How to troubleshoot Microsoft RDS licensing issues

Case



You are facing a Microsoft Remote Desktop Services (RDS) licensing issue and your RDS users do not get an RDS Client Access License (CAL) allocated. This article provides guidance on how to troubleshoot Microsoft RDS licensing issues. This guidance applies both to on-premises Remote Desktop Services (RDS) installations as well as to Azure Virtual Desktop (AVD).



Solution



You have two MMC-based management consoles to assist you in RDS licensing related issues. The RD licensing manager console is the first.





The RD licensing diagnoser console is the second.





To troubleshoot Microsoft RDS licensing issues, carry out the following steps.



- It is a good idea to review the following article (https://stefanos.cloud/blog/microsoft-rds-licensing-demystified/) to familiarize yourself with the requirements and limitations of using the Microsoft RDS licensing server and better understand the concepts and components involved.

- As always, check the Windows logs related to the RDS licensing server. Access Application and Services LogsWindowsTerminalServices-LicensingOperational. For a list of common event log IDs refer to the following article: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff404145v=ws.10#remote-desktop-licensing. For a list of common RDS licensing issues and resolutions, refer to the following article: https://docs.microsoft.com/en-us/troubleshoot/windows-server/remote/troubleshoot-rds-licensing-guidance#common-issues-and-solutions.

- Always check the health status of your RDS license server. First off, the RDS license server should be activated. Secondly, you should have purchased the minimum required number of RDS licenses (per-user, per-device or VDI) which are needed by your users and devices. When purchasing RDS CALs, check your operating system version for TS/RDS CAL interoperability, as per the following article: https://social.technet.microsoft.com/wiki/contents/articles/14988.rds-and-ts-cal-interoperability-matrix.aspx. Thirdly, ensure that you have configured either a local GPO or domain GPO to setup the licensing server location and the RDS CAL type to use. These GPO policies are available in the following GPO path:- Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Licensing- Use the specified Remote Desktop license servers.

- Set the Remote Desktop licensing mode.

- Make sure that the licensing server is added to the "Terminal Server License Servers" domain group.

- Always check if your RDS servers are in a domain or workgroup. Workgroup only supports per-device CALs. If you need to convert existing RDS per-device or per-user CALs, follow instructions in the following article: https://stefanos.cloud/kb/how-to-convert-rds-per-user-to-rds-per-device-cals/.

- Check the required RDS licensing ports to be open from the user workstations to the RDS license server. The port in charge of communicating between the licensing manager and the session host is the following:- TCP 135 - RPC for License Server communication and RDSH.

- TCP 1024-65535 (randomly allocated) Used for RPC For Windows Server pre-2008.

- TCP 49152 - 65535 (randomly allocated) - This is the range in Windows Server 2012, Windows Server 2008 R2, Windows Server 2008.

- TCP 445 - SMB

- TCP 443: Communication over the internet to the Microsoft Clearing House.

- TCP 5985: WMI and PowerShell Remoting for administration.

- TCP 139 - NetBIOS session service

- You can also use the Test-NetConnection Powershell cmdlet to test connectivity on individual port and endpoint.

- Check whether your RDS license server is still under the grace period or not. If the grace period has ended, you may need to reset the RDS grace period. To do that, open an elevated regedit session and navigate to registry key Computer-->HKEY_LOCAL_MACHINE-->SYSTEM-->CurrentControlSet-->Control-->Terminal Server-->RCM-->GracePeriod. Take a backup of this key first (registry export command). Then delete the "Timebomb" registry entry and reboot the server.



- Rebuild the RDS license server database.

References



https://docs.microsoft.com/en-us/troubleshoot/windows-server/remote/troubleshoot-rds-licensing-guidance



https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/hh553162(v=ws.10)



RDS licensing demystified


https://stefanos.cloud/kb/how-to-troubleshoot-microsoft-rds-licensing-issues/

Comments

Post a Comment

Popular posts from this blog

Acronis Cyber Protect 15 virtual machine backup not working when using shared mode virtual disks vhds

Image
Case When you apply and run an Acronis Cyber Protect backup against a virtual machine which is part of a guest cluster which makes use of virtual disk shared files of type .vhds (VHD Set), you run across the following error. Activity succeeded with warnings. Activity 'Preparing for backup of virtual machine' succeeded with the following warning 'Windows error: (0xC05CFF0A). The requested operation cannot be performed on the virtual disk as it is currently used in shared mode. Or the error may state something along the lines of: "Failed to open virtual disk file '.vhds'. Unknown format of the virtual disk." The same error as above can occur in virtual machine backup of virtual machines which include a .vdhx shared disk. Solution The above error is by design when you are attempting a virtual machine backup to virtual machine which does not have an Acronis backup agent installed, as per https://kb.acronis.com/content/68573 . According to Acronis, as of July 2
Read more

How to perform hardware health checks in Windows

Image
Case You need to perform an overall hardware health check in a Windows machine, running either a Windows client or a Windows Server operating system. This article provides guidance on the steps to carry out to perform hardware health checks in Windows. Solution Carry out the steps below. - Thoroughly check all Windows event logs (Application, System, Security) for any warnings or errors which may be related to issues you are experiencing with your Windows machine. - Check the device management mmc console by running devmgmt.msc. Ensure that you choose to show all hidden devices from the View menu. If you notice any exclamation marks next to any device, you will need to re-install its driver from the respective manufacturer to ensure that there afterwards no warnings in the device management console. - Check the health of all your disks , either HDD or SSD. Follow instructions in the following KB article for steps to follow to check your disk health: https://stefanos.cloud/kb/how-to-ch
Read more

How to resolve Group Policy error codes 8007071a and 800706ba

Image
Case You are running "Group Policy Update" on an OU inside the Group Policy Management Console in Active Directory but you are receiving RPC errors from your servers or domain-joined workstations, as shown in the example below. After a Group Policy Update, you come across Group Policy error codes 8007071a and 800706ba. This means that the local Windows Firewall is not configured properly to allow Group Policy (GPO) traffic. GPO traffic an be either remote GPO update or remote GP Resultant Set of Policy (RSOP) operations. Solution Option 1 Run gpedit.msc and create a new local group policy object which implements the following policies under Local Computer Policy --> Computer Configuration --> Windows Settings --> Security Settings --> Windows Defender Firewall --> Inbound Rules : The full configuration is shown below. After the above local group policies are configured on each domain server and workstation, you can start applying group policy objects to the dom
Read more