Control the Issuance of Terminal Services Client Access Licenses (TS CALs)

Applies To: Windows Server 2008

By default, a Terminal Services license server issues a Terminal Services client access license (TS CAL)—if an appropriate TS CAL is available—to any terminal server that requests one on behalf of a client that is trying to connect to the terminal server.

Control which terminal servers are issued TS CALs

For security reasons, you might want to specify the terminal servers to which a license server will offer TS CALs. You can use the License server security group Group Policy setting to control which terminal servers are issued TS CALs by the license server.

If you enable the License server security group policy setting and this Group Policy setting is applied to a Terminal Services license server, the license server will respond only to requests for TS CALs from terminal servers whose computer accounts are a member of the Terminal Server Computers group on the license server.

The Terminal Server Computers group is created as a local group on the license server the first time the Terminal Services Licensing service is started on the license server. By default, the Terminal Server Computers group is empty. The Terminal Server Computers group is not deleted or changed in any way by disabling or not configuring the License server security group policy setting.

If you disable or do not configure the License server security group policy setting, the license server issues a TS CAL—if an appropriate TS CAL is available—to any terminal server that requests one.

The License server security group policy setting can be found in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\TS Licensing and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (https://go.microsoft.com/fwlink/?Linkid=89673).

Control which version of TS CALs are issued to terminal servers

A license server attempts to provide the most appropriate TS CAL for a connection. For example, a Windows Server 2008 license server will try to issue a Windows Server 2008 TS CAL for clients connecting to a terminal server running Windows Server 2008, and will try to issue a Windows Server 2003 TS CAL for clients connecting to a terminal server running Windows Server 2003.

By default, if the most appropriate TS CAL is not available for a connection, a Windows Server 2008 license server will issue a Windows Server 2008 TS CAL, if available, to the following:

• A client connecting to a Windows Server 2003 terminal server

• A client connecting to a Windows 2000 terminal server

You can use the Prevent license upgrade Group Policy setting to change this default behavior. If you enable the Prevent license upgrade policy setting, the license server will issue only a temporary TS CAL to the client if an appropriate TS CAL for the terminal server is not available. If the client has already been issued a temporary TS CAL and the temporary TS CAL has expired, the client will not be able to connect to the terminal server unless the TS Licensing grace period for the terminal server has not expired. For more information about the grace period, see Overview of TS Licensing.

The Prevent license upgrade policy setting can be found in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\TS Licensing and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (https://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

• Managing TS Licensing

• Terminal Services Client Access Licenses (TS CALs)