The client cannot play back video, and multiple "401 - Access denied" error messages are logged in the Windows Media Services logs (885168)

CAUSE

A service provider can write or can purchase a Windows Media Services authorization plug-in to enforce a "Play Once" subscription model or a "Play N Times" subscription model. These subscription models limit the number of times that an end user can view content.

In some clients, such as Windows XP Media Center Edition, when the end user switches from full-screen mode to windowed mode while the end user is viewing content, the client creates a new connection to the server to retrieve the content. Depending on the logic of the authorization plug-in, the reconnection to the server will count down, or decrement, the number of plays that the end user has left. If the specified Play Count limit is reached, the client will not longer have access to the content.

An end user who uses Windows Media Player may experience the same behavior when the end user closes a stream, switches to another URL, or experiences a prolonged network interruption and then tries to reconnect and to play the same content.

RESOLUTION

To avoid the behavior that is mentioned in the "Symptoms" section, use one or more of the following methods.

Make the Windows Media Services authorization plug-in server connection-independent

Modify the Windows Media Services authorization plug-in to track usage by using a logging database or by using another database storage system. This method helps you determine whether the end user has completed viewing the content within a specified period. When you use this method, access is permitted according to the specified tracking data every time that the end user reconnects to the server.

For example, the logging database may track whether the client is reconnecting to the server to request the same content at the same index point and within the same relative time frame as the earlier connection. If the client is requesting the same content, the client would be authorized to access the content.

Typically, a service provider would use a custom logging plug-in to make 401 error messages easier to identify in the logs. There are several logging fields that you may want to use to record each connection or to record actions by the clients. For example, the c-status field will record 401 error messages if the Windows Media Services authorization plug-in denies clients access to content. For more information, see the Windows Media Services SDK and the Windows Media Help documentation.

Enable a time-based subscription model

The service provider may decide to use a time-based subscription model instead of a "Play Once" subscription model or a "Play N Times" subscription model. A time-based subscription model would let the client reconnect to the server to access specific content an unlimited number of times within a specified period. For example, in a time-based subscription model, an end user could view a movie repeatedly within a 24-hour period.

A time-based subscription model does not require the server to decrement the number of times that a file has been accessed. Therefore, a time-based subscription model helps the end user avoid the reconnection issue. For example, authorization rights on a two-hour movie may let an end user view the movie for only a three-hour period. In this example, the three-hour time-based subscription model would restrict viewing to a limited time. This model also gives the end user a reasonable period of time to pause and to play back the movie.

Use Windows Media Digital Rights Management

Windows Media Digital Rights Management (DRM) offers a robust and more secure solution than the other options. Windows Media DRM functionality contains a rich set of rights that can support a variety of business models. These rights can determine the actions that clients can perform on the content.

Access control on the server does not help protect against recording or redistribution of the content stream. However, Windows Media DRM acts independently of any server-side plug-in architecture because the rights are applied to the media file. Therefore, Windows Media DRM also helps protect the physical delivery of intellectual property from unauthorized use, from unauthorized copying, or from unauthorized forwarding.

Windows Media DRM supports both time-based rights and play-based rights. You can use these rights together with the methods that are mentioned in the "Make the Windows Media Services authorization plug-in server connection-independent" section and in the "Enable a time-based subscription model" section to provide a more customized solution.

However, use caution when you apply play-based Windows Media DRM rights. This method may cause behavior that is similar to what an end user may experience when instance-based subscriptions are implemented within an authorization plug-in. In this case, if the specified Play Count limit is reached, an end user would have to obtain a new license to play back the content again.

In some configurations, Windows Media DRM licenses can be delivered silently to a client. If you do this, the end user's experience is not affected.

For more information about Windows Media DRM, see the Windows Media Rights Management SDK.

MORE INFORMATION

Authorization plug-ins are used to determine what the client is allowed to do. Generally, authorization plug-ins are used together with an authentication plug-in. The authentication plug-in is used to validate an end user's identity. Depending on the service provider's business model and licensing scenario, the authorization plug-in gives the client access to the content or denies the client access to the content, depending on the terms of the license agreement.

Typically, when an authorization plug-in denies access to content, it will log a 401 error message to the Windows Media Services log file. The built-in Windows Media Services Client Logging plug-in lets you log client connections and streaming details in a file on the server. You can set the location of the logging file by using the properties of the plug-in.

If end users are reporting that they are experiencing problems when they try to connect to content, view the log file. If it contains many 401 error messages, end users may be experiencing this problem.

For more information about logging, about authorization plug-ins, and about authentication plug-ins, see the Windows Media Services SDK and the Windows Media Services Help documentation.

REFERENCES

Technical support for Media Center

Because Microsoft Windows XP Media Center Edition was included with your hardware device or system, the hardware manufacturer provides technical support and assistance for this software. Your manufacturer may have customized the installation with unique components such as specific device drivers and optional settings to maximize the performance of that manufacturer's hardware. If you require technical help with Windows XP Media Center Edition, contact your manufacturer directly because the manufacturer is best qualified to support the software that the manufacturer has installed on the hardware.

You can also visit the Windows XP Media Center Edition product information Web site at the following Microsoft Web site:

http://www.microsoft.com/windowsxp/mediacenter/

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.