Remote Desktop client access license

In this article, we’ll consider the installation, configuration, and activation of the Remote Desktop Licensing role on Windows Server 2019 and 2016, as well as the installation and activation of the RDS client access licenses (CALs).

I remind you that after the installation of the Remote Desktop Session Host role, users can use it only for 120 days of a trial period (evaluation license), and users can’t connect to an RDS host afterward. According to Microsoft licensing rules, all users or devices that use RDS features must be licensed. To register and issue Remote Desktop Client Access Licenses (RDS CALs), there is a separate Windows service in the RDS role called Remote Desktop License Server.

Install the Remote Desktop Licensing Role on Windows Server 2019/2016

You can deploy the Remote Desktop License service on any domain server. It is not necessary to install it on one of the servers on the RDSH farm.

Before you start the installation, add a new server to the Terminal Server License Servers domain security group (or make sure you have the permission to change this group membership), otherwise, the server won’t be able to issue RDS Per User CAL to the domain users.

You can install Remote Desktop Licensing using Server Manager. To do it, select the Remote Desktop Services role in the Add Roles and Features Wizard.

Select Remote Desktop Licensing as the role service.

It remains to wait until the installation of the role is completed.

The RDS-Licensing service is managed using the Remote Desktop Licensing Manager console (licmgr.exe).

In Windows Server, it’s easier to install roles and features using PowerShell. To install the RDS Licensing Service and RD Licensing Diagnoser, just run one command:

Install-WindowsFeature RDS-Licensing –IncludeAllSubFeature -IncludeManagementTools

To list the RDS services installed on the host, use the command:

Get-WindowsFeature -Name RDS* | Where installed

Activating the RDS License Server on Windows Server

In order to issue licenses to RDP clients, your RDS License Server must be activated. To do it, open the Remote Desktop Licensing Manager (licmgr.exe), right-click the name of your server, and select Activate Server.

The RDS licensing server activation wizard will start. Here you will need to select the activation method you prefer. If your server is connected to the Internet, it can automatically connect to Microsoft servers and activate the RDS license server. If there is no direct Internet access from the server, you can activate the server using a web browser or by phone.

Then you must fill in some information about your company (some of the fields are required).

It remains to click the Finish button.

If you right-click the server name in the console and select Review Configuration, you can verify that the RDS License Server is activated and can be used to activate RDSH clients in your domain.

• This license server is a member of the Terminal Server License Servers group in Active Directory. This license server will be able to issue RDS Per User CALs to users in the domain, and you will be able to track the usage of RDS Per User CALs.
• This license server is registered as a service connection point (SCP) in Active Directory Domain Services.

RDS CALs: Types of Remote Desktop Client Access Licenses

Each user or device that connects to Remote Desktop Session hosts must have a client access license (CAL). There are two types of RDS CALs:

• Per-Device CAL – is the permanent license type assigned to a computer (device) that connects to the RDS server more than once (when a device is first connected, a temporary license is issued to it). These licenses are not concurrent, i.e., if you have 10 Per Device licenses, only 10 hosts can connect to your RDS server. The current OVL RDS CAL is called: WinRmtDsktpSrvcsCAL 2019 SNGL OLV NL Each AP DvcCAL;
• Per-User CAL – is the type of license that allows a user to connect to the RDS server from any number of computers/devices. This type of license is associated with an Active Directory user and issued not permanently, but for a specific period of time. The license is issued for a period of 52 to 89 days (random number).  The current Open Value license of this type is called WinRmtDsktpSrvcsCAL 2019 SNGL OLV NL Each AP UsrCAL.   

.

Note. We should note that the 2016 RDS CAL may be installed only on a licensing server running Windows Server 2016 or 2019. Installing RDS CALs to the previous Windows Server versions is not supported. Those, you cannot install 2016 RDS CALs on a Windows Server 2012 R2 licensing host.

When trying to add new RDS CALs 2019 on Windows Server 2016, an error will appear:

Installing RDS CALs on Windows Server 2019/2016

Now you must install the pack of Remote Desktop client licenses (RDS CAL) you have purchased on the License Server.

Right-click your server in Remote Desktop Licensing Manager and select Install Licenses.

Select the activation method (automatic, online, or by phone) and the license program (in our case, it is Enterprise Agreement).

Many enterprise agreement numbers for RDS have already been leaked on the Internet. I think it won’t be a problem to find the numbers (4965437), you don’t even need to look for rds cracks or activators.

The next steps of the wizard depend on which license program you have selected. In the case of an Enterprise Agreement, you must specify its number. If you have chosen License Pack (Retail Purchase), enter the 25-character product key you got from Microsoft or a partner.

Specify the product version (Windows Server 2019/2016), license type (RDS Per user CAL), and the number of licenses to be installed on the server.

After that, the server can issue licenses (RDS CAL) to clients.

You can convert RDS User CALs to Device CALs (and vice versa) using the Convert Licenses menu item in the RD Licensing Manager console.

If you have run out of free RDS licenses, you can revoke previously issued RDS Device CALs for inactive computers using the following PowerShell script:

$RevokedPCName=”lon-bc1-123” $licensepacks = Get-WmiObject win32_tslicensekeypack | where {($_.keypacktype -ne 0) -and ($_.keypacktype -ne 4) -and ($_.keypacktype -ne 6)} $licensepacks.TotalLicenses $TSLicensesAssigned = gwmi win32_tsissuedlicense | where {$_.licensestatus -eq 2} $RevokePC = $TSLicensesAssigned | ? sIssuedToComputer -EQ $RevokedPCName

$RevokePC.Revoke()

RDS CAL Usage Reports

In the RDS License Console, you can generate a license usage report. To do this, select Create Report -> CAL Usage from the server context menu.

However, I prefer to use PowerShell to report RDS CAL usage. The following script will show the remaining number of licenses in all RDS CAL packs:

Import-Module RemoteDesktopServices -ErrorAction Stop Set-Location -Path 'rds:' -ErrorAction Stop $licenses = (Get-Item -Path RDS:\LicenseServer\LicenseKeyPacks\* | Where-Object Name -Like "-Per User-*").Name $total=0; $issued=0; foreach ($license in $licenses) { $count=(Get-Item -Path RDS:\LicenseServer\LicenseKeyPacks\$license\TotalLicenses).CurrentValue $total= $total + $count $count2=(Get-Item -Path RDS:\LicenseServer\LicenseKeyPacks\$license\IssuedLicensesCount).CurrentValue $issued= $issued + $count2 } $available = $total - $issued

Write-Host "Total Licenses available: $available"

You can run this PowerShell script via Zabbix and set an alert if the remaining number of licenses is less, for example, 5.

The following Powershell script will allow you to generate a Per User CAL Report:

Import-Module RemoteDesktopServices -ErrorAction Stop Set-Location -Path 'rds:' -ErrorAction Stop $path = “C:\Reports\RDS_CAL_Usage.csv” $fileName = (Invoke-WmiMethod Win32_TSLicenseReport -Name GenerateReportEx).FileName $fileEntries = (Get-WmiObject Win32_TSLicenseReport | Where-Object FileName -eq $fileName).FetchReportEntries(0,0).ReportEntries $objArray = @() foreach($entry in $fileEntries){ $objArray += $entry | select User, ProductVersion, CALType, ExpirationDate $objArray[-1].User = $objArray[-1].User.Split('\') | select -Last 1 $time = $objArray[-1].ExpirationDate.Split('.') | select -first 1 $objArray[-1].ExpirationDate = [datetime]::ParseExact($time, "yyyyMMddHHmmss", $null) }

$objArray | Export-Csv -Path $path -Delimiter ',' -NoTypeInformation

How to Remove RDS CALs from an RD License Server?

If you want to move your RDS CAL license packs from one Remote Desktop licensing server to another, you can remove the installed RDS CAL license pack from the licensing server using PowerShell.

Using the following cmdlet, you can list all the installed RDS CAL packs on the server:

Get-WmiObject Win32_TSLicenseKeyPack|select-object KeyPackId,ProductVersion,TypeAndModel,AvailableLicenses,IssuedLicenses |ft

Find the KeyPackId value for the RDS CAL package that you want to remove and run the command:

wmic /namespace:\\root\CIMV2 PATH Win32_TSLicenseKeyPack CALL UninstallLicenseKeyPackWithId yourKeyPackId

You can also completely remove all CALs by re-creating the RDS license database. To do this, stop the Remote Desktop Licensing service:

Stop-Service TermServLicensing

Rename the file C:\Windows\System32\lserver\TLSLic.edb to C:\Windows\System32\lserver\TLSLic.edb_bak and start the service:

Start-Service TermServLicensing

After that, all RDS CAL licenses will be removed, and you must reactivate them.

Configuring RDS Licenses on RD Session Hosts

After the RDS License Server is activated and being run, you can reconfigure RD Session Host to obtain CAL licenses from this server. You can set the license type and specify the name of the license server from the Server Manager GUI, using PowerShell, or Group Policy.

To change the name/address of the licensing server on the RDS host, open Server Manager -> Remote Desktop Services -> Collections. In the upper right menu “Tasks” select “Edit Deployment Properties”.

In the deployment properties, go to the RD Licensing tab, select the Remote Desktop licensing mode, and set the RDS license server. Click Add -> Ok.

You can change the RDS license server address and CAL type using PowerShell:

$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting

Then specify the license type you need:

$obj.ChangeMode(4)

Then specify the name of the RDS License Server:

$obj.SetSpecifiedLicenseServerList("rdslic2016.woshub.com")

And check the current settings:

$obj.GetSpecifiedLicenseServerList()

If you want to assign the RDS licensing server parameters via Group Policy, you need to create a new GPO and link it to the OU with RDS servers (or you can specify the name of the RDS licensing server using the Local Group Policy Editor – gpedit.msc). The RD licensing settings are located under the following GPO section: Computer Configuration -> Policies -> Admin Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Licensing.

There are two Remote Desktop settings that we need to configure:

• Use the specified Remote Desktop license servers – the address of the License Server is set;
• Set the Remote Desktop licensing mode – select RDS CAL license type.

Try to check the RD License Server status and the number of the issued licenses using the Remote Desktop Licensing Diagnoser tool (lsdiag.msc or Administrative Tools -> Remote Desktop Services -> RD Licensing Diagnoser). RD Licensing Diagnoster can be installed on RDSH servers using Server Manager (Features -> Remote Server Administration Tools -> Role Administration Tools -> Remote Desktop Services Tools -> Remote Desktop Licensing Diagnoser Tools).

If the RDSH server is not configured to use an RDS license server, the following warnings will appear in the Licensing Diagnoser console:

• Licenses are not available for this Remoter Desktop Session Host server, and RD Licensing Diagnose has identified licensing problems for the RDSH.
• Number of licenses available for clients: 0
• The licensing mode for the Remote Desktop Session Host server is not configured.
• Remote Desktop Session Host server is within its grace period, but the RD Session Host server has not been configured with any license server.

If there are no warnings, and you see the message “RD Licensing Diagnoser did not identify any licensing problems for the Remote Desktop Session Host server”, then the RDSH server can successfully receive RDS CALs for remote users and/or devices.