Windows 2000 vs. NT Terminal Server Licensing

Microsoft changes the rules for Win2k Terminal Services

Just when you thought you understood licensing for Windows NT Server 4.0, Terminal Server Edition (WTS), Microsoft changed it for Windows 2000 (Win2K). The rules, available license types, prices, and the steps required to set up licenses are slightly different in Win2K. Explore how Windows 2000 Terminal Services licensing works in Microsoft's first integrated terminal server product, learn how to set up licenses, and discover the logic behind the changes.

Licensing Roles in Windows 2000
Several players cooperate to make Terminal Services licensing work: terminal servers, license servers, and the Microsoft clearinghouse that enables license servers and access licenses. Figure 1, page 110, shows how these three players cooperate. Which machine you make into a license server depends on how your network is set up. In a purely Win2K domain, the license server must be a domain controller. In a workgroup or NT 4.0 domain, the license server can be a member server—it can even be the terminal server. (This setup is possible because a license server's duties aren't resource intensive.)

The first time a client machine accesses the terminal server, the terminal server will accept the license that the client offers or request a license from the license server. The terminal server finds the license server by discovery (i.e., broadcasting in workgroups and NT 4.0 domains or polling the domain controllers in Win2K domains). If the terminal server can find the license server and the license server has a license to issue, the license server will give a license to the terminal server, and the terminal server will issue the license to the client machine (not the user). The terminal server then lets the client machine make the terminal connection. If the terminal server is unable to connect to the license server, the terminal server will accept clients' preexisting licenses. However, the terminal server won't permit clients without valid temporary or permanent licenses to log on. When a client disconnects from the terminal server, the client retains its license—the license doesn't go back to a pool. Thus, if I log on to a terminal server once from my office desk and once from my home office, I'll use up two separate licenses.

License Types
Terminal Services license servers recognize and manage four types of licenses. A client machine must have one of the following licenses to connect to the terminal server:

TSCALs are for named user accounts in the domain, and the license server issues them on a per-seat basis. Anyone in a company who's using the terminal server must have a TSCAL, regardless of whether he or she is using Microsoft's RDP display protocol or Citrix's ICA display protocol (i.e., if you've installed Citrix MetaFrame for Win2K) to connect to the terminal server. To access a Win2K server, a client also needs a 2000 Client Access License (2000CAL). Microsoft sells TSCALs for retail trade in 5-packs and 20-packs. A 5-pack costs $749 retail, and an upgrade from a WTS 5-pack costs $349. (That comes to a little less than $150 per head retail, which is about what WTS TSCALs cost.)

The way you buy TSCALs will determine how you pay for them and how much flexibility you have in the purchase. Most people who buy small volumes of Microsoft products will buy TSCALs as part of a 5-CAL or 20-CAL Microsoft License Pak (MLP). Physically, an MLP is a thin cardboard envelope that contains the End User License Agreement (EULA) that denotes the number of CALs purchased. MLPs for Win2K TSCALs also include a license code, which is a 25-character alphanumeric code that identifies what the license is for and how many TSCALs it purchases (so, you can't fudge the entries and say that you bought 20 TSCALs when you really bought only 5). You can install an MLP only once. Small to midsized companies can acquire licenses through a program called Microsoft Open License, which lets customers purchase a user-specified quantity of licenses. After you purchase licenses this way, Microsoft issues you an Open License Authorization and license numbers for the licenses, which you can install as many times as you need to. Select and Enterprise Agreements for large companies work in a similar manner as open licenses except that customers provide their Enrollment Agreement number instead of the Open License number.

The Terminal Services Internet Connector license lets as many as 200 concurrent users connect anonymously to a terminal server through the Internet. You can't use an Internet Connector license to dial in to the network from home—you need a TSCAL for your home computer. The Internet Connector license's sole purpose is to demonstrate Web-enabled applications to Internet users. According to Microsoft, you can't install the Internet Connector license pack on a Win2K terminal server for employees. The server permits Internet Connector license clients to access Terminal Services only anonymously through the Internet. A 200-pack Win2K Internet Connector license costs $9999 and is available to only Microsoft Select volume customers.

Frankly, the Internet Connector licenses aren't good for much because you can't legally use them to give employees access to Terminal Services from home. Although you might think Internet Connector licenses sound useful for application service providers (ASPs—companies that lease applications to users through a dial-up connection), they're not. Microsoft is still figuring out how the Terminal Services licensing for ASPs will work. Terminal Services for ASPs might eventually be available as an additional product (i.e., Win2K Terminal Services for ASPs) or as an add-on to Win2K. As of October 1999, Microsoft was working with about 50 ASPs to see how client licensing should work. At that point, Microsoft was using the TSCAL model. Under this model, the company charges ASPs each month for the number of user accounts the ASPs are supporting. In contrast, in Citrix's model for ASPs, the company charges ASPs per month based on the number of concurrent users the ASPs average for that month.

The two remaining license types are simpler. Windows 2000 Professional (Win2K Pro) comes with a built-in TSCAL. All other OSs (including NT Workstation) must purchase a TSCAL. Clients acquire a temporary license when the terminal server requests a license and the license server doesn't have any to offer (perhaps because you haven't installed a license pack yet). In this situation, the license server issues a temporary license, then tracks the issuance and expiration of the license.

Not all terminal service functions require one of these four licenses. If you run Terminal Services in Remote Administration mode (an option when you're installing Terminal Services), you don't need TSCALs because Remote Administration mode comes with two administrator licenses.

Activating Terminal Services Licenses
So far, the licensing structure looks familiar to users who have used WTS. However, Win2K has a new requirement for terminal service licensing—activation. You can't just plug in the terminal server and let clients log on. Temporary licenses will function for a limited time (90 days), so to fully enable Win2K terminal server licenses, you must activate the license server and download the license key. Until now, only Citrix WinFrame and MetaFrame required activation.

Activation ensures that you've paid for the licenses you're using. According to Citrix, activation also helps technical support keep track of you for better customer support. (However, I have a sneaking suspicion that the monetary concerns are the key motivation.) When you activate a license, you provide your product number to Microsoft. Microsoft then runs an encryption algorithm on your product number and sends you the results as an activation code. Next, you send the activation code back to Microsoft, and the company runs another encryption algorithm on it and sends you a license code that corresponds to your activation code. Although this step is extra, the process isn't too arduous. According to Microsoft, TSCAL activation is a sort of pilot project to see how activation works. If the trial is a success, Microsoft will require activation for other products in the future.

Terminal Services licensing installs as an option. (If you want to add this option to a server or domain controller, go to the Control Panel Add/Remove Programs applet and select Add/Remove Windows Components.) When you first open the Terminal Services licensing tool, the system presents you with a dialog box similar to the one that Screen 1, page 112, shows. To set up the license server to monitor license usage and assign TSCALs, you need to activate the server and have Microsoft assign client licenses to the server.

To activate the license server, right-click the license server's icon in the Terminal Services Licensing dialog box and select Activate Server from the context menu. This action starts the Activation wizard, which gives you four options for contacting Microsoft to give the company your product number. The default option is to use the Internet. This option provides a direct connection to Microsoft but requires the license server to have an Internet connection. Your other options include connecting through the Web from the license server or another computer with an Internet connection (not a direct connection to Microsoft as the default option provides), telephone, or fax. For my example, I'll choose the Web option and click Next.

As Screen 2 shows, the wizard instructs you to take your Product ID and go to https://activate.microsoft.com. On this Web page, you have the choice of activating a license server or installing license key packs. Select the option to activate the server, and click Next. Input the required product ID number, personal information, and purchase method, and click Next. Review the information onscreen, and be sure that you entered the product ID correctly or the activation code won't work on your server. Click Next to submit the information. The Web site will spit out your activation code. Input the activation code into the wizard to activate the server, which will then appear in the Terminal Services Licensing dialog box with a status of Activated.

You can end your connection with the activation Web site, or you can acquire client licenses based on the code that the site is displaying. You need client licenses, so you might as well continue. To move to the next screen of the site's Web licensing tool, click Yes. On the resulting page, input the codes of all the license packs you have (i.e., the MLP number or your Open License or Enrollment Agreement number). Again, confirm the information that you've entered and click Next to submit it. The Web site will spit out a valid license pack number that works with the server you activated. To install the license pack number, return to the Terminal Services Licensing dialog box and right-click the activated server. Select the Install Licenses option from the context menu. When prompted, input the license pack number in the boxes provided by the wizard, as Screen 3 shows. This license pack number works with only this server, and if the license pack number is for a retail purchase, you can install the number only once.

The Clock Is Ticking
You have only 90 days to activate a TSCAL license server. Use those 90 days to ensure that you're running the licensing service on the system that is best for the job. The client licenses you create will work only on the server you've activated.

Terminal Services licensing sounds complicated, and the process of activating license servers and generating license packs sounds even worse. However, the process isn't that difficult if you understand which client types need which license types, ensure that the terminal servers can connect to the license servers, and properly activate and install license packs on the license servers.