Terminal Services Log

In this article I will describe terminal services licensing discovery methods in workgroup and domain.

In Work group there are two methods for discovering licensing:

License Servers Registry Key Query

go to the registry to key

Everybody knows that for access terminal services it is enough to open just 3389 ports and remote clients will be able to access the terminal server.
For terminal services licensing to communicate between two servers there are few more ports that would need to be available.
This is for a scenario when you have licensing server in one site or behind firewall.

Application protocol Protocol Ports
RPC TCP 135
Randomly allocated high TCP ports TCP random port number between 1024 – 65535*
NetBIOS Datagram Service UDP 138
NetBIOS Name Resolution UDP 137
NetBIOS Session Service TCP 139
SMB TCP 445

Terminal Services Licensing communicates by using RPC over named pipes. Service has the same firewall requirements as those of the “File and Printer Sharing” feature.

Microsoft allows you to use downgrade rights and if you, let’s say, purchased licenses for Windows 2008 you can downgrade it to Windows 2003. For full list of downgrade options please use the link below.

http://www.microsoft.com/windowsserver2008/en/us/downgrade-rights.aspx

You have the Terminal server, and the freshly installed Terminal CALs for per user mode but your server is issuing temporary terminal CAL. What is going on?
When installed, the Terminal services licensing  is configured in per device mode. So if you have installed per user cals and the server is in per device mode (you haven’t changed licensing mode), the server will issue temp terminal CALs. To fix this you will need to change the licensing mode.

Change this in Terminal Services Configuration – Server settings.

When changed to per user mode you will note that available licenses listed as “N/A” and “Issued” will not change as in per device mode.
This is because terminal services licensing per user mode is not fully implemented in Windows 2003. You will need to this on your own.
Per user terminal licensing mode is fully managed in Windows 2008.

Have you ever been in a situation to move licenses from one licensing server to another?
Unfortunately that is not a trivial job to do. There are few steps you will need to perform in order to move terminal CALs.

1. Install Terminal Services Licensing on the new server
2. Activate the Terminal Services Licensing Server on the new server
3. Install your terminal CALs on the new server. Licenses cannot be activated more than once, so you will have to call the Microsoft Clearinghouse. They will re-issue your CALs for installation on the new server.
* make sure that you have all the paperwork for the terminal CALs
* start the Terminal Services Licensing management, choose server Properties, choose “Telephone” on the “Connection Method”, choose your country,
* call the regional MS Clearinghouse; they will guide you
4. verify that your Terminal Server(s) can locate the new TS Licensing Server (you may need to override terminal licensing server on your terminal services server)
5. deactivate the TS Licensing Server on the old server and uninstall it

Many people will ask what is the difference between users and device CAL when purchasing licenses for terminal services. CALs have different scenarios that I will explain.

If you have more users than clients (like in a classroom, where multiple people connect to the Terminal services from shared client workstations), then per Device licensing is a cheaper and better choice.

If you have more clients than users (users connect from multiple clients, for example their office PC, a laptop and their PC at home), then per User licensing is the cheaper and better choice.

I have noted that sometimes some Wyse thin clients  require new device CAL from terminal services licensing every time they boot.
This is a bug in Wyse firmware and it should be fixed by Wyse support team. It happens only on certain devices.

Why is this important?
Lets say you have 50 thin clients and 50 device CALs for terminal services. If one device requests two licenses, one device will not be able to connect as there is no device CAL available any more.
You will ask Wyse team to help you and their answer is trivial: change terminal services licensing in per user mode!
This is only a temporary fix. This way you will need to track available user CALs by yourself. Why is this soltuion from Wyse? It is because terminal CAL is not tracked in per user mode, per user mode is fully implemented only in Windows 2008 server terminal services.
They should fix this bug ASAP.