{"id":11819,"date":"2017-05-11T10:18:21","date_gmt":"2017-05-11T02:18:21","guid":{"rendered":"http:\/\/i-services.info\/wordpress\/?p=11819"},"modified":"2020-04-15T10:06:21","modified_gmt":"2020-04-15T02:06:21","slug":"%e6%98%af%e5%90%a6-windows-2012-r2-workgroup-%e7%9a%84-rds-%e6%9e%b6%e6%a7%8b%ef%bc%8c%e7%84%a1%e6%b3%95%e6%8e%a1%e8%b3%bc-rds-user-cal%ef%bc%8c%e5%83%85%e8%83%bd%e8%b3%bc%e8%b2%b7-rds-device-cal","status":"publish","type":"post","link":"http:\/\/i-services.info\/wordpress\/?p=11819","title":{"rendered":"\u662f\u5426 Windows 2012 R2 workgroup \u7684 RDS \u67b6\u69cb\uff0c\u7121\u6cd5\u63a1\u8cfc RDS user CAL\uff0c\u50c5\u80fd\u8cfc\u8cb7 RDS device CAL?"},"content":{"rendered":"

\u554f\u984c\u63cf\u8ff0<\/u><\/b>\uff1a<\/b><\/b> <\/p>\n

Windows 2012 R2 workgroup \u7684\u74b0\u5883\u4e0b\uff0cRDS user CAL \u7121\u6cd5\u6301\u7e8c\u6b63\u5e38\u904b\u4f5c\uff0c\u7d04 120 \u5929\u5f8c\uff0c\u7528\u6236\u7aef\u6703\u7121\u6cd5\u9023\u7dda\u4e26\u51fa\u73fe\u4ee5\u4e0b\u932f\u8aa4\u8a0a\u606f: <\/p>\n

\"clip_image004\"<\/a> <\/p>\n

\u8acb\u554f\u662f\u5426 Windows 2012 R2 workgroup \u7684 RDS \u67b6\u69cb\uff0c\u7121\u6cd5\u63a1\u8cfc RDS user CAL\uff0c\u50c5\u80fd\u8cfc\u8cb7 RDS device CAL?<\/font> <\/p>\n

\u89e3\u6c7a\u65b9\u6cd5<\/u><\/b>\uff1a<\/b> <\/p>\n

\u89e3\u7b54<\/b>:<\/b> \u662f\u7684<\/font>\uff0c\u6c92\u6709\u52a0\u5165\u7db2\u57df\u7684Windows 2012 R2 workgroup\u55ae\u6a5f\u7248\u4e3b\u6a5f\uff0c\u50c5\u80fd\u5920\u8cfc\u8cb7Per Device CAL\u88dd\u7f6e\u6388\u6b0a\u624d\u80fd\u652f\u63f4RDS\u9060\u7aef\u670d\u52d9\u67b6\u69cb\u3002 <\/p>\n

(1) \u4f9d\u64daRDS\u9060\u7aef\u684c\u9762\u670d\u52d9\u7684\u67b6\u69cb\u8a2d\u8a08\uff0c\u9700\u8981\u642d\u914dAD\u7db2\u57df\u4f86\u9032\u884c\u4f7f\u7528\u8005\u9060\u7aef\u5b58\u53d6\u7684\u7ba1\u5236\u3002\u5982\u679c\u8a72\u4e3b\u6a5f\u52a0\u5165\u7db2\u57df\u4e4b\u5f8c\uff0c\u624d\u80fd\u5920\u4f7f\u7528Per User CAL\u4f7f\u7528\u8005\u6388\u6b0a\u53bb\u7ba1\u5236\u9060\u7aef\u767b\u5165\u5b58\u53d6\u7684\u884c\u70ba\u3002 <\/p>\n

(2) \u56e0\u70baWindows Server\u55ae\u6a5f\u7248\u9810\u8a2d\u5c31\u5df2\u7d93\u5f37\u5236\u555f\u7528Per Device CAL\u88dd\u7f6e\u6388\u6b0a\u8a08\u7b97\uff0c\u5728\u7de9\u885d\u671f120\u5929\u5167\u662f\u4e0d\u9700\u8981\u8a3b\u518aCAL\u4e5f\u80fd\u5920\u9060\u7aef\u767b\u5165RDSH\u4e3b\u6a5f\uff0c\u904e\u4e86\u9019\u6bb5\u7de9\u885d\u671f\u9593\u53ea\u80fd\u5920\u8cfc\u8cb7Per Device CAL\u88dd\u7f6e\u6388\u6b0a\uff0c\u624d\u80fd\u5920\u63a7\u7ba1\u4e0d\u9650\u4eba\u6578\u7684\u4f7f\u7528\u8005\u9060\u7aef\u767b\u5165\u5b58\u53d6\u8a72\u4e3b\u6a5f\u3002 <\/p>\n

Per Device vs. Per User<\/b><\/b> <\/p>\n

Let\u2019s start with some basics.  RD Licensing is primarily deployed in one of two flavours; Per Device or Per User. Per Device is used to allocate a Client Access License (CAL) to each client device accessing an RD deployment, including VDI infrastructure. Per User licensing is used to allocate a CAL to each user connecting to an RD deployment (where an Active Directory infrastructure exists). A single RDSH can only accommodate one mode of licensing at a time. <\/p>\n

One of the first and most significant decisions an IT admin is faced with when setting up a Remote Desktop infrastructure is which mode they should use. Keeping things simple; licenses cost money, so choosing the model that has the least financial impact will often answer this question for you. I.e. which is less; the number of users connecting to an RD deployment or the number of client devices? This becomes particularly relevant in situations where one user may log onto multiple client machines, or multiple users share a single client device for example. <\/p>\n

That said, there are a number of distinctions between these two licensing modes that may also play a part in this decision process that System Administrators should also be aware of: <\/p>\n\n\n\n\n\n\n\n\n\n\n\n
\n

<\/b>Per Device<\/b><\/b><\/p>\n<\/td>\n

\n

Per User <\/b><\/p>\n<\/td>\n<\/tr>\n

\n

CALs are physically assigned to each client device, marked within the registry<\/b><\/p>\n<\/td>\n

\n

CALs are assigned to a user\u2019s properties within Active Directory (where a Server 2008 AD infrastructure exists) <\/p>\n<\/td>\n<\/tr>\n

\n

CALs are tracked and enforced<\/b><\/p>\n<\/td>\n

\n

CALs can be tracked but not strictly enforced.<\/p>\n<\/td>\n<\/tr>\n

\n

CALs can be tracked regardless of AD membership<\/b><\/p>\n<\/td>\n

\n

CALs cannot be tracked within a workgroup<\/p>\n<\/td>\n<\/tr>\n

\n

Up to 20% of CALs can be revoked on demand<\/b><\/p>\n<\/td>\n

\n

CALs cannot be revoked<\/p>\n<\/td>\n<\/tr>\n

\n

Temporary CALs assigned on first logon are valid for 90 days<\/b><\/p>\n<\/td>\n

\n

Temporary CALs are not assigned <\/p>\n<\/td>\n<\/tr>\n

\n

Full CALs remain valid for 52-89 days at random<\/b><\/p>\n<\/td>\n

\n

CALs are valid for 60 days before renewal <\/p>\n<\/td>\n<\/tr>\n

\n

CALs cannot be over allocated<\/b><\/p>\n<\/td>\n

\n

CALs can be over allocated (in breach of the End User License Agreement) <\/p>\n<\/td>\n<\/tr>\n

\n

An offline License Server issuing Per Device CALs can (under specific conditions) prevent users logging into an RD deployment<\/b><\/b><\/p>\n<\/td>\n

\n

An offline License Server issuing Per User CALs will not prevent users from logging on<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Notice the last entry in the above table; this is often overlooked within large mission critical production environments with only one active License Server, presenting itself as a single point of failure (addressed later). <\/p>\n

One of the biggest differences between Per Device and Per User licensing lies around tracking and enforcement. Whilst both modes can be tracked to provide CAL reporting, only Per Device is strictly enforced. This is to say that even if a Per User CAL isn\u2019t available, a user won\u2019t be prevented from connecting and you will see an error reported within Event Viewer (typically Event ID 21). Be aware however that running in Per User mode with more connections than installed CALs is in breach of the End User License Agreement (EULA), to which all customers are legally bound. <\/p>\n

A feature often overlooked within RD Licensing is the ability to revoke on demand up to 20% of your Per Device CALs within RD Licensing Manager. This can be useful if a full CAL has been assigned to a device that has since been decommissioned, and you want to reallocate this to a new client prior to the 52-89 day automatic expiry. Where Per User licensing is not strictly enforced, this functionality is only available for Per Device CALs.  <\/p>\n

Grace periods<\/h3>\n

Once the RD License Server role is installed, administrators have 120 days to activate the license server with the Clearing House. During this time, users can connect to RDSH servers without any CALs being assigned. Contrary to popular belief, the RDSH servers themselves do not have any grace period; only the RD License Servers. Furthermore; if using Per Device mode, only after a second successful logon will a full CAL actually be assigned (preventing DoS attacks). <\/p>\n

Temporary CALs that are initially assigned from an unlimited pool are valid for 90 days (per Device only). As such \u2013 it is possible for users to legally connect to an RDSH server without any CAL for up to a maximum of 210 days after the RD Licensing role has been installed. <\/p>\n

Troubleshooting tips<\/h3>\n

RD Licensing has historically proven a pain point for many customers, and yet whilst the deprecation of CAL forwarding has simplified things greatly, having a deeper understanding of the mechanics at work is never a bad thing.  Usually a license server outage may not have an appreciable impact on end users (especially if Per User); but there are certain situations that may lead to denied connections; specifically when using Per Device CALs that require renewal or upgrade. <\/p>\n

If an RD Licensing Server issuing Per Device CALs does go down and there is no immediate backup; the quickest way to prevent any denied connections is to temporarily switch the licensing mode on each RDSH server to Per User. As this mode of licensing is not strictly enforced, users will never be denied a connection. Whilst this restricts administrators from accurate CAL tracking, it may provide some needed breathing space to address the underlying issue.  The administrator needs to ensure that there are enough CALs installed to cover all users connecting into the environment in order to be in compliance with the EULA. <\/p>\n

For issues with Per Device CAL distribution when the RD License Servers are online and operational, the most efficient course of action will normally be to delete the MSLicensing registry entry (after backing up) from any affected client devices, which is located under HKLM\\SOFTWARE\\Microsoft\\MSLicensing. Two successful subsequent logons to an RDSH server should recreate and populate this hive on the client device with a new CAL; which can be verified within RD Licensing Manager. <\/p>\n

\u53c3\u8003\u6587\u4ef6: <\/p>\n

Remote Desktop Licensing Demystified <\/p>\n

https:\/\/social.technet.microsoft.com\/wiki\/contents\/articles\/21180.remote-desktop-licensing-demystified.aspx<\/a> <\/p>\n

\u91dd\u5c0dWindows Server 2012 Workgroup \u55ae\u6a5f\u7248\uff0c\u5728\u8a72\u4e3b\u6a5f\u4f7f\u7528RDS Licensing\u670d\u52d9\u50c5\u80fd\u5920\u555f\u7528Per Device CAL\u7684\u6388\u6b0a\u9650\u5236\uff0c\u5728Workgroup\u55ae\u6a5f\u6a21\u5f0f\u4e26\u4e0d\u652f\u63f4Per User CAL\u7684\u6388\u6b0a\uff0c\u8acb\u60a8\u53c3\u8003\u4ee5\u4e0b\u5fae\u8edf\u8ad6\u58c7\u8207\u77e5\u8b58\u5eab\u7684\u8aaa\u660e\u3002 <\/p>\n

\"clip_image006\"<\/a> <\/p>\n

\u53c3\u8003\u6587\u4ef6: <\/p>\n

RDS Licenses – Why 0 available? \"clip_image007\"<\/a> <\/p>\n

https:\/\/social.technet.microsoft.com\/Forums\/office\/en-US\/50448328-91b1-43c2-9fdd-dab7912e8f0e\/rds-licenses-why-0-available?forum=winserverTS<\/a> <\/p>\n

Managing server 2012 RDS in a workgroup <\/p>\n

https:\/\/social.technet.microsoft.com\/Forums\/windowsserver\/en-US\/cbffb2d4-ff9d-49ee-a9ce-a60db2262422\/managing-server-2012-rds-in-a-workgroup?forum=winserverTS<\/a> <\/p>\n

\"clip_image009\"<\/a> <\/p>\n

\u53c3\u8003\u6587\u4ef6: <\/p>\n

Best practices for setting up Remote Desktop Licensing (Terminal Server Licensing) across Active Directory Domains\/Forests or Workgroup <\/p>\n

https:\/\/support.microsoft.com\/en-us\/help\/2473823\/best-practices-for-setting-up-remote-desktop-licensing-terminal-server-licensing-across-active-directory-domains-forests-or-workgroup<\/a> <\/p>\n

RD Licensing Configuration on Windows Server 2012 <\/p>\n

https:\/\/blogs.technet.microsoft.com\/askperf\/2013\/09\/20\/rd-licensing-configuration-on-windows-server-2012\/<\/a><\/p>\n

<\/div>