Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 213 Source: LicenseService

Level
Description
Replication of license information failed because the License Logging Service on server <domain controller name> could not be contacted.
Comments
 
In my case, deleting the "HKLM\Software\Citrix\MSLicensing" registry key of the Citrix server (MPS3), followed by a reboot helped. Delete the whole subtree. The regkey will be rebuilt when the LicenseServer service starts.
In my case, on the TSE server, I set the service "License service" to start automatically and pushed the Start Button. On the Server where the event 213 appeared, I restarted the "License service". After this, the problem was gone.
See the links to "IBM Support Reference #S1001371" and "JSI Tip 6730" for possible solutions to this problem.
I received the following information from the Microsoft support team: "The event 213 you saw is recorded by the License Logging Service. License Logging Service (LLS) is a tool that was originally designed to help customers manage licenses for Microsoft server products that are licensed in the Server Client Access License (CAL) model. LLS was introduced with Windows NT Server 3.51. Because of original design constraints and evolving license terms and conditions, LLS cannot provide an accurate view of the total number of CALs. Sometimes, even though you have purchased an ample number of licenses, you may find that there are licensing events recorded in the Event Viewer stating that you are out of licenses. For the reason above, by default LLS is disabled in Windows Server 2003 and future products. In other words, the events reported by LLS are not accurate and you can safely disregard them. To prevent these events from being recorded, you can turn off the licensing service on all domain controllers. For more information about LLS, you can refer to the following Microsoft Knowledge Base articles: ME824196 and ME316631.
Therefore, you actually do not need to worry about these licensing events and they will not have any impact on your domain. If you still prefer enabling the LLS service, we can try resetting the license manager information to solve this issue. This derives from our previous experience and it will work in most cases. To do this, follow these steps:
1. Click Start -> Run, type "net stop licenseservice" (without the quotation marks) and press Enter to stop the License Logging service.
2. Delete or rename the following files on the Domain Controller:
- Cpl.cfg, which contains all of your purchase history and is located in %Systemroot%\System32.
- Llsuser.lls, which contains the user information on number of connections, located in %Systemroot%\System32\Lls.
- Llsmap.lls, which contains License group information, also located in %Systemroot%\System32\Lls.
3. Click Start -> Run, type "net start licenseservice" (without the quotation marks) and press Enter to restart the License Logging service.
4. Manually re-add the appropriate license information. See ME185953 for more details on these steps".
On a Windows 2000 Server environment, this error may appear if you remove/change the license server. For me, ME296681 did not solve the problem. You can establish the name of the license server instead of using the habitual discovery procedure. The article ME239107 describes this workaround; however remember to restart the License Registration Service.


In one case, the two computers involved had a time difference of more than 5 minutes. When this was corrected, the EventID ceased to reappear.
As per Microsoft: "There is a problem in the License Server service that could cause the service to deadlock. This stops the service from processing any requests". See ME247794 for a hotfix. This information applies to Windows NT Server 4.0.

ME185953 provides information on how the License Service keeps track of license usage. You might also want to look at ME824196. It describes the License Logging Service in Windows Server Operating Systems.

"Planning the License Server" is a good article on the license server.
This event started to appear after we removed a server. See ME296681 to resolve the problem.
This frequent error message is generated by the License Service that failed to connect to a proper license server. Unless there is server performing such function one can safely stop this service and set it to "Manual" or "Disabled". The service should run if one intends to monitor the use of NT licenses throughout the organization, but in this case a license server has to be configured.
I noticed this event after moving the forest root to another server. In AD sites and services open the default site and right click  Licensing Site Settings and choose properties. You can now choose the new Master License Server.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...