Summary
Users attempting to connect to a XenApp server on Windows Server 2003/2008 or a Presentation Server on Windows 2000 Server or Windows Server 2003 may experience the following Terminal Services-related errors in the Event Log:
Event ID: 1003
Source: TermService
Type: Information
The terminal service client has provided an invalid license.
Event ID: 1004
Source: TermService
Description: Unable to acquire a license for user name, domain name.
Troubleshooting Terminal Server Licensing
Symptom 1
When connecting with a Citrix ICA Client after downloading a Remote Desktop Protocol (RDP) Web client, the RDP client might not exhibit any problems and continue to connect.
Background 1
With Microsoft (both regular Client Access License (CAL) and Terminal Services CAL) licenses, before an ICA connection is established (the GINA logon pop-up), the client license must be confirmed to exist and be valid.
Note: Windows 2000 Professional and XP Professional Workstations do not have built-in CALs with respect to Windows 2003 Terminal Server License Servers.
When there are insufficient permissions to the below registry key, connection failures occur. Check the Microsoft Terminal Services License manager to see if the workstation is enumerated. If the workstation is not enumerated, this is not considered a Citrix issue. For more information, contact Microsoft Technical Support. Verify that your Windows 2000/2003 Terminal Licenses are activated. For more detailed information, see the White Paper: Microsoft Windows 2000 Terminal Services Licensing Technology.
For Windows Server 2008 licensing information, refer to Licensing Terminal Services in Windows Server 2008.
Cause 1
The Event Log does not specify the client device that provided the invalid license. Insufficient permissions are being applied to the Microsoft license key in the registry for the Authenticated Users group. When testing, attempt to create an RDP connection after removing the MSLicense key in the registry as a user (no Domain Admin or Power User Group); the RDP connection also fails.
Resolution 1
CTX463072 – Error: Cannot connect to the Citrix server.
Note: Although not necessary, it might be worthwhile to investigate the Cryptography registry keys under HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER on both the server and workstation. See Microsoft TechNet and the usage of RegMon and FileMon for additional information.
http://www.microsoft.com/technet/sysinternals/default.mspx
These changes take effect from the client device.
Note: If you are making a desktop connection, then opening Program Neighborhood inside the desktop session (Pass-through) and the subsequent ICA connection is failing, the affected workstation, in this case, is actually the server.
Complete the following procedure if you experience these licensing errors:
Caution! This fix requires you to edit the registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.
1. Open the Registry Editor (Regedt32.exe).
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSLicensing.
3. Highlight this key, select Security on the toolbar, and select Permissions.
4. Click the Advanced key.
5. Verify that the Authenticated Users group is in Permissions Entries.
Note: If this group is not found, click Add, select the Users Group, and click OK.
In Permission Entry for MSLicensing, give full control to the Users group and click OK. In the Access Control Settings for MSLicensing, click Apply, then OK. In Permission Entry for MSLicensing, click Apply and then OK.
6. Attempt to connect using the 32-bit ICA Client for Windows.
Note: If using a NON-native Windows client (Macintosh, Linux, or a Thin Terminal) without a local registry, the above permissions must be made to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\MSLicensing
After moving the Terminal Services Licensing server, RDP clients do not exhibit any problems and continue to connect.
Cause 2
A potential race condition between the Icaapi.dll and the Rdpwsx.dll might cause the private certificate key on the Terminal Services server to become unsynchronized.
Resolution 2
Caution! This fix requires you to edit the registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.
From the Windows 2000 Terminal Server, follow Microsoft TechNet article 239107 to add the Terminal Server license server.
1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters
3. On the Edit menu, point to New, and then click String Value
4. Add the following value:
Name: DefaultLicenseServer
Data type: REG_SZ
Data value: ServerName
Note: The ServerName can be any of the following designations that represent the license server:
• The NetBIOS Name of the server
• The fully-qualified domain name (FQDN) of the server
• The IP address of the server
From the Windows 2003/2008 Terminal Server, follow Microsoft TechNet article 279561 to add the Terminal Server license server.
1. Click Start > Run, type regedit, and then click OK.
2. Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters
3. On the Edit menu, point to New, and then click Key.
4. Name the new key LicenseServers.
5. Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters\LicenseServers
6. On the Edit menu, point to New, and click Key.
7. Name the new key ServerName where ServerName is the NetBIOS name of the license server that you want to use, and then press ENTER.
8. Restart your computer.
Note: The new key name can be any of the following designations that represent the license server:
• The NetBIOS Name of the server
• The fully-qualified domain name (FQDN) of the server
• The IP Address of the server
Note: If you use Windows Server 2003 SP1 and later or Windows Server 2008, you can set this in the Terminal Services Configuration administrative tool. The following screen shot shows the interface in Windows Server 2003:
9. Under Server Settings, double-click the License server discovery mode and either enter the NetBIOS name of the server or the IP address. This requires a restart to take effect.
Note: In Windows Server 2008, under Edit Settings, double-click License server discovery mode, select the Licensing tab, select the Use the specified license servers option button, and enter the license server name (or IP address) in the field provided. The following screen shot shows the interface in Windows Server 2008:
Follow Microsoft TechNet article 323597 for the repair of the certificate keys on the Terminal Server.
Symptom 3
When connecting an ICA Client using a Wyse WT1200LE version 4.2.x terminal, there is a known issue that exists with the firmware shipped with this thin client device.
An individual workstation may connect to server A but not to server B.
Some client workstations may connect to all servers while others are denied to some servers.
In both cases, the RDP client connection from the same workstation may connect to both servers A and B.
Resolution 3
Upgrade to the latest Firmware version 4.4.079 for the discontinued Winterm model 1200LE. http://www.wyse.com/serviceandsupport/support/dlOraFW.asp?which=2&model=Winterm%201200LE
Troubleshooting for non-Windows clients
Note: If using a NON-native Windows client (Macintosh, Linux, or a Thin Terminal) without a local registry, the above permissions (outlined in Issue 1) must be verified on the following registry key on the XenApp server/Presentation Server:
HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\MSLicensing
1. How many TSCAL servers are installed and where are they installed? Are you using Active Directory Services or Windows NT 4.0 domain?
If your Terminal Servers are members of an Active Directory domain, you should install the TS License Server on a domain controller in the root domain of the forest. There can be only one Enterprise TS License server per Active Directory site. Install one Enterprise TS License server for each site in the Active Directory forest.
For the Active Directory Object to be created properly, install TS Licensing as an Enterprise Administrator or an administrator belonging to the root domain. If an empty root domain is created, the Active Directory object for the TS-Enterprise-License-Server might not be created properly.
Does the object look like it is in the Active Directory Sites and Services and can it be queried using an LDAP query? If you follow this process, all Windows 2000 servers running Terminal Services will discover their site-wide Enterprise TS license server by LDAP lookup.
Whether or not Active Directory is used is very important with regard to the TS License Server discovery process. See these articles for more information about the TS License server discovery process: 232520, 261110, 304080.
2. How many Terminal Servers generate the error(s) and are the Terminal Servers on the same subnet/domain as the TSCAL Server?
When only MetaFrame servers were on the same subnet, changing the TCP/IP configuration on the MetaFrame servers to h-node for WINS, adding a WINS server to the mix, and using the DefaultLicenseServer registry key, all servers in the Active Directory were able to find the TS License server. See Symptom 2. Therefore, does specifying the NetBIOS name of the TS License server by modifying the following registry value help?
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters\DefaultLicenseServer
The NetBIOS name, of course, must be resolvable.
3. Does it make a difference if the user on the workstation is an administrator or user class account? This is also important to know when the server is acting as the client in pass-through mode.
4. What ICA Client version are you using?
5. Which Windows/non-Windows workstations are experiencing these symptoms? See CTX101845 – Terminal Server Client Access License (TSCAL) Issue with the ICA Client for Java.
6. Are there temporary TSCAL servers in TS Admin?
7. Is 287687 applied? Is 315404 applied? Is Microsoft Service Pack 3 applied? Do 270898, 277917, or Terminal Services Licensing for Windows help?
8. Is Control Panel - MSLicensing set to per-server or per-seat?
9. See HOW TO: Use the Terminal Services Licensing Reporter Tool (Lsreport.exe).
10. See 823313 - How to deploy Windows Server 2003 Terminal Services.
11. See Troubleshooting Terminal Server Licensing.
Isolation Steps
1. Isolate the problem server to a workgroup and/or promote it to a domain controller.
2. Enable this server as a TSCAL Server.
3. Create at least two ICA sessions to this server.
4. Disable the TSCAL Server from this server.
5. If applicable, demote the server.
6. Rejoin the original domain.
7. Attempt to create an ICA session.
Note: These steps are known to correct the above issue. The above action items, if completed successfully, will prove that:
• No changes were made to the XenApp server/Presentation Server
• The changes occurred at the operating system level
