Control the Issuance of Remote Desktop Services Client Access Licenses (RDS CALs)

For security reasons, you might want to specify the RD Session Host servers to which a license server offers RDS CALs. You can use the License server security group Group Policy setting to control which RD Session Host servers are issued RDS CALs by the license server.

If you enable the License server security group policy setting and this Group Policy setting is applied to a Remote Desktop license server, the license server responds only to requests for RDS CALs from RD Session Host servers whose computer accounts are members of the Terminal Server Computers group on the license server.

The Terminal Server Computers group is created as a local group on the license server the first time the Remote Desktop Licensing service is started on the license server. By default, the Terminal Server Computers group is empty. The Terminal Server Computers group is not deleted or changed in any way by disabling or not configuring the License server security group policy setting.

If you disable or do not configure the License server security group policy setting, the license server issues an RDS CAL—if an appropriate RDS CAL is available—to any RD Session Host server that requests one.

Note

You should only enable the License server security group policy setting when the license server is a member of a domain. You can only add computer accounts for RD Session Host servers to the Terminal Server Computers group when the license server is a member of a domain. The policy setting has no effect if you enable the policy setting on a license server that is a member of a workgroup; the license server continues to issue RDS CALs to any RD Session Host server that requests RDS CALs from the license server.

The License server security group policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\RD Licensing and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC).

	Note
	If the License server security group policy setting is enabled and applied to a license server, it is noted in Review Configuration in the Remote Desktop Licensing Manager tool. For more information about Review Configuration, see Review the Configuration of a Remote Desktop License Server.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (https://go.microsoft.com/fwlink/?LinkId=138134).

A license server attempts to provide the most appropriate RDS CAL for a connection. For example, a Windows Server 2008 R2 license server tries to issue a Windows Server 2008 R2 RDS CAL for clients connecting to an RD Session Host server running Windows Server 2008 R2, and tries to issue a Windows Server 2003 TS CAL for clients connecting to an RD Session Host server running Windows Server 2003.

	Note
	In Windows Server 2008 R2, Terminal Services client access licenses (TS CALs) are now called Remote Desktop Services client access licenses (RDS CALs).

By default, if the most appropriate RDS CAL is not available for a connection, a Windows Server 2008 R2 license server issues a Windows Server 2008 R2 RDS CAL, if available, to the following:

• A client connecting to a Windows Server 2003 RD Session Host server
  
  
• A client connecting to a Windows 2000 RD Session Host server
  
  

You can use the Prevent license upgrade Group Policy setting to change this default behavior. If you enable the Prevent license upgrade policy setting, the license server issues only a temporary RDS CAL to the client if an appropriate RDS CAL for the RD Session Host server is not available. If the client has already been issued a temporary RDS CAL and the temporary RDS CAL has expired, the client is not able to connect to the RD Session Host server unless the RD Licensing grace period for the RD Session Host server has not expired. For more information about the grace period, see Overview of Remote Desktop Licensing.

The Prevent license upgrade policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\RD Licensing and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (https://go.microsoft.com/fwlink/?LinkId=138134).