Terminal Server License Service Discovery – Part 1: This Discovery Process


If you would like to be notified when Michael Burke releases Terminal Server License Service Discovery – Part 2, please sign up to our Real time article update newsletter.


This article details the License Server discovery process used by Terminal Servers to locate license servers on the network. Part 1 covers the details of the discovery process, while part 2 will delve into troubleshooting and best practices.


As a main component in any Terminal Server deployments, the license server plays a crucial role in allocating and managing client access license tokens. Therefore, it is important to understand how terminal servers locate the license servers in your organization, how to manipulate the process and what to do when things go awry.



Choosing a Role


Windows Server 2003 allows the license server to be installed on any server in the enterprise. The Terminal Services License Service is installed using Add/Remove Programs in Control Panel. 



Note:
Windows 2000 required that the license server be installed on an Active Directory domain controller; however beginning with Windows Server 2003, this no longer applies and the license server can be installed on any Windows Server 2003 server. 


As part of the installation, you must select a license server role. Figure 1 shows the role selection dialog. You will notice that the text states “Make this license server available to”; however this can be misleading. It is a common misconception that the license server role determines the boundaries of which terminal servers can leverage the license server to allocate CALs to clients. On the contrary, the role simply determines how and when the license server is discovered by terminal servers.



Figure 1: License Service Installation


When the Enterprise mode is selected, the installation writes an entry into Active Directory in the following location:


LDAP://CN=TS-Enterprise-License-Server,CN=<sitename>,CN=sites,CN=configuration, DC=<domainname>,DC=com



Note:
In order for this entry to be successful, the administrator installing the service must have the appropriate rights in Active Directory to create the entry.


There are only two different role choices in the installation wizard – Domain/Workgroup and Enterprise; a registry key value identifies the distinction. However there are three license server role classifications. The differences are listed below:



  • Workgroup License Server – When a terminal server that is not a member of an Active Directory domain discovers a license server, it is discovered as a Workgroup License Server.
  • Domain License Server – When a terminal server discovers a license server by direct RPC communication, it is identified as a Domain License Server.
  • Enterprise License Server – When a terminal server discovers a license server by performing an LDAP query to Active Directory, it is identified as an Enterprise License Server.

Generally speaking, Domain/Workgroup role license servers will only be discovered automatically if the service is installed on a domain controller. However, Enterprise mode license servers are usually automatically discovered.



The Discovery Process


When a terminal server comes online, it attempts to discover a license server from which to obtain Terminal Services license tokens for clients, and will continue to do so until it has located one. After a license server has been located, the discovery process will not run again until all of the cached license servers in the terminal server’s registry are unavailable.


The discovery process typically runs as a result of one of the following events:



  • The terminal server service starts and has not yet discovered any license servers
  • A terminal server can no longer contact any known license servers during the polling interval
  • A client logs on and the terminal server is unable to contact any license servers

How it attempts to discover the license server depends on the domain membership status of the terminal server. For terminal servers that are in a workgroup, or in a non-Active Directory-based domain, such as a Windows NT, the discovery process is substantially different than if the terminal server is a member of an Active Directory domain; in either case the discovery process runs through the following broad steps:



  1. Discovery is performed to locate a license server.
  2. Once found, the license server is cached in the terminal server’s registry for future reference in one of the following locations depending on the mode of the license server that was discovered:













License Server Role


Registry Cache Location


Enterprise Role


HKLM\Software\Microsoft\MSLicensing\Parameters\ DomainLicenseServerMulti


Domain/Workgroup Role


HKLM\Software\Microsoft\MSLicensing\Parameters\ EnterpriseLicenseServerMulti


It also obtains a set of digital certificates from the license server in order to check CALs allocated to clients from this license server.



  1. Once the license server is discovered, the terminal server periodically checks to be sure it can still contact it.
  2. If at any time the terminal server attempts to contact a license server and none are available, the discovery process begins again.

Workgroup and Non-Active Directory Discovery


This method of discovery is performed when the terminal server is a member of a workgroup, or is a member of a non-Active Directory domain, such as a Windows NT domain.


When the discovery process begins, the terminal server will first check its LicenseServers registry key. The location of this key varies based on the operating system version; table 1 lists the locations of the LicenseServers keys for both Windows 2000 and Windows 2003.














OS Version


Location of LicenseServers key


Windows Server 2003


HKLM\System\CurrentControlSet\Services\TermService\Parameters \LicenseServers


Windows 2000 Server


HKLM\System\CurrentControlSet\Services\TermService\Parameters

Table 1: LicenseServers registry key locations


For each entry in this key, it will attempt to connect via Windows RPC (remote procedure call). If a license server responds, the server is cached in the registry and the discovery process is terminated.


If the LicenseServers key is empty, or no license servers can be contacted, the next action is to perform a NetBIOS broadcast on the terminal server’s local subnet to see if any license servers respond. If so, an RPC connection is opened to the server and the license server is added to the registry. If no license servers respond to the broadcast, the discovery process sleeps for 15 minutes and begins again.


If at any point in the discovery process a license server is discovered, the license server is added to the registry and is checked every 120 minutes. If all known license servers are no longer reachable, then the discovery process is initiated again. Figure 2 details this 2-step process in flowchart form. 



Figure 2: Workgroup/Non-Active Directory Discovery (Click for larger image)


Active Directory Membership Discovery


If the terminal server is a member of an Active Directory domain, the discovery process is quite different. Just as with the workgroup model, it first checks the LicenseServers registry key for any entries, and then attempts to connect to each entry via RPC. If any are found, they are cached in the registry on the terminal server and the discovery process ends.


If no license servers were found, the terminal server will perform an LDAP query to Active Directory in an attempt to locate an enterprise license server. The server queries the following object:


LDAP://CN=TS-Enterprise-License-Server,CN=<sitename>,CN=sites,CN=configuration, DC=<domainname>,DC=com


If an entry is found, it attempts an RPC connection to the license server. If successful, it adds the license server(s) to the registry and the discovery process continues to see if it can locate any domain license servers. 


The terminal server will then attempt to connect via RPC to each domain controller in its own site to locate a license server, and if unsuccessful, it will move on to check each domain controller in the domain. Connectivity to any discovered license servers is checked every 60 minutes. Any discovered license servers are added to the terminal server’s registry cache.


If no license servers are discovered, then the process sleeps for 60 minutes and begins again. Once a license server has been discovered, if at any point no known license servers are reachable the discovery process is initiated again. Figure 3 details this 3-step process in flowchart form.



Figure 3: Active Directory Discovery (Click for larger image)


Once you have read through the processes above, you will get a better understanding of how the process works and how to manipulate it to your advantage. In part 2 of this article, we will get into how to better control the discoverability of your license servers and how to troubleshoot the process when things aren’t working.


If you would like to be notified when Michael Burke releases Terminal Server License Service Discovery – Part 2, please sign up to our Real time article update newsletter.

About The Author

Leave a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top