tiCrypt 2.18.1

RD Licensing (Per-Device CALs)

Every Windows Server with the Remote Desktop Session Host role installed needs Remote Desktop Services Client Access Licenses (RDS CALs). The role starts a 120-day grace period when it is installed. Once the grace period ends, the session host refuses remote desktop connections unless it can get CALs from an activated license server.

In tiCrypt, every Windows VM is a session host: the Windows image installs the role, and each VM cloned from the image inherits it. The license server is a separate Windows Server on your own network that the VMs reach through the tiCrypt Licensing Servers allowlist.

This guide covers the recommended setup for tiCrypt: per-device CALs served by a standalone (workgroup) license server. If your environment already has an Active Directory domain with RD licensing in place, you can use it instead. Confirm that the license server is reachable from the tiCrypt VM network and that its CAL type matches the session host configuration.

Why Per-Device CALs

tiCrypt VMs run in an isolated network with no Active Directory domain. This rules out per-user CALs:

	Per-User CALs	Per-Device CALs
Tracking	License server must be joined to AD to track and report usage	License server tracks issued CALs locally, with or without AD
Workgroup support	Not permitted: the license server cannot identify or count users without AD	Fully supported: CALs are tied to each connecting device
Compliance visibility	None in a workgroup; no way to demonstrate license compliance	The license server keeps an auditable list of issued device CALs

In the per-device model, the "device" is the computer the user runs the Remote Desktop client on, not the VM. A device gets a temporary CAL the first time it connects and a permanent CAL the next time. A permanent CAL stays assigned to that device for a random period of 52 to 89 days and is renewed while the device keeps connecting. Buy one CAL for each distinct computer that connects to tiCrypt Windows VMs, not for the number of concurrent sessions.

Microsoft references

• License RDS with Client Access Licenses: official overview of RDS CAL types, grace periods, and enforcement.
• Set up RD Licensing across domains, forests, or workgroups: workgroup-specific requirements.

Setup

Steps 1 to 3 run on the license server. Steps 4 and 5 run in the Windows image (the session host).

1. Install the RD Licensing Role

On the server that will act as the license server, open an elevated PowerShell session:

Install-WindowsFeature RDS-Licensing -IncludeManagementTools

Restart if prompted.

2. Activate the License Server

1. Open Remote Desktop Licensing Manager (licmgr.exe).
2. Right-click the server name and select Activate Server.
3. Follow the wizard. Choose Automatic connection if the server has internet access, or Telephone for air-gapped environments (the wizard displays a Product ID; call the Microsoft Clearinghouse number shown and enter the confirmation code they provide).
4. After activation, the server status changes to Activated.

3. Install Per-Device CALs

1. In Remote Desktop Licensing Manager, right-click the server and select Install Licenses.
2. Select your license program (e.g., Enterprise Agreement, Open License) and enter the agreement number.
3. Choose the RDS Per Device CAL product for the same or a newer Windows Server version than your Windows images. For example, Windows Server 2025 VMs need Windows Server 2025 CALs; older CALs are not issued to them.
4. Enter the quantity and complete the wizard.

Verify the installed CALs appear under the server's license summary.

4. Configure Session Hosts to Use Per-Device Mode

The session host's licensing mode must match the CAL type. Set it in the Windows image through Local Group Policy:

1. Open gpedit.msc on the session host (or apply via domain GPO if applicable).
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Licensing.
3. Enable Use the specified Remote Desktop license servers and enter the license server's hostname or IP.
4. Enable Set the Remote Desktop licensing mode and select Per Device.

Alternatively, set both via PowerShell:

$ts = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
New-Item -Path $ts -Force | Out-Null

# Point session hosts at the license server
Set-ItemProperty -Path $ts -Name "LicenseServers" -Value "license-server.example.com" -Type String

# Set licensing mode to Per Device (2 = Per Device, 4 = Per User)
Set-ItemProperty -Path $ts -Name "LicensingMode" -Value 2 -Type DWord

caution

A licensing mode mismatch (session host set to Per User but only Per Device CALs installed, or the reverse) makes connections fail once the grace period ends.

5. Verify

Install the RD Licensing Diagnoser in the image if it is not already there:

Install-WindowsFeature RSAT-RDS-Licensing-Diagnosis-UI

In a running Windows VM, after the allowlist entry below is in place, open the diagnoser from Server Manager (Tools > Remote Desktop Services > RD Licensing Diagnoser) or run lsdiag.msc. It reports:

• Whether the session host can reach the license server.
• The configured licensing mode.
• The number of available and issued CALs.

Fix any issues it flags before handing VMs to users.

Network and Firewall

The RD license server uses Microsoft RPC. Session hosts must be able to reach it on:

Port	Protocol	Purpose
135	TCP	RPC endpoint mapper: the session host contacts this port first to learn which dynamic port the licensing service listens on
50000-50099	TCP	RPC dynamic ports, narrowed from the default range (49152-65535) so the allowlist only needs 100 ports (see below)

If Windows Firewall is on at the license server, or another firewall sits between tiCrypt and the license server, it must also allow these ports from the tiCrypt VM network.

Restricting the RPC Dynamic Port Range

By default, RPC services pick a dynamic port anywhere in TCP 49152-65535. Restrict RPC on the license server to a smaller range so you only need to open those ports. Microsoft recommends keeping the range above port 5000 and at least 100 ports wide, because every RPC service on the server shares it.

# Run on the license server, then restart it
$rpc = 'HKLM:\SOFTWARE\Microsoft\Rpc\Internet'
New-Item -Path $rpc -Force | Out-Null
New-ItemProperty -Path $rpc -Name "Ports" -PropertyType MultiString -Value "50000-50099" -Force
New-ItemProperty -Path $rpc -Name "PortsInternetAvailable" -PropertyType String -Value "Y" -Force
New-ItemProperty -Path $rpc -Name "UseInternetPorts" -PropertyType String -Value "Y" -Force
Restart-Computer

Adjust the range to fit your environment. It must not overlap with ports used by other services on the same server.

After the restart, confirm that the licensing service (TermServLicensing) listens inside the range:

$svc = Get-CimInstance Win32_Service -Filter "Name='TermServLicensing'"
Get-NetTCPConnection -State Listen -OwningProcess $svc.ProcessId | Select-Object LocalPort

Microsoft references

• Ports used by RDS: RDS port requirements.
• Configure RPC dynamic port allocation to work with firewalls: the Rpc\Internet registry settings used above.

tiCrypt Licensing Server Allowlist

tiCrypt VMs have no outbound network access by default. The RD license server must be added to the tiCrypt Licensing Servers allowlist so that session hosts inside VMs can reach it. Only super-admins can register licensing servers.

1. Navigate to Management > Virtual Machines > Licensing Servers.
2. Click Create new licensing server.
3. Under Server, enter the license server's hostname or IPv4 address. Use the same name or address you set in Use the specified Remote Desktop license servers (step 4).
4. Under Ports, type 135 and press Enter. Then type the RPC dynamic range as a single entry, such as 50000-50099, and press Enter. The range is added as one chip per port.
5. Under Protocol, select TCP.
6. Click Register server.

Troubleshooting

Start with the RD Licensing Diagnoser in an affected VM (step 5). It names the license server the VM uses, the licensing mode, and the first problem it finds. Then use the table below.

Symptom	Likely cause	How to debug and fix
Diagnoser or a notification reports that no Remote Desktop license server is available	The VM cannot reach the license server on TCP 135 or on the RPC dynamic ports	In the VM, run Test-NetConnection license-server.example.com -Port 135, then repeat with a port from your RPC range (for example -Port 50000). If either test fails, check the allowlist entry under Management > Virtual Machines > Licensing Servers: the server must match the name set in step 4, the ports must include 135 and the full RPC range, the protocol must be TCP, and Active must be Yes. Also check any firewall in front of the license server.
Port 135 test succeeds, but the RPC range test fails	The RPC range was not applied on the license server, or the range in the allowlist does not match it	On the license server, run the TermServLicensing port check from Restricting the RPC Dynamic Port Range. If the port is outside your range, check the Rpc\Internet values and restart the server. If the range differs from the allowlist, delete the entry and register it again with the correct range.
Every test fails, even with a correct and active allowlist entry	The tiCrypt backend does not apply licensing server rules (licensing-server-driver is none, the default)	Check licensing-server-driver in the tiCrypt VM service configuration. It must be firewalld.
Diagnoser reports that the licensing mode is not configured, or that it does not match the installed CALs	LicensingMode is missing or set to Per User (4)	In the VM, run Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' | Select-Object LicensingMode, LicenseServers. LicensingMode must be 2 (Per Device). Fix it in the image (step 4). VMs created from the image afterwards use the new value.
New VMs refuse connections right away, or the diagnoser shows few grace days left	VMs inherit the grace-period clock from the image, so it started when the role was installed during the image build	In the VM, run Invoke-CimMethod -InputObject (Get-CimInstance -Namespace root/cimv2/TerminalServices -ClassName Win32_TerminalServiceSetting) -MethodName GetGracePeriodDays to see the days left. The grace period cannot be extended. Make sure the VM can reach an activated license server with CALs.
"There are no Remote Desktop client access licenses available"	All CALs are issued, the license server is not activated, or the installed CALs are for an older Windows Server version than the VMs	In Remote Desktop Licensing Manager, check that the server shows Activated and compare Total and Issued for each CAL product. The CAL product version must match or exceed the VMs' Windows Server version. To free CALs from computers that no longer connect, right-click a device CAL and select Revoke License (up to 20% at a time), or buy more.
Devices stay on temporary CALs	The license server is not activated or has no matching CALs, or the device has connected only once	A permanent CAL is issued on the device's second connection. If devices keep temporary CALs after reconnecting, activate the server and install CALs (steps 2 and 3).
"The remote computer disconnected the session because of an error in the licensing protocol"	RPC traffic between the VM and the license server is interrupted, or the user's computer has a damaged stored license	First work through the connectivity rows above. If only one user's computer is affected, on that computer delete the registry key HKLM\SOFTWARE\Microsoft\MSLicensing, then start the Remote Desktop client once as administrator so it can recreate the key.