Citrix states in their article: CTX564283

CTX564283 - How to Troubleshoot 1003 and 1004 Terminal Server Licensing Errors

This document was published at: http://support.citrix.com/kb/entry.jspa?externalID=CTX564283

Document ID: CTX564283, Created on: Aug 12, 2002, Updated: Feb 19, 2004

Products: Citrix MetaFrame XP 1.0 for Microsoft Windows 2000, Citrix MetaFrame 1.8 for Microsoft Windows 2000, Citrix MetaFrame XP 1.0 for Microsoft Windows 2003

Follow the tips and suggestions below to answer inquiries of this nature.

Problem Description

Users attempting to connect to a MetaFrame 1.8 or MetaFrame XP server on Windows 2000 may experience the following Terminal Services related errors in the event viewer:

Event ID: 1003
Source: TermService
Type: Information

The terminal service client has provided an invalid license.

Q294326

OR

Event ID: 1004
Source: TermService
Description: Unable to acquire a license for user name, domain name.

Known Issues

WARNING! Several resolutions in this document recommend editing the registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Make sure you back up the registry before you edit it. If you are running Windows NT, also update your Emergency Repair Disk (ERD).

Issue 1

When connecting with a Citrix ICA Client after downloading an RDP Web Client, the RDP Client may not exhibit any problems and continue to connect.

Background

With Microsoft licenses (both regular CAL and Terminal Services CAL), if not connecting from a Windows 2000 Professional or Windows XP Professional based client, before an ICA connection is established, the client license must be confirmed to exist. Insufficient permissions to this registry key results in connection failures. If the connection continues to fail, check the Microsoft Terminal Services License manager to see if the workstation is enumerated. If not, this is not considered a Citrix issue. For more information, Contact Microsoft Support. Verify that your Windows 2000 Terminal Licenses are activated. For more detailed information, see the Microsoft White Paper: “MS Windows 2000 Terminal Services Licensing.”

Cause

The event log does not specify the client device that provided the invalid license. Insufficient permissions are being applied to the Microsoft license key in the registry for the Authenticated Users group. When testing, attempt to create an RDP connection after removing the MSLicense key in the registry as a user (no Domain Admin or Power User Group); the RDP connection will also fail.

Resolution

These changes take effect from the client device.

NOTE: If you are making a desktop connection, then opening Program Neighborhood inside the desktop session (Pass-through) and the subsequent ICA connection is failing, the affected Workstation, in this case, is actually the server.

1.
Open the Registry Editor (Regedt32.exe).

2.
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSLicensing.

3.
Highlight this key, select Security on the toolbar, and select Permissions.

4.
Click the Advanced key.

5.
Verify that the Authenticated Users group is in Permissions Entries.
Note: If this group is not found, click Add, select the Users Group, and click OK.
In Permission Entry for MSLicensing, give full control to the Users group and click OK. In the Access Control Settings for MSLicensing, click Apply, then OK. In Permission Entry for MSLicensing, click Apply and then OK.

6.
Attempt to connect using the Win32 Client.

Issue 2

After moving the Terminal Services Licensing server, RDP clients do not exhibit any problems and continue to connect.

Cause

A potential race condition between the Icaapi.dll and Rdpwsx.dll dynamic-link libraries (DLLs) may cause the private certificate key on the Terminal Services server to be unsynchronized.

Resolution

These changes take effect for the client side workstation.

Note: If you are making a desktop connection, then opening Program Neighborhood inside the desktop session (Pass-through) and the subsequent ICA connection is failing, the affected Workstation, in this case, is actually the server.

1.
From the Terminal Server, locate the following path in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters

Add the following value: DefaultLicenseServer
Data type: REG_SZ
Data value: Server Name

Note: Server Name, “the name of the licensing server, can be a NetBIOS name or IP address.

2.
Follow Microsoft TechNet Article Q323597 for the repair of the certificate keys on the Terminal Server.

Issue 3

This issue is about connecting an ICA Client using a Wyse WT1200LE Version 4.2.x terminal. This is a known issue that exists with the firmware shipped with this thin client device. Upgrading to the firmware Version 4.2.020 (the latest available) does not resolve this issue. Using an earlier version of the firmware resolved this issue.

Symptoms

1.
An individual workstation may connect to MetaFrame server A but not to MetaFrame server B.

2.
Some client workstations may connect to all servers while others are denied to some servers.

3.
In both cases, the RDP client connection from the same workstation may connect to both MetaFrame servers A and B.

Troubleshooting Steps

1. How many TSCal servers are installed and where are they installed? Are you using Active Directory Services or Windows NT 4.0 domain?

If your Terminal Servers are members of an Active Directory domain, should install the TS License Server on a domain controller in the root domain of the forest. There can be only one Enterprise TS License server per Active Directory site. Install one Enterprise TS License server for each site in the Active Directory forest. For the Active Directory Object to be created properly, install TS Licensing as an Enterprise Administrator or an Admin belonging to the root domain. If an empty root domain is created, the Active Directory Object for the TS-Enterprise-License-Server may not get created properly. Does the object look like it is in the Active Directory Sites and Services and can it be queried using an LDAP query? If you follow this process, all Windows 2000 servers running Terminal
Services will discover their site-wide Enterprise TS license server by LDAP lookup. Whether or not Active Directory is used is very important with regard to the TS License Server discovery process. See these Knowledgebase article for more information about the TS License server discovery process: Q232520, Q261110, Q304080.

2. How many Terminal Servers generate the error(s) and are the Terminal Servers on the same subnet/domain as the TSCAL Server?

When only MetaFrame servers were on the same subnet, changing the TCP/IP configuration on the MetaFrame servers to h-node for WINS, adding a WINS server to the mix, and using the DefaultLicenseServer registry key, all servers in the Active Directory were able to find the TS License server. See Known Issue 2. Therefore, does specifying the NetBIOS name of the TS License server by modifying the following registry value help?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters\DefaultLicenseServer

The NetBIOS name, of course, must be resolvable.

3. Does it make a difference if the user on the workstation is an administrator or user class account? This is also important to know when the server is acting as the client in pass-through mode.

4. What ICA Client version are you using?

5. Which Windows/non-Windows workstations are experiencing these symptoms?

6. Are there temporary TSCal servers in TS Admin?

7. Is Q287687applied? Is Q315404 applied? Is Microsoft Service Pack 3 applied? Do Q270898, Q277917, or Q294655 help?

8. Is Control Panel - MSLicensing set to per-server or per-seat?

9. HOW TO: Use the Terminal Services Licensing Reporter Tool (Lsreport.exe)

Isolation Steps

1. Isolate the problem server to a workgroup and/or promote it to a domain controller.

2. Enable this server as a TSCAL Server.

3. Create at least two ICA sessions to this server.

4. Disable the TSCAL Server from this server.

5. If applicable, demote the server.

6. Rejoin the original domain.

7. Attempt to create an ICA session.

Note: These steps are known to correct the above issue. The above action items, if completed successfully, will prove that:

A. No changes were made to the MetaFrame server.

B. The only changes that occured were at the operating system level.