Soon, we will launch a new and updated customer portal, which is an important step toward providing our customers with one place to learn, interact, and get help.
Learn more.

How Do I Monitor and Control Usage of the Network Key?

This article is for server administrators using a Zemax OpticStudio or Lensmechanix network softkey or red USB hardkey. It covers logging license usage, password protection, user and computer restrictions, as well as the detachable license feature to use a license seat when not connected to the network. You will need to complete the steps to setup the network license on the server first, per the article How to Install the Network License Version of OpticStudio

This article is not intended to address monitoring usage of black USB network dongles. For information on monitoring black USB network keys, please visit this page.


Introduction to the Sentinel Admin Control Center

Viewing user sessions and checked out licenses

Configuration License seat check out on the client

Q&A for Softkey and Red USB Network Licenses

Addendum: Restarting the Sentinel LDK License Manager Service to fix issues
Alissa Wilczynski
Red Key
Installation and Troubleshooting

NOTE:  Before continuing this article, you should be certain that you have a softkey or red USB license. 


Red USB hardkeys and softkeys may be used with any version of OpticStudio 15.5 or later, but 15.5 Sp3 or later is recommended for the license manager to ensure it will display the license information on the client machine.

This article is not intended to address monitoring network usage of black USB dongles.  For information on monitoring Black USB network keys, please visit this page.  

Introduction to the Sentinel Admin Control Center

Open a browser window and go to http://localhost:1947 on the server machine.  By default, this Sentinel Admin Control Center (ACC) page is visible from any client machine as well as the server machine, unless you set a password

Tip: You can also get here by clicking Launch Sentinel Admin Control Center from the Zemax LIcense Manager application.

Click on Sentinel Keys.  This page shows all available licenses found on the computer and on the network.  The license with the location shown as “Local” is hosted on this machine.

TIP: Zemax licenses are listed as Vendor 114811 . If you have Sentinel licenses from other vendors, this will help you identify ours.


You can then click on the Features button to the right of the locally hosted license, or you may click on the Features section of the left hand navigation pane.  The Features page will tell you details about each license, including the total number of seats available (labelled as Limit – in the screen shot below, the Limit is 5) and the type of Zemax OpticStudio license (Product/Feature – this is a Professional-level Network license).




Viewing user sessions and checked out licenses

Active sessions

Click on Sessions along the left-hand side of the page to see each license seat in active use. From here, you can see each current user’s ID, IP Address, machine name, and login time. Note there is a Disconnect option but OpticStudio will not release a lciense seat unless the end-user closes the application.

TIP: The sessions list does not include detached / checked out licenses in use by client machine . See the next section for instructions to see checked out licenses. 

Viewing Checked out Licenses

You can see who or what client machine has checked out a license seat for offline use.

First, click the Products link on the left.

Next, click the number under the "detached" heading to display the list of computers with a checked out license and their expiration date. See the Detachable Licenses section below for more information on configuring this feature. 





The Configuration page is where most settings will be controlled on a keyserver machine. Here, we will go through all of the most-relevant options for your keyserver.

Basic Settings (Writing an access log, and setting a password)


Allow Remote Access to ACC:
If checked, the Sentinel Admin Control Center page will be accessible from any machine that can view the server.  For example, this would allow client machines to log in and view the Sessions to identify who is accessing a particular license.  Client machines can access the Control Center by navigating in an internet browser to

TIP: Once this is checked, all ACC pages are visible and configuration settings may be changed by any client machine, unless you have set a password for the Configuration Pages on the key server. See the next section on how to set a password.

Write an Access Log File

To log usage of the Zemax License from client machines follow these steps:

1. Check the 
Write an Access Log File box.
2. Check the Include Remote Requests box.
3. Click the Edit Log Parameters button to configure the formatting and set the information you want to log. See the built-in help located at the following page for details on how to format the log files.

Tip: You can include commas in between each parameter of the "log parameters" page if you want the file to be saved in a comma-delimited format that you can open with Excel or other software.


Select the following additional check boxes if you wish:

  • Include Local Requests: Logs requests on the current machine (Normally not useful for servers, unless you also run your Zemax application on the server)
  • Include Administration Requests: Logs requests made to Sentinel License Manager by Admin Control Center (no license information is tracked)

To view the logs, the log files are stored with the filename access.log in the following folder:

  • ..\Program Files (X86)\common files\aladdin shared\HASP\log (if Write Log Files Daily is checked)
  • ..\Program Files (X86)\common files\aladdin shared\HASP\ (if Write Log Files Daily is not checked)

To limit the size of the log files you can set a size limit. When the log file reaches the size specified (0 - 9999 KB) in Size Limitthe file is closed and a new log file is started. If Size Limit is setto 0, the log file is never closed.

Password Protection:
By default, no password is set. You can add a password to prevent local and remote users from changing settings or seeing the license information on the server without prompting for a password. If you only need to lock out remote users from access to the server's Admin Control Center, you can remove the check the "
Allow Remote Access to ACC" box on this page instead.

To set a password follow these steps:

1. Choose either Configuration Pages or All ACC pages. For example, if you would like to view current licenses, but restrict the ability to modify any of the configuration settings, you will want to password protect the Configuration Page. To restrict viewing any pages in the Sentinel Admin Control Center without a password, choose All ACC Pages.

TIP: If you set a password for "All ACC pages" your softkey license will not be visible in the Zemax License Manager on the server, as the license manager has no way to enter a password when retrieving key information. However, clients will still be able to see it

2. Click Change Password.

3. You will next be asked to supply a new password. If there is no current password set, leave Current Admin Password blank. Enter a password in the New Admin Password field and Re-enter new admin password. Click Submit to confirm it.

3. After submitting the new password, you will get an authentication popup to enter the new password. Leave the User Name field empty, as there is no username required. Type the new password you just set and you will get logged back in to the Admin Control Center. 

Clearing a forgotten password
If you forget the password you set, it can be removed.

1. Using Notepad, open the file hasplm.ini located in C:\Program Files (x86)\Common Files\Aladdin Shared\HASP folder.
2. Delete the encrypted password (everything after the equals sign) on the line adminpassword. Re-save the file.
3. Restart the Sentinel LDK License Manager Service
4. Close and re-open all instances of your web browser 

Additional built-in help on the password feature is  here: http://localhost:1947/_int_/ACC_help_config_user_access.htm




Allow or deny access from specific users on the local network.The default with no rules set is to allow all users access to the network license.

Click Show Recent Users to display a list of users who have recently accessed licenses on this machine. From the popup window that appears, you can explicitly select to block or allow users individually "on the fly" so you don't have to add them to the "User Restrictions" list manually.

You can also combine user and machine rules (like allow certain users only from a certain machine access to a license) by replacing @all with the IP address or machine name. Further details on rules is available in the built-in help page: http://localhost:1947/_int_/ACC_help_config_users.html

Things to know about the user restrictions list:

  • The username is based on the WIndows username. To verify the format of the username, click the Show Recent Users button.
  • The list of rules is processed from top to bottom (similar to Apache and other products).
  • Note that allow=all@all will automatically be the added as the last item on the list. If you want to restrict all users except certain ones, just make sure deny=all is at the bottom of the list, but above allow=all@all like Example 2 below.
  • These rules are shared by all Sentinel Licensed products you have installed on the machine. For example, if you have both OpticStudio Pro and Premium network licenses, you cannot block users from one or the other. You would need to move one license to another machine or VM then set rules on that machine**.

** NEW FEATURE - You can add rules so only certain users or computers can access certain products. This  eliminates the need to host licenses on different servers if you want to have separate rules for each each.  This feature was added as of the Sentinel LDK Runtime 7.60. Check the diagnostics page of the Admin Control Center to see the runtime version you currently have installed.

The 7.60 LDK release (or newer) will be included with the Zemax License Manager as of April 2018. If you want it earlier or don't want the new Zemax License Manager, you may install the latest Sentinel LDK runtime separately. Instructions are in the article "How to Troubleshoot Softkey License Iissues" in the "Repairing" section.

How to allow or deny access to a specific product or key id:

1 - See the "Features" page to identify the product number or key ID.
TIP: We recommend using Product rather than Key ID as the key ID would change if the license is replaced with a new one
2 - Modify the user restrictions

This line would deny USER1 access to an OpticStudio Premium-Network license (product 21) with key ID 410177719861922512

This line would deny all users at COMPUTER1 access to the same license:

Here are some example screen shots showing the most common user restriction scenarios customers ask for. 

Example 1 
This example allows everybody except user1 user2 and user3 to use all licenses. 


Example 2
The below example allows only user1 user2 and user3 access to licenses. Notice the deny=all is after the list of users and before "allow=all@all".


Access to Remote License Managers

Allow or deny access to view licenses hosted on other servers. This will usually be configured on the client machines, not on the keyserver itself.

Access from Remote Clients (client machine restrictions)

Allow or deny access to seats from the network license from some or all machines.  

Allow Access from Remote Clients must remain checked on the keyserver machine, or clients will not be able to see the license on the server.

You can also restrict certain computers from using the license. Click Show Recent Client Access to display a list of users who have recently accessed licenses on this machine. You can block or allow machines "on the fly". That way you don't have to add them to the "Access Restrictions" list manually.

Things to know about the access restrictions list:

  • You can use either an IP address or computer name. We recommend using the computer name as IP addresses are generally dynamic and may change.
  • These rules are shared by all Sentinel Licenses you have installed on the machine. For example, if you have both OpticStudio Pro and Premium network licenses, you cannot block computers from one or the other. You would need to move one license to another machine or VM then set rules on that machine.
  • The list of rules is processed from top to bottom (similar to Apache and other products).
  • Note that allow=all@all will automatically be the added as the last item on the list. If you want to restrict all users except certain ones, just make sure deny=all is above allow=all@all like Example 2 below.

To set the rules manually, the rules are similar to the above "User" settings page. Examples are below. See the built-in Help at http://localhost:1947/_int_/ACC_help_config_remote_clients.html for other details.

Example 1 
This example allows everybody except the 5 machines listed to use the license.


Example 2
The below example allows only the 5 machines listed access to the license. Notice the deny=all is after the list of users and before "allow=all@all".

Detachable Licenses - Checking out license seats for use offline 

Note: This feature is for softkey licenses only. Red USB network keys are not capable of license check out.

Softkeys are able to permit license check-out on a client machine, which allows a client to reserve a seat from the network key, hosted on the local machine for a limited loan period. The seat is removed from the general network license pool and saved for exclusive use on the local client machine. During this loan period, the client machine can be taken offline while maintaining private access to its license seat.

By default, when the key is initially installed and activated, license check-out is disabled.  To enable the check out functionality, check the “Enable Detaching of Licenses" box. Once a license is checked out, it is stored on the local client machine for a set period. During this period, the user can disconnect from the internet entirely while still maintaining use of Zemax OpticStudio.

Max Detach Duration

The duration of the license loan can be set for any period from 1 - 9999 days. Licenses automatically expire after the specified duration. Checked out licenses can be checked back in early any time by the client, as long as the client can communicate with the key server machine. Note that licenses cannot be checked back in early from the server machine, only from the client machine. See the "License Seat Check Out on the Client" section of this article. 

Tip: We recommend keeping the duration as short as practical. We suggest 1-2 weeks. If a client computer with a checked out license seat fails, lost or stolen, you will lose access to that license seat until the specified duration runs out. For example, if you check out a license for a 30 day duration, and the client computer is stolen on day 1, you will need to wait 29 days for the check out period to expire. If you encounter this situation, and need a temporary license seat, feel free to contact the Zemax support team. Include your softkey license number (Such as L100000). Note that temporary licenses are available for 30 days or less.

Reserved Licenses

A certain number or percentage of all available license seats can be reserved on the network and made unavailable for check out.  In the example screenshot below, we have reserved 5 licenses (or seats) on a 15-license network soft key. This means that 10 licenses could be checked out to individual client machines for offline use, but 5 licenses would only be available on a first-come, first-served basis.  If you are hosting more than one network license on a single server (for example both OpticStudio Professional and Premium) it is possible to configure different settings for each by using the “Per-Product Settings” option.
Tip: If you have more than one Zemax network license on the server, select the "Per Product Settings" button on the right. You may configure different detachable license settings for each license.


License Seat Check Out on the Client

To check out a license seat on a client machine for use offline, follow these steps:

1. Close OpticStudio.
2. Launch the Zemax License Manager (ZLM)
  • For OpticStudio licenses, you can find the Zemax License Manager in Start > All Programs > Zemax OpticStudio.
  • For Lensmechanix licenses, Open Start > All Programs > Lensmechanix > Zemax License Manager.
3. Your network license will be listed with license type "Network" the list and should have a Check Out button. If the Check out button is greyed out and unavailable, look through the list of keys to ensure you do not already have a license checked out (Look for a license with a line stating Checked out until and a Check In button). If you do not find a checked out license, then your network must use a Red USB dongle, which does not support license check out.

4. Press the Check Out button.

If the check out was successful, an additional entry in the License Manager will appear with the following information about the checked out license seat. The date next to Checked out until is when the license seat will expire and automatically be checked back in to the server. The length of time is set by your network keyserver administrator. 

Tip: If you press the Check Out button on the client and receive an error stating that the check out could not be completed, or "The server adminbistrator has disabled license check out", you need to contact your network administrator and ask them if license check out on the server is enabled, or troubleshoot the issue (the error is the same for either, depending on the version of OpticStudio you are running).

5. Once the license seat is checked out, the client machine may be disconnected from the network. To return a license seat before it expires, simply press the Check In button. Note that your computer needs to be online and be able to see the key server the license seat was checked out from.

For more details on the ZLM controls and information, you may also refer to the OpticStudio Help in The Help Tab > Information Group > License Manager and in the article "Transferring and Updating a Softkey License" or How to Install the Network License Version of OpticStudio in the "Using Zemax License Manager on the Client Machine" section.


Q&A for Softkey and Red USB Network Licenses


Q: I checked out a license seat for use offline. When i restarted my computer, it was no longer available in the Zemax License Manager. What happened?

A: This is an issue that was discovered with the licensing in OpticStudio 17, 17.5 and 18.1. The vendor of our softkey licensing released an update that was included in OpticStudio 18.4. If you need to address this without installing 18.4, you can install the latest version of the softkey runtime instead. Open our knowledge base article How to Troubleshoot Softkey License Issues. Though not required on the server hosting the license to fix this issue, we recommend updating the server as well as the client machines, since it includes some security enhancements.

Q: In the Zemax License Manager, the there are less than the total number of available seats I expect to see. Why?

A: First, check for licenses that have been checked out (detached) as well as open sessions in the Viewing user sessions and checked out licenses section above. If the total number of seats is still not what you expect, this means that the server has not properly released a session after OpticStudio was closed.To resolve this, you can Restart the Sentinel LDK License Manager Service.

Q: How can I enable license check-out on the key server so that my colleagues can work offline?  

A: See the Configuration > Detachable Licenses. section above.

Note: License check out is only an option for network softkeys, not for Red USB network keys.

Q: Where do I set the length of the checked-out license loan period?

A: See Configuration > Detachable Licenses. and set the number of days in "Max. Detach Duration"

Q: What if clients get an error when checking out a license even though check out is enabled on the keyserver? 

A: Restart the Sentinel LDK License Manager service on the server.

Q: How can I keep X seats reserved for first-come, first-serve use while allowing the others to be checked-out?

A: See Configuration > Detachable Licenses. on the keyserver machine. You may set a fixed number (X) or a percentage of all licenses to keep locked in the general license pool, unavailable for check-out.

Q: Can I check a license seat back in early from the key server machine if the client machine is broken or stolen? 

A: No. Checking in an offline license has to be done from the client machine. If the client machine is no longer available due to machine failure or theft, you will need to wait until the check out loan period expires to get the seat back. See the Detachable licenses section of this article for details. 

Q: Where can I find additional help for the Admin Control Center?

A: Besides the documention here, there is either the "Help" link on the left side of the Admin Control Center page, or you may access context-sensitive help for each section by clicking the “Help” button in the lower right corner of each page which will take you to the proper subsection of the Help index.


Addendum: Restarting the Sentinel LDK License Manager Service to fix issues

This is useful if it's not practical to restart the entire license server machine, and can be used to fix the following issues:

  • The license server or client machines are not able to see the softkey license in the Zemax License Manager 
  • You change a configuration setting on the keyserver and it doesn't take effect after clicking "Submit".
  • License check out on the client fails even if the detachable license feature is enabled on the server.
  • You need to release license seats from the server that appear in the session list but are not accessible to other users.

You may either open the Start menu, and search for services.msc, or open Control Panel > System and Security > Administrative Tools > Services. Right-click on Sentinel LDK License Manager and select Restart. It will typically take 30-60 seconds to be ready.