New Functionality in Windows Server 2008 Terminal Service Licensing

This is Paul Fragale, coming to you from my little corner of the world. With the launch of Windows Server 2008, there have been several cases around Terminal Server and Terminal Server License Server. I would like to take a moment to review with you some common steps that can help you resolve these issues.

The first case:

Introducing a Windows 2008 Terminal Server into your existing Windows 2003 Environment requires a little preparation. The first main point is that a Windows Server 2008 Terminal Server can only talk to a Windows 2008 License Server. (Additional information can be found at https://technet.microsoft.com/en-us/library/cc770371.aspx) There are two ways to set up the environment to handle this requirement:

  1. The first is to upgrade your existing license server to 2008. You will need to have access to all your license packs before doing this.
  2. The second is to add an additional terminal license server (has to be Windows 2008, remember) to your environment. Then configure the terminal servers to point directly to the correct license server. This can be accomplished by changing the configuration of discovery in the “Terminal Services Configuration” tool.

image 

The second case:

Limiting your Client Access Licenses (CALs) issuance is a frequent concern. With the auto-discovery process any Terminal Server can search Active Directory for a license server. If it finds one, it can then use the TSLS to issue licenses, thereby possibly depleting your license pool inadvertently. To prevent this, Microsoft has introduced a new group called “Terminal Server Computers”. This group allows you to configure what servers the license server is allowed to talk to. It works in conjunction with the “License server security group” Group policy found in the following location:

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\TS Licensing.

In Windows 2008, we have found that it is a good idea to add all your Terminal Servers to this group when the License server is Windows 2008. A couple of symptoms that people have reported are the following:

  1. Windows Terminal Servers are not receiving new CALs from the recently upgrade Windows 2008 Terminal License server.
  2. My Windows 2008 Terminal Server is only getting temporary licenses.

Once you have added the servers to the “Terminal Server Computers” group, the server will start communicating and receiving licenses from the TSL. The one catch is that the server has to have already discovered the license server.

The third case:

Upon installing a Windows 2008 TSL, you may find the following event in the System event log:

Event ID: 8195 Task Category: None Level: Warning Keywords: Classic User: N/A Computer: tsl.alpineskihouse.com Description: The computer account for the Terminal Services license server could not be added to the Terminal Server License Servers group in Active Directory Domain Services during the installation of TS Licensing. The action failed with Win32 error code 0x80072037.

This event occurs in the following situations:

  1. You have a Windows 2000 Active Directory domain with either all the
    domain controllers are Windows 2000, or at least the PDC Emulator is still running
    on a Windows 2000 domain controller. When this is the case, the "Terminal Server
    License Severs" group does not exist in the "Built-in" container. Look for the
    existence of this group. If it does not exist, you need to move the PDC Emulator
    role over to a Windows Server 2003 domain controller (or higher) and keep it
    there.
  2. The "Terminal Server License Servers" group does exist in the "Built-in"
    container, but when the License Server installation happens it connected to a
    Windows 2000 domain controller. During the installation and running of the license
    server it must only connect / communicate with a Windows Server 2003 (or higher)
    domain controller for it to function properly.

(I would like to thank Rob Greene for providing this third piece of information.)

So hopefully this gives you a little insight on troubleshooting your own Terminal Server License Server issues.

Until next time,

-Paul Fragale