
Terminal Server Licensing Tool
The Terminal Server Licensing tool provides for the administration of the license server% When
started" it displa!s a list of all discoverable license servers (see 8igure 2* and can be used to
administer an! of those servers from a single location%
Figure 2 Terminal Server Licensing tool
Windows Server 2003 Terminal Server Licensing Technology White Paper 1)
/otes
1. The Terminal Services Computers group is empty 3y default.
The terminal server license server does not grant licenses to
any computers unless you e5plicitly populate this group.
2. The most e@cient )ay to manage terminal server computer
accounts is to create a glo3al group containing the accounts of
all terminal servers and license servers that must receive
licenses. Then; place this glo3al group into the local <or domain
local= Terminal Services Computers group. This method allo)s a
domain administrator to manage a single list of computer
accounts.
6. To add a computer account to a group; open the Computer
Management snap0in; navigate to the $roperties page of the
group; and clic- &dd. An the Select 'sers; Computers; or
#roups dialog 3o5; clic- A3Bect Types and then chec-
Computers.
Selecting a license server allows it to be managed% Supported activities include
Activating the license server
%nstalling license to6ens
7iewing license iss'ance and availability details
Advanced options s'ch as de(activating a license server
Man! of the activities in the preceding list are related to communication with the Microsoft
Clearinghouse% The centrali0ed management capabilities of this tool simplif! the process b!
allowing a single" .nternet/connected site to provide these services for an enterprise%
Terminal Server License 7eporting
Tool
The Terminal Server License 1eporting tool (LS1+P:1T%+D+* provided with the Microsoft
'indows !erver 3447 Resource $it can be used to anal!0e the information contained in the
license server database% .t is a command/line utilit! that outputs the information from the license
server6s database into a tab/delimited te't file% The tool has been updated to include the client
7ardware .- in the report which is useful for trac&ing licenses issued to particular client devices%
The reporting tool can be used with the following parameters
Windows Server 2003 Terminal Server Licensing Technology White Paper 1,
A8 filename
-irects output to the written to a file name =filename=
(=filename= defaults to 6lsreport%t't=*%
A- start JendK Writes onl! license to&ens that were issued between start
and end (end defaults to the current date*%
AT -irects onl! temporar! to&ens to be written
AW
Serverlist
-irects 7ardware .- to be included in report (onl! for
Windows Server 2003 license servers*%
) list of servers to 4uer!% .f not specified" a list will be
obtained from a domain controller%
AL Prints a program summar! to the screen%
"sage8
Lsreport JA8 filenameK JA- start JendKK JATK JALK JserverlistK
#$amples8
Lsreport
Lsreport AT 3TLS/9 3TLS2
Terminal Server Client License Test
Tool
The Terminal Server Client License Test tool (TSTCST%+D+* provided with the 'indows
!erver 3447 Resource $it can be used to displa! details about the license to&en residing on a
client device% .t is a command/line utilit! that displa!s the following information b! default
%ss'er
Scope
%ss'ed to comp'ter
%ss'ed to 'ser
License %
Type97ersion
7alid :rom
#$pires ;n
>! using the A) switch" the following additional information is displa!ed
Windows Server 2003 Terminal Server Licensing Technology White Paper 1.
Server certi2icate version
Licensed prod'ct version
<ardware %
!lient plat2orm %
!ompany name
Terminal Server License Server
8ie)er Tool
The Terminal Server License Server Iiewer tool (LSI.+W%+D+* provided with the 'indows
!erver 3447 Resource $it can be used to displa! the license servers that are discoverable on !our
networ&% .t is a M2.;based utilit! that shows the name and t!pe of each license server that it
discovers% .t also provides the abilit! to create a log file with advanced diagnostic information
about the discover! process%
$referred License Server (MI Scripts
2se the following WM. script to set a preferred license server
AddLicenseServer.vbs
'***************************************************************************
'
' WMI VBscript to add a specified License server to Terminal server's registry
'
'***************************************************************************
if Wscript.arguments.count<1 then
Wscript.echo "Script requires one argument, the LicenseServerName"
Wscript.echo "e.g. cscript AddLicenseServer LicenseServerName"
Wscript.quit
end if
Dim strServer
strServer=Wscript.arguments.Item(0)
for each terminal in GetObject("winmgmts:
{impersonationLevel=impersonate}").InstancesOf ("win32_TerminalServiceSetting")
result = terminal.AddDirectConnectLicenseServer (strServer)
WScript.Echo "Method returned result = " & result
Windows Server 2003 Terminal Server Licensing Technology White Paper 1/
if err <>0 then
WScript.Echo Err.Description, "0x" & Hex(Err.Number)
end if
next
2se the following WM. script to delete preferred license servers
eleteLicenseServer.vbs
'***************************************************************************
'
' WMI VBscript to add a specified License server to Terminal server's registry
'
'***************************************************************************
if Wscript.arguments.count<1 then
Wscript.echo "Script requires one argument, the LicenseServerName"
Wscript.echo "e.g. cscript DeleteLicenseServer LicenseServerName"
Wscript.quit
end if
Dim strServer
strServer=Wscript.arguments.Item(0)
for each terminal in GetObject("winmgmts:
{impersonationLevel=impersonate}").InstancesOf ("win32_TerminalServiceSetting")
result = terminal.DeleteDirectConnectLicenseServer (strServer)
WScript.Echo "Method returned result = " & result
if err <>0 then
WScript.Echo Err.Description, "0x" & Hex(Err.Number)
end if
next
2se the following WM. script to 4uer! preferred license server settings
='eryLicenseServers.vbs
'***************************************************************************
'
' WMI VBScript that queries the License servers configured for registry bypass.
'
' on the Terminal server
'
'***************************************************************************
for each Terminal in GetObject("winmgmts:
{impersonationLevel=impersonate}").InstancesOf ("win32_TerminalServiceSetting")
Windows Server 2003 Terminal Server Licensing Technology White Paper 10
WScript.Echo "The License Servers are = " &
Terminal.DirectConnectLicenseServers
next
#lossary
omain License Server ; The scope of a domain license server is a domain or a wor&group%
#nterprise License Server ; +nterprise license server is the default setting for a license server%
.ts scope is an )ctive -irector! site%
License !ode ; ) license code is a 2?/character alphanumeric code that represents the t!pe and
number of licenses !ou are entitled to% The License Code comes as part of the Microsoft License
Pac& (MLP* pac&aging%
License >ey ; ) license &e! consists of the digital certificate bits that represent a license% The
license &e! for a TS C)L is stored locall! on the client device%
License >ey Pac6 ; ) license &e! pac& is a digital representation of a group of license &e!s%
License &e! pac&s are installed on the license server as a result of license installation%
License >ey Pac6 % ; ) license &e! pac& .- is a 3?/character alphanumeric representation of a
license &e! pac& and is used to install licenses when using the WWW or Phone method%
License Server ; ) license server is a computer that runs a Windows Server 2003 operating
s!stem that has been configured with the Terminal Server Licensing service%
License Server Activation ; License server activation is the process of assigning a server a
limited/use D/?0E certificate for the purpose of issuing license &e!s%
License Server % ; ) license server .- is a 3?/character alphanumeric representation of the
certificate of a license server" which is used to obtain a license &e! pac& b! means of a license
installation%
Summary
The Terminal Server Licensing service provides a mechanism to manage and allocate TS C)L
to&ens% .t wor&s in con5unction with terminal server" terminal server clients" and an automated
clearinghouse to manage the licensing process% This facilit! simplifies the license trac&ing
process for s!stem administrators%
For More Information
8or the latest information on the Windows Server 2003 famil!" Terminal Server" and the Terminal
Server Licensing service" visit
Windows Server 2003 Terminal Server Licensing Technology White Paper 11
'indows !erver 3447 Terminal !ervices
httpAAwww%microsoft%comAwindowsserver2003AtechnologiesAterminalservicesA or
httpAAgo%microsoft%comAfwlin&ALLin&.dN9H3C0
Microsoft 'indows !erver 3447
httpAAwww%microsoft%comAwindowsserver2003 or httpAAgo%microsoft%comAfwlin&AL
Lin&.dN9G?33
'indows !erver 3447 Terminal !erver *icensing Issues and Re8uirements for +eployment
httpAAsupport%microsoft%comALidNH23393 or httpAAgo%microsoft%comAfwlin&ALLin&.dN23CCC
Terminal !ervices "#9
httpAAwww%microsoft%comAwindowsserver2003Acommunit!AcentersAterminalAterminalOfa4%msp'P
DSLTfa4Section929923929920920 or httpAAgo%microsoft%comAfwlin&ALLin&.dN23CC?
8or additional information about the deplo!ment and management of the Terminal Server
Licensing service" see the 'indows !erver 3447 Resource $it and the +eployment )lanning
:uide in the Microsoft; 'indows; !erver 3447 Resource $it at
httpAAwww%microsoft%comAwindowsserver2003AtechinfoAres&itAdeplo!&it%msp' or
httpAAgo%microsoft%comAfwlin&ALLin&.dNC2EH
Windows Server 2003 Terminal Server Licensing Technology White Paper 20