Manage AD Bridge Enterprise Licenses
There are two options to manage the assignment of AD Bridge Enterprise licenses:
- Globally using the License Management page in the BeyondTrust Management Console on a Windows administrative workstation connected to Microsoft Active Directory.
We recommend that you manage your licenses through the BeyondTrust Management Console.
- Locally using an AD Bridge Enterprise command-line utility (setkey-cli) on a Linux, Unix, or macOS computer.
When you install the AD Bridge Enterprise agent without a permanent license on a Unix or Linux computer, a 30-day product evaluation key is automatically generated. If a permanent license key or an extended evaluation license key is unavailable, AD Bridge Enterprise will stop authenticating users and applying Group Policy settings after 30 days. The expiration date of an evaluation license applies only to the computer on which the license is installed.
To obtain a permanent license or to convert a trial license to a full license, contact a BeyondTrust sales representative at www.beyondtrust.com/contact.
You can upgrade an evaluation license to a permanent license by importing the permanent license key into the BeyondTrust Management Console, and applying it to a client computer. If the automatic assignment feature is in use, the AD Bridge Enterprise agent will automatically apply a permanent license when you log on a client with an AD account, restart the AD Bridge Enterprise authentication service, or run the command-line utility for managing licenses.
BeyondTrust offers site licenses and single-computer licenses.
- A site license covers all the computers in a domain and its child domains. To determine whether a computer falls under a site license, AD Bridge Enterprise checks the last two components of the domain name.
- If there are multiple domains, a different license file is required for each domain, regardless of whether you are using a site license or a set of single-computer licenses. To spread a set of single-computer licenses across two or more domains, you can request BeyondTrust sales to distribute the licenses in two or more license files.
For example, example.com is the domain governed by a site license and one of the child domains is named child.example.com. The child domain is covered by the site license because the last two components of the domain name match.
BeyondTrust offers two kinds of licenses: workstation and server. Both single-computer licenses and site licenses distinguish between servers and workstations. When a computer joins a domain, AD Bridge Enterprise looks at the version of the operating system to determine whether to assign a workstation or a server license. If a server license is unavailable, a workstation license is automatically used.
A workstation license limits the number of concurrent logins to five discrete user accounts. With a server license, the number of concurrent logins is unlimited.
If the computer is a server but is using a workstation license because no server licenses were available, please contact BeyondTrust sales at www.beyondtrust.com/contact to obtain more server licenses. You can adjust the license type that you want the agent to obtain by using the command-line utility for managing licenses.
The AD Bridge Enterprise agent verifies a license when you run the setkey-cli utility, when you start the AD Bridge Enterprise authentication service, and when you log on. To verify a license, the setkey-cli utility uses the computer's Active Directory account to search for licenses in the computer's OU hierarchy up to the top of the domain. Other domains in the forest are not searched. When the computers's domain controller is down, the utility loads the license from the disk without verifying its assignment in Active Directory.
The AD Bridge Enterprise Group Policy service also checks for a license when it refreshes the computer's Group Policy Objects (GPOs). If the license is invalid, the service ignores the GPOs. Once the license becomes permanent and valid, the service applies the GPOs when it restarts.
If the message "Invalid computer!" is displayed in the Assigned To column, revoke the license and return it to the pool of available licenses. This action is performed by right-clicking the license you want to revoke, and then clicking Revoke License.
License Feature Codes
Licenses contain codes that can include or exclude features. When a license is displayed in the console, the codes in the Features column indicate the entitlements that the license covers.
The following table describes each feature code:
|SC||Covers the use of two-factor authentication with a smart card|
|GP||Covers the application of GPOs|
|AU||Covers the auditing and reporting components|
|AD||Covers the use of the AD Bridge Enterprise management tools for Active Directory|