Finding and Fixing Excessive SMB Server 5.0 License Usage

We have a small lab network with a Windows 2000 (SP4) server. There are
about 15 machines on the network, most running Win2000 (SP4), a couple of XP
machines, and 4 Linux boxes. About a week ago, some users were unable to
access the shared drives in the server. In the event log was the following:

No license was available for user lab\MrUser using product SMB server 5.0

Event 201


The product view tab of the licensing tool displayed the following:

Product: Windows Server
Per seat purchase: 0
Per seat allocated: 0
Per server purchased: 24
Per server allocated: -105

(yes, negative 105)


MS KB 103138 seems to address this issue, but we already have SP4 installed.

The network has been stable for months, so everyone is at a loss to explain
this. (About 18 months ago we did have this problem, but the server was
rebuilt on a bigger system drive.) The guess is that one of the machines
(probably one of the Linux boxes) has started sending out rouge RPC
connections, but we are not sure how to identify who has requested what.

1) Is there a way to explicitly identify who is using licenses?

2) Has anyone else see this? What did you do to correct it?

3) Any suggestions aside from rebuilding the server again?


Any help will be greatly appreciated!

Thanks!

Don

> 1) Is there a way to explicitly identify who is using licenses?

NET SESSIONS at cmd prompt.

> 2) Has anyone else see this? What did you do to correct it?

I've seen the more common issue of licence-usage being doubled, one named
pipe connection and one SMB connection per seat under different credentials..
but never -105!

> 3) Any suggestions aside from rebuilding the server again?
>
Putting a firewall with fine control over IP/Port access on the server might
help identify the offending client. I'd try this before resorting to any
desperate measures.

Anteaus,

Thanks for the comments!!

I am going to go with your suggestions and also put a network monitor
(WireShark) on line. Your ideas have got me thinking about a couple of
things now.

Thanks!!

Don




"Anteaus" <Anteaus@discussions.microsoft.com> wrote in message
news:0D5ED713-844C-4223-812C-27A2CB45C1C4@microsoft.com...
> > 1) Is there a way to explicitly identify who is using licenses?
>
> NET SESSIONS at cmd prompt.
>
> > 2) Has anyone else see this? What did you do to correct it?
>
> I've seen the more common issue of licence-usage being doubled, one named
> pipe connection and one SMB connection per seat under different
credentials..
> but never -105!
>
> > 3) Any suggestions aside from rebuilding the server again?
> >
> Putting a firewall with fine control over IP/Port access on the server
might
> help identify the offending client. I'd try this before resorting to any
> desperate measures.
>