If you would like to be notified when Michael Burke releases Terminal Services CAL Allocation Process (Part 1) please sign up to our Real time article update newsletter.
In this two-part article, readers will get a step-by-step look at the Terminal Services CAL allocation process in a Windows Server 2003 Terminal Server environment, the components involved and the difference in the CALs. Part one will focus on some background information, including the various CAL types and licensing modes of Terminal Servers. Part two will build on this information and include step-by-step walkthroughs of various scenarios, including detailed flowcharts of the process.
Overview
The basic architecture of a Terminal Server environment includes three components – a Terminal Server, a Terminal Services License server, and a client. The architecture and relationship of these components is diagramed below (figure 1):
Figure 1
The Terminal Server is responsible to the allocation process itself, not the license server. The license server is simply a repository to hold and track Terminal Services CAL usage. License servers are activated using the Microsoft Clearinghouse, which is an entity, maintained by Microsoft for the purpose of activating and/or deactivating license servers, as well as issuing Terminal Server CAL packs.
Licensing Modes
Beginning with Windows Server 2003, there are two different licensing modes for Terminal Server – Per-User and Per-Device. The licensing mode that is configured for a particular Terminal Server determines which type of license is required for a client to establish (either functionally or legally) a session on that Terminal Server. A Terminal Server can only be in one mode at any given time and therefore can only accept connections using one type of license. Per-User mode CALs only apply to clients connecting to Terminal Server that are in Per-User mode, and likewise, Per-Device CALs only apply to Terminal Servers in Per-Device mode.
The Per-User mode option was added just prior to the release of Windows Server 2003, so Microsoft had no time to fully implement the licensing model as they had no existing way to attach a Terminal Server CAL to a user account. Because of this, Per-User CALs are not tracked in the licensing database and are never actually “issued”. This is also the reason why we have a choice of licensing modes for a Terminal Server – choosing per-user licensing mode actually alters the CAL allocation process, turning off most of the functionality. The Terminal Server only checks to see if it can locate a license server and then simply accepts the connection. It does not actually check to see if any Per-User CALs are installed on the license server since those functions have been shut off.
Licensing Grace Period
Every Terminal Server that comes up on the network automatically enters its licensing grace period the first time a client connects. This grace period lasts 120 days and allows the Terminal Server to accept connections without having a license server on the network. The grace period ends after 120 days or once the Terminal Server locates a license server, whichever comes first. Once out of the grace period, in most cases the Terminal Server must be able to contact a license server to accept new connections.
Terminal Server CAL Types
Windows Server 2003 license servers can handle allocating CALs to both Windows 2000 and 2003 Terminal Servers. The Windows Server 2003 family of TS CALs involves the following:
- Temporary Terminal Server CAL
- Temporary Terminal Server CAL
- Windows Server 2003 Device TS CAL
- Windows Server 2003 External TS Connector
Temporary Terminal Server CAL
Temporary CALs are issued to a client the first time they connect to a Terminal Server and are valid for 90 days. Once the CAL has been issued to the client and the client has successfully logged on, the Terminal Server will attempt to upgrade the Temporary CAL to a permanent (Full) CAL on each subsequent connection attempt. If no full CALs are available for upgrade, then the client can continue to connect until the Temporary CAL expires.
A license server can issue Temporary CAL regardless of whether the license server has been activated or not. In addition, Temporary CALs are generated by the license server itself so there is no limit to the number of Temporary CALs a license server can issue. However, once a client has received a Temporary CAL, it can never receive another one, and once it expires, a Full CAL must be available for the client to connect.
Windows Server 2003 User TS CAL
Beginning with Windows Server 2003, Microsoft introduced a Per-User licensing model for connecting to Windows 2003 Terminal Servers, where the license is tied to the user as opposed to the device. However, it is important to distinguish that this is not a concurrent user model – each user is licensed individually and exclusively.
This licensing model was added just prior to the release of Windows Server 2003, so Microsoft had no time to fully implement the licensing model as they had no existing way to attach a Terminal Server CAL to a user account. Because of this, Per-User CALs are not tracked in the licensing database and are never actually “issued”. This is also the reason why we have a choice of licensing modes for a Terminal Server. This functionality will be “fixed” in Longhorn Server, due out in 2007. For more information on this, see Microsoft KB article 822134.
Windows Server 2003 Device TS CAL
Per-Device CALs are issued to devices that connect to a Terminal Server and are valid for connecting to either Windows 2000 or 2003 Terminal Servers. Each device must be licensed in the environment as this is not a concurrent connection license. When the license server issues the CAL, a random expiration date is generated for the CAL, which expires between 52-89 days from the date issued. The limit of 89 days is key to the license recovery process. When the CAL expiration gets down to 7 days or less, the license server will attempt to contact the issuing license server to renew the CAL each time the client connects.
Windows Server 2003 External TS Connector
The External TS Connector license is for special-use cases, such as an ASP environment, and licenses a Terminal Server for unlimited connections from external, non-employee users. Similarly to the Per-User CAL, there is no tracking mechanism for this license; therefore the Terminal Server must be placed in Per-User mode to allow the use of this license. Furthermore, under the EULA, the Terminal Server must be dedicated to external connections only and cannot service connections from internal users. Due to the cost of this license, it is not particularly popular as it must be licensed for each Terminal Server.
License Recovery Process
Once a device has been issued a CAL, that device owns that CAL until it expires. Even if that device will never reconnect to the Terminal Server before the CAL expires, there is no way to manually recover the CAL. License recovery is handled inherently by the expiration of CALs. Device CALs are valid for a maximum of 89 days; however temporary CALs are valid for 90 days. The license server runs a process every 24 hours to recover CALs that have expired and place them back into the pool.
Let’s assume there are 20 Per-Device CALs installed on the license server. Device #20 logs on and obtains the last Full CAL in the pool, and the license server issues the CAL with an expiration of 89 days. Later that day, this machine crashes and is never recovered. A replacement machine is brought onto the network and connects to the Terminal Server. The license server will issue a Temporary CAL to the client the first time it connects and all is well.
The next morning, the client reconnects to the Terminal Server. Because no available Full CALs exist in the pool, the client is still permitted to connect because the Temporary CAL does not expire for another 89 days. However, the Full CAL issued to the machine that crashed expires in 88 days. This one day of separation is key to making this process work.
On the 89th day, the Full CAL expires and later that evening, is returned to the pool by the CAL recovery process. On the 90th day, the Temporary CAL is due to expire, but can now be upgraded because the Full CAL has been returned to the pool. The client now receives the Full CAL, complete with a new expiration date.
Putting it Together in Part Two
Part one focused primarily on understanding the different CALs involved in a Terminal Server environment, the different modes for Terminal Servers and differences of each. In part two, we will walk though several different allocation scenarios and take an in-depth look at the steps involved, including a detailed flowchart of the entire process.
If you would like to be notified when Michael Burke releases Terminal Services CAL Allocation Process (Part 1) please sign up to our Real time article update newsletter.
