Verify uReset License Usage
This article will review how Specops uReset licenses are consumed and assumes you are on the latest version of uReset.
The count is based on the number of enabled Active Directory user objects that have a uReset GPO applied to them in Active Directory.
License usage will be displayed in the subscription tab of the Admin Pages and Reporting Readers link which can be launched within the Specops Authentication Gatekeeper Admin under the Gatekeeper Tab.
uReset regularly updates a record of how many licenses have been consumed. The license check is part of a daily user counting as part of Authentication Gatekeeper service.
Adjusting License Consumption
Check Policy Mode
This is done by changing the reset password policy mode from “Cloud” to “Group Policy”. To do this:
- Navigate to the uReset tab and under reset password, select Edit Authentication Rules under the cloud policy and then screenshot the MFA options and weights.
- Change to Group Policy and then Edit Authentication Rules and match the screenshot previously used in the cloud policy. This ensures that everything is the same and will not cause any issues to end users that are currently enrolled.
Group Policy
If license counts are higher than expected, you may need to adjust the scope of your uReset GPOs to exclude some user objects in order to reclaim licenses for those users. Begin by checking which GPOs in your domain contain uReset settings. On a system with the Specops Authentication Gatekeeper Admin installed, launch Specops Authentication Gatekeeper Admin from the start menu and go to the Active Directory Settings tab. GPOs containing uReset settings will be listed next to the Active Directory scopes tab:
To determine how each uReset GPO is applied we must check in Group Policy Management Console MMC. Check the locations where the GPO is linked and whether any Security Filtering has been applied.
In order to reduce license consumption any of the following changes can be made within Group Policy:
- Link the GPO on different sub-OUs and disable/delete the current links
- Change the Security Filtering to limit the GPO’s scope to a security group
- Deny applying the GPO to a security group via advanced delegation on the GPO
Once changes are made, the user counting data in uReset will not update until the next daily user count. If you would like to see results immediately, you can also count consumed licenses manually by going to the User Counting Tab in the Admin Pages and Reporting Readers link and select the “Start Counting” Button:
