ARS licensing FAQ
From ActiveRoles
This section is intended to answer most frequently asked questions about product licensing and license enforcement behavior. This section should not be considered an actual license agreement. Nothing in this article should be considered legally binding or a replacement for an official Quest licensing agreement. As this article describes the behavior of the ActiveRoles Server software it should not be considered a contract nor will this article supersede the End User License Agreement signed by the customer at the time of software purchase.
The information below is valid for ActiveRoles Server version 6.1 and below (where applicable).
Licensing for Active Directory
Q: How is ActiveRoles Server licensed for Active Directory?
A: ActiveRoles Server is licensed by counting the total number of enabled user account in each of the domains being managed with ActiveRoles Server.
Q: What constitutes an "enabled user account"?
An "enabled user account" includes, but is not limited to, user logon accounts, secondary accounts tied to users, administrative accounts, service accounts, test accounts and iNetOrgPerson objects – as long as the accounts are enabled in the Active Directory database.
An "enabled user account" does not include inter-domain trust accounts, contacts, disabled mailbox-enabled user accounts in Exchange resource forest.
Q: How is ActiveRoles license count determination made?
A: ActiveRoles Server license count is determined by the total number of enabled User or INetOrgPerson objects in each domain that will be managed by ActiveRoles Server.
Q: What happens with the license count is exceeded?
A: When the number of enabled user accounts or INetOrgPerson objects in all managed domains exceeds the license count, a violation warning will automatically begin appearing when either the MMC or web interfaces are opened by the user. In this situation the customer should immediately contact their Quest Sales representative to purchase the appropriate number of licenses necessary to come back into compliance.
Q: What happens when license expiration occurs?
A: Every license has an optional license expiration date. If the license expiration date is passed the ActiveRoles Server Administration Service will no longer allow management of Active Directory.
Q: What is a Managed Domain?
A: After ActiveRoles Server is installed, each domain to be managed must be registered within the software; these domains are known as Managed Domains. Forest affiliation of a managed domain is not considered when determining license count.
Q: Management of Users in Non-Managed Domains
A: ActiveRoles Server provides the ability to manage AD objects from multiple domains without regard to forest. To manage these users each domain must be registered with ActiveRoles Server as a “managed” domain. Therefore management of users from non-managed domains is not supported. The only two operations that are supported for users in non-managed domains are a) adding such users to a group located in a managed domain and b) delegating permissions to such a user. Such usage of users from non-managed domains is not licensed.
Q: Can ActiveRoles Server License by OU or by Department?
A: No. Currently all enabled users plus all enabled INetOrgPerson accounts within all Managed Domains are counted against the license. ActiveRoles Server does not support per department or per OU license models.
Licensing for Active Directory Lightweight Directory Service (AD LDS /formerly ADAM)
Q: How is ActiveRoles Server licensed for AD LDS/ADAM?
A: Basically, ActiveRoles Server is licensed for AD LDS/ADAM the same way it is licensed for Active Directory - each enabled user account in each AD LDS/ADAM instance must have a valid license. You can think of an AD LDS/ADAM instance as an Active Directory Domain.
Q: Can ActiveRoles Server be used to Manage AD LDS/ADAM without being licensed for Active Directory?
A: Yes. ActiveRoles Server can be licensed to manage just Active Directory, just AD LDS, or both.
Q: Do AD/LDS “Proxy” user accounts require a license separate from the AD license?
A: Yes, “Proxy” accounts are full AD LDS/ADAM accounts that are programmatically tied to an Active Directory user account so that the employee may logon with their AD account, but the “Proxy” user is used to control access within the customer’s applications. Each "proxy" account in each managed AD/LDS instance do consume a license as they can be managed by ActiveRoles Server.
Q: What is a Managed AD LDS Instance?
A: After ActiveRoles Server is installed, each instance of AD LDS to be managed must be registered within the software; these instances are known as Managed Instances.
Licensing for ActiveRoles Exchange Resource Forest Manager
Understand what Exchange Resource Forest Manager does
Q: Is ActiveRoles Exchange Resource Forest Manager a separate chargeable application?
A: Yes, it is a separate chargeable add-on application to ActiveRoles Server. The customer should have both licenses for enabled users in ActiveRoles Server and this add-on application.
Q: How is ActiveRoles Exchange Resource Forest Manager Licensed?
A: Each user that has a corresponding mailbox in a separate Exchange Resource Forest will require a license. This means that in general the number of ActiveRoles Server user licenses should be equivalent to the number of licenses required for ActiveRoles Exchange Resource Forest Manger.
Q: Will ActiveRoles manage exchange mailboxes without ActiveRoles Exchange Resource Forest Manager?
A: Yes, ActiveRoles Server can manage exchange mailboxes in managed domains without ActiveRoles Exchange Resource Forest Manager. ActiveRoles Exchange Resource Forest Manger provides automation and extra security in the special case where the customer has deployed one or more AD forests for management of user accounts and an isolated-separate forest just for Exchange.
Q: Can I license and use ActiveRoles Exchange Resource Forest Manger without licensing the ActiveRoles Server?
A: No, Exchange Resource Forest Manager requires ActiveRoles Server to function.
Licensing for ActiveRoles Self-Service Manager
Understand what Self-Service Manager does
Q: Is ActiveRoles Self-Service Manager a separate chargeable application?
A: Yes, it is a separate chargeable add-on application to ActiveRoles Server. The customer should have both licenses for enabled users in ActiveRoles Server and this add-on application.
Q: How is ActiveRoles Self-Service Manager Licensed?
A: Each user that requires access to Self-Service web site will require a license. This means that in general the number of ActiveRoles Server user licenses should be equivalent to the number of licenses required for ActiveRoles Self-Service Manger.
Q: Does ActiveRoles Server provides any self-service capabilities without ActiveRoles Self-Service Manager?
A: Yes, ActiveRoles Server provides Self-Service web site where employee can update personal account information in AD and participate in approval workflow. ActiveRoles Self-Service Manger adds self-service group management and attestation capabilities.
Q: Can I license and use ActiveRoles Self-Service Manger without licensing the ActiveRoles Server?
A: No, Self-Service Manager requires ActiveRoles Server to function.
