How to install RDS role and CALs on Windows Server 2019?

How to install RDS role and CALs on Windows Server 2019?

In this article, we will examine the installation, configuration, and activation of the Remote Desktop role on Windows Server 2019. We will also cover the installation and activation of RDS Client Access Licenses (CALs).

After installing the RDS role, users can only use it for a 120-day trial period. Users cannot connect to an RDS host afterward. According to Microsoft rules, all users or devices that use RDS functions must have a license. Remote Desktop License Server is a service that registers and issues Remote Desktop Client Access Licenses (RDS CALs).

Install Remote Desktop Licensing Role on Windows Server 2019/2016

You can deploy the Remote Desktop Licensing Service on any domain server. There is no need to install it on any of the servers in the RDSH farm.

Before you begin the installation, add a new server to the Terminal Server License Servers domain security group. Otherwise, the server will not be able to issue RDS Per User CALs to domain users.

For example, you can install the Remote Desktop license using Server Manager. To do this, select the Remote Desktop Services role in the Add Roles and Features wizard.

Select Remote Desktop Licensing as the role service.

It remains to wait for the role installation to complete.

The RDS-Licensing service is managed using the Remote Desktop Licensing Manager console (licmgr.exe).

In Windows Server, it’s easier to install roles and features using PowerShell. To install RDS Licensing Service and RD Licensing Diagnoser, simply run one command:

Install-WindowsFeature RDS-Licensing –IncludeAllSubFeature -IncludeManagementTools

To list the RDS services installed on the host, use the command:

Get-WindowsFeature -Name RDS* | Where installed

Activating RDS License Server on Windows Server

To issue licenses to RDP clients, your RDS license server must be active. To do this, open the Remote Desktop Licensing Manager (licmgr.exe). Then right-click your server name and select Activate Server.

The RDS License Server Activation Wizard starts. Here, you’ll need to select your preferred activation method. The server will automatically connect to Microsoft servers and activate the RDS License Server. If there’s no connection, you can activate the server using a web browser or by phone.

You must then fill in some information about your company (some fields are mandatory).

All that remains is to click on the Finish button.

By right-clicking on the server name and Review Configuration , you can verify that it is active. It can then be used to activate RDSH clients.

• This license server is a member of the Terminal Server License Servers group in Active Directory. This license server will be able to issue RDS per-user CALs to domain users. And you will be able to track RDS per-user CAL usage.
• This license server is registered as a Service Connection Point (SCP) in Active Directory Domain Services.

RDS CALs: Types of Remote Desktop Client Access Licenses

Each user or device connecting to the Remote Desktop session hosts must have a Client Access License (CAL). There are two types of RDS CALs:

• Per Device CAL – is the type of permanent license assigned to a computer that connects to the RDS server more than once. These licenses are not concurrent. That is, if you have 10 Per Device licenses, only 10 hosts can connect to your RDS server. The current RDS OVL CAL is called: WinRmtDsktpSrvcsCAL 2019 SNGL OLV NL Each AP DvcCAL;
• Per-User CAL – is the type of license that allows a user to connect to the RDS server from any number of computers. This type of license associates with an Active Directory user for a specific period. The license is valid for a period of 52 to 89 days (random number). The current Open Value license of this type is called WinRmtDsktpSrvcsCAL 2019 SNGL OLV NL Each AP UsrCAL.

If you use RDS 2019 Per Device CAL in a Workgroup environment, the RDS server will terminate a user session every 60 minutes. The following message will appear: “Remote Desktop License Problem: There is a problem with your Remote Desktop license, and your session will be disconnected in 60 minutes.” Therefore, for RDS servers in a Workgroup environment, you must use Per Device RDS CALs.

. 

Note:  We should note that the RDS 2016 CAL can only be installed on a license server running Windows Server 2016 or 2019. Thus, installing RDS CALs on previous versions of Windows Server is not supported. Also, you cannot install RDS 2016 CALs on a Windows Server 2012 R2 license host.

When trying to add new RDS 2019 CALs on Windows Server 2016, an error appears:

Installing RDS CALs on Windows Server 2019/2016

You now need to install the Remote Desktop Client License Pack (RDS CAL) you purchased on the license server.

Right-click your server in Remote Desktop Licensing Manager and select Install Licenses .

Select the activation method and licensing program (in our case, it is the Enterprise Agreement).

Many RDS enterprise agreement numbers have already been leaked online. I think it won’t be a problem to find the numbers (4965437). You don’t even need to look for RDS cracks or activators.

The next steps in the wizard depend on the licensing program you selected. If you selected an Enterprise Agreement, you must specify its number. If you selected a license pack, enter the 25-character product key you received.

Indicate:

• the product version (Windows Server 2019/2016),
• the type of license (RDS Per user CAL)
• the number of licenses to install on the server.

Then the server can issue licenses (RDS CALs) to clients.

You can convert RDS User CALs to Device CALs (and vice versa) using the Convert Licenses menu item in the RD Licensing Manager console.

In case of shortage, you can revoke previously issued unused CALs using the following PowerShell script:

$RevokedPCName=”lon-bc1-123”
$licensepacks = Get-WmiObject win32_tslicensekeypack | where {($_.keypacktype -ne 0) -and ($_.keypacktype -ne 4) -and ($_.keypacktype -ne 6)}
$licensepacks.TotalLicenses
$TSLicensesAssigned = gwmi win32_tsissuedlicense | where {$_.licensestatus -eq 2}
$RevokePC = $TSLicensesAssigned | ? sIssuedToComputer -EQ $RevokedPCName
$RevokePC.Revoke()

Up to 20% of Per-Device RDS CALs can be revoked. Per-User CALs cannot be revoked.

RDS CAL Usage Reports

In the RDS Licensing Console, you can generate a license usage report. To do this, select Create Report -> CAL Usage from the server context menu.

However, I prefer to use PowerShell to report RDS CAL usage. The following script reports the number of licenses remaining in all RDS CAL packs:

Import-Module RemoteDesktopServices -ErrorAction Stop
Set-Location -Path 'rds:' -ErrorAction Stop
$licenses = (Get-Item -Path RDS:\LicenseServer\LicenseKeyPacks\* | Where-Object Name -Like "-Per User-*").Name
$total=0;
$issued=0;
foreach ($license in $licenses) {
$count=(Get-Item -Path RDS:\LicenseServer\LicenseKeyPacks\$license\TotalLicenses).CurrentValue
$total= $total + $count
$count2=(Get-Item -Path RDS:\LicenseServer\LicenseKeyPacks\$license\IssuedLicensesCount).CurrentValue
$issued= $issued + $count2
}
$available = $total - $issued
Write-Host "Total Licenses available: $available"

You can run this PowerShell script through Zabbix and trigger an alert if the number of remaining licenses is less than 5, for example.

The following Powershell script will allow you to generate a CAL report per user:

Import-Module RemoteDesktopServices -ErrorAction Stop
Set-Location -Path 'rds:' -ErrorAction Stop
$path = “C:\Reports\RDS_CAL_Usage.csv”
$fileName = (Invoke-WmiMethod Win32_TSLicenseReport -Name GenerateReportEx).FileName
$fileEntries = (Get-WmiObject Win32_TSLicenseReport | Where-Object FileName -eq $fileName).FetchReportEntries(0,0).ReportEntries
$objArray = @()
foreach($entry in $fileEntries){
$objArray += $entry | select User, ProductVersion, CALType, ExpirationDate
$objArray[-1].User = $objArray[-1].User.Split('\') | select -Last 1
$time = $objArray[-1].ExpirationDate.Split('.') | select -first 1
$objArray[-1].ExpirationDate = [datetime]::ParseExact($time, "yyyyMMddHHmmss", $null)
}
$objArray | Export-Csv -Path $path -Delimiter ',' -NoTypeInformation

How do I remove RDS CALs from an RD License Server?

If you want to move your RDS CAL packs from one Remote Desktop license server to another, you can remove the installed RDS CAL pack from the license server using PowerShell.

Using the following cmdlet, you can list all RDS CAL packs installed on the server:

Get-WmiObject Win32_TSLicenseKeyPack|select-object KeyPackId,ProductVersion,TypeAndModel,AvailableLicenses,IssuedLicenses |ft

Find the KeyPackId value for the RDS CAL package you want to delete and run the command:

wmic /namespace:\\root\CIMV2 PATH Win32_TSLicenseKeyPack CALL UninstallLicenseKeyPackWithId yourKeyPackId

You can also completely remove all CALs by rebuilding the RDS license database. In other words, stop the Remote Desktop Licensing Service:

Stop-Service TermServLicensing

Rename the file C:\Windows\System32\lserver\TLSLic.edb to C:\Windows\System32\lserver\TLSLic.edb_bak and start the service:

Start-Service TermServLicensing

After this, all RDS CAL licenses will be deleted, and you will need to reactivate them.

Configuring RDS Licenses on RD Session Hosts

By the server manager

Once the RDS License Server is enabled, you can reconfigure the RD Session Host to obtain CALs. This allows you to set the license type and specify the license server name. There are two ways to do this: from Server Manager or Group Policy.

To change the license server name/address on the RDS host, open Server Manager -> Remote Desktop Services -> Collections. In the top right menu “Tasks”, select “Edit Deployment Properties”.

In the deployment properties, go to the RD Licensing tab, select the Remote Desktop licensing mode, and set the RDS license server. Click Add -> Ok.

If the license type is not set on the RDSH server, you will receive the error “Licensing mode for the Remote Desktop Session Host is not configured”.

You can change the RDS license server address and CAL type using PowerShell:

$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting

Then specify the type of license you need:

$obj.ChangeMode(4)

Note: Enter 4 if the server should use Per User license type, and 2 if Per Device. 

Then specify the name of the RDS license server:

$obj.SetSpecifiedLicenseServerList("rdslic2016.woshub.com")

And check the current settings:

$obj.GetSpecifiedLicenseServerList()

By the Group strategy

If you want to assign RDS license server settings via Group Policy, you need to create a new GPO and link it to the OU with RDS servers (or you can specify the RDS license server name using the Local Group Policy Editor – gpedit.msc). RDS license settings are located in the following section of the GPO: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Licenses.

There are two Remote Desktop settings we need to configure:

• Use specified Remote Desktop license servers – the license server address is set;
• Set Remote Desktop Licensing Mode – Select RDS CAL license type.

RDSH hosts use the following network ports to obtain an RDS license from the RDS License Server. Ensure that the firewall is not blocking the following ports:

• TCP/135 – RPC from Microsoft;
• UDP/137 – NetBIOS Datagram Service;
• UDP/138 – NetBIOS Name Resolution;
• TCP/139 – NetBIOS Session Service;
• TCP/445 – SMB;
• TCP/49152-65535 – RPC dynamic address range

Warnings

You can check open ports using the PortQry tool or the Test-NetConnection cmdlet.

Try checking the status of the RD License Server and the number of issued licenses using the Remote Desktop Licensing Diagnoser tool (lsdiag.msc or Administrative Tools -> Remote Desktop Services -> RD Licensing Diagnoser). The RD Licensing Diagnoser tool can be installed on RDSH servers using Server Manager (Features -> Remote Server Administration Tools -> Role Administration Tools -> Remote Desktop Services Tools -> Remote Desktop Licensing Diagnoser Tools).

If the RDSH server is not configured to use an RDS license server, the following warnings appear in the Licensing Diagnoser console:

• Licenses are not available for this Remote Desktop Session Host server, and RD Licensing Diagnose has identified licensing issues for the RDSH.
• Number of licenses available for customers: 0
• The licensing mode for the Remote Desktop Session Host server is not configured.
• The Remote Desktop Session Host server is in its grace period, but the Remote Desktop Session Host server has not been configured with any license servers.

If you have installed RDSH on the evaluation edition of Windows Server, remember to convert it to the full version by following the guide. Without conversion, RDSH services on such a host will only work for 120 days, even if you target it to an activated RDS license server.

If there are no warnings and the message “RD Licensing Diagnoser did not identify any licensing problems for the Remote Desktop Session Host server” is displayed, the RDSH server can receive RDS CALs for remote users and/or devices.

Note: In our case, after specifying the new license server address, the following error started appearing on the RDP client: “The remote session was disconnected because there is no Remote Desktop license server available to provide a license.” The problem can be resolved by deleting the L$RTMTIMEBOMB key from the registry on the RDSH server.