Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
How To Set up Per User CALs on a Terminal Server through Windows 2003 Server
Terminal Server 2003
What you need:
At least 1 Windows 2003 server, though at least 2 is suggested, one being License server, and one being the Terminal Server.
1. Install License server on a WIndows 2003 Server (This can be the same server you are using for TS).
Note: A Windows 2000 Server can be used for the licensing manager only if you have Per Device CALs,
INSTEAD of Per User, NOT Mixed.
Note: Although you can have a mixture of Device and User CALS, you cannot run both from the same server
at the same time.
Note: (added by mlichstein) he suggests the following: If you have 2003 Terminal servers, you MUST have a
2003 licensing server, regardless of the type of licenses.
It is my understanding, after conversations with MS that this is not the case, and that if you have
ONLY Per Device CALs, then you can use a Windows 2000 Server. It is only if you have User CALs that
you MUST use Windows 2003. For this reason, MS suggest you don't use Windows 2000 if you have
Windows 2003 Terminal Servers.
2. Call Microsoft to activate your License Server, AND your CALs.
Note: Apparently this can be done over the internet, but that's not how I did it!
Also, (added by ChicagoTechNet) you can auto-activate licences.
3. Change the configuration of the Terminal Server to use Per User, rather than the default Per Device.
Note: To do this, click Start -> (All programs ->
Administrative Tools -> Terminal Service Configuration.
Then click on Server Settings and change the Licencing value to "Per User".
Note: IMPORTANT! If you install TS with Per User CALs, because the default is Per Device, you HAVE TO
change to Per User, or 120 days later you will have problems. (added by ChicagoTechNet)
4. If users still can't get in, and get "You do not have permission to access this session", or something similar,
then you need to do 2 things:
a) Make sure the local security policy on the Terminal Server reflects that the required users have
"Allow Log On Locally" rights, and "Allow log on through Terminal Services" rights.
Note: When you open Local Security Policy under Administrative Tools, these two are found in
Local Policies -> User Rights Assignment
b) If still can't log in, then likely the server has trouble locating itself as licensing server, or the licensing server
is hard to reach.
In this case, follow the directions here: http://support.microsoft.com/?kbid=279561
Note: The final Key (looks like a folder), which would be your server's name should contain NO data values,
except (Default).
5. If still no joy... well, youneed to call MS because youmust have done something wrong!
Some important points:
1. You only need current Windows Server 2003 license for Terminal Server, and not a separate license.
You do need CALs for all active connections to the server. These are of two types:
a) Per Device: This is the default configuration, and is the type of licnese that is temporary for 120 days
when TS is first installed. These licenses allow a machine to connect to the server, and ANYONE using
that machine can legally access the TS under its license, but a user using that machine cannot then go
to their machine and access the TS under the same license! If they do this a new Per Device license will
be issued if one is available.
b) Per User: This (as described above) is not default, but means that once a user logs onto the TS, that
same user account in AD can access the TS from ANY machine connected to the network, and this
includes a terminal session via a link through some hotel on the other side of the world, if need be!
2. This is diferent than Windows 2000 which only has one type of CAL, which is equivalent to Per Device.
3. IMPORTANT! Although Windows 2000 Pro and Windows XP Pro are allowed access to Windows 2000
Terminal Server WITHOUT buying a new CAL (or at least that was the case for a while), Windows 2003
Server - Terminal Services does not allow this. CALs must be purchased for each User, or Device.
4. If the server is in Per User mode as described above, then any Per Device temporary licences listed as
issued in TS Licensing Manager will be ignored. But, even though users will be able to log on using the
Per User CALs, these will not show as issued in the Licensing Manager. This is a "bug" of sorts, that will
(apparently) be remedied by Microsoft at a later date. Essentially it is because User CALs are not currently
supported (managed) by the License Manager software! ALthough Per Device CALs are supported.
5. For more info, see this site: http://support.microsoft.com/?kbid=822134
(added by mlichstein) useful link if you have time to read it (instead of this quick FAQ):
http://www.microsoft.com/windowsserver2003/techinfo/overview/termservlic.mspx
More info, from the official MS TS site:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/serverroles/terminalserver/default.asp
Another good link (12/11/04 UK Date): http://www.wown.com/articles_tutorials/Windows_2003_Terminal_Services_Part1.html
Hope this all helps,
Will
![[borg2]](/data/assets/smilies/borg2.gif "[borg2] [borg2]")
![[borg]](/data/assets/smilies/borg.gif "[borg] [borg]")
resistance is futile!
- B Gates
At least 1 Windows 2003 server, though at least 2 is suggested, one being License server, and one being the Terminal Server.
1. Install License server on a WIndows 2003 Server (This can be the same server you are using for TS).
Note: A Windows 2000 Server can be used for the licensing manager only if you have Per Device CALs,
INSTEAD of Per User, NOT Mixed.
Note: Although you can have a mixture of Device and User CALS, you cannot run both from the same server
at the same time.
Note: (added by mlichstein) he suggests the following: If you have 2003 Terminal servers, you MUST have a
2003 licensing server, regardless of the type of licenses.
It is my understanding, after conversations with MS that this is not the case, and that if you have
ONLY Per Device CALs, then you can use a Windows 2000 Server. It is only if you have User CALs that
you MUST use Windows 2003. For this reason, MS suggest you don't use Windows 2000 if you have
Windows 2003 Terminal Servers.
2. Call Microsoft to activate your License Server, AND your CALs.
Note: Apparently this can be done over the internet, but that's not how I did it!
Also, (added by ChicagoTechNet) you can auto-activate licences.
3. Change the configuration of the Terminal Server to use Per User, rather than the default Per Device.
Note: To do this, click Start -> (All programs ->
Administrative Tools -> Terminal Service Configuration.Then click on Server Settings and change the Licencing value to "Per User".
Note: IMPORTANT! If you install TS with Per User CALs, because the default is Per Device, you HAVE TO
change to Per User, or 120 days later you will have problems. (added by ChicagoTechNet)
4. If users still can't get in, and get "You do not have permission to access this session", or something similar,
then you need to do 2 things:
a) Make sure the local security policy on the Terminal Server reflects that the required users have
"Allow Log On Locally" rights, and "Allow log on through Terminal Services" rights.
Note: When you open Local Security Policy under Administrative Tools, these two are found in
Local Policies -> User Rights Assignment
b) If still can't log in, then likely the server has trouble locating itself as licensing server, or the licensing server
is hard to reach.
In this case, follow the directions here: http://support.microsoft.com/?kbid=279561
Note: The final Key (looks like a folder), which would be your server's name should contain NO data values,
except (Default).
5. If still no joy... well, youneed to call MS because youmust have done something wrong!
Some important points:
1. You only need current Windows Server 2003 license for Terminal Server, and not a separate license.
You do need CALs for all active connections to the server. These are of two types:
a) Per Device: This is the default configuration, and is the type of licnese that is temporary for 120 days
when TS is first installed. These licenses allow a machine to connect to the server, and ANYONE using
that machine can legally access the TS under its license, but a user using that machine cannot then go
to their machine and access the TS under the same license! If they do this a new Per Device license will
be issued if one is available.
b) Per User: This (as described above) is not default, but means that once a user logs onto the TS, that
same user account in AD can access the TS from ANY machine connected to the network, and this
includes a terminal session via a link through some hotel on the other side of the world, if need be!
2. This is diferent than Windows 2000 which only has one type of CAL, which is equivalent to Per Device.
3. IMPORTANT! Although Windows 2000 Pro and Windows XP Pro are allowed access to Windows 2000
Terminal Server WITHOUT buying a new CAL (or at least that was the case for a while), Windows 2003
Server - Terminal Services does not allow this. CALs must be purchased for each User, or Device.
4. If the server is in Per User mode as described above, then any Per Device temporary licences listed as
issued in TS Licensing Manager will be ignored. But, even though users will be able to log on using the
Per User CALs, these will not show as issued in the Licensing Manager. This is a "bug" of sorts, that will
(apparently) be remedied by Microsoft at a later date. Essentially it is because User CALs are not currently
supported (managed) by the License Manager software! ALthough Per Device CALs are supported.
5. For more info, see this site: http://support.microsoft.com/?kbid=822134
(added by mlichstein) useful link if you have time to read it (instead of this quick FAQ):
http://www.microsoft.com/windowsserver2003/techinfo/overview/termservlic.mspx
More info, from the official MS TS site:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/serverroles/terminalserver/default.asp
Another good link (12/11/04 UK Date): http://www.wown.com/articles_tutorials/Windows_2003_Terminal_Services_Part1.html
Hope this all helps,
Will
resistance is futile!
- B Gates