4

Updated: I changed the setup to make it closer to the live environment, I am no longer using IP addresses to connect to each other. I also have clarified the question more, if it needs more clarification, please let me know.

I am doing some testing to add a second RD Session Host server to our network. Currently we have one Win 2k8 R2 machine (LIC-SRV) that has both the "Remote Desktop Session Host" and "Remote Desktop Licensing" services running. The license server has a 20 User "RDS Per User CAL" installed. The RD Session Host instance is using the license server running on itself is working fine and is acting correctly.

I have a created a second machine (RDSH-SRV) running "Remote Desktop Session Host" only.

On RDSH-SRV I set it up for per user licensing. When I go to set the License server LIC-SRV does not show up on the list of available servers even though I have LIC-SRV's "Discovery Group" set to Workgroup. When I manually enter LIC-SRV as the server it gives me the following error:

---------------------------
Remote Desktop Session Host Configuration
---------------------------
Your account does not have administrator privileges on the license server; therefore, it cannot be determined if the license server is a valid license server for the Remote Desktop Session Host server to use. Do you still want to add the license server to the list?
---------------------------
Yes No
---------------------------

I click Yes and add the server to the list.

When I go to the Licensing Diagnosis screen on RDSH-SRV it lists LIC-SRV as having Connectivity of "Available", but Credentials are "Not Available".

When I click Provide Credentials on the right side of the page it prompts me for my credentials on LIC-SRV, I then type in my LIC-SRV credentials (I am a member of the Administrators group on LIC-SRV) but after clicking OK the dialog disapears for 1-2 seconds then the prompt for the credentials shows itself again, as if I entered invalid information for the credentials. It never gives me any kind of error message, just a repeated prompting. I can connect from RDSH-SRV to a LIC-SRV network share, entering my credentials to allow access, and it connects fine, so the issue is not that the credentials are wrong.

I have tried both with and without the hostname in the username box (srchamberlain vs LIC-SRV\srchamberlain) but it always re-prompts for the credentials.

Both computers are members of the workgroup "WORKGROUP". I am doing the work on RDSH-SRV under a the login srchamberlain, there also is a srchambrelain account on LIC-SRV with the same password. Both srchamberlain accounts are members of the Administrators group on their respective machines.

I do not know if this should affect anything but RDSH-SRV is actually a Hyper-V VM running on LIC-SRV. They are connected with a "Private" network connection. RDSH-SRV has the DNS roll enabled and the VM network adapter on LIC-SRV and DRSH-SRV use that DNS server to resolve the names of each other.

Scott Chamberlain
  • 1,455
  • 2
  • 21
  • 37
  • It would have been a lot more useful if you had adjusted your computers names in the question from `boxa` and `srctest` to something that reflects the role of the server. I have tried reading through this three times now, and I am still having problems following which system you are talking about, and which system you don't have an account on. – Zoredache Feb 22 '12 at 23:53
  • @Zoredache I have edited for clarity, any other information you need I can provide too. – Scott Chamberlain Feb 23 '12 at 01:34

2 Answers2

6

Found the answer to my problem. From the note on the bottom of the page on Troubleshooting TS Licensing Installation:

Important
To view the configuration details of a Windows 2000 or a Windows Server 2003 license server, you must provide the credentials of the built-in local Administrator account on the license server. The credentials of any other account, even if that account has administrator privileges on the license server, will not allow you to view the configuration details.

Now this is a 2008 R2 server, but I bet it still applies. I will update when I track down the Head of IT so he can enter the password.

UPDATE: So it appears that licensing will only work if one of two conditions are met:

  1. The built-in administrator account on LIC-SRV must be entered in when you click "Provide Credentials"
  2. If when you select which license server to use and you are currently logged in to the built-in administrator account on RDSH-SRV and the username and password of the built in Administrator account is the same on both RDSH-SRV and LIC-SRV

If either one of the conditions are met then Licensing will work in workgroup mode.

Scott Chamberlain
  • 1,455
  • 2
  • 21
  • 37
  • Nice job. I've not used TS/RDS in workgroup mode so I've just learned something. – joeqwerty Feb 23 '12 at 18:58
  • As I understand that in case you not entered credentials you just don't see license config in RDS configuration console from other machine... But I suppose licenses should be issued OK to the clients, etc. What I'm interested in is whether there is any way to check available licensing pool and which server actually issued license to client without credentials/access to RDS licensing server? Can I somehow confirm that license was issued to client from specific license server on a client side? – Mikhail Jan 10 '14 at 08:42
1

I just came across the very same issue on Windows Server 2012 VMs. Both servers have RDSH service role installed and one of them holds RD Licensing service role.

Both of the VMs are in a WORKGROUP. Built-in Administrator accounts have the same password.

Every time I tried to point SERVER02 to use SERVER01 as license server and trying to Provide Credentials - the window just appeared again.

I then installed RD Licensing service role on SERVER02 and I was able to add it on SERVER01 and connect to it remotely.

I then tried viewing services remotely from SERVER02 on SERVER01, but failed with Access Denied error.

Administrative shares were not accessible due to Access Denied error, although I did get a password prompt window and I even could reach test share created on SERVER01 from SERVER02.

Eventually, after some googling, it was found out that UAC was enabled on SERVER01.

It required several steps before I could successfully Provide Credentials:

  1. Disabling UAC completely.

  2. Disabling UAC remote restrictions:

    Key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Value: LocalAccountTokenFilterPolicy Data: 1 (to disable, 0 enables filtering) Type: REG_DWORD (32-bit)

  3. Disabled UAC Admin Approval mode under:

Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Disable the policy User Account Control: Run all administrators in Admin Approval Mode.

Volodymyr Molodets
  • 2,424
  • 9
  • 36
  • 52