How does Win2K TS Licensing work?

Terminal Server and Citrix Metaframe Licensing Document

The following document is to shed some light on the mystery of Microsoft Terminal Server Licensing. Hopefully this explanation will answer any questions that may arise when the thought of a Citrix Server Farm is brought up and the Licenses needed to implement a Farm in keeping with the Microsoft Licensing Agreement Terms and EULA (End User License Agreement).

Also included in this document will be an explanation of terms in regards to what each license is and its purpose in the scheme of each implementation.

Windows2000 Server License: This is the license that is purchased for the server to run the Server Network Operating System. This needs to be purchased for EACH Terminal Server that is being purchased for the Farm.

Windows2000 CAL (Client Access License): This is the license needed to access a Windows2000 Server from any Workstation. These need to be purchased for each workstation that will be accessing the Citrix servers no matter what OS the clients PC is running.

Windows2000 Terminal Services CAL (Client Access License): This license is required when attaching to a Terminal Server form ANY OTHER Workstation OS excluding Windows 2000 or Windows XP Professional. Licenses for Windows2000 and Windows XP Professional are already licensed for access to terminal Services. Licenses for these Workstations will be given out from a Pool of Built-In licenses on the License Server.

Citrix Metaframe Xpe Server Software with Subscription Advantage: This license is for the Citrix Metaframe software which increases the functionality and management of the Microsoft Terminal Server. The starter pack includes all needed software for Load Balancing and Management as well as 20 End User Licenses. Citrix licenses are concurrent connections to the Citrix Server rather than Per Server/Seat as Microsoft is. Subscription Advantage is a maintenance fee that includes Licenses for all current and future Feature Releases which are functionality add-onÆs to the Citrix product.

Logon and Licensing Process:
Windows 2000 Terminal Services requires a Domain Controller or member server to run a Service called Terminal Server License Service. The purpose of this Service is to issue Terminal Server CALÆs to all devices connecting to a Windows 2000 server running the Terminal Server Service. This license is assigned to a client device and stored in the registry on the client device. There is a HotFix that needs to be installed on the server running the License Service, which eliminates some of the issues with this. The following is a break down of the process of this service and itÆs functionality with the HotFix installed:

1. The Terminal Server License Service is started on a DC. The install can be found under Add/Remove programs of any Windows 2000 server.

2. All Terminal Server CALÆs that are purchased need to be added to this server and NOT directly installed on the Terminal Server running Citrix Metaframe.

3. Upon install, the licenses need to be activated through MicrosoftÆs Clearing House. This can be achieved through the Internet or by physically calling them on the phone.

4. There is a HotFix that needs to be installed on the server running the License Service, which eliminates some of the issues with this process (these will be discussed later in this document).

5. The first time a client attempts to connect to the Citrix Server from a non-Windows2000 or Windows XP Pro PC, they are assigned a temporary license ætokenÆ from the License Service. This ætokenÆ is stored on the ClientÆs PC in the registry located in HKLM\software\microsoft\mslicensing.).

6. The second time a client attempts to attach to the server, an attempt is made to upgrade the validated temporary license token to a full Terminal Server CAL. If no full CALÆs are available, the temporary CAL will continue to function for 90 days.

7. When the 90 days have elapsed, the client will again attempt to upgrade to a full TS CAL. If none are available, the connection will be rejected.

8. If a full license can be located, the license token takes the place of the temporary token in the clientÆs registry. An expiration has been added to each token that is issued. This expiration is set to a random number of days between 52-89 days of issuance. When a client connects to a terminal server, the date is checked. If the expiration is within 7 days, the terminal server connects to the License Server and renews the TS CAL token, giving it another expiration of 52-89 days. If the License Server is not available, the TS CAL token functions as normal, with the Terminal Server attempting to replace it at each login.

9. Any TS CAL token that has not been renewed is returned to the group of available license tokens upon expiration.

10. Any client that is connecting to a Citrix Farm from a PC running Windows 2000 Pro or Windows XP Pro do not need separately purchased TS CALÆs. When these clients connect, they are issued a token from License Server from a separate pool of æbuilt inÆ licenses that are reserved for clients connecting from an OS that is equal or higher than the OS running on the Terminal Server. This pool is inexhaustible.



Redundancy:
According to Microsoft, it is best to install and activate Terminal Server License service on two Domain Controllers in a environment that needs high availability. It is suggested that all License Tokens be installed on only 1 of the license servers. In the event that the Primary License Server were to be unavailable, unlicensed clients will still be able to connect with temporary license tokens from the other License Server.

How it Works for Non-Windows Clients:
Because non-Windows clients do not contain a registry, an alternative solution was developed:
When a non-Windows client connects to a MetaFrame session for the first time, the target MetaFrame server to which they connect requests a TS CAL from the license server. Then, instead of passing the TS CAL to the non-Windows client, the CAL is stored in that MetaFrame server's registry, beneath HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\MSLicensing\. Whenever the non-Windows client returns to that MetaFrame server, no license request is necessary because the license already exists in that MetaFrame server's registry.
If the same non-Windows client then connects to a second MetaFrame server in the same domain, the second MetaFrame server requests a CAL from the license server as before. However, because the license server has already issued a CAL for that client, the same CAL is re-issued to the second MetaFrame server. This scenario assumes that all MetaFrame servers share a single common Terminal Services Licensing server.
In both cases, the non-Windows ICA Client is not reached by the Terminal Services License server directly. The target MetaFrame server requests a TS CAL from the license server on the client's behalf and then retains a copy of the TS CAL for future use. Over time, all MetaFrame servers in a load-balanced farm will contain copies of the TS CALs for all non-Windows clients.

Components of Terminal Server Licensing:
1. TS CAL Token: the Terminal Services Client Access License token is issued to the physical device that is running the Terminal Services client software (in our caseàCitrix Metaframe Client).
2. Terminal Server: the Terminal Server is a Windows 2000 Server machine that has Terminal Services enabled in application server mode. The Terminal Server provides multiple clients with access to Windows based applications running on the server. The Terminal Server validates a client machineÆs license token. If the client does not have a license token, the terminal server requests one for the client from the license server.
3. License Server: the Terminal Services license server is a windows 2000 server machine that has the TSL components installed. This machine tracks and deploys client license tokens. One license server can serve multiple terminal servers concurrently.
4. Microsoft Clearinghouse: the Microsoft Clearinghouse is a database that Microsoft maintains to issue digital certificates for securely installing license tokens. It also issues license key packs to Terminal Services license server that requests them.