Application in Remote Device consuming licenses

[sasikumar_r]

Hi All,

We have a scenario in which licenses are showing as over consumed for few Applications.On checking for 1 application (visio) most of the consuming devices are remote devices,and also it is showing access mode as Xendesktop. Example: User Bravo is not assigned to any physical device and not having access to xendesktop as well. But Bravo(remote Device) is showing as consuming Visio application.under the application tab of Bravo(remote device) it is showing Visio is detected. on checking with Citrix admin it is confirmed that user bravo is not having access to Visio application. we have Citrix Edgesight,Xenapp Agent and Xendesktop connections are configured. Not sure from which of these connection it is detecting user bravo has got access to Visio application. It would be great if someone could help me with where to check for the information to remediate this issue.

Let me know for more information.

Thank you
Sasi

[statler]

i Sasi,

The XenApp Server agent will extract which users and devices have access to which applications based on Active Directory SIDs.

You can find the details in the chapter on the XenApp Server Adapter in the "FNMSInvAdapersAndConnectorsReference.pdf" document. See:

https://helpnet.flexerasoftware.com/fnms2019r1/EN/WebHelp/PDF%20Documents/On-Prem/FNMSInvAdaptersAndConnectorsReference.pdf.

[sasikumar_r]

Hi @statler,
Thank you for your response.
From the local IT team i understand, golden image is having visio installed. Around 750users are accessing this image through xendesktop. but only 200 users have access to Visio application,IT team is provinding access to visio.exe file to the users using AD permissions.

My doubt here is, since the image is having visio installed - users who are all accessing the image through xendesktop are considered as consuming the license(regardless they have access to execute visio.exe or not)?

If yes how can we overcome this situation?

Any suggestions\Advice would be very helpful on this?

Thank you
Sasi

[Garth_Honey1]

As many businesses use AD OU's to manage who has access to specific applications and/or who can execute applications, it would be great if we could associate one or more AD OU's to a license and FNMS would calculate the consumption based on the users or devices in the associated OU's.

[statler]

Hi Sasi,
Hi Garth_Honey1,

@Sasi: Any users having access to the image through XenDesktop will consume a license. File level restrictions that your IT team implements for preventing access to certain executables are not taken into consideration for license consumption in FNMS.

@Garth_Honey1: The recommended approach would be to import the AD Organizational Units (OUs) into FNMS as Enterprise Groups ("Corporate Units", "Locations" or "Cost Centers"). Importing OU data from AD can be implemented using a Business Adapter (MGSBI). Of course, users and devices will have to be assigned to the correct Enterprise Groups, too.

For any license configured in FNMS, on the "Group assignment" tab on the license object, you can see a detailed break-down of the consumption by Enterprise Group. In the Reports section in the FNMS UI, there is a standard report "License Compliance > Licenses > Licenses Consumed and Allocated by Enterprise Groups" that can be used for this purpose, too.

[kclausen]

@sasikumar_r , you need to be careful on this topic.  You have placed an application on your golden image and therefore it is an installed application on a device.  During an audit, some publishers will state that since the application is "installed", it will require a Device license - even if the user cannot launch the application because of AD Groups.

[statler]

@sasikumar_r :  It looks as if the upcoming FNMS 2019 R2 release - currently scheduled for Nov. 5th - will have a feature "Support for XenApp and XenApp Desktop Application Groups and user filters".

You may want to look into that .

[JeffVoss]

@sasikumar_r, to add to the complexity of if it is on the gold image it counts stated by @kclausen if you are using App-V, any one who logs on to a device that has been tagged as having a user with App-V use the same VM instance, it will assign it to every user after that person if you are using PVS. Not sure about how MCS machine behave.