Managing Licenses with the Licensing Service

After the Server Suite Licensing Service is installed and running, you can use the Licensing Service control panel to manage Server Suite licenses in these ways:

Opening the Licensing Service Control Panel

Use the Windows Start menu to open the Licensing Service control panel. If Centrify Licensing Service Control Panel is not pinned to the Start menu, use Start menu searching to locate and start the Centrify Licensing Service control panel.

The Licensing Service control panel contains the following tabs:

  • General. Use this tab to monitor current licensing service status, start and stop the licensing service, and manually refresh license count information as described in Starting, Stopping, and Refreshing the Licensing Service.

    The Current Configuration area displays the name of the Active Directory forest that the licensing service manages, and the name of the computer where the licensing service is running.

    The Monitoring Details area displays the current status of license monitoring, the date of the last license usage update, and license status details. Current status can be one of the following:

    • Idle. The licensing service is running, and is available to perform a license usage update.

    • Busy. A license usage update is in progress, or the licensing service is starting.

    • N/A. The licensing service is not running or is otherwise unavailable.

      An additional field, Service status, displays whether the Licensing Service is running or stopped.

  • DC/DZ Deployment. Use this tab to monitor usage details—including license counts—of authentication and privilege elevation (also known as access control and privilege management) licenses. See Monitoring Centrify License Usage for more information about using this tab.

  • DA Deployment. Use this tab to monitor usage details—including license counts—of audit and monitoring service licenses. See Monitoring Centrify License Usage for more information about using this tab.

  • DC/DZ Licenses. Use this tab to create license containers, and add or remove licenses for authentication and privilege elevation (also known as access control and privilege management). See Creating License Containers and Adding License Keys and Adding and Removing Centrify License Keys for more information about using this tab.

  • DA Licenses. Use this tab to add or remove licenses for audit and monitoring service. See Adding and Removing Centrify License Keys for more information about using this tab.

  • Settings. Use this tab to configure how often license usage information is automatically refreshed, and license usage email notification details. Email notification details that you can configure include the list of recipients, SMTP server settings, whether some system information is hidden in notification email, and the license usage threshold that triggers email notification. See Configuring Licensing Service Settings and Configuring License Usage Email Notification for more information about using this tab.

  • Troubleshooting. Use this tab to manually refresh license usage information and manage licensing service logging. Logging parameters that you can configure include trace level of logged events and log file location. You can also view and save the current log from this tab. For more information, see Configuring Licensing Service Settings and Configuring and Viewing Licensing Service Logs.

Starting, Stopping, and Refreshing the Licensing Service

Use the General tab in the Licensing Service control panel to start, stop, and restart the licensing service, and to refresh license count information manually.

To start and stop the licensing service:

  1. Open the Licensing Service control panel General tab.
  2. Click Start, or Stop, or Restart.

Whenever you start or restart the licensing service, license usage information is refreshed. See Monitoring Centrify License Usage for information about viewing license usage information.

Licensing service start and stop information can be logged in the licensing log file depending on the log trace level that is configured. See Configuring and Viewing Licensing Service Logs for information about viewing the licensing log and setting the log trace level.

Refreshing the License Count Manually

In some situations, you might want to refresh the license count information in the licensing service without refreshing all license usage information. When you refresh the license count information as described in this section, license keys are updated in the licensing service, but a complete license usage evaluation is not triggered.

For example, if you add or remove licenses through Access Manager or Audit Manager after the licensing service is installed, you should update the license count in the licensing service as described here so that the license changes that you made through Access Manager or Audit Manager are implemented immediately in the licensing service. If you do not update the license count as described here, license additions or removals that you perform through Access Manager or Audit Manager are not implemented until a regularly scheduled license update task executes.

If you need to refresh all license usage information, including license count, perform the procedure described in Refreshing license usage information.

To refresh the license count manually:

  1. Open the Licensing Service control panel General tab.
  2. Click Refresh Now.

Creating License Containers and Adding License Keys

Before you can add Centrify authentication and privilege elevation license keys, you must create a Licenses container object in Active Directory because you must have at least one Licenses container in the forest into which you install license keys. It is also possible to add more License containers to the forest and use those additional containers to control who can use which license keys. For example, you may want to create one license container for application servers and another for workstation licenses. You can then set permissions on the container objects to prevent the workstation administrators from installing the application server license keys and the application server administrators from installing the workstation license keys in their respective containers.

You can also use Access Manager to assign a specific license container to an individual zone as described in Assigning a License Container to a Zone through Access Manager.

Creating License Containers

To add a new license container object for authentication and privilege elevation licenses:

  1. Open the Licensing Service control panel DC/DZ Licenses tab.

  2. In the License container section, click Add.

    alt

  3. Browse to select a location for the new license container, then click Create. Select either container or organizational unit to indicate the type of object to create, and type a name for the new license container object and click OK.

  4. Click OK to close the Browse for Container dialog box.

  5. When prompted to confirm the creation of the container object, click Yes to add the license container to Active Directory.

  6. Click Permissions to assign Read License and Modify License permissions to specific users or groups. The users or groups that you give the Modify License permission to can then add license keys to the new license container.

    alt

Adding and Removing Centrify License Keys

When you install Centrify software for authentication and privilege elevation, you must provide at least one licensing key that is specific to authentication and privilege elevation. Likewise, when you install audit and monitoring service, you must provide at least one license key that is specific to audit and monitoring service.

If you are using a valid evaluation license key for audit and monitoring service and install a permanent audit and monitoring service license key, the evaluation key is automatically removed from the audit and monitoring service installation. If you are using a valid permanent auditing license key and install an evaluation license key for audit and monitoring service, the evaluation key takes precedence as long as it has not expired.

To add license keys for authentication and privilege elevation:

  1. Open the Licensing Service control panel DC/DZ Licenses tab.
  2. In the License container section, select the appropriate License container from the list of available license containers.
  3. At the bottom of the dialog box, in the License keys installed in this container section, click Add.
  4. Type or paste the new license key string, then click OK.
  5. Click OK.

To add license keys for audit and monitoring service:

  1. Open the Licensing Service control panel DA Licenses tab.
  2. In the Installation section, select the auditing installation for which you are adding a license.
  3. Click Add.
  4. Type or paste the new license key string, then click OK.
  5. Click OK.

To delete a license key that you have previously installed:

  1. Open the Licensing Service control panel DC/DZ Licenses tab or the DA Licenses tab.
  2. In the License keys installed in this container section, highlight the license to delete, click Remove, and then click OK.

Monitoring Centrify license Usage

The Licensing Service control panel allows you to monitor how many Centrify licenses in the forest are in use, and how many are available. You can see usage information for access control and privilege management licenses, and for auditing licenses.

To generate a more comprehensive report of license usage, including detailed system information about the computers where you have Centrify software deployed, use the Licensing Report wizard. When you generate a license usage report with the wizard, information is formatted as comma-separated values (CSV) in a text file. See Creating Licensing Reports with the Licensing Report Wizard for more information.

To see usage information for authentication and privilege elevation licenses:

  1. Open the Licensing Service control panel DC/DZ Deployment tab.

    The license usage information that is displayed when you first open the tab is from the last time you refreshed the information in the DC/DZ Deployment dialog box. If you restarted the Licensing Service or refreshed license usage information from the Troubleshooting tab, the latest license usage information is not displayed in the DC/DZ Deployment dialog box until you perform Step 2 and Step 3.

  2. In the Source field, select the licensing service host computer for which to report license usage information.

    If you select Last Updated Centrify Licensing Service, the licensing service host computer containing the latest valid licensing information is selected.

  3. Click Refresh.

    Information displayed in the dialog box is based on the most recent refreshing of license usage information, which is generated by a scheduled refresh, manual refresh, or starting the Licensing Service. That is, clicking Refresh here does not instruct the licensing service to check current license usage.

  4. Optional: To display current license usage information:

    1. Perform a manual refresh from the Troubleshooting tab as described in Configuring Licensing Service Settings.
    2. Return to the DC/DZ Deployment tab and click Refresh.

To see usage information for audit and monitoring service licenses:

  1. Open the Licensing Service control panel DA Deployment tab.

    The license usage information that is displayed is for all available audit and monitoring service installations (that is, global capacity and usage are shown).

  2. In the Source field, select the licensing service host computer for which to report license usage information.

    If you select Last Updated Centrify Licensing Service, the licensing service host computer containing the latest valid licensing information is selected.

  3. In the Installation field, select an audit and monitoring service installation whose licensing information you want to see.

  4. Click Refresh.

    Information displayed in the dialog box is based on the most recent refreshing of license usage information, which is generated by a scheduled refresh, manual refresh, or starting the licensing service. That is, clicking Refresh here does not instruct the licensing service to check current license usage.

  5. Optional: To display current license usage information:

    1. Perform a manual refresh from the Troubleshooting tab as described in Configuring Licensing Service Settings.
    2. Return to the DA Deployment tab and click Refresh.

Configuring Licensing Service Settings

Use the Settings tab in the Licensing Service control panel to refresh license usage information and configure licensing email notification details.

Refreshing license usage information

You can use the licensing service to refresh license usage information in these ways:

To configure an automatic refresh interval:

  1. Open the Licensing Service control panel Settings tab.
  2. In the Update Schedule section, click Configure.
  3. Specify a start time and recurrence pattern (interval), and click OK.

To manually refresh license count and usage information:

  1. Open the Licensing Service control panel Troubleshooting tab.

  2. Click Refresh Now.

    Manually refreshing license count and usage as described here updates both license count and license usage. If you want to update just the license count (for example, due to performance considerations), perform the procedure described in Refreshing the License Count Manually.

Configuring License Usage Email Notification

Email is sent to a list of recipients when a license is deployed. Routine notices are sent if license usage is below 90% (or a different threshold if you specify one). Warnings are sent if usage thresholds are exceeded. The default thresholds that trigger email warnings are 90%, 100%, and 120%.

Typical email notification appears as follows, and includes an attachment of the latest report generated by the Licensing Report wizard (not shown here):

`From: " Delinea Licensing Service" <licensingservice@domain.com>

To: "System Administrator" <sysadmin@domain.com>

Subject: Notice from Centrify: You are deploying 17% of your DirectControl/DirectAuthorize UNIX licenses, 20% of your DirectAuthorize Windows licenses, and 30% of your total DirectAudit licenses.

Date: Monday, October 31, 2016 12:00 AM

DirectControl/DirectAuthorize UNIX usage: 13 out of 75
DirectAuthorize Windows usage: 5 out of 25
Total DirectAudit usage: 15 out of 50

=== DirectControl/DirectAuthorize Usage Summary ===
UNIX Server: 5 used, 50 licensed
UNIX Workstation: 5 used, 25 licensed
UNIX without license type: 3 used
Windows Server: 2 used, 25 licensed
Windows Workstation: 3 used, 0 licensed
DirectControl/DirectAuthorize Evaluation: 0 licensed
DirectControl UNIX - Express: 0 used
Mac systems: 0 used
zLinux systems: 0 used

=== DirectAudit Usage Summary ===
UNIX Server: 5 used, 25 licensed
UNIX Workstation: 5 used, 0 licensed
UNIX without license type: 0 used
Windows Server: 2 used, 25 licensed
Windows Workstation: 3 used, 0 licensed
DirectAudit Evaluation: 0 licensed
zLinux systems: 0 used`

You can configure email notification details such as the list of recipients, SMTP server settings, whether to omit some system information from the report attached to the notification email, and one license usage threshold that replaces the default 90% threshold.

To configure license usage email notification:

  1. Open the Licensing Service control panel Settings tab.

  2. In the Notification section, click Configure.

  3. To add or remove a user on the email recipient list:

    • To remove the user from the list of recipients, highlight the user name and click Remove.
    • To add a user to the list of recipients, click Add in the Recipients section. Type the email address and display name for the user and click OK.

  4. To configure SMTP server settings:

    • Type the display name and email address of the user who is the email sender.
    • Type the host name or IP address of the outbound email server and specify a port number.
    • If the outbound email server requires secured password authentication for login, select This server requires authentication and type the name and password of a user with login permission. If the outbound email server does not require secured password authentication for login, leave this check box unchecked.
    • To optionally test the SMTP configuration, click Test and specify a recipient for the test email message.

  5. To specify that a warning is sent when license usage exceeds a threshold other than 90%, select Warn when the usage reached and specify a threshold value from 1% to 89%. The threshold that you specify is used instead of the default 90% threshold.

  6. The license usage report generated by the Licensing Report wizard is included as an attachment in email notification. To omit host, zone, and installation names from the attachment, select Hide host, zone and installation names from the attached licensing report.

  7. Click OK.

    Depending on how a recipient’s email filters are configured, notification email might be redirected to a recipient’s junk or spam folder. If a recipient is not receiving email as expected, check the recipient’s junk or spam folder. If necessary, modify the recipient’s email filters so that notification email is not directed to the junk or spam folder.

    By default, if the license usage report is 10 MB or larger, the service sends the report as a .zip file instead of a plain text attachment. You can add the following registry setting to configure the size for which the service attaches the report as .zip file: HKLM\SOFTWARE\Centrify\Licensing Service\ReportNotificationCompressionThreshold as a DWORD registry setting. Enter the value as the number of MB for the file size threshold. For example, a value of 3 will make sure that licensing reports that are 3 MB or larger are sent as zip files.

Configuring and Viewing Licensing Service Logs

Detailed licensing service log files are created while the licensing service is running, and are saved in the following default location:

C:\\Program Files\\Common Files\\Centrify Shared\\Logs

In addition to viewing the current log file, you can edit the current file, configure which events are stored in log files (that is, the logging level) and specify the location where log files are stored.

To view and edit the current log file:

  1. Open the Licensing Service control panel Troubleshooting tab.
  2. To save the current log file without first opening it for viewing, click Save As, navigate to a folder location, specify a name for the log file, and click Save.
  3. To open the log file for viewing and editing, click View Log. While the file is open for viewing, use the File and Edit menus to save the file to a name and location of your choice, select parts of the file for copying, or clear the file.
  4. To save a zipped version of the log file to a location of your choice, click Export Diagnostics Data, specify a folder location, and click OK.

To configure licensing service event logging level:

  1. Open the Licensing Service control panel Troubleshooting tab.
  2. Click Options.
  3. In the Log Settings dialog box, select one of the following categories of events to log:
    • No log messages
    • Error messages
    • Warning messages
    • Informational messages
    • All messages
  4. Click Apply, then click OK.

To specify a different licensing service log file folder:

  1. Open the Licensing Service control panel Troubleshooting tab.
  2. Click Options.
  3. In the Log folder path field, specify or browse to the folder where you want to store licensing service log files.
  4. Click OK.