LICENSING

Be sure to read all the way through this section, because the Windows Server 2003 licensing section contains some great news that alleviates much of the licensing pain that Terminal Services users have encountered .

In addition to the basic server operating system license required for every installed server, both Terminal Server RDP clients and Citrix ICA clients require two licenses to connect to a Terminal Server session. The first license is the standard Microsoft Client Access License (CAL) for accessing Windows NT files and print services.

The second license required to enable a client connection is a Windows Terminal Services License (TS CAL). If the session client is running on a computer with Windows 2000 Professional or Windows XP Professional when connecting to a Windows 2000 Server farm, it is not necessary to purchase a TS CAL for that client device or user . The server has a "built-in" pool of licenses it can provide to those client machines running Windows 2000 Pro or Windows XP Pro. In the case of Windows Server 2003, there is no "built-in" TS CAL pool. Owners of Windows XP Professional desktop licenses are eligible for free TS CALs, however. (Talk with your licensing provider to receive the free licenses as soon as possible, since this offer from Microsoft is limited.) Although Windows NT 4.0 TSE does not enforce licensing, both Windows 2000 Server and Windows Server 2003 arduously enforce licensing of the TS CAL.

Note 

There is a special provision for an Internet Connector in Windows 2000. This license mode allows 200 anonymous, concurrent users to access Terminal Services on a single server. However, the End User License Agreement specifically states that anyone affiliated with the owner of the license cannot use it (in other words, vendors , customers, employees , contractors, and so on cannot use the license). This rule makes the license restrictive to the point of being useless. Fortunately, the Internet Connector is being replaced as described in the Windows 2003 licensing section that follows .

Windows 2000 Licensing

Windows 2000 enforces the use of the Terminal Services CAL. During any attempt to connect to a session, both the standard CAL and the TS CAL will be checked. If either license is missing or invalid, the connection is refused . If the connection is granted, a temporary or permanent TS CAL is assigned.

Note 

In a Windows NT Domain with Windows 2000 or Windows Server 2003 member terminal servers, terminal services licensing must be installed on a Windows 2000 or Windows Server 2003 member. When upgrading the Domain to Windows 2000 Server or Windows Server 2003 Active Directory, licensing must be reinstalled on a Domain Controller (DC). Failing to install Terminal Services Licensing and the license codes on the new DC will cause a loss of terminal service capabilities (no license server available).

Windows 2000 Server comes with a license services server that tracks and allocates TS CAL licenses to clients at connection time. The license server needs to be installed on a Windows 2000 server and activated through Microsoft License Clearing House via a Web browser, the telephone, or a process called Automatic Activation. When a client requests a connection to a Windows 2000 server, the request is forwarded to the central license server for validation. The license server uses the username and computer name to check for an existing license. If none is available, a new license will be issued to the client, and the connection is completed. If the license pool is exhausted, the connection is refused. A temporary license can be enabled that will expire after 90 days.

The significant issue with this licensing is that if a user connects one time from any device (a trade show kiosk, for example), a TS CAL is allocated (although it is not legitimate from the standpoint of the Microsoft Server 2000 licensing agreement to provide a license to a machine not owned by the person using it). Due to this execution of the licensing, the unclear license language, and technical problems (Microsoft provides no licensing option to deal with devices that aren't owned by the company whose user is using it), many customers found themselves continually running out of TS licenses. In July 2002, Microsoft responded to strong user feedback regarding the TS license execution by changing the licensing model slightly (via a hotfix patch) to allow the license server to expire leases after 90 days. To install this patch, install the Service Pack 2 Security Rollup package, or Service Pack 3, to your license server and all terminal servers in your environment.

Tip 

After installing Service Pack 2 Security Rollup or Service Pack 3, uninstall and reinstall all TS licenses and reactivate them in order to complete this fix.

Licensing and Terminal Services Execution Modes

Windows 2000 Terminal Services can be installed in two different modes. The remote administration mode does not require a TS CAL. The purpose of this mode is to allow administrators to do server maintenance remotely. Therefore, certain restrictions apply to running in this mode. Only two concurrent client sessions are permitted. Server application compatibility services are also disabled, such as the global install mode. The Application Server mode is the mode utilized for Terminal Services in a server-based computing environment. This mode is not restricted like the remote administration mode and requires the TS CALs as discussed earlier.

Windows Server 2003 Licensing

Probably the single most significant reason to move from Windows 2000 Server to Windows Server 2003 across the corporate environment is the new licensing options. Although the execution of the license server is identical to Windows 2000, the licensing choices are dramatically improved. Following are the changes made to licensing with Windows Server 2003:

1. Windows Server 2003 provides a 120-day grace period for renewals as opposed to 90 days with Windows 2000 Server.

2. Windows Server 2003 supports a new license optionPer User licensingas well as the Per Seat licensing supported in Windows 2000 Server (Microsoft has renamed it in Windows 2003 to Per Device). Additionally, a hybrid may be used (some licenses may be allocated per device and some per user). The Per User licensing will work best for environments where users have multiple devices that connect to the terminal servers (that is, a single user connects from a desktop, laptop, CE device, home PC, trade show kiosk, and so on). The Per Device licensing works best for environments where multiple users share the same device (manufacturing floors, hospitals , 24/7 offices, and so on). Note that with this change the temporary fix we discussed earlier in this section, allowing Windows 2000 to expire the leases every 90 days, has been eliminated.

3. The Internet Connector License noted earlier is replaced in Windows 2003 with an External Connector (EC) license called the Terminal Server External Connector (TS-EC) to address the need previously mentioned: to enable external users to access a company's terminal servers, without the need to purchase individual TS CALs for them or their devices. An example of an external user is a person who is not an employee of the company or its affiliates . Companies can purchase Windows CALs and TS CALs for entities not owned by themfor example, business partnersin order to give those entities access to their networks and terminal servers. This may be the best solution when a small number of business partners or customers need access to a server or group of servers. This license mode allows 200 anonymous, concurrent users to access Terminal Services.

Licensing and Terminal Services Execution Modes

Unlike Windows 2000 Server, which had a dual-mode Terminal Services component, Windows Server 2003 separates the remote administration and Terminal Services functionality into separately configurable components. Remote Desktop for Administration is enabled through a check box on the system Control Panel's Remote tab. Terminal Services is enabled by adding the "Terminal Server" component using the Windows Components portion of the Add/Remove Programs Wizard.

In addition to the two virtual sessions available in Windows Server 2003 Terminal Services remote administration functionality, an administrator can also remotely connect to the console of a server. A significant outcome to this change is that applications that would not work in a virtual session before, because they kept interacting with "session 0," will now work remotely. To connect to the console, administrators can choose one of the following methods :

• – Use the Remote Desktop Microsoft Management Console (MMC) snap-in.

• – Run the Remote Desktop Connection (mstsc.exe) program with the /console switch.

• – Create Remote Desktop Web Connection pages that set the ConnectToServer-Console property.