Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1004 Source: TermService

The terminal server cannot issue a client license.
I received this issue on a W2K server running Citrix Metaframe XP. Clients were not able to login. Using TS manager on the server, I logged out inactive sessions and this cleared the issue.  Note: I was not at TS/Citrix license ceiling, did not have any other errors, and all services were running normally.
In my case, this problem was a permissions issue on the Windows XP client computer. I logged in with a privileged account to establish the license, then logged in with the user account with no problems.
My client was still using Windows 98 and I needed to delete the RDP Licenses from the client per MS article ME187614. I deleted the key HKEY_LOCAL_MACHINE\Software\Microsoft\MSLicensing and the problem was fixed.
This event is logged when a thin client device tries to obtain a Terminal Services license from a Microsoft Windows Server 2003-based terminal server. See ME884570 for a hotfix applicable to Microsoft Windows Server 2003.

This behavior can occur if sections of the Windows 2000 registry on Terminal Server Client are changed from the default permission level. See ME315277 to solve this problem.
The Windows 2000 TS Licensing Service needs to be located on a PDC emulator. In my case the PDC emulator, which is a Windows 2003 server had errors regarding the Time Service, more precisely EventID 47 appeared in the event log. I manually resynchronized the time on this DC by entering at the command prompt the following command: "w32tm /resync /rediscover". After this, the TS started to issue licenses immediately.

Even though I was experiencing this problem on a small network with just two W2K servers (the TS server and TS license server), the registry hack explicitly specifying the license server to use (even if there is only one available) in ME239107 fixed my problem.
See ME827355 for a hotfix applicable to Microsoft Windows 2000.

Check ME314825, ME329889, ME813508, and "Citrix Support Document ID: CTX564283" for more information about this event.
This happened to us when the remote registry services was set to manual. Starting the service did alleviate the problem.
In the case that your Windows 2003 WTS is installed in a Windows 2000 Domain, you must install the terminal server license manager on a Windows 2003 server.
These error messages could be caused by too restrictive of a Local Security Policy on the Windows 2000 Server that is configured as the Terminal Server Licensing Server.  The local policy in question is Security Options | Additional restrictions for anonymous connections.  There are 3 possible values which are set in the registry by configuring this policy:
0 - None. Rely on default permissions
1 - Do not allow enumeration of SAM accounts and shares
2 - No access without explicit anonymous permissions
For example: say you have 2 terminal servers, TSLicense & TSApps. TSLicense is the server running the terminal server licensing service and TSApps is a typical terminal server that users connect to for applications or desktops. TSApps is configured to point to TSLicense as the DefaultLicenseServer. TSLicense is configured with valid Win2K TS CALs to issue to Win95/98/NT 4.0/CE/Embedded NT workstations.
If you set this policy to 2 (on server TSLicense), when a client (without a valid Win2K TS CAL) attempts a connection to TSApps, the system log on TSApps will report event id:1004 "The terminal server cannot issue a client license". Also, periodically, the server TSApps will report event id:1010 "The terminal services could not locate a license server. Confirm that all license servers on the network are registered in WINS\DNS, accepting network requests, and the Terminal Services Licensing Service is running."
To resolve this, set the "Additional restrictions for anonymous connections" policy to 0 or 1. 1 is recommended by Microsoft.
This came about because we use a standard security template (.inf) for all our Windows 2000 servers.  Apparently the Terminal Server Licensing server requires a lesser security setting in order to dole out licenses correctly.

Problem could be ''browse list'' related. Had the problem that when TS server was in Admin mode, no problems connecting at all. However - when in Application mode, some users (not all) would be refused a connection (because in App mode, server must be able to contact Licensing Server). Validated this by putting server back to Admin mode then back to Application mode, same results occurred - 100% success in Admin mode, still failures in Application mode.
On refused connections, System log reported:
- Event ID 1004 - The terminal server cannot issue a client license, and/or
- Event ID 1003 - The terminal service client has provided an invalid license.

Also I saw Event ID 1010 with source: TermService: “The terminal services could not locate a license server. Confirm that all license servers on the network are registered in WINS\DNS, accepting network requests, and the Terminal Services Licensing Service is running”.
Nevertheless, my DefaultLicenseServer registry value was set to the license server so it did not make sense that this message was appearing.
Then I located Event ID8021 with source: BROWSER: “The browser was unable to retrieve a list of servers from the browser master \\SERVER07 on the network \Device\NetBT_Tcpip_{3369AE70-AC54-4090-971B-761E95B603FF}. The data is the error code”.
Therefore, I turned off the ''Computer Browser'' service on SERVER07 and with a browse tool forced a few master browser election to elect a new master browser. Once a new master browser was elected, all worked just fine. Conclusion is that SERVER07 was advertising either a corrupt (not 100% sure) or probably more likely, an incomplete browser list which was preventing the TS Server from locating the licensing server.
If you follow ME239107, you have to add the registry key on TS Licensing Server also.
If you have a WinXP client that cannot connect to a Win2k TS Server, see ME319555 and ME323597.
This issue can occur if the MSLicensing registry key on the client computer is corrupted. To resolve this issue, back up the MSLicensing registry key, and then remove it. See ME329888.
As per Microsoft:"[These] error messages can occur if the Citrix MetaFrame server runs out of pooled licenses. It is possible that the licenses were consumed by other connections on different servers. To resolve this behavior, change the License Pool Count " (see link below for instructions).

ME329700 says that this problem occurs if all the following conditions are true:
- The client is an ICA client.
- The client uses Windows 2000 Terminal Services.
- The client is on a network that has Citrix MetaFrame 1.8 for Windows 2000 Service Pack 2 or earlier installed.
- The client connects to a terminal server, logs off, ends the session, and then tries to reconnect to the terminal server.
This is a known problem with Citrix Metaframe 1.8 Service Pack 1 for Windows 2000 and it should be resolved by latest service pack for MetaFrame 1.8 for Windows 2000.

As per ME329944, this behavior occurs because the Citrix ICA client is not working. The Citrix ICA client is responsible for getting a license through the Terminal Services Licensing service when you are using the Citrix product. If the ICA client is not working Windows 2000 generates a 1004 event message on the Terminal Server. The event message indicates that a client did not receive a license. To resolve this behavior, contact Citrix for more troubleshooting.

Also, as per ME274805, this message may be caused by a difficulty in communicating over the network, and not by an actual licensing issue. Terminal Services and the client may be having difficulties communicating over the local area network (LAN), the wide area network (WAN), or the virtual private network (VPN) that they are using to establish the session.

A corrupted certificate on the terminal server is corrupted may also cause this error. See ME329896.

This error will be logged when the terminal server requests a CAL for a client device but cannot locate a MS-license server to request. Be sure that your license server is discoverable on the same domain, site, or workgroup as your terminal server.
Try setting the ip adress to the Licencing server on your terminal servers - see ME239107.
I got this error after moving MS licensing to another server. There was a string in registry that still pointed to the "old" MS license server. When i changed the values in this string the problem dissapeard.
The registry string was HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService\Parameters

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.