About three months ago, a friend of mine—we’ll call him “Mark”—deployed his first terminal server. He set up a licensing server, configured a Windows 2000 terminal server in application mode, installed all the proper applications, and got everyone up and running. For a while, everything ran smoothly. One morning, several users were no longer able to establish terminal sessions. Nothing changed in the configuration. What could be wrong? Mark’s problem was traced to Microsoft’s client access licensing (CAL) agreement for terminal servers.
The trouble with terminal-server licensing
I believe that Microsoft’s licensing for terminal servers is one of the worst agreements developed by Microsoft. Here’s how terminal-server licensing works and why understanding the agreement and applying a Microsoft hotfix will help you avoid the problems Mark experienced.
There are four types of terminal-server access licenses:
- Built-in: Standard for clients running Windows 2000
- Internet connector: Applicable only in situations with nonemployees (i.e., a terminal server on the Internet for B2B applications)
- TS CALs: Terminal Server Client Access Licenses are for pre-Windows 2000 clients, such as Windows 95/98 PCs.
- Temporary: A 90-day temporary license is assigned to devices that have no other type of license.
In this article, I will concentrate on the TS CALs and temporary licenses and how they work with pre-Windows 2000 devices.
An example of how it works
Let’s look at an example of a fictional company that we’ll call XYZ Printing, Inc. In this example, my friend Mark works at XYZ Printing, Inc., which uses this infrastructure:
- A Windows 2000 domain with two Win2K domain controllers and one Win2K terminal server running in application mode
- One of the domain controllers is also acting as the terminal-service licensing server.
- There are currently 10 users running Windows 95 clients who need to access an HR database that isn’t compatible with Windows 95.
Mark wants to have these users run terminal sessions to access the database. Mark purchases 10 TS CALs and activates them on the licensing server. The users already had Win2K CALs, which are also required. Mark sets up a couple of Windows 95 PCs, and tests the application using terminal services. After verifying that everything works as it should, he configures the 10 PCs in the HR department. Everyone is able to get in, and everything works perfectly.
Three months later, Sarah and Kevin from HR call and complain that they can’t connect to terminal services. Mark looks at the Terminal Service Licensing snap-in and discovers that these two users’ PCs are using temporary licenses and that they just expired.
Mark had purchased and activated 10 CALs, so why were these two PCs using temporary licenses? TS CALs are assigned per client, not per user. They are also not applicable per concurrent connection. This means that every PC or device that connects to the terminal server must have its own license.
Further investigation will show Mark that the two PCs he used to test terminal services are using his two “missing” CALs. Mark hasn’t used these two PCs since testing, and in fact, the PCs have been reformatted since that time. Mark is now desperately trying to reassign the CALs to the two problem PCs in HR, but he won’t succeed. Once a TS CAL is assigned to a device, it is permanent and irrevocable.
Right now, Mark’s system is using 12 TS CALs. If Mark uses a VPN client from home to establish a terminal session, his home PC will use another CAL. If one of the PCs in HR becomes corrupt and needs to be rebuilt, the rebuilt system will use still another CAL. If a new Windows 98 PC replaces one of the PCs in HR, the new PC will use another CAL. Mark can’t revoke a CAL, nor can he reassign it. The only option Mark has is to place a phone call to the Microsoft Clearinghouse and have his licenses reissued.
Microsoft really left IT managers in a bad position with this one. Instead of making administration simpler, managers or administrators have to monitor how many clients are connecting, ensure that no PCs are connecting that don’t need to be, and periodically call the Clearinghouse to reissue licenses.
Sometime after the release of Service Pack 2, Microsoft threw us a life preserver—a special hotfix that allows the licensing server to automatically reissue licenses. The hotfix must be applied to the licensing server, as well as every terminal server running in application mode. The hotfix does not apply to licenses already issued, so you should reissue your licenses one last time by placing a call to the Microsoft Clearinghouse.
After the hotfix is applied, TS CALs are issued to clients with a random expiration period of 52-89 days. If the client connects to the terminal server within seven days of expiration, the CAL is renewed. If the client hasn’t connected within seven days of expiration, the CAL will automatically be reissued.
How the hotfix solves Mark's problem
Looking back at the case study, let’s see what would have happened if the hotfix had been applied before the deployment of terminal services.
Mark’s licensing server would be set up the same way and would have 10 available TS CALs. Mark’s two test PCs would be assigned CALs, as would eight of the HR PCs. The other two HR PCs would be assigned 90-day temporary licenses. Here’s where things change; somewhere between 52 and 89 days of license assignment to Mark’s test PCs, two CALs would expire and be automatically reissued. The next time Sarah and Kevin connect to terminal services, the licensing server issues the available CALs to their PCs. Mark never receives a call from Sarah or Kevin, and he does not need to continually monitor the licenses on the server.
Get the hotfix now!
Before this hotfix came out, I was irritated with Microsoft for the lack of foresight shown in this licensing scheme. The administrative overhead to maintain terminal-server licensing was ridiculous. Microsoft recommends that you wait for Service Pack 3 because it will contain this fix, but I disagree. This is one hotfix that you can’t live without. Get the hotfix here.
Share your experiences!
How has the Win2K terminal services licensing affected your shop and your work? Post a comment to this article or send us a letter.