# Need help...Windows 2008 Terminal Server licensing

**URL:** <https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855>\
**Category:** Factual Questions\
**Created:** [September 16, 2008, 4:36pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855 "2008-09-16T16:36:29Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\
**Post date:** [September 16, 2008, 4:36pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/1 "2008-09-16T16:36:29Z")

</div>

One of my customers is having a bit of an odd problem with their 2008 Terminal Server. Basically every time a user logs in it tells them they have to activate the license (and then delays for 10 seconds before it lets you choose to activate later). I’m not very familiar with WTS 2008 and haven’t seen this error before.

I checked in the TS License Manager and it’s listing the License Program as Open with 50 Cals available. Went back to Terminal Services in Server Manager and checked and TS and TS Licensing are both running and installed. When I check event errors it says:

> [@](#):
>
> Log Name: System  
> Source: Microsoft-Windows-TerminalServices-Licensing  
> Date: 9/16/2008 9:58:52 AM  
> Event ID: 4105  
> Task Category: None  
> Level: Warning  
> Keywords: Classic  
> User: N/A  
> Computer: \<server\>.\<domain\>  
> Description:  
> The Terminal Services license server cannot update the license attributes for user “\<user name\>” in the Active Directory Domain “\<domain\>”. Ensure that the computer account for the license server is a member of Terminal Server License Servers group in Active Directory domain “\<domain\>”.  
> If the license server is installed on a domain controller, the Network Service account also needs to be a member of the Terminal Server License Servers group.  
> If the license server is installed on a domain controller, after you have added the appropriate accounts to the Terminal Server License Servers group, you must restart the Terminal Services Licensing service to track or report the usage of TS Per User CALs.  
> Win32 error code: 0x80070005  
> Event Xml:  
> \<Event xmlns=“[http://schemas.microsoft.com/win/2004/08/events/event](http://schemas.microsoft.com/win/2004/08/events/event)”\>  
> \<System\>  
> \<Provider Name=“Microsoft-Windows-TerminalServices-Licensing” Guid=“{4D99F017-0EB1-4B52-8419-14AEBD13D770}” EventSourceName=“TermServLicensing” /\>  
> \<EventID Qualifiers=“51456”\>4105\</EventID\>  
> \<Version\>0\</Version\>  
> \<Level\>3\</Level\>  
> \<Task\>0\</Task\>  
> \<Opcode\>0\</Opcode\>  
> \<Keywords\>0x80000000000000\</Keywords\>  
> \<TimeCreated SystemTime=“2008-09-16T15:58:52.000Z” /\>  
> \<EventRecordID\>33150\</EventRecordID\>  
> \<Correlation /\>  
> \<Execution ProcessID=“0” ThreadID=“0” /\>  
> \<Channel\>System\</Channel\>  
> \<Computer\>\<server\>.\<domain\>\</Computer\>  
> \<Security /\>  
> \</System\>  
> \<UserData\>  
> \<EventXML xmlns:auto-ns3=“[http://schemas.microsoft.com/win/2004/08/events](http://schemas.microsoft.com/win/2004/08/events)” xmlns=“Event\_NS”\>  
> \<param1\>198miranda\</param1\>  
> \<param2\>\<domain\>\</param2\>  
> \<param3\>0x80070005\</param3\>  
> \</EventXML\>  
> \</UserData\>  
> \</Event\>

I checked in ADUC and the user groups for the users in question are in the Terminal Server License Servers group (built-in). Looking at TS Manager in Server Manager I see the users all have a red arrow next to them, which means they are definitely not authorized for some reason.

Some additional info that might or might not be useful: This 2008 server is in the domain but not part of AD…it’s simply a server in the domain. Also, it looks like they are using local policies for some reason (my guess is that the domain policies weren’t working right and they just decided to go this route to get it working).

That’s all I can think of information wise. Would REALLY appreciate it if someone has seen this problem before and can direct me to a solution that’s fairly easy. I’ve restarted TS AND the License server (it’s on the same box) just in case, but that didn’t seem to have any effect.

-XT

---

<div class="post-metadata">

**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\
**Post date:** [September 16, 2008, 4:53pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/2 "2008-09-16T16:53:30Z")

</div>

Just checking; the individual user account properties terminal services tab doesn’t have deny TS log on checked right?

Also I assume you’ve checked "Ensure that the computer account for the license server is a member of Terminal Server License Servers group in Active Directory domain “\<domain\>”. Are the DCs 2008 as well?

---

<div class="post-metadata">

**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\
**Post date:** [September 16, 2008, 5:05pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/3 "2008-09-16T17:05:42Z")

</div>

Nope, the users are able to log in fine…they just get an activation screen on log in. If they try and activate they get an error saying they aren’t administrators. If they wait, they get a selection that says ‘activate later’…clicking on that lets them log in fine. It’s just a pain in the ass.

As an aside, I tried to log in as domain administrator…same exact error. When I tried to activate I got a weird DNS error (said couldn’t activate because DNS entry was wrong…I checked, the DNS entry for this server is correct). When I log in via a TS using the LOCAL administrator for the server I get no activation error at all (also a little green arrow by the local admin user).

This is a stand alone server in the domain. All the other DC’s are Windows 2003…this is the only 2008 server.

And yes, I checked…the server name for the TS is in that same Terminal Server License Servers group in ADU&C. It all SEEMS to be set up correctly, and it works of course…but every time a domain user logs in they get that activation error and they have to wait 10 seconds before the activate later selection comes up. While this isn’t a major problem, the customer wants it fixed. I’ve got a call in to MS Licensing as well as this thread. Any ideas would be MUCH appreciated.

-XT

---

<div class="post-metadata">

**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\
**Post date:** [September 16, 2008, 5:30pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/4 "2008-09-16T17:30:43Z")

</div>

The TS licensing server (not the server OS) hasn’t been activated with MS?

I’m not sure why you said “same” in “…same Terminal Server License Servers group in ADU&C.”

---

<div class="post-metadata">

**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\
**Post date:** [September 16, 2008, 5:32pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/5 "2008-09-16T17:32:08Z")

</div>

Can you expand on ‘in the domain but not in AD’ bit?

---

<div class="post-metadata">

**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\
**Post date:** [September 16, 2008, 6:05pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/6 "2008-09-16T18:05:04Z")

</div>

[QUOTE=yoyodyne]  
The TS licensing server (not the server OS) hasn’t been activated with MS?  
[/QUOTE]

Yup. And the CALs have been activated to, and are registered as well.

> [@](#):
>
> I’m not sure why you said “same” in “…same Terminal Server License Servers group in ADU&C.”

Well, I suppose I should have just said it’s IN the TSLS group in ADU&C…i.e. the server name is in there as well as the user groups who are using the terminal server. If that doesn’t make sense let me know…I’m doing about 5 things at once here.

BTW, appreciate the help!

[QUOTE=Quartz]  
Can you expand on ‘in the domain but not in AD’ bit?  
[/QUOTE]

It’s not an AD controller…it’s in the domain as a stand alone server. Does that make sense? Think of it like a workstation…it’s in the domain, but it’s not participating in the AD.

-XT

---

<div class="post-metadata">

**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\
**Post date:** [September 16, 2008, 6:20pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/7 "2008-09-16T18:20:23Z")

</div>

It’s a domain member server, not a DC. That’s ok.

The users need to be in the “Remote Desktop Users” local group on the TS machine. The TS machine needs to be in the “Terminal Server License Servers” domain group on the DCs.

---

<div class="post-metadata">

**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\
**Post date:** [September 16, 2008, 6:22pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/8 "2008-09-16T18:22:33Z")

</div>

Users are in the Remote Desktop Users group, yes. As I said, it’s working (it wouldn’t work if they WEREN’T in the RDU group), they are just getting a activation screen on login. The TS is in the TSLS domain group as well…as are the user groups for the users using the TS.

-XT

---

<div class="post-metadata">

**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\
**Post date:** [September 16, 2008, 6:28pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/9 "2008-09-16T18:28:33Z")

</div>

The users need to be removed from the TSLS domain group. Only the TSLS machine should be there. You’re telling it that all the user accounts are licensing servers.

---

<div class="post-metadata">

**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\
**Post date:** [September 16, 2008, 6:33pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/10 "2008-09-16T18:33:18Z")

</div>

Well, I put em in there because the error code I read said they should be in there. However, I can take them back out…but that would put me back where I started. However, I’ll do that and see if it has any effect.

-XT

---

<div class="post-metadata">

**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\
**Post date:** [September 16, 2008, 6:37pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/11 "2008-09-16T18:37:22Z")

</div>

Force DC replication after you take them out.

---

<div class="post-metadata">

**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\
**Post date:** [September 16, 2008, 6:42pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/12 "2008-09-16T18:42:27Z")

</div>

kk, did that. Doesn’t seem to be doing anything though. Still getting the same error unfortunately.

-XT

---

<div class="post-metadata">

**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\
**Post date:** [September 16, 2008, 6:47pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/13 "2008-09-16T18:47:11Z")

</div>

Do one of [these](http://technet.microsoft.com/en-us/library/cc737644.aspx) too. Except the first one I guess. Are any GPOs working on the TS machine?

---

<div class="post-metadata">

**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\
**Post date:** [September 16, 2008, 7:04pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/14 "2008-09-16T19:04:15Z")

</div>

They are using GPO’s for the domain, and they have some specifically for the TS, but according to the customer they weren’t working properly so they applied local machine policies to lock it down.

I had already tried some of the things in your link (not going to mess with a direct registry edit though), and doesn’t seem to have any effect. I’m totally getting the run around from Microsoft Tech support (one guy suggested I disconnect the server from the network and try to re-activate…no idea what THAT was supposed to accomplish). They are simply passing me back and forth in the queue.

Gods…I HATE Microsoft! WHy is this so hard? Anyway, appreciate the help and suggestions.

-XT

---

<div class="post-metadata">

**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\
**Post date:** [September 16, 2008, 7:10pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/15 "2008-09-16T19:10:54Z")

</div>

The GPO issue could be part of the problem. Those things usually come down to DNS.

Sorry I can’t help. If it were easy I (we?) wouldn’t have a job.

---

<div class="post-metadata">

**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\
**Post date:** [September 16, 2008, 7:24pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/16 "2008-09-16T19:24:25Z")

</div>

ETA: You can run Tstst.exe from within MPSRPT\_DirSvc.EXE  
available [here](http://www.microsoft.com/downloads/details.aspx?familyid=cebf3c7c-7ca5-408f-88b7-f9c79b7306c0&displaylang=en) and see if it tells you anything.

ETA2: Guess I just post too slow. Even after I’ve pushed the button.

---

<div class="post-metadata">

**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\
**Post date:** [September 16, 2008, 7:24pm UTC](https://boards.straightdope.com/t/need-help-windows-2008-terminal-server-licensing/463855/17 "2008-09-16T19:24:53Z")

</div>

Resolved. lol, it WAS an easy problem in the end. Basically the activation was corrupt. It needed to be completely cleared out, and the key code re-applied and re-activated (and it DIDN’T need the internet connection disconnected…lol). And then…it worked like a charm.

Oh well…thanks for the helpage everyone. Sorry it turned out to be such a silly problem. Once I finally actually talked to a tech with a clue at MS they knew exactly what the issue was (I guess they have had this trouble before) and were able to fix it in like 5 minutes.

-XT