Windows Server 2003 Terminal Services Licensing

Posted by Benny Tritsch on January 2, 2006

[Overview] [License Server] [Per Device TS CAL] [Per User TS CAL] [Transition Plan]

Per Device Licensing Mechanism

After the Terminal Services license server is activated, you can safely install client licenses and assign them to the clients. The first time an unlicensed client attempts to log on to a terminal server, the server contacts the license server and requests a license for this client. Before licenses can be issued for clients, a license server must be installed on the network. This license server must have been activated by Microsoft Clearinghouse and provides encrypted key packages for the client licenses.

If a client connects to a terminal server, the server checks for the client's license. If the client does not have a valid license, the terminal server connects to the activated license server to request a valid license. The license server sends the terminal server a temporary license valid for 90 days. The terminal server forwards this license to the client, granting it temporary access for 90 days. At this point, the user is not logged in yet. If  the user authenticates successfully, the terminal server contacts the license server again and informs it about this fact. Now, the temporary license will be marked as "valid". You could also use the notion "one-time licenses" for temporary licenses marked as "valid". Only temporary licenses that are not marked "valid" behave like standard 90-day temporary licenses.

If the client with a temporary license marked as "valid" connects to the terminal server the next time, its temporary license is instantly upgraded to a full license -- if the license server can issue a permanent license from its license pool. As a consequence, the temporary license marked as "valid" works a little different compared to a standard temporary license. It behaves like a one-time license if there are enough permanent licenses available in the license server pool. If this would not be the case, a client without a license initially connecting to a terminal server hooked up to an activated license server would always use a temporary license for 90 days. But this is not the case, permanent licenses are consumed much faster. It only takes up to 90 days until temporary licenses issued by a not activated license server are updated to full licenses.

The permanent license is valid for a random period between 52 and 89 days (which sounds a bit weird). Its validity is again verified by the terminal server upon each connection. If the license is due to expire within the following 7 days, it is renewed by a new permanent license for another period ranging from 52 to 89 days. This does not consume a new license from the license pool on the license server and it is completely independent of the mechanisms behind temporary licenses. It is more like a "permanent license refresh".

An issued Per Device TS-CAL is permanently assigned to a certain computer or terminal and cannot be transferred to another device without manual intervention. A Per Device TS-CAL is a digitally signed certificate that is stored locally on the client. On 32-bit Windows platforms, you can find the information related to the license in the registry at HKLM \Software \Microsoft \MSLicensing \Store \License00x.

If you discard the client or if a client does connect to the terminal server during the valid period, the associated license is returned to the pool of available licenses on the license server. This is possible because the license server keeps track of the expire date. This eliminates the danger of losing licenses because of hard drive damage, reinstallation of clients, or test connections to the terminal server. You will find a more detailed description of this procedure at http://support.microsoft.com/ under Knowledge Base article 287687

Each terminal server will accept any client connecting to it as long as the client has a valid license. So, if your client X received a license from the license server on terminal server A, terminal server B will accept a connection of client X. Terminal servers can validate a client license without contacting the license server. Only if the client has no valid license (because it is expired), the terminal server asks the license server to provide a valid new license or to update the expired license.

Next