120 days grace period or purchased licenses ?
benxxv
know it's 120 days grace period license or purchased licenses are given to
clients ?
Rob Leitman [MS]
first 120 days. The grace period is intended to give you the time to
install the CALs.
Rob
"benxxv" <u30064@uwe> wrote in message news:6a79ac1226478@uwe...
benxxv
won't stop after the grace period ? What feature gives me the assurance that
my Terminal Server Activated properly and my TS CALs are working fine ?
It's my client project, though the Terminal Server is working fine now, i
need to assure them in some way that TServices won't stop after grace period.
Thankyou.
Rob Leitman [MS] wrote:
>If CALs are installed, the licenses will be issued, even if you're in the
>first 120 days. The grace period is intended to give you the time to
>install the CALs.
>
>Rob
>
Vera Noest [MVP]
Licensing Service, activated the LS, and installed a TS CAL license
pack on the activated LS, without any error messages, is that
correct?
And you are running Windows Server 2003, with SP1?
And the EventLog on the TS doesn't list any warnings or errors
regarding licensing?
Start by ensuring that your Terminal Server can locate the
Licensing Server. You can do this in Administrative tools -
Terminal Services Configuration - Server Settings - Licensing
You should be able to start the TS Licensing Manager and verify
that your installed TS CAL pack is listed there, with an entry like
"Windows Server 2003 - Terminal Server Per ???? CAL Token" and the
amount of licenses you bought under "Total".
If ???? = "Device", meaning you installed Per Device TS CALs, then
you should see an entry under "Issued", which represent the number
of Per Device TS CALs which has already been issued to your
clients. If this entry is > 0, then licenses are being issued, and
all is working as it should.
If ???? = "User", meaning you installed Per User TS CALs, then it's
a bit more complicated, because Per User licenses are currently
unmanaged, and thus are not issued at all. The entry under
"Issued" will always be "N/A" in this case, even if everything
works as it should.
To ensure that your setup is OK, check to make sure that your
Terminal Server is using the proper licensing mode, in
Administrative tools - Terminal Services Configuration - Server
Settings - Licensing. It should list "Per User" here, matching the
TS CALs you installed on the Licensing Server.
Note that you most likely also will see an entry in the TS
Licensing Manager, called: "Temporary Licensing for Windows Server
2003 - Terminal Server Per Device CAL Token".
The reason for this entry is that every client which connects to a
TS for the first time, while the TS is configured to use the Per
Device licensing mode, will receive a temporary TS CAL. On the
second connection, it will receive one of the purchased Per Device
TS CALs. If you later switched the licensing mode of the TS to Per
User, these temporary licenses will still be listed in the TS
Licensing Manager.
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
"benxxv" <u30064@uwe> wrote on 09 dec 2006 in
microsoft.public.windows.terminal_services:
benxxv via WinServerKB.com
the end, you can see one of my another problem on normal user unable to login
into TS Session unless i add the user into administrative group.
> I assume that you have already installed the Terminal Services
> Licensing Service, activated the LS, and installed a TS CAL license
> pack on the activated LS, without any error messages, is that
> correct?
Yes, It's correct. I installed Terminal Services Licensing Service, activated
the LS, and installed a TS CAL licesnse pack on the installed LS, i don't
have any error messages related to Terminal Services in any of the Event
Viewers (System, application etc.).
> And you are running Windows Server 2003, with SP1?
Yes, I am running Windows Server 2003 R2 SP1
> And the EventLog on the TS doesn't list any warnings or errors regarding licensing?
Yes, I reviewedth Event Viewer and no error or warnings regarding terminal
services or terminal server licensing.
> Start by ensuring that your Terminal Server can locate the
> Licensing Server. You can do this in Administrative tools -
> Terminal Services Configuration - Server Settings - Licensing
Yes, Terminal Server Licensing Server is up and running and working fine.
> You should be able to start the TS Licensing Manager and verify
> that your installed TS CAL pack is listed there, with an entry like
> "Windows Server 2003 - Terminal Server Per ???? CAL Token" and the
> amount of licenses you bought under "Total".
Yes, TS CAL Pack is listed and i am using Per User cAL Tokens.
> If ???? = "User", meaning you installed Per User TS CALs, then it's
> a bit more complicated, because Per User licenses are currently
> unmanaged, and thus are not issued at all. The entry under
> "Issued" will always be "N/A" in this case, even if everything
> works as it should.
Yes, N/A is shown as mine is PER USER.
> To ensure that your setup is OK, check to make sure that your
> Terminal Server is using the proper licensing mode, in
> Administrative tools - Terminal Services Configuration - Server
> Settings - Licensing. It should list "Per User" here, matching the
> TS CALs you installed on the Licensing Server.
Yes, Licensing shows "Per User" as attribute value.
> Note that you most likely also will see an entry in the TS
> Licensing Manager, called: "Temporary Licensing for Windows Server
> 2003 - Terminal Server Per Device CAL Token".
> The reason for this entry is that every clien which connects to a
> TS for the first time, while the TS is configured to use the Per
> Device licensing mode, will receive a temporary TS CAL. On the
> second connection, it will receive one of the purchased Per Device
> TS CALs. If you later switched the licensing mode of the TS to Per
> User, these temporary licenses will still be listed in the TS
> Licensing Manager.
The above entry is not there, may be my TS CAL is Per User.
Thankyou verymuch for your elaborative step by step process.
So, with the above process, can I assure my Client that Terminal Server is
installed properly and working fine and it will work after the grace period
too ?
Also, i have posted one more question on the regular user unable to login
into TS Session, but if I add this user to adminstrative group, login is
successful. Please advice me on this too.
>[quoted text clipped - 17 lines]
>>>> know it's 120 days grace period license or purchased licenses
>>>> are given to clients ?
--
Message posted via WinServerKB.com
http://www.winserverkb.com/Uwe/Forums.aspx/windows-ts/200612/1
Vera Noest [MVP]
worries there.
For the logon problem:
You have to add your users or user groups to the *local* Remote
Desktop Users group, which is a built-in group on the Terminal
Server.
If that doesn't solve it:
* what is the *exact* error message that users get when they try to
connect?
* this server is not a Domain Controller, I hope?
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
"benxxv via WinServerKB.com" <u30064@uwe> wrote on 10 dec 2006 in
microsoft.public.windows.terminal_services:
[verification of proper Per User licensing deleted]
benxxv via WinServerKB.com
Regarding Logn Problem: I added users and user groups to the Remote Desktop
Users Group, still no luck. It's a Domain Controller. And the error message
is as follows:
Logon Message
To log on to this remote computer, you must be granted the Allow log on
through TErminal SErvices right. By detault, members of the REmote Desktop
Users group have this right. If you are not a mmember of the REmote Desktop
Users group or another group that has this right, or if the Remote Desktop
User group does not have this right, you must be granted this right manually.
OK
Please suggest.
Thank you verymuch for your support.
Vera Noest [MVP] wrote:
>Yes, your licensing seems to be functioning as it should. No
>worries there.
>
>For the logon problem:
>You have to add your users or user groups to the *local* Remote
>Desktop Users group, which is a built-in group on the Terminal
>Server.
>
>If that doesn't solve it:
>* what is the *exact* error message that users get when they try to
>connect?
>* this server is not a Domain Controller, I hope?
>_________________________________________________________
>Vera Noest
>MCSE, CCEA, Microsoft MVP - Terminal Server
>TS troubleshooting: http://ts.veranoest.net
>___ please respond in newsgroup, NOT by private email ___
>
>"benxxv via WinServerKB.com" <u30064@uwe> wrote on 10 dec 2006 in
>microsoft.public.windows.terminal_services:
>
>[verification of proper Per User licensing deleted]
>
>> So, with the above process, can I assure my Client that Terminal
>> Server is installed properly and working fine and it will work
>[quoted text clipped - 4 lines]
>> adminstrative group, login is successful. Please advice me on
>> this too.
--
Vera Noest [MVP]
security reasons!
If you really want to go on with this setup, you will have to
modify the Default Domain Controller Security Policy to give your
users the Logon Locally right on all your DCs.
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
*----------- Please reply in newsgroup -------------*
benxxv via WinServerKB.com
Default DOmian Controller Security Settings
Local Policies
User Rights Assignment
Allow log on locally
added Users group
Also, i added users group to Allow log on through Terminal Services.
with gpupdate.exe i updated.
Still i am getting the same error.
Logon Message
To log on to this remote computer, you must be granted the Allow log on
through TErminal SErvices right. By detault, members of the REmote Desktop
Users group have this right. If you are not a mmember of the REmote Desktop
Users group or another group that has this right, or if the Remote Desktop
User group does not have this right, you must be granted this right manually.
OK
Can you please confirm if the above method is correct or i need to do this in
any other way ?
Vera Noest [MVP] wrote:
>It is *not* recommended to run TS on a DC, for both performance and
>security reasons!
>
>If you really want to go on with this setup, you will have to
>modify the Default Domain Controller Security Policy to give your
>users the Logon Locally right on all your DCs.
>
>_________________________________________________________
>Vera Noest
>MCSE, CCEA, Microsoft MVP - Terminal Server
>TS troubleshooting: http://ts.veranoest.net
>*----------- Please reply in newsgroup -------------*
>
>"benxxv via WinServerKB.com" <u30064@uwe> wrote on 11 dec 2006:
>
>> thankyou. i will assure my client that TS Services are working
>> fine.
>[quoted text clipped - 12 lines]
>> not have this right, you must be granted this right manually.
>> OK
--
Vera Noest [MVP]
DC. Since there is no local Remote Desktop Users group on a DC,
you'll probably have to assign all the required user rights manually.
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
"benxxv via WinServerKB.com" <u30064@uwe> wrote on 11 dec 2006 in
microsoft.public.windows.terminal_services:
benxxv via WinServerKB.com
application to run when they login, i think i can keep them in Administrators
group and don't think any problems from security point of view.
What's your final opinion on this ?
Regards....
Vera Noest [MVP] wrote:
>I'm not sure and I can't test it either, since I don't run TS on a
>DC. Since there is no local Remote Desktop Users group on a DC,
>you'll probably have to assign all the required user rights manually.
>
>_________________________________________________________
>Vera Noest
>MCSE, CCEA, Microsoft MVP - Terminal Server
>TS troubleshooting: http://ts.veranoest.net
>___ please respond in newsgroup, NOT by private email ___
>
>"benxxv via WinServerKB.com" <u30064@uwe> wrote on 11 dec 2006 in
>microsoft.public.windows.terminal_services:
>
>> I gave the logon locally right at the following:
>>
>[quoted text clipped - 36 lines]
>>>TS troubleshooting: http://ts.veranoest.net
>>>*----------- Please reply in newsgroup -------------*
--
Vera Noest [MVP]
That's the worsed scenario possible.
Defining a starting application doesn't change that one bit, it's
dead easy to start whatever program from whatever other program.
If you continue with this setup, be sure that you have detailed plans
on how to recover your AD domain, once your DC is compromized beyond
repair. And remember that backups are not going to help in this
situation.
For your own sake: don't do this!
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
*----------- Please reply in newsgroup -------------*
TP
1.) Allow log on locally is not needed, so remove the
group from this right
2.) Verify that your change to the default DC Security
Settings is taking effect on your DC:
- Logon to your DC as an administrator, click
Start-->Run, and type secpol.msc
- Drill down to Local Policies-->User rights assignment,
and double-click Allow logon through terminal services
- The list of groups granted access should match the
one you specified in the default DC Security policy
Please let me know what you find.
Thanks.
-TP
TP
Can you verify this on your domain? RDU group is
under domain\Builtin. It is listed as Domain Local, but
really it is Builtin Local for the DCs. (Double-click it
and examine the scope.)
I don't have a *fresh* 2003 DC handy at the moment,
but I believe the only key TS-related logon security
difference between a member TS and a DC is that on a
DC, the "Allow logon through Terminal Services" is set to
Administrators and Domain Adminis by default, whereas
on a member server it is set to Administrators and
Remote Desktop Users.
The default setup security, C:\WINDOWS\security\templates\setup security.inf
defines Administrators and Remote Desktop Users. I
*think* when dcpromo runs it removes Remote Desktop
Users from the list, and adds Domain Admins. Again, I
am not certain, I checked a few different 2003 DCs and
they were not set consistently.
I just checked a fresh Longhorn DC, and it is set to
Administrators only.
This is different than Power Users, which is deleted and
therefore does *not* exist on a DC.
On a TS server in admin mode (even a DC), when you click
Select Users on the Remote tab, you are actually adding/removing
users/groups from the Remote Desktop Users group.
-TP
benxxv via WinServerKB.com
Dear TP, your elaborative explanation on the terminal services really helped
me to not only solve the problem but to understand the logic behind it.
I added "Remote Desktop Users" group to "Allow logon through terminal
services" through secpol.msc. My problem solved.
Regular Users are now able to login through terminal services.
Thankyou.
And now, my server is a dell 2850 poweredge. By default Dell kept a Wall
Paper of the Server Frontview, now for the Terminal User this wallpaper is
showing up by default and it is taking time to load the login credentials
window.
I disable the wallpaper on the desktop, but i am unable to remove this for
terminal services users. How can I disable this Dell WallPaper ? Please note,
i disabled Active Desktop for the terminal users, but that doesn't solve my
problem.
ThankYou.
TP wrote:
>Hi,
>
>1.) Allow log on locally is not needed, so remove the
>group from this right
>
>2.) Verify that your change to the default DC Security
>Settings is taking effect on your DC:
>
>- Logon to your DC as an administrator, click
>Start-->Run, and type secpol.msc
>
>- Drill down to Local Policies-->User rights assignment,
>and double-click Allow logon through terminal services
>
>- The list of groups granted access should match the
>one you specified in the default DC Security policy
>
>Please let me know what you find.
>
>Thanks.
>
>-TP
>
>> I gave the logon locally right at the following:
>>
>[quoted text clipped - 21 lines]
>> Can you please confirm if the above method is correct or i need to do
>> this in any other way ?
--
TP
If I understand you correctly, you are saying that the
logon desktop has a wallpaper, but after the user logs
on they have no wallpaper. You do not want wallpaper
to appear on the logon desktop. Please correct me if I
am wrong.
You need to edit the profile for the SYSTEM user on
your TS, and set the wallpaper to none. Here is how:
Start-->Run-->regedit
Navigate to the following registry key:
HKEY_USERS\.DEFAULT\Control Panel\Desktop
In the right window, double-click the Wallpaper registry
value, and modify its Value data to the following:
(none)
Click the OK button to save your change.
Test by connecting to the TS.
-TP
Vera Noest [MVP]
Check in regedit under
HKEY_USERS\.default\control panel\desktop\wallpaper
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
"benxxv via WinServerKB.com" <u30064@uwe> wrote on 12 dec 2006 in
microsoft.public.windows.terminal_services:
benxxv via WinServerKB.com
my problems are solved very quickly....Thankyou...Thankyou...
I tweaked the registry as per your values.
Now the wall paper also got removed and just plain logon window is appearing.
I have one more requirement.
When i give the user login credentials to one of the user to login to
terminal server and do his work, sometimes, i need to see what the user is
performing on my application and need to guide them on the navigation in my
application.
So, how can i as an administrator view the user session while he works in the
terminal server session and guide him accordingly ?
Thankyou once again.
Vera Noest [MVP] wrote:
>You mean the Logon screen background?
>
>Check in regedit under
>HKEY_USERS\.default\control panel\desktop\wallpaper
>
>_________________________________________________________
>Vera Noest
>MCSE, CCEA, Microsoft MVP - Terminal Server
>TS troubleshooting: http://ts.veranoest.net
>___ please respond in newsgroup, NOT by private email ___
>
>"benxxv via WinServerKB.com" <u30064@uwe> wrote on 12 dec 2006 in
>microsoft.public.windows.terminal_services:
>
>> Thankyou Vera and TP.
>>
>[quoted text clipped - 49 lines]
>>>> Can you please confirm if the above method is correct or i
>>>> need to do this in any other way ?
--
Message posted via http://www.winserverkb.com
TP
your results.
To answer your question:
1.) Connect to your server using Remote Desktop,
and logon as an administrator
2.) Open up Terminal Services Manager (tsadmin.exe),
right-click on the user you want to guide, and choose
Remote Control. By default, the user will be prompted
to allow you to remote control them, they need to answer
yes to the prompt.
3.) When you are finished helping the user, Press Ctrl and
the * key on the numeric keypad at the same time.
-TP
Vera Noest [MVP]
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
"TP" <tperson....@mailandnews.com> wrote on 12 dec 2006 in
microsoft.public.windows.terminal_services:
> Remote Desktop Users is still there, even on a DC.
benxxv via WinServerKB.com
Thankyou. Now I am able to the terminal user session also.
One more question, the client drives or printers are not being seen in the
terminal session. I configured to map drives in the Terminal Services
Configuration, still i am not able to see them. What could be the problem ?
Also, I learnt so many new things and tweaks from you both. Can I get your
email ids, so that i can be in touch with you through email for any of my
technical questions ? I know sharing my problems through this forum helps
others as well. Still, if possible, provide me your email ids.
My email id is: ben...@rediffmail.com
ThankYou.
TP wrote:
>You are welcome. Thank you for posting with
>your results.
>
>To answer your question:
>
>1.) Connect to your server using Remote Desktop,
>and logon as an administrator
>
>2.) Open up Terminal Services Manager (tsadmin.exe),
>right-click on the user you want to guide, and choose
>Remote Control. By default, the user will be prompted
>to allow you to remote control them, they need to answer
>yes to the prompt.
>
>3.) When you are finished helping the user, Press Ctrl and
>the * key on the numeric keypad at the same time.
>
>-TP
>
>> Both of you are sent by GOD. I am very happy for your support.
>> Almost all my problems are solved very
>[quoted text clipped - 16 lines]
>>
>> Thankyou once again.
Vera Noest [MVP]
drives and printers, but it doesn't enforce redirection.
You have to configure the rdp client to use drive and printer
redirection.
No, you can't get my email address.
I don't do private consultations, and if I did, they would
certainly not be for free. But you're welcome to continue posting
here.
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
"benxxv via WinServerKB.com" <u30064@uwe> wrote on 13 dec 2006 in
microsoft.public.windows.terminal_services:
benxxv via WinServerKB.com
The question i am putting here not really related with Terminal Services, i
apologize for that, i already posted this in Windows 2003 General groups...
sorry about this.....Still i need a solution....Please help me.
Since 8th of December, my windows server 2003 standard clock is giving time
problem. It's going back by one day. I am not sure whether it is completely
one day before or whatsoever, but on 10th i did correction, again this
morning (15th), i noticed server date is 14th, but time is accurate. So,
again i changed my date to 15th few minutes back.
Please guide me, if this is the problem with CMOS Battery ?
I have the following error in my Event Viewer...except the following, i don't
have any other errors related to time.
Vera Noest [MVP] wrote:
>The settings on the server only allow for the clients to redirect
>drives and printers, but it doesn't enforce redirection.
>You have to configure the rdp client to use drive and printer
>redirection.
>
>No, you can't get my email address.
>I don't do private consultations, and if I did, they would
>certainly not be for free. But you're welcome to continue posting
>here.
>_________________________________________________________
>Vera Noest
>MCSE, CCEA, Microsoft MVP - Terminal Server
>TS troubleshooting: http://ts.veranoest.net
>___ please respond in newsgroup, NOT by private email ___
>
>"benxxv via WinServerKB.com" <u30064@uwe> wrote on 13 dec 2006 in
>microsoft.public.windows.terminal_services:
>
>> Dear TP & Vera,
>>
>[quoted text clipped - 39 lines]
>>>>
>>>> Thankyou once again.
--
Message posted via http://www.winserverkb.com
Vera Noest [MVP]
No, this is most likely not the battery.
Aren't you the one who made all users Administrators on your TS
which also is a DC?
Maybe you are starting to see the first side-effects of that setup?
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
"benxxv via WinServerKB.com" <u30064@uwe> wrote on 15 dec 2006 in
microsoft.public.windows.terminal_services:
benxxv via WinServerKB.com
Terminal Server we discussed earlier and even, i didn't added all the users
into administrators, as per TP guidance, i added Remote Desktop Users group
to local Policy, allow terminal servers logon group.
Now.......
Event ID : 520
Please see the following url. In my case, it's rundll32.exe
http://www.ultimatewindowssecurity.com/events/com188.html
My date changed values are as follows:
Previous Time: 12:00:27AM 12/14/2006
New Time: 12:00:27AM 12/13/2006
One thing what happened is: around 12.10AM, internet got intermittently
disrupted and internet came back.
Please guide me.
Vera Noest [MVP] wrote:
>You didn't include the EventID in your post.
>
>No, this is most likely not the battery.
>Aren't you the one who made all users Administrators on your TS
>which also is a DC?
>Maybe you are starting to see the first side-effects of that setup?
>_________________________________________________________
>Vera Noest
>MCSE, CCEA, Microsoft MVP - Terminal Server
>TS troubleshooting: http://ts.veranoest.net
>___ please respond in newsgroup, NOT by private email ___
>
>"benxxv via WinServerKB.com" <u30064@uwe> wrote on 15 dec 2006 in
>microsoft.public.windows.terminal_services:
>
>> Hi I am back again..
>>
>[quoted text clipped - 14 lines]
>> I have the following error in my Event Viewer...except the
>> following, i don't have any other errors related to time.
--
TP
Your clock is being changed by a user. This is frequently caused
by people double-clicking on the clock and using it as a quick
calendar. They click on a date, and then click OK to close the
window, thus changing the date.
Do you have users logging on to this server that are members of
Administrators or Power Users? Regular users of the server
should not be a member of either of these groups.
You should modify the server's local security policy (like you
did before for granting the ts right) either directly or via group
policy. The setting to change is:
Security Settings\Local Policies\User Rights Assignment\Change the system time
Modify it so that the only account in the list is LOCAL SERVICE
As an alternative, you could modify the list so that it only contains
LOCAL SERVICE and one other specific user account that you
will *only* use when you need to manually change the date/time.
-TP