Home / server / Questions / 958890
Accepted
prd
Asked: 2019-03-19 19:22:27 +0800 CST

Windows RD Licensing: Double license from uppercase and lowercase user name

  • 772

I was having problem with RDS license. So I checked my license usage, and found out that a user takes 2 license. The user DOMAIN\pajak below is using DOMAIN\PAJAK and DOMAIN\pajak. I can't revoke the license either from one of them.

RDS Screenshot

The license will expire on May, and I am short 2 licenses since there are 2 users having similar problem. When I right click on the name, I got a greyed "Revoke License" option. I am the administrator.

  • How can this happened, and how to fix this? i.e, remove double licenses.
  • Since it seems RDS CAL are case sensitive, how can I limit user to use only lowercase, and reject uppercase login from windows RDS?

Note: The user Pajak, means tax, is for government login, to check our finance. It is a requrement from our government to give a certain government liaison to audit our ledger in exchange for our special tax privileges. Thus, I can only limit our system not to allow him do something bad. But I can't trust them to put a notice on their system nor organization. I can warn the other user that I've stripped off, but not this user.

Thank you

windows

2 Answers

  1. You can't revoke RDS User CALs. You can remove/re-add the license pack or rebuild the database. http://sigkillit.com/2017/08/31/remove-rds-cals-from-rds-server/

    • 0
  2. Best Answer

    I know this is old but the same issue occured with me on a windows 2019 rds farm. This is what fixed my problem, from the Microsoft technet forums. https://social.technet.microsoft.com/Forums/windows/en-US/bb5d15b8-11f8-4ffc-99c8-afe491ce504a/2019-cal-user-license-duplicates-based-upon-case-sensitivity?forum=winserverTS

    This can be happen if the license attributes are not able to be updated on the user account object due to lack of permission. What I would recommend is to first grant the necessary permissions in AD, and then you can rebuild the database to clean things up.

    When things are working properly, if a user logs on you should see their license issued as you do now in RD Licensing Manager, and you should see the RD licensing attributes on their user account object. You may use AD Users & Computers -- View Advanced Features -- right-click on the user -- Attributes tab -- look for several msTS* attributes such as msTSExpireDate, msTSManagingLS, etc. If these are blank and the user shows up in RD Licensing Manager it is likely the permissions issue.

    You can grant the permissions using Active Directory Users and Computers using below basic steps:

    On the OU that contains your users, right-click and choose Delegate Control... , follow wizard On Users and Groups page, click Add and then enter SELF On Tasks to Delegate page, select Create a custom task to delegate On Active Directory Object Type page select Only the following objects in the folder, then scroll down and select User objects On Permissions page, select General, then scroll down and select Read and write Terminal Server license server Once you have updated the permissions, please log on with a user account that doesn't have their licensing attributes populated and then check after successfully logged on that the attributes now have values.

    Please reply back with your results.

    Thanks.

    -TP

    • 0