Remote Desktop License Server Security Group Configuration

Summary

When the Remote Desktop Licensing role service is installed on the server, the Terminal Server Computers local group is created. The license server will respond only to requests for RDS CALs from Remote Desktop Session Host servers whose computer accounts are members of this group if the Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\RD Licensing\License server security group Group Policy setting has been enabled and applied to the license server. By default, the Terminal Server Computers local group is empty.

When the Remote Desktop Licensing role service is removed from the server, the Terminal Server Computers local group is deleted.

Resolutions

To resolve this issue, check the event ID, and then view the troubleshooting information for that event in the sections below.

Resolution steps for the following event ID: 73

To resolve this issue, delete the Terminal Server Computers local group on the Remote Desktop license server. If the Remote Desktop Licensing role service is no longer installed on the server, the Terminal Server Computers local group is no longer needed.

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To delete the Terminal Server Computers group:

1. On the license server, open the Local Users and Groups snap-in. To open Local Users and Groups, click Start, click Run, type lusrmgr.msc, and then click OK.

2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

3. In the left pane, click Groups.

4. In the right pane, right-click Terminal Server Computers, click Delete, and then click Yes.

Note: If the license server is installed on an Active Directory domain controller, use the Active Directory Users and Computers snap-in (dsa.msc) to delete the Terminal Server Computers group. To delete the Terminal Server Computers group on a domain controller, you must have membership in the Domain Admins group in AD DS, or you must have been delegated the appropriate authority. To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK.

Resolution steps for the following event ID: 4141

To resolve this issue, add the computer account for the Remote Desktop Session Host (RD Session Host) server to the Terminal Server Computers local group on the Remote Desktop license server.

Note: When the License server security group Group Policy setting is enabled and applied to a license server, the license server will respond only to license requests from RD Session Host servers whose computer accounts are members of the Terminal Server Computers local group. This Group Policy setting can be found in Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\RD Licensing.

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To add the computer account for the RD Session Host server to the Terminal Server Computers group:

1. On the license server, open the Local Users and Groups snap-in. To open Local Users and Groups, click Start, click Run, type lusrmgr.msc, and then click OK.

2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

3. In the left pane, click Groups.

4. In the right pane, right-click the Terminal Server Computers group, and then click Properties.

5. Click Add.

6. In the Select Users, Computers, or Groups dialog box, click Object Types.

7. Select the Computers check box, and then click OK.

8. Locate and then add the computer account for the RD Session Host server that you want to add.

9. Click OK to close the Select Users, Computers, or Groups dialog box, and then click OK to close the Terminal Server Computers Properties dialog box.

Note: If the license server is installed on an Active Directory domain controller, use the Active Directory Users and Computers snap-in to add the computer account for the RD Session Host server to the Terminal Server Computers group. To add the computer account for the RD Session Host server to the Terminal Server Computers group on a domain controller, you must have membership in the Domain Admins group in AD DS, or you must have been delegated the appropriate authority. To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK.

Resolution steps for the following event ID: 71, 4140

Create the Terminal Server Computers local group on the license server

To resolve this issue, create the Terminal Server Computers local group on the Remote Desktop license server.

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To create the Terminal Server Computers group:

1. On the license server, open the Local Users and Groups snap-in. To open Local Users and Groups, click Start, click Run, type lusrmgr.msc, and then click OK.

2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

3. In the left pane, right-click Groups, and then click New Group.

4. In Group name, type Terminal Server Computers, click Create, and then click Close.

Note: If the license server is installed on an Active Directory domain controller, use the Active Directory Users and Computers snap-in to create the Terminal Server Computers group. To create the Terminal Server Computers group on a domain controller, you must have membership in the Domain Admins group in AD DS, or you must have been delegated the appropriate authority. To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK.