LAB: RemoteDesktop–Script to Generate Per User CAL Report

-

 

http://social.technet.microsoft.com/Forums/en-US/winserverTS/thread/567c380e-4d2f-4cb4-8df5-34575669d6d7
When a person leaves your company if you delete their AD user account the count of Per User RDS CALs in use will decrease automatically.

A RDS Per User CAL expires after 60 days of not being used.  What this means is that if you have a user account that has not logged on to one of your RDSH servers in the last 61 days they will not show up on the Per User CAL Usage report.

The above are implementation details of Per User RDS license tracking.  I will leave it up to you to decide what complies with the license agreement.  For example, what is the definition of permanently?  If an employee switches departments, does not use your RDSH servers for a year, and then starts using them again did you violate the EULA (assuming you reassigned the CAL)?  Perhaps you would say no in this example.  What about if the same thing happens for only a month duration?  Or a week?  Or a day?  At some point a reasonable person would say that you did not permanently reassign the license.

Just food for thought.  I would not worry about it much if you are not frequently reassigning CALs from one user to another and then back again.  Maybe the definition of permanently is at least 60 days?  By the way, Permanent Per Device RDS CALs are valid for 52-89 days, perhaps that is the definition.



http://blogs.msdn.com/b/rds/archive/2009/11/09/per-user-cal-reporting-script.aspx

http://gallery.technet.microsoft.com/ScriptCenter/9739eaee-fb8a-4cb8-8456-7f138d175934/ 

When to use this script

1.  For a Windows Server 2003 Terminal Server, there is no issuance of Per User (PU) CALs. Hence the customers also have no idea about the number of PU CALs to be purchased. Also, they are not aware of the number of users that have logged in to a given terminal server over a period of time. This script will help them address these needs.

2.  For a Windows Server 2008 Terminal Server or a Windows Server 2008 R2 Remote Desktop Session Host Server, the inbox License Manager PU reporting feature only shows CALs that are currently valid. It does not give any data about the PU CALs which were issued earlier but now expired. This script helps the admin track expired CALs as well.

3.  For a license server running Windows Server 2008 or Windows Server 2008 R2, there is a bug causing PU reporting with ‘All Trusted Domain’ scope to fail even if one of the domains in the trusted domain list is unreachable. This script will report the PU CAL usage for all the reachable domains.

4.  For a license server running Windows Server 2008 or Windows Server 2008 R2, the admin cannot get the PU CAL usage report for a list of domain(s). This script enables admins to enter a number of specific domain name(s) and generates CAL usage details for those domain(s).

Usage of the script

cscript PerUserCALReport.vbs <option> [DomainFQDN1] [DomainFQDN2] [DomainFQDN3] ...

Where ‘option’ can be either of the following –

/W2K3 - for tracking usage trend of Windows Server 2003 Per User (PU) CALs for a given domain(s)

/W2K8 - for tracking both valid & expired Windows Server 2008 PU CALs for a given domain(s)

/All - for combined details of both the above

‘DomainFQDN’ – optional switch – should be in the format of mytestdc.nttest.microsoft.com. If no parameter is specified, the current domain is assumed.

Here is the usage of the script for the common scenarios it addresses:

(1) Tracking the users connecting to a terminal server running Windows Server 2003 for a given domain(s).

To get the details of the users connected to the terminal servers running Windows Server 2003 in a given domain(s) at a given instant, use this script with /W2K3 option.

cscript PerUserCALReport.vbs /W2K3 [DomainFQDN]

(2) Tracking of total usage of Windows Server 2008 PU CALs issued (both valid & expired) for a given domain(s).

cscript PerUserCALReport.vbs /W2K8 [DomainFQDN]

(3) Tracking of CALs in specified domains (e.g. in a trust of 20 domains, you want to know the CAL usage in only 2 of them).

cscript PerUserCALReport.vbs /All [DomainFQDN1] [DomainFQDN2]

(4)    Tracking of CALs across multiple domains where some of them could be unreachable (e.g. in a trust of 20 domains, out of which 5 are unreachable and you want to know the usage in the rest of the 15 domains which are reachable).

cscript PerUserCALReport.vbs /All [DomainFQDN1] [DomainFQDN2] … [DomainFQDN20]

Sample Output

cscript PerUserCALReport.vbs /ALL

For Domain: TS-A25D.cotoso.corp.com --  Number of W2K8 CALs - Valid: 3  Expired: 2  Total: 5 

For W2K8 User details of domain: TS-A25D.cotoso.corp.com please refer to the file TS-A25D.cotoso.corp.com.W2K8UserDetails.csv saved in the current directory.

For Domain: TS-A25D.cotoso.corp.com --  Number of W2K3 Users - Active: 4  Stale: 0  Total: 4   

For W2K3 User details of domain: TS-A25D.cotoso.corp.com please refer to the file TS-A25D.cotoso.corp.com.W2K3UserDetails.csv saved in the current directory.

Limitations

(1) This script cannot distinguish between valid and expired Windows Server 2008 Per User (PU) CALs issued to a Windows Server 2003 user object.

(2) In case of tracking Windows Server 2003 PU CAL usage trend, the result provided by this script might deviate +/- 10% from the actual result, depending on the frequency and interval with which it is scheduled.

(3) In a heterogeneous deployment of terminal servers running both Windows Server 2003 & Windows Server 2008 (or Windows Server 2008 R2), there could be users who might need to connect to both types of terminal servers. A user having Windows Server 2008 PU CAL is authorized to connect to a terminal server running Windows Server 2003 as well. In that case, the list of users (who have connected to a terminal server running Windows Server 2003) provided by the script, might contain some users, who have been already issued a Windows Server 2008 PU CAL & therefore don’t  need to purchase a Windows Server 2003 PU CAL. To identify whether a given user has already a Windows Server 2008 PU CAL issued or not, you need to run the script with /W2K8 option for the domain, which the user belongs to.

image

image

image

image

Comments

  1. gibsonherryAugust 18, 2017 at 6:23 PM

    Thanks for such a valuable and informative platform I find here. I am regular to read publication of this blog and definitely waiting for more articles.
    Cisco WAP121

    ReplyDelete

Post a Comment

Popular posts from this blog

E15 CU3–Update Failed–AD replicated Exceeded the tombstone lifetime.

-
Image
  Exchange 2013 CU3 The naming context is in the process of being removed or is not replicated http://technet.microsoft.com/en-us/library/replication-error-8452-the-naming-context-is-in-the-process-of-being-removed-or-is-not-replicated-from-the-specified-server(v=ws.10).aspx   C:\> REPADMIN /SHOWREPS Root\RDC01 DSA Options: IS_GC Site Options: (none) DSA object GUID: f1694974-47c4-4555-a214-db3c86854aeb DSA invocationID: f1694974-47c4-4555-a214-db3c86854aeb ==== INBOUND NEIGHBORS ====================================== CN=Schema,CN=Configuration,DC=lab7,DC=root     TW\AD02 via RPC         DSA object GUID: bfcc1053-e1da-46fd-8b9d-179c7992...
Read more

202301 - Exchange onpreme - PowerShell Serialization Payload Signing

-
Image
Released: January 2023 Exchange Server Security Updates https://techcommunity.microsoft.com/t5/exchange-team-blog/released-january-2023-exchange-server-security-updates/ba-p/3711808 https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/SerializedDataSigningCheck/ 1.  Update KB5022143 (Exchange SU) 2. Run latest HealthCherker 3.  PowerShell Serialization Payload Signing https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/SerializedDataSigningCheck/ Certificate signing of PowerShell serialization payload in Exchange Server https://support.microsoft.com/en-us/topic/certificate-signing-of-powershell-serialization-payload-in-exchange-server-90fbf219-b0dd-4b2c-8a68-9d73b3309eb1 4.  MonitorExchangeAuthCertificate    https://microsoft.github.io/CSS-Exchange/Admin/MonitorExchangeAuthCertificate/ 5.                 New-SettingOverride -Name "EnableSigningVerification" -Component Data -Secti...
Read more

Ticket: RemoteAPP certificate revocation check error

-
Image
  . certutil -f –urlfetch -verify <your_certificate>.cer From internet client (Win7 ultimate x64) Issuer:     CN=TWCA Secure CA -Evaluation Only     OU=SSL Certification Service Provider-Evaluation Only     O=TAIWAN-CA INC.     C=TW Subject:     CN=deep2.msft.com     OU=ITS     O=Msft Corporation     L=Taipei     S=Taiwan     C=TW Cert Serial Number: 04bd dwFlags = CA_VERIFY_FLAGS_ALLOW_UNTRUSTED_ROOT (0x1) dwFlags = CA_VERIFY_FLAGS_IGNORE_OFFLINE (0x2) dwFlags = CA_VERIFY_FLAGS_FULL_CHAIN_REVOCATION (0x8) dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000) dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000) ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN (0x20000000) HCCE_LOCAL_MACHINE CERT_CHAIN_POLICY_BASE -------- CERT_CHAIN_CONTEXT -------- ChainContext.dwErrorStatu...
Read more