AWS license-manager documentation change
Summary
Expanded troubleshooting documentation for License Manager user-based subscriptions, adding 20+ new sections covering product configuration failures, instance launch issues, Active Directory deletion problems, service-linked roles, RDS SAL errors, license count discrepancies, RDS License Diagnoser, trust configurations, billing issues, and operational guidance.
Security assessment
The changes are operational troubleshooting improvements without evidence of addressing specific vulnerabilities. While some sections mention security groups and credentials (e.g., 'Troubleshoot user subscription product configuration failures'), these are standard configuration guidance rather than responses to security incidents. No CVEs, vulnerabilities, or security incidents are referenced.
Diff
diff --git a/license-manager/latest/userguide/user-based-subscriptions-troubleshoot.md b/license-manager/latest/userguide/user-based-subscriptions-troubleshoot.md index 8d52ec740..e5e999770 100644 --- a//license-manager/latest/userguide/user-based-subscriptions-troubleshoot.md +++ b//license-manager/latest/userguide/user-based-subscriptions-troubleshoot.md @@ -5 +5 @@ -Troubleshoot instance complianceTroubleshoot license complianceTroubleshoot instance connectivityTroubleshoot failures to join the domainTroubleshoot Systems Manager connectivityTroubleshoot Systems Manager Run CommandTroubleshoot Microsoft RDS Licensing failuresTroubleshoot Microsoft Office activation failures +Troubleshoot instance complianceTroubleshoot user subscription product configuration failuresTroubleshoot user subscription instances launch failuresTroubleshoot license complianceTroubleshoot instance connectivityTroubleshoot failures to join the domainTroubleshoot Systems Manager connectivityTroubleshoot Systems Manager Run CommandTroubleshoot Microsoft RDS Licensing failuresTroubleshoot Microsoft Office activation failuresTroubleshoot the inability to delete Active DirectoryTroubleshoot inability to delete AWSServiceRoleForAWSLicenseManagerUserSubscriptionsService Service Linked Role (SLR)Troubleshoot subscription is not present error for RDS SAL productTroubleshoot license counts not showing up correctlyTroubleshoot RDS License Diagnoser issuesTroubleshoot trustsTroubleshoot billing issues for user subscriptionsTroubleshoot inactive marketplace subscription statusTroubleshoot user limits per instance Troubleshoot CAL token not vended after migration to RDS SAL Seamless domain join not working for EC2 instances with user subscription productsVPC endpoint was created in my accountRemove all VPC endpoint resources created by License ManagerChange a username on Managed Active DirectoryDissociate users from a terminated instanceInstall additional software on user subscription instancesJapanese Language Packs on user subscription instancesLocal Administrator user on user subscription instancesNumber of users that can RDP to a user subscriptions instanceUsers in my self-managed AD for Office and Visual Studio productsSupported Windows operating systemsSupported versions of Office and Visual StudioUsing user subscription with older Windows Server versionsUsing License Manager user subscriptions across accounts or regionsTips for contacting AWS Support @@ -14,0 +15,4 @@ The following are troubleshooting tips to help solve issues that can occur with + * [Troubleshoot user subscription product configuration failures](./user-based-subscriptions-troubleshoot.html#product_configuration_failing) + + * [Troubleshoot user subscription instances launch failures](./user-based-subscriptions-troubleshoot.html#instance_launch_failures) + @@ -28,0 +33,50 @@ The following are troubleshooting tips to help solve issues that can occur with + * [Troubleshoot the inability to delete Active Directory](./user-based-subscriptions-troubleshoot.html#delete_active_directory) + + * [Troubleshoot inability to delete AWSServiceRoleForAWSLicenseManagerUserSubscriptionsService Service Linked Role (SLR)](./user-based-subscriptions-troubleshoot.html#delete_service_linked_role) + + * [Troubleshoot subscription is not present error for RDS SAL product](./user-based-subscriptions-troubleshoot.html#rds_sal_subscription_error) + + * [Troubleshoot license counts not showing up correctly](./user-based-subscriptions-troubleshoot.html#license_counts_not_showing) + + * [Troubleshoot RDS License Diagnoser issues](./user-based-subscriptions-troubleshoot.html#rds_licensing_mode_error) + + * [Troubleshoot trusts](./user-based-subscriptions-troubleshoot.html#troubleshoot_trusts) + + * [Troubleshoot billing issues for user subscriptions](./user-based-subscriptions-troubleshoot.html#billing_user_subscriptions) + + * [Troubleshoot inactive marketplace subscription status](./user-based-subscriptions-troubleshoot.html#inactive_marketplace_status) + + * [Troubleshoot user limits per instance](./user-based-subscriptions-troubleshoot.html#user_limits_per_instance) + + * [ Troubleshoot CAL token not vended after migration to RDS SAL ](./user-based-subscriptions-troubleshoot.html#cal_token) + + * [Seamless domain join not working for EC2 instances with user subscription products](./user-based-subscriptions-troubleshoot.html#seamless_domain_join) + + * [VPC endpoint was created in my account](./user-based-subscriptions-troubleshoot.html#vpc_endpoint_created) + + * [Remove all VPC endpoint resources created by License Manager](./user-based-subscriptions-troubleshoot.html#remove_vpc_endpoint) + + * [Change a username on Managed Active Directory](./user-based-subscriptions-troubleshoot.html#change_username) + + * [Dissociate users from a terminated instance](./user-based-subscriptions-troubleshoot.html#dissociate_terminated_instance) + + * [Install additional software on user subscription instances](./user-based-subscriptions-troubleshoot.html#additional_software) + + * [Japanese Language Packs on user subscription instances](./user-based-subscriptions-troubleshoot.html#japanese_language_packs) + + * [Local Administrator user on user subscription instances](./user-based-subscriptions-troubleshoot.html#local_admin_user) + + * [Number of users that can RDP to a user subscriptions instance](./user-based-subscriptions-troubleshoot.html#rdp_user_limit) + + * [Users in my self-managed AD for Office and Visual Studio products](./user-based-subscriptions-troubleshoot.html#self_managed_ad) + + * [Supported Windows operating systems](./user-based-subscriptions-troubleshoot.html#supported_os) + + * [Supported versions of Office and Visual Studio](./user-based-subscriptions-troubleshoot.html#supported_software) + + * [Using user subscription with older Windows Server versions](./user-based-subscriptions-troubleshoot.html#older_windows_versions) + + * [Using License Manager user subscriptions across accounts or regions](./user-based-subscriptions-troubleshoot.html#unsupported_scenarios) + + * [Tips for contacting AWS Support](./user-based-subscriptions-troubleshoot.html#aws_support_tips) + @@ -37,0 +92,32 @@ Instances which are launched to provide user-based subscriptions and are unable +## Troubleshoot user subscription product configuration failures + +Your product configuration may be failing due to issues with outbound network access. To address this, ensure that the default security group permits outbound traffic to the IP addresses of each domain controller's network interface as well as SSM. + + * Verify that default security group settings facilitate outbound traffic to the IP addresses of domain controller network interfaces. + + * License Manager creates two network interfaces which use the default security group of the VPC where your AWS Managed Microsoft AD is provisioned. These interfaces are used for required service functionality with your directory. Ensure that your default security group allows outbound traffic to each domain controller's network interface IP address, or the security group used by the domain controllers. For more information, see [Prerequisites to create user-based subscriptions](user-based-subscriptions.html#usubs-prerequisites) and [What gets created](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_getting_started_what_gets_created.html) in the Directory Service Administration Guide. + + * Configure outbound internet access from instances providing user-based subscriptions or VPC endpoints. + + * Outbound internet access from the instances providing user-based subscriptions, or VPC endpoints, must be configured for your instances to communicate with SSM. For more information, see [Setting up Systems Manager for EC2 instances](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-ec2.html) in the AWS Systems Manager User Guide. + + + + +Once the provisioning process is complete, you can associate a different security group to the interfaces created by License Manager. The security group you select must also allow the required traffic to each domain controller's network interface IPv4 address or security group. For more information, see [Work with security groups](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) in the Amazon Virtual Private Cloud User Guide. + +## Troubleshoot user subscription instances launch failures + +Your instance launches can be failing due to multiple reasons. Here are some of the common issues for which an instance launch may fail: + + * Ensure your instance is discoverable by SSM, see Troubleshoot instance connectivity. + + * Ensure your instance is able to join your domain, see Troubleshoot failures to join the domain. + + * Ensure that the Route53 outbound resolver endpoint rule is set. For more information, see the blog post [Integrating your Directory Service's DNS resolution with Amazon Route 53 Resolvers](https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-your-directory-services-dns-resolution-with-amazon-route-53-resolvers/). + + * If launching instances from custom AMIs created on top of User subscription AMIs, please make sure to perform Sysprep and ensure unique computer names when creating and launching instances from custom AMIs. + + + + @@ -84,0 +171,233 @@ To resolve this issue, ensure that your instance is moved to the correct VPC, or +## Troubleshoot the inability to delete Active Directory + +License Manager is registered as an authorized application with Directory Service during configuration, thereby safeguarding active directories from deletion once configured. As part of the standard procedure, customers need to first remove all instances, instance associations, and user subscriptions. Following this, they can proceed with removing the active directory from the License Manager and subsequently delete the directory itself. + +## Troubleshoot inability to delete AWSServiceRoleForAWSLicenseManagerUserSubscriptionsService Service Linked Role (SLR) + +License Manager requires the "AWSServiceRoleForAWSLicenseManagerUserSubscriptionsService" service-linked role for managing AWS resources that will provide user-based subscriptions. A service-linked role makes setting up License Manager easier because you don't have to manually add the necessary permissions. License Manager defines the permissions of its service-linked roles, and unless defined otherwise, only License Manager can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity. + +For more information, see [Prerequisites to create user-based subscriptions in License Manager](./user-based-subscriptions.html#usubs-prerequisites) and [License Manager – User-based subscription role](https://docs.aws.amazon.com/license-manager/latest/userguide/user-based-subscription-role.html) and [Service-linked roles](https://docs.aws.amazon.com/singlesignon/latest/userguide/slrconcept.html). + +## Troubleshoot _subscription is not present_ error for RDS SAL product + +Your account must have a subscription to Windows Server Remote Desktop Services Subscriber Access License (RDS SAL). All users associated with instances providing user-based subscription products must have a single active subscription to this license in addition to any other products they would like to use. Your user will be subscribed to RDS SAL on their behalf when they subscribe to a user-based subscription product. + +But if this has been unsubscribed or removed due to other compliance reasons, you might have to resubscribe. If you are already subscribed, you can try unsubscribing and resubscribing, which will not affect your License Manager user subscriptions. + +## Troubleshoot license counts not showing up correctly + +After initial setup or configuration changes, it can take up to 24 hours for the license server to display accurate license counts for all license types in the License Diagnoser. + +What to do: + + * Wait up to 24 hours after setup before expecting accurate license count reporting + + + + +This delay is normal and allows the license server sufficient time to properly synchronize and update all license information across different license types. If you run into an error please refer Troubleshoot RDS License Diagnoser issues. + +## Troubleshoot RDS License Diagnoser issues + +These errors are typically caused by credential or permission issues. To resolve: + + 1. **Verify user credentials:** Ensure you are using the same user account that was provided to License Manager during onboarding + + 2. **Check session credentials:** If you see **"Credentials not available"** against the server in the summary section: + + 1. Click on the license server in the summary section that shows **"Credentials not available"** + + 2. In the right-hand side menu that opens, add the credentials of the user that was onboarded to License Manager + + 3. Click **"Refresh"** + + + + +If the issue persists, follow the additional troubleshooting steps outlined in Microsoft's documentation: [Cannot connect to RDS - No license server](https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/cannot-connect-rds-no-license-server) + +This should resolve most credential and permission-related issues with the License Diagnoser. + +## Troubleshoot trusts + +Based on our experience working with many customers, the vast majority of trust configuration issues are either DNS resolution or networking connectivity errors. These are some troubleshooting steps to help you resolve common issues: + + * Check whether you allowed outbound networking traffic on the AWS Managed Microsoft AD. + + * If the DNS server or the network for your on-premises domain uses a public (non-RFC 1918) IP address space, follow these steps: + + * In the Directory Service console, go to the IP routing section for your directory, choose **Actions** , and then choose **Add route**. + + * Enter the IP address block of your DNS server or on-premises network using CIDR format, for example 203.0.113.0/24. + + * This step isn't necessary if both your DNS server and your on-premises network are using RFC 1918 private IP address spaces. + + * After you verify the security group and check whether any applicable routes are required, launch a Windows Server instance and join it to the AWS Managed Microsoft AD directory. Once the instance is launched: + + * Run this PowerShell command to test DNS connectivity: + + Resolve-DnsName -Name 'example.local' -DnsOnly + + + + +You should also look through the message explanations in the [Trust creation status reasons guide](https://docs.aws.amazon.com//directoryservice/latest/admin-guide/ms_ad_troubleshooting_trust_creation.html) in the Directory Service documentation. + +## Troubleshoot billing issues for user subscriptions + +AWS will bill you through a monthly subscription, based on the number of users associated with the license included Microsoft Office or Visual Studio instances. These per-user charges are billed per calendar month, and the billing starts from the time you subscribe to the product. If you remove access to a user during the existing month, you will be billed for the user for the remainder of the month. You will stop incurring charges for the user the following month. + +Furthermore: + + * Billing is based on a per-user basis within User subscriptions. Only users who are subscribed to the product will incur charges, not all users in the active directory. + + * Billing operates on a monthly cycle, starting from the first day of each calendar month. Charges are levied for the entire month, regardless of the specific date of subscription activation. + + * You need an RDS SAL for each user who needs to access your Office/VS instances. + + * To stop incurring charges for user-based subscriptions, you must disassociate the user from all instances they are associated with. Deleting a user from Active Directory does not disassociate the user from instances. For more information, see [Disassociate users from an instance that provides License Manager user-based subscriptions](./usubs-disassociate-users.html). + + * A user is only counted once. You get charged per user for Microsoft Office and Visual Studio, irrespective of the number of EC2 instances the user connects to. Users are charged for their subscription once, regardless of their usage of multiple instances. + + + + +## Troubleshoot inactive marketplace subscription status + +After you configure your directory with the required products, you would need to subscribe to the required products. Products with a Marketplace Subscription Status of Inactive require you to subscribe before you can associate users to an instance and utilize them. + +## Troubleshoot user limits per instance + +There is a limit of 25 instances per user. In case you need adjustment, please reach out to AWS Support. Users are charged for their subscription once, regardless of their usage of multiple instances. + +## Troubleshoot CAL token not vended after migration to RDS SAL