How to configure the keyserver and clients for Zemax network licenses

This article explains how to configure and activate a keyserver and client machine for use with an OpticStudio or OpticsBuilder network license. Also included is a FAQ and some troubleshooting tips.

If you are configuring an OpticsViewer network license server or client, see this article instead

For instructions on how to install OpticStudio with an individual license, please refer to "Installing OpticStudio for the first time." 

Authored By Alison Yates & Alissa Wilczynski



This article explains how to configure a license server and client machine for use with an Opticstudio or OpticsBuilder  network license that uses either a Red USB or softkey (one that uses only an license activation code).  




Image_1   Images_2   Image_3  Image_4


Prior to October 2016, Zemax sold black network USB dongles, as pictured above. If you still have one of these license types (they will have a license serial number of 22000 to 40999), see "Installing OpticStudio with a black USB network license." 


Note that the network softkey or red USB license is worth the full value of the software. We recommend that you ensure the network key for its full replacement value, and that the keyserver machine be kept in a secure room. See the Zemax Licensing Policies for details on both perpetual and subscription licenses. 


Zemax network licenses make it easy to receive support renewal updates as they only have to be applied on the server machine. This also means the seats can be shared among a team without using transfer codes or trying to keep track of physical USB dongles for each user. The Red USB network key has the licensing information embedded in it. The softkey has no physical unit -- the license itself is attached to the keyserver computer through software. License check-in/check-out for offline use is supported with Softkey licenses, but not the Red USB key.


Preparing to install


Before installing the software, there are some simple concepts you must understand. The network key is installed on a machine called the keyserver. This can be a real machine or a virtual one. The server hosts the license key and the software service that makes the license available over your network (LAN). The keyserver can be any Windows machine on the network. There is no Linux support for the license server. It can be installed on Windows 7 Service Pack 1, 8.1, or 10 or any Windows Server 2008 R2 SP1 or newer Server operating system up to 2019. Note that "Core" versions of Windows Server are not supported.  The server requires ~500MB drive space free for the software and only requires the same minimum RAM the OS requires to install. 


Client machines are the machines that will run your Zemax software or and use the network license. The client machines must be able to ping the keyserver in order for the server's license to be seen.


Zemax uses the Thales (formerly Gemalto) Sentinel LDK license technology and communicates on port 1947 on your network.  


Tip: You cannot run multiple client users of OpticStudio on the key server itself or multiple users on client machines. You may have one user on the server or on each client machine. This is due to the instance limitations and the way the licensing is designed to assign network seats to client computers. See the FAQ at the end of this article for details.


Installing on the keyserver machine


The first step to configuring your network license is to properly configure the keyserver machine that will host the license. Doing this requires three steps: installing software and activating the license, checking the Windows firewall, and configuring the keyserver settings. The following sections describe these steps in detail. Note that in order to properly install the keyserver software, you must be logged in as an administrator on the key server machine.


Install and activate the license software


To install the license software and activate your license, take the following steps. 


  1. For installations on machines with Internet access, the Zemax license manager software will download everythnig needed. If your server is without internet access, you will need to first download and install the .NET Framework from Microsoft. As of Jan 2021, the minimum .NET version required is 4.8 but you may install a newer .NET framework if you like. Then proceed to step 2 and install the Zemax License Manager.
  2. Navigate to the OpticStudio Downloads page. Open the Resource Files section. Download and launch the Zemax License Manager (ZLM) installer. This application will allow you to view, activate or transfer the license as well as update your license when renewed or changed in the future. This installer package includes everything you need to install and manage your license server. You may accept the default options or choose an installation folder.

    Tip: If you are upgrading over an older version in the same folder, all settings and licenses will be retained. 




  1. Activate your license:

    Note: Starting in May of 2019, Zemax begin shipping the Zemax License Manager Version 2 (ZLM V2), with a different user interface.  The instructions below will cover both versions of ZLM, though most new licenses require the newer release. 


  • For Red USB network licenses: These require no activation. You may plug in your red USB dongle. The key should light up with a red light if it is working properly. If the key does not light up, you may need to refer to the "repairing the license runtime" in "How to troubleshoot red or green USB license issues" article. If the key is lit, move down to Step 4.

  • Softkey licenses: If you only received an activation code, and the server is connected to the internet, start by opening the Windows Start menu...Zemax License Manager...Zemax License Manager. If you have a softkey license and your server is not connected to the internet: please visit this article for instructions to activate your softkey license offline. Then come back to this article and move down to step 4 "Verify your license" to complete the server configuration.

  • For the classic versions of ZLM (Nov 2018 or older), select New key, input your activation code, and click Apply License. You should get a message of success. 

    TIP: If your activation code starts with "ZU" you need to upgrade your Zemax License Manager to a May 2019 or newer version and follow the instructions in the next section. 

  • For ZLM V2 as pictured below, select New License,

    Tip: If you are completing a license transfer from another machine into this one, use the "Receive License" tab instead and use the transfer code you have. 

    Enter the License Number and Activation Code. If your software requires a Zemax account login, two fields will automatically be displayed to enter your Zemax email address and password. Once activation is complete, you will receive a confirmation message that your software has successfully activated. Move down to step 4 "Verify your license"

    TIP: If you get a "not authorized" error, the License Administrator will need to add you as an "end user" of the license to authorize you





  1. Verify your license is installed and working. After activation, you will be taken to the License Information or View License sections of the ZLM or ZLMV2, respectively. Verify that the Product, Support expiration, and Seats: Total match your activation email or purchase order.

    IMPORTANT: After completing activation and verifying your information, we recommend reading the Zemax Licensing Policy. It provides details on how softkey licenses are locked to the machine, tips to avoid losing it, backing it up, and our policy on lost keys. 

    Move to the next section "Check or open the Windows Firewall". 


License Information







Check or open the Windows firewall


The next step in the installation and configuration process is to check the Windows firewall. Normally the installation process opens the Windows firewall for you automatically. This section will tell you how to verify that it is configured properly.


  1. Open the Windows Firewall settings by clicking the Windows Start button and searching, "Firewall."
  2. Select the Windows Firewall app.
  3. Select "Allow an app or feature through Windows Firewall."


Allow an app or feature through Windows Firewall


  1. Check the list of applications. If “License Manager” or "Sentinel License Manager" is already on the list, then you may move to the next section of this article: Configure keyserver settings and security. If not, move to step 5 of this process to add it. 




  1. Click "Allow another app." If "Allow another app" is greyed out, select Change settings to enable it.




  1. Click Browse and open the C:\Program Files (x86)\Common Files\Aladdin Shared\HASP folder.
  2. Select the hasplms.exe file from the list and click Open.




  1. The Zemax License Manager will appear on the Add an app window. Click Add to add the License Manager to list of exceptions. 




  1. The check boxes next to License Manager specify which type of network includes this exception. You may check any (or all) the boxes for Domain, Public networks, and Private networks. public networks are excluded by defaut for security reasons.

    Tip: If the computer is not joined to a domain, the Domain option will not show up. 




  1. Ensure port 1947 is not blocked on your network firewall both for UDP and TCP, and that you can "ping" the IP address or name of the key server machine from other machines. Consult with your IT or network department if you are not sure.  


Configure keyserver settings and adding End-users


​The final step in configuring the keyserver machine is to configure its settings and security. Click on Launch Sentinel Admin Control Center (ACC). This is located at the top of the Zemax License Manager (Classic) or under Troubleshoot (ZLM V2). You can also get to the Admin Control Center by opening a web browser and navigating to http://localhost:1947.       
This will open your web browser to the the following page. If this page does not open, see the "repairing the softkey runtime" section of "How to troubleshoot softkey license issues."


Click Sentinel Keys to see your installed Zemax license(s). Licenses can be identified by the Key ID field, which is also present in the Zemax License Manager. Note that Gemalto/SafeNet do provide licenses for other software, so you may also see non-Zemax licenses on this page. You can identify Zemax licenses using the Vendor field; Zemax's Vendor number is 114811. 


After identifying your license, you should be done with the basic server setup! If you have troubles with any of this process, you may contact Zemax support for additional assistance. For client configuration, proceed to the next section for client configuration. 




If you would like to further specify your server settings and security, select Configuration. You will see six tabs used to configure it. By default the licenses are available to anyone within your network. There is also no password or other blocks on changing settings in the Admin Control Center from other computers. You may configure security settings, log license usage, restrict users / computers from the license, and configure license Check Out (also known as Detachable Licenses) so client machines can use the software offline. For full details and instructions, refer to "How do I monitor and control usage of the network license?." 


Now that your server is configured, move to the next section Adding End-users to the license


Detachable licenses


Adding End-users to the license


if you have activated a subscription license (subscription is normally in the Product Name in your activation email), you are required to add end-users to the license. End users will then be authorized to use the license (they will be prompted to login) as well as access the Myzemax support resources.

Perpetual licenses do not require assigning end users to use the network license, but still need to be associated with the license for full access to support resources. The License Administrator (who by default is the one who originally received the activation email) can add end users to the license. Adding a new end user will automatically send them an invitation to create a Zemax account if they do not have one. See this article for detailed information on adding end-users.

Once your end users are assigned you can setup OpticStudio on a client machine. See the next section. 


Installing on the client machine


Note: If you are connecting to a server that has a Black USB network license (for Opticstudio only, and license numbers 22000-40999), the below instructions do not apply. For help with configuring a client machine to locate a server with a black USB network license, refer to the "client" section of the article "Installing OpticStudio with a Black USB network hardkey." 


If you have a red USB or Softkey license follow the steps below to guide you to installing and setting up the client machine.


  1. Ensure that you are logged in as an administrator on the machine.

    Download the latest copy of OpticStudio from the OpticStudio downloads page and follow the instructions in "Installing OpticStudio for the first time."
  2. Once installed, open Zemax License Manager from Start...Zemax Opticstudio...Zemax License Manager. Open the "License Information" or "View License" tab so see if it finds the network license automatically. If you do not see any licenses, skip to What to do if the license is not found automatically.
  3. Find the network license you wish to use and select Default or Set as Default. Some Zemax licenses require a login to use. If this is the case, a screen will pop up requesting your Zemax account email address and password. Login with your MyZemax email address and password.

    Once the license default is selected you will be returned to the View License page. The Default button will be blue, indicating which license is your default. You must remain connected to the network to use the license.

    Tip: If it says "not authorized" when logging in to the license. Log in to your Zemax account. In your Profile, find the license number you want access to and the License Administrator will be listed. Email the administrator and request they add you as as an End User.

    TIP 2: If you do not remember your MyZemax credentials, open, select Log  in, and select Forgot password? If you are still unable to login or use the license, email for help. 


If you have multiple licenses available to you, you can change the default anytime. 







What to do if the license is not found automatically


If the key was not found automatically by the client machine, follow the configuration steps below to help specify the network server where the license is hosted. 


  1. Obtain the license server machine name. Note that Zemax support does not know your server name as we do not host your license. One easy method to get the server name is to check with a colleague that is using the same license. You can get the server name from the Zemax License Manager application on their machine. It will be listed in the "Location" column next to "hosted on" .
    If this is at an educational institution for an optics class, check with the class instructor. If this is at a business, contact the Zemax License Administrator as listed in your Zemax account profile or your IT department to obtain the server information.

    Example of the license server name from a machine:

  2. Enter the server name. To do so, open the Zemax License Manager application and select Launch Sentinel Admin Control Center (ACC). This is located at the top of the Zemax License Manager (Classic) or in the Troubleshoot tab (ZLM V2). You can also get to the Admin Control Center by opening a web browser and navigating to this link: http://localhost:1947.

    Tip: If the Sentinel ACC gives an error message when opening, see the "Repairing the license runtime" section of "How to troubleshoot softkey license issues."

  3. As pictured below, open Configuration...Access to Remote License Managers. Make sure Allow access to Remote Licenses is checked. We recommend you also select Aggressive Search for Remote Licenses.

    In the Remote License Search Parameters box, input the machine name of the network license server you would like to access. We recommend using either the raw machine name such as servername, or the fully qualified name such as if you know it. It is not necessary to include http:// or any port number 1947 in the machine name.  

  4. Click Submit when done entering the server information. Check under Options...Sentinel Keys on the left to see if the network license has become visible. Note that there may be a delay of ~60 seconds before the key information is refreshed with the new settings.

    If you see it, close the Admin Control Center and re-open Opticstudio. If Opticstudio launches successfully, you are done! If the key remains unfound, continue to Step 5.

    TIP: If your client machine gets a "key not found" error even if the license is displayed or other errors, there is additional troubleshooting in Resolving network license issues on client machines 




     5. If the license key is still not found after entering the server information, try these options:


  • Restart the machine. That will ensure the licensing service has saved and refreshed the network settings.
  • Make sure you are connected to the company network directly or via VPN. 
  • If you are logging in to a company network via a VPN connection, your IT department may need to configure the VPN server to pass through traffic to the license server's IP address (Port 1947). Zemax cannot help you configure your company firewalls.
  • We also recommend verifying that your security software is not blocking access to the license software. Check your security software's logs to see if either the HASP_RT.EXE in the OpticStudio installation folder, or HASPLMS.exe in C:\windows\system32 has been blocked. Instructions for Mcafee Enterprise is covered in the Frequently Asked Questions section at the bottom of this page.


If you still cannot get Opticstudio to locate the license, feel free to contact Zemax support or your license administrator or company IT department for further help. 



Zemax License Manager (Version 2) license check out


This section is optional. Opticstudio will automatically use a network license seat when it launches, and releases the license seat when it closes. Most users will just make the license "Default'.


If you need to leave the network you can check a seat out before you go offline. This assumes your server administrator has enabled this option and your license type supports this feature.


Note that using the license check out feature dedicates a license seat to your machine for 1 or more days (14 days is the default) depending on the server settings. Therefore it's not recommended to use this feature unless you really need it. We also recommend checking it back in as soon as you no longer need it. This will maximize the availability of license seats for others. 


To check out a license, follow these steps:


  1. Close OpticStudio to ensure the license seat is not in use. 
  2. Launch the Zemax License Manager (ZLM). For OpticStudio licenses, you can find the Zemax License Manager in Start...All Programs...Zemax OpticStudio.

    For a Zemax License Manager dated May 2019 or later, continue to step 3. If your License manager shows a date of November 2018 or older at the top, skip to Classic License Manager license check out.


  1. Open the "View License" tab. Look for your network license - it will have "Network" in the product description. Make sure there is at least 1 Available seat or you will have to wait until another person stops using the license to check one out. 
  2. Click Check Out

    TIP: If you receive any check out errors, see the article Resolving network license issues on client machines 



  1. If the check out was successful, an additional entry in the ZLM will appear with the following information. It will also be made your default license. The date by "Checked Out Until" is the date and time the license seat will expire and automatically stop working. The length of time is set by your network server administrator. 



  1. Once the license seat is checked out, the client machine may be disconnected from the network. To return a license seat before it expires, simply press Check In. Note that your computer needs to be online and be able to see the same license number from which the seat was checked out. 



  1. Press OK, and you are done! 


Zemax License Manager (Classic) license check out


This applies to the Zemax License Manager from Opticstudio 18.9 or earlier (License Manager dated Nov 2018 or earlier).


  1. Locate your network license under License Information with "Network" as the product. Make sure there is at least 1 "Available" seat on the list.
  2. Click Check Out.




  1. If the check out was successful, an additional entry in the License Manager will appear with the following information about the checked out license seat. The date next to Checked Out Until is when the license seat will expire and automatically be checked back in to the server. The length of time is set by your network keyserver administrator. 

    TIP: If you receive any check out errors, see the article Resolving network license issues on client machines 






  1. Once the license seat is checked out, the client machine may be disconnected from the network. To return a license seat before it expires, simply press the Check In button. Note that your computer needs to be back on the network and able to see the same license that was checked out, or the process will fail. 





Frequently asked questions


Can I have multiple users run OpticStudio on the license key server machine?


OpticStudio network licenses are designed using a client-server model. The key server is intended host the license itself, and the licensing assigns 1 seat per machine. Also, OpticStudio is designed to allow a limited number of instances of the application. The key server can run a copy of OpticStudio for one user if you wish. Just be aware that using OpticStudio on the server for long optimizations or raytracing may tie up the CPU and may interrupt the license process for client machines. As a workaround to the above, you could install virtualization software such as VMware, then install Windows and OpticStudio within it. This also would allow you to limit RAM and CPU usage.


Do I have to worry about losing my softkey on the key server in case of hardware failure, theft, or a reinstall of Windows?


Yes, the softkey license is moved to the machine during install and locked to the machine so it can be lost. We recommend reading the Zemax Licensing Policies. It gives details on how softkey licenses work, tips to avoid license loss, backing it up and our policy on lost keys. Both the policies for perpetual licenses and subscription ones are covered here. 


What if Port 1947 is in use on my network?


Note that the keyserver and clients communicate on port 1947 on your network. This is because that port is not registered to any other known services. However, if that port is in use on your network, we can provide information to change it. Note that you will have to change the port on the key server and each client machine that will access the license server. Also, after the change the license will not be visible in the Zemax License Manager. Contact Zemax support to get instructions to change it and details. Please include your license key serial number (for example L000000) as well.


How do I configure multiple client machines with the server address, so users don't have to enter it themselves?


Normally, client machines will find the key server without entering the server name into the settings as long as they are on the same subnet. However, if you want to preconfigure the clients with a specific server name, or other settings, please see this article for details.


In the Zemax License Manager, there are fewer than the total number of available seats I expect to see. Why?


First, check on the server machine for licenses that have been checked out (detached) as well as open sessions. For instructions, read this link: "How do I monitor and control usage of the network key?." If the total number of seats is still not what you expect, this means that the server has not properly released a session after OpticStudio was closed. To resolve this, you can restart the Sentinel LDK License Manager service.


I checked out a license seat for use offline. When I restarted my computer, it was no longer available in the Zemax License Manager. What happened?


This is an issue that was discovered with OpticStudio 17.0 through 18.1. The vendor of our softkey licensing software released an update that addressed this issue. It was included in Opticstudio 18.4. More details on this issue in this article 


Client machines will not find the license server, or hang on the OpticStudio "splash screen" indefinitely. What can I do?


First, make sure that the firewall exception on the server is configured in step 5 of the server setup instructions above. Once you are sure of that, check the client machine has specified the name of the server in the What to do if the license is not found automatically section. If that is done, then your security software may be blocking access to the license software. We have seen both Trend Micro and McAfee block this.


If you use Trend Micro, check its scan logs to see if either the HASP_RT.EXE in the OpticStudio installation folder (normally C:\program files\Zemax OpticStudio), or HASPLMS.exe in C:\windows\system32 has been blocked.


If you use McAfee Enterprise, it's HIPS (Host Intrusion Prevention System) feature can block this. You can temporarily turn off HIPS to see if this is the case. On the client machine, perform the following steps: 


Right-click the McAfee icon in the system tray (by the time displayed at the bottom right). The Mcafee icon is normally a red shield with an M in the center. Navigate the menu to the Disable option. Select Disable HIPS protection. If this works, your IT department can whitelist the hasp_rt.exe process to fix it permanently. This file is located in c:\program files\Zemax OpticStudio.




Addendum: migrating your network license to a new server


This section provides a recommended procedure to move to a new server with minimal downtime and configuration. Note that if client machines have a checked out license seat at the time the license is moved to the new server, it will not affect them, as the checked-out licenses simply time out automatically. 


  1. Install the Zemax License Manager software on the new server following the process at the beginning of this article. 
  2. Copy the HASPLM.INI file from the current server to the new one. This file contains all the server settings from the Admin Control Center (user rules, detachable license settings, password, etc., as described in "How Do I Monitor and Control Usage of the Network Key?"). It is located in C:\Program Files (x86)\Common Files\Aladdin Shared\HASP.
  3. Transfer the license from the old server to the new one. If using a Red USB license you may simply plug it in. If using a softkey license, follow one of the guides here: "Transferring and Updating a Softkey License (with internet)" and "Activate, Transfer, or Update a Softkey License On A Machine Without Internet Access." Note that there can be no active client sessions of the Zemax software open when transferring, so this is best scheduled after hours.  
  4. Test the license server is working with an OpticStudio client machine. If you need to test the new license server before moving the license over, you may email They can provide you a 2 week temporary network license you can use. Note that you must have an active support agreement to receive a trial license.

    If moving a softkey license, test the transfer process between servers with the trial license to make sure it works and get used to the process.

    TIP: After you are done with the trial license test and have moved the active license, you will want to remove it from the server to prevent users from accidentally using it after it expires. The easiest way to remove the trial license is to just transfer it away and discard the generated transfer code or h2r file.
  5. Let the users of OpticStudio know they may need to modify the settings on their client machines with the new server IP address or machine name. You can provide the new server information and a link to the instructions in this article under "What To Do If the License Is Not Found Automatically."  Alternatively you can provide them with a modified HASPLM.INI file with the new server information per the following article: "Automate Client Computer Configuration for Softkey and Red USB key Network Installations."


Addendum: restarting the Sentinel LDK license manager service to fix issues


This is useful if it's not practical to restart the entire client or server computer, and can be used to fix the following issues:


  • The license server or clients are not able to see the softkey license in the Zemax License Manager 
  • You change a setting on the keyserver and it doesn't take effect even after submitting changes
  • A license seat fails to check out on the client even though the "detachable license" feature is enabled on the server.
  • Releases sessions showing on the server that are no longer actually in use. Note that this does not release checked out licenses.


You may either open the Start menu, and search for services.msc, or open Control Panel...System and Security...Administrative Tools...Services and right-click on Sentinel LDK License Manager and select Restart.


Sentinel LDK License Manager





If your client machine has any issues checking out a license, gets a "key not found" error even if the license is displayed, or cannot see the server license at all, there is additional troubleshooting in Resolving network license issues on client machines 


If you are a network administrator and would like to easily configure multiple client machines to use the same keyserver settings, see "Automate client computer configuration for softkey and Red USB key network installations" for more details. 




Was this article helpful?
0 out of 2 found this helpful



Please sign in to leave a comment.