Windows 2000 / 2003 Terminal Services / Citrix Metaframe XPa connection issues

(Sorry in advance for the long question - trying to be detailed)

Our setup has seemed to work fine for a while, but now I am frequently having users who try to connect to a citrix session that recieve the following error:

"Error in connection:
Network or dialup problems are preventing communication with the Citrix server.  An attempt to automatically restore the connection will begin after a delay to let the network recover.  If the problem persists, please contact your network admin."

It then counts down 30 seconds and retrys, and fails. this cycle continues until you cancel it.

There are no problems with the network or connectivity. I searched on Google and found a solution that said to install Metaframe 1.8 SP3, but we are running XPa Feature Release 3. I also found a solution that said to check the permissions on the registry key HKEY_LOCAL_MACHINE\Software\Microsoft\MSLicensing\Store\ on the client, but this is not the issue either as the have full control of that key.

The clients do not show any related errors in the event log.

We found that DELETING the keys HKEY_LOCAL_MACHINE\Software\Microsoft\MSLicensing\Store\LICENSE00x on the client machine allows the user to connect succesfully, but I am not satisfied with this. I want to know why this is happening so that I can fix the root cause.

The Citrix servers themselves show the following event log entry:

EventID: 1004
The terminal server cannot issue a client license.

I suspect it may have to do with MS Terminal Services Licensing, but I don't know what.

Here is what my environment is like:

- Windows 2000 AD Domain - Three domain controllers. DC1 (2000 server, SP4) runs Terminal Services Licensing, others run logging service.
- One Windows 2003 Server TSL1 (not a DC) also running TS licensing with CALs for 2003 installed
- Citrix servers running both Windows 2000 and 2003 Server OS
- About 260 clients running XP SP1 or 2000 SP4 (the client OS seems to make no difference) for thick clients, and thin clients.

When I open TS Licensing on DC1 (2000 server) I see this:

Activation Status - Activated

PRODUCT                                                                    |          TYPE          |          TOTAL          |          AVAILABLE          |          ISSUED

Existing Windows 2000 License                                               Built-in                    Unlimited                    Unlimited                         582
Temporary Licenses for existing Windows 2000 License            Temporary                    -                                -                                 44
Temporary Licenses for Windows 2000 TS CAL                        Temporary                    -                                -                                 13
Windows 2000 Terminal Services Client Access License             Select                        100                             81                                19
Windows 2000 Terminal Services Client Access License             Open                         100                             11                                89

The following errors related to TS are also in the event log on DC1:

This is logged when starting the licensing service - EventID: 22
The Terminal Services Licensing server DC-01 has no license pack registered for product 'Windows 2000 Terminal Services Client Access License'.  Use Terminal Services Licensing administrative tool to register the licenses pack.

This shouldn't matter as far as I know as it should use operating system equivelency for 2000 or higher.

When I open TS Licensing on TSL1 (2003 server) I see this:

Activation Status - Activated

PRODUCT                                                                        |          TYPE          |          TOTAL          |          AVAILABLE          |          ISSUED

Existing Windows 2000 License - TS CAL Token (per device)           Built-in                    Unlimited                    Unlimited                           0
Temporary Licenses Windows Server 2003 License - TS CAL          Temporary                    -                                -                                  9
Windows Server 2003 - TS per device CAL token                      Volume License                150                            130                               20

There are no errors related to TS in the event logs on the 2003 server.

I am totally stumped as to why the clients continue to recieve this error, and it is seriously affecting our business. Any help anyone can offer will be greatly appreciated! Thanks!!!
Who is Participating?
oBdAConnect With a Mentor Commented:
They need permissions on the MSLicensing key on the client machine. The permissions for this key seem to be behaving rather strangely. In a bunch of W2k clients, for example, all deployed with the same image, were a few machines where the permissions had to be adjusted; the others were working fine. Similar thing just lately on two freshly installed XP machines (and Citrix Client v8): When an administrator logged on to the client and connected to Citrix (with whatever account), it worked fine, a regular user logged on to the client failed to connect due to missing permissions on the HardwareID key.
I remember having this issue too, I think the way I fixed it was doing that fix you did on the clients on the server.  I look through my logs and confirm in a bit.
Your client machines' logon problems are indeed probably due to incorrect permissions in the registry. I guess you can logon just fine to Citrix when you're logged on to the client machine with local administrative permissions? You're already pretty close, but the key users need full access to is one level higher: HKLM\Software\Microsoft\MSLicensing; they need permissions on the HardwareID key, too.
As for your license servers, you should be able to use only one of them (the W2k3 one), if you feel like it. The W2k3 TSLS will recognize if a request is issued by a W2k TS, and hand out the "built-in" license if the client is running W2k or XP. Since it's not a DC, you might have to point your W2k TS to the W2k3 LS as preferred license server. As for moving your W2k licenses to the W2k3 LS, you'll have to call the MS Clearing House and tell them thyt you want to migrate your license server to another machine; they should issue you new licenses. Make sure they'll give you W2k TS licenses; sometimes they get confused and might send you W2k3 TS licenses, which clients accessing your W2k TS can't use.

Establishing Preferred Windows 2000 Terminal Services License Server
Cloud Class® Course: MCSA MCSE Windows Server 2012

This course teaches how to install and configure Windows Server 2012 R2.  It is the first step on your path to becoming a Microsoft Certified Solutions Expert (MCSE).

darth_wannabeAuthor Commented:
oBdA: The users having the issue are local admins on the client machines. I'll confirm the permissions at the MSLicensing level as well as on the HardwareID key.

wtp_issc: You are refering to removing that key on the Citrix servers themselves?
wtp_isscConnect With a Mentor Commented:
Yup...sadly though I can't confirm that is what I did or if it is even possible.  I went back through all my logs and I didn't write down a thing.
darth_wannabeAuthor Commented:
My main concern here (now that I have a workaround for the clients) is to figure out what the root cause of this is so I can avoid it in the future.

I would hate to find out in 90 days that all these clients only got temporary CALs and have them all expire at once again in three months and have to go through all this again.

There is no reason I can think of that the permissions on the client machines registry would suddenly have changed, and since I control the patches that are distributed to clients, I know that there have been none applyed that cooincide with the timing of this issue. But then again, it could be something I'm not aware of.

Any idea what the cause of this might be?
darth_wannabeAuthor Commented:
Would the users need permissions to that key on the Citrix servers, and not just on the client machines?
darth_wannabeAuthor Commented:
That's the thing that is confusing me, as the users here are administrators on their local machines.
Can you access the W2k Terminal Server with the RDP client?
Event Message 1004 Terminal Services Licensing When You Use the Citrix ICA Client

Does it happen when you access the W2k Terminal Server, the W2k3 Terminal Server, or on both machines?
If it only happens when you log on to the W2k3 TS: the W2k3 TS probably finds the W2k LS on the DC instead of the W2k3 LS, so it won't be able to issue a license. Try to set the preferred LS on your W2k3 TS to your W2k3 LS (note: this setting differs from the W2k version; the correct link for a W2k3 TS is in the KB239107 article as well).
If it only happens on the W2k TS: Have you tried setting the preferred License Server on your W2k TS to point to your W2k3 LS (I'd suggest to test this off-hours, with a W2k or XP client, so as to not use a "real" license)?
If it happens on both machines: It might be that your MSLicensing keys are simply corrupt, which would explain why yiu can't logon at all, but are able to when the key is deleted:
"Error Connecting to Terminal Server: <ServerName>" Error Message Occurs When You Try to Connect to a Terminal Server

Not really likely, but for the sake of completeness:
" Terminal Server Has Ended the Connection" error message

That's sort of a last resort. Before you do that, you can as well move the licenses that are currently on your W2k LS to your W2k3 LS.
Because of a security error, the client could not connect to the Terminal Server
darth_wannabeAuthor Commented:
OK, a new peice of information has come forward that could shed some light.

Last Sunday one of the other admins here was attempting to make some changes to the terminal services configuration on the Windows 2003 server that runs TS licensing. During the process, he actually uninstalled TS licensing from the server.

Realizing later what had happened when he couldn't connect to the 2003 servers, he reinstalled TS Licensing on the 2003 server and purchased another 150 CALs and installed them (he couldn't find the info for our original 150 CALs).

My theory at this point is that as a result of him doing that, the CALs that were issued by the server before were no longer valid, and so until we deleted the license info from the registry and got a new one the users couldn't log in to Citrix.

If this is the case, then this shouldn't be an issue in the future.

What do you guys think?
That depends on my question above about when the error happens. If it only happens when accessing the W2k3 TS, then this is a very likely explanation.
The W2k TS clients shouldn't be influenced by the W2k3 LS, unless the preferred license server has been set to point to your W2k3 LS, as a W2k TS expects the TS LS on the DC only.
To eliminate questions like that, you might want to consider to transfer the W2k TS licenses to the W2k3 LS, and set the preferred license server entry on your W2k TS. That way, you only have one TS LS to take care of.
Btw.: Your admin wouldn't have had to buy the licenses; a call to the MS Clearing House and an explanation of what had happened should have been enough; MS should have sent you new licenses. (Actually, you should even be able to re-claim the lost licenses.) The (already activated) licenses you had couldn't have been installed anymore anyway, even if he had found them.
darth_wannabeAuthor Commented:
Thanks for all the help guys!

Looks like since we did the registry fix on the clients (deleting the key I mentioned) everything is running smoothly.

oBdA: It looks like when the client gets a license from the 2000 server, it only works for 2000 terminal servers....then when they access a 2003 terminal server, it goes out and grabs a CAL from the 2003 TS Lic server that overwrites the 2000 CAL. Then they just continue using that one (even for accessing 2000 servers).

Since that is the case, when the 2003 ts lic server was gone, they were not able to access 2000 or 2003 terminal servers until we deleted the mentioned registry key.

We are in the process of migrating from 2000 to 2003, and will have only one TS licensing server when we are done. Also, we're going to call MS and get our original 150 CALs for a total of 300 (roughly what we'll need anyway).

Thanks again for the help.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.