Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1010 Source: TermService

Source
Level
Description
The terminal services could not locate a license server. Confirm that all license servers on the network are registered in WINS\DNS, accepting network requests, and the Terminal Services Licensing Service is running.
Comments
 
In Windows 2003, a terminal server in application mode will service clients without a license server for 120 days. If no Windows Server 2003 licenses are installed on a terminal server license server by the end of those 120 days, this event will appear because the grace period is over. Purchase and install Windows Server 2003 CALs in either per user or per device mode.
If this event is logged every six hours, the Terminal Services Licensing discovery process may not find a license server. See WITP74540 for details.
See ME279561 to find out how to override the license server discovery process in Windows Server 2003 Terminal Services.

ME239107 shows information about establishing preferred Windows 2000 Terminal Services License Server.

ME248430 shows how to transfer Terminal Services CAL from one computer to another.
As per Microsoft: "When a Windows 2000 Terminal Services server is in a Windows NT 4.0-based domain, the Windows 2000 Terminal Services server is not able to use Active Directory services to find the Windows 2000 Terminal Services Licensing server.". See ME261110 - the link below for a way to resolve this issue.

As per ME329896, this issue may occur if a certificate on the terminal server is corrupted.
Also related to EventID: 1004 "The terminal server cannot issue a client license".

Both could be caused by too restrictive of a Local Security Policy on the Windows 2000 Server that is configured as the Terminal Server Licensing Server. The local policy in question is Security Options | Additional restrictions for anonymous connections. There are 3 possible values which are set in the registry by configuring this policy:
0 - None. Rely on default permissions
1 - Do not allow enumeration of SAM accounts and shares
2 - No access without explicit anonymous permissions

For example: say you have 2 terminal servers, TSLicense & TSApps. TSLicense is the server running the terminal server licensing service and TSApps is a typical terminal server that users connect to for applications or desktops. TSApps is configured to point to TSLicense as the DefaultLicenseServer. TSLicense is configured with valid Win2K TS CALs to issue to Win95/98/NT 4.0/CE/Embedded NT workstations.

If you set this policy to 2 (on server TSLicense), when a client (without a valid Win2K TS CAL) attempts a connection to TSApps, the system log on TSApps will report event id:1004 "The terminal server cannot issue a client license". Also, periodically, the server TSApps will report event id:1010 "The terminal services could not locate a license server. Confirm that all license servers on the network are registered in WINS\DNS, accepting network requests, and the Terminal Services Licensing Service is running."

To resolve this, set the "Additional restrictions for anonymous connections" policy to 0 or 1. 1 is recommended by Microsoft.

This came about because we use a standard security template (.inf) for all our Windows 2000 servers. Apparently the Terminal Server Licensing server requires a lesser security setting in order to dole out licenses correctly.


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...