Will I need a license server to manage my PolicyPak licenses?
There are absolutely no servers involved in the licensing process for PolicyPak so you will not need a license server. Licenses are contained within a Group Policy Object and are typically linked to the domain but can be linked to a specific OU.
Why does PolicyPak licensing ask “Who am I?” and “Where do I want to use it?”
Let’s jump to the end of the story and take a look at what the License Tool generates when you’re making a license request.
There’s always two items: “Scope” and “SOM_name”. There’s always just one scope and there could be several SOM_Names.
“Scope” means: Where you might ever possibly use PolicyPak. Typically, this is (and should be) the whole domain. This doesn’t mean you WILL be using PolicyPak anywhere / everywhere in the whole domain. You select the Scope on this screen as seen here:
“SOM_Name” (Scope of Management): This is the specific places you will be licensing PolicyPak. This is what you’re selecting on this screen as seen here:
So, here’s some examples from some License Request Key files.
Example 1: You are the domain admin and you wish to license the whole domain for PolicyPak.
This means you are the domain admin and you want to license the whole domain. This is the easiest case.
Example 2: You are the domain admin and you wish to license specific OUs for PolicyPak.
Example 3: You are an OU admin and you wish to license specific OUs for PolicyPak.
Okay. So, why do we have Scope and Scope of Management? Because sometimes companies have, say, one domain, with multiple OU administrators – where NEITHER has any overlap of duties and they BOTH want to use PolicyPak (and pay for it separately)
In this case NEITHER is the domain admin. They can EACH have their own “Scope” (where they can POSSIBLY use it) and “Scope of Management” where they’ll ACTUALLY use it and not overlap.
When LT goes to install the license you receive from PolicyPak, it will create a new GPO and link it the SCOPE.
Occasionally, we get the question of: “What can I do if I already selected the whole domain (‘I am a domain admin’) in the first screen and I don’t want to link the GPO to the whole domain?” First, here are some facts:
That being said, there are two ways to proceed if your license file’s SCOPE is the whole domain, but you don’t want to link it over to the whole domain :
Plan A: Go ahead and let the LT create the GPO and link it to the domain.
Plan B: Generate another request the LRK using the LT tool and send to your sales person.
Plan C: Delete the GPO’s link. Then relink the GPO to the OU you want
Last thought: Remember that all client computers must have the PolicyPak CSE installed. Without the CSE installed, PolicyPak directives are ignored. So, just because there’s a GPO linked to the domain doesn’t mean that computers will be able to do anything. They have to be “in scope of management” and also have the CSE installed to pick up PolicyPak directives.
What if we license one OU, say, SALES COMPUTERS OU then during the year we also want to license a “peer” OU, like MARKETING COMPUTERS OU?
If SALES COMPUTERS OU is licensed, and you want to also license MARKETING COMPUTERS OU, that’s fine. Re-Run your licensing tool, and perform a mid-year “True Up”. You only need to pay for overage.
What happens when the PolicyPak license expires / if my company chooses not to renew?
When a PolicyPak license expires, all computers which are licensed will stop being licensed and downgrade to Community Mode.
Remember: Community mode only processes the very first Pak and the first 25 elements in the Pak, and those elements must be registry items.
If the administrator chose to set any settings within the Pak inside the GPO to “Revert this settings when they no longer apply” then when the license expires, those settings will, indeed, revert back.
All other settings’ values will remain on the machine as they last were set.
However, the following PolicyPak protections will stop working:
We purchased our PolicyPak licensing for a parent OU in our Active Directory structure.What happens if I need to add additional sub-OUs inside of the parent one?How will this affect our licensing?
Whether you purchase PolicyPak licensing for a domain or a single OU, the issued license is for ALL computer accounts that reside there and ANY child OUs -- automatically.This means you can create and/or delete as many OUs within your licensed scope as you wish.This makes our licensing structure highly flexible and worry-free.At the time of your PolicyPak license renewal date you will have the opportunity to “true up” but again, this would only be for additional computer accounts within your AD structure.
I’m an OU admin and not a domain administrator. Can I use PolicyPak in my OU and not the whole domain?
Yes. You don’t need to be a domain administrator to use PolicyPak. The only requirement is the ability to create GPOs for your computers and users. But you likely already have that ability, so you’re ready to get started with PolicyPak.
PolicyPak can be licensed per OU and sub-OU. So if you manage a portion of your company’s Active Directory, you can easily license PolicyPak.
I am generating an Initial Request for a new license and there are disabled computer accounts located throughout my domain. Will these be included?
No, the PolicyPak licensing tool automatically excludes any disabled computer accounts as well as computers that have the word “computer” included within their name (which is our trial mode.).
Do the user accounts have to be contained within the same OU as the licensed PolicyPak computer accounts in order to receive my configured PolicyPak application GPOs?
No.This is what makes PolicyPak licensing so easy.As long as a computer is licensed for PolicyPak, all/any users logged on that computer will receive all computer and user GPOs involving PolicyPak. This means that the users and computers can reside in separate OUs within your Active Directory structure. It’s simply the COMPUTER that needs to be licensed.
Are there any special PolicyPak licensing issues for virtual desktops?
No, virtual desktops are licensed in the same manner as physical desktops? From a licensing perspective, there is no difference between the two. If there’s a computer account in Active Directory, and it’s active, it counts your PolicyPak licensing.
I have multiple domains. How is that licensed?
Easy. Here’s the general process.
We then create a licensing key