Shared Device Licensing is the worst-supported corner of the Adobe estate, and Adobe gives you no API for it. So License Commander treats DNS as the API Adobe refuses to give you, and treats a human's attention as the scarcest resource of all.
A Shared Device License is not a person's seat. It is a paid entitlement bolted to a physical lab machine, billed to a campus account, that someone orders weeks before the computer is ever plugged in. Adobe's own API deliberately excludes it. The only record that a machine is consuming a license lives inside the Admin Console and a nightly CSV export.
Done by hand, one shared license means logging into the console, clicking through three separate product screens, downloading CSVs, squinting at cryptic machine names, guessing which department owns each one, looking up a billing account, finding the fiscal officer, and hand-keying a billable record. Then doing it again every time the count moves. And there is no clean way to ever revoke one.
Here is how the SDL Engine does all of it in the background, and what makes each step genuinely novel.
By the numbers
official Adobe APIs for shared-device and FRL licensing. The data lives only in a web console.
of machines whose Adobe-reported name does not match their real DNS name. Measured, not assumed.
campus DNS subdomains tried, in a smart order, to resolve a bare machine name.
runtimes running one identical resolver algorithm, so cloud and on-campus always agree.
nights a machine must go dark on DNS before an offline seat retires itself.
Seeing the invisible
Driving a console that has no API, unattended, at two in the morning.
Because Adobe exposes no API, the Engine does what a human would: it drives the live Admin Console with a headless browser. It keeps a persistent, logged-in session, and when that session ever lapses it re-authenticates itself by scripting the full university single sign-on flow from a secret vault, no human re-login required. It pulls from three different product screens, then files every report to storage. In August Adobe retired the report button on its shared-device screens, so the Engine moved those screens to the same device export it already used for the third one; all three now come out the same way.
Adobe also has bad nights. Since late August, the early-morning run stays quiet if Adobe is having trouble, and a second attempt runs later that morning. If the first run already worked, the retry does nothing. Only that final attempt sends an email when something is still wrong, so a passing Adobe outage heals itself before it reaches anyone's inbox.
Why it is clever
When a screen does not behave, the Engine does not just fail. It scrapes the product names actually on the page and puts them in the alert, so an operator can instantly tell a real Adobe rename from a passing glitch. It survives Adobe's random "something went wrong" pages, navigation aborts, and the one-time promo overlays that float over the table and eat clicks. Two real production incidents, down to the exact 2 a.m. failure, are baked into the code as permanent guards. It even reads Adobe's virtualized, scroll-as-you-go permission lists correctly, a genuinely fiddly piece of browser engineering.
✓ Toil removed a person logging into a console every morning, clicking through three UIs, and downloading spreadsheets by hand.
Making sense of a machine
Turning a cryptic name into a billable title, with a confidence score.
A raw device row is close to meaningless: a lab-sticker name, a package string, an Active Directory path. The Engine classifies each one into exactly one billable product, Creative Cloud Pro or Acrobat Pro, and, crucially, it scores its own confidence as HIGH, LOW, or REVIEW. A clear signal bills itself. An ambiguous one is flagged for a person and never guessed.
Why it is clever
The same physical machine can appear under a curly apostrophe one week and a straight one the next, or with a leading zero that drifts. The Engine normalizes all of that away, straightening four kinds of typographic apostrophes and stripping run-leading zeros, so GSC024-A and GSC24-A are understood as the one machine they really are. That single normalization is what makes it safe to promise a device is never billed twice. It also prefers the machine's public campus IP over the private one Adobe often reports, because only the public address reverse-resolves to a real name.
✓ Toil removed a human eyeballing every machine name and mapping it to a product, and the double-billing that quietly happens when the same machine shows up two different ways.
Guessing who pays
Best-effort billing that knows when it is unsure.
The hardest part of a shared machine is the question no data answers directly: which department pays for it? The Engine attacks that with a ladder of tactics. It reads the owning unit from the Active Directory path and the DNS zone. It applies a library of curated rules that map machine and package clues to an exact, validated unit name. When a package looks like a professor's lab, it splits out the surname, looks the person up in the directory, and accepts the answer only when it is unambiguous. And when a new orphan device appears, it infers the account from its neighbors: other shared machines on the same package, subdomain, and hostname prefix.
Why it is clever
It refuses to pretend. On a low-confidence guess, it will not silently pre-fill an account. It shows candidate chips and a plain warning when a package is spread across several units, and it hands the final call to a person. Once an account is chosen, it resolves the fiscal officer automatically from the campus chart of accounts, so nobody has to look up who owns the money.
✓ Toil removed the detective work of tracing an unlabeled shared machine back to a department and a billing account, without the mis-billing that guessing invites.
It only bothers a human for the calls that actually need a human. Everything else, it just does.
The one thing a person still decides
A review queue that pre-fills the tedious ninety percent.
Every genuinely new machine lands in an SDL Review queue, not on a bill. An administrator flips through them one at a time in a focused card that shows the evidence: the fully qualified name, the IP, the package, and the date it went active, alongside a confidence badge that reads plainly as "auto-resolved," "suggested, confirm," or "needs you." One click approves it. That approval mints a complete, billable license record, with the responsible contact, the fiscal officer, and the correct recharge fiscal year already attached, and a full audit trail.
Why it is clever
Nothing is ever billed before a person confirms it, yet the person almost never has to type anything. The tedious ninety percent, the title, the unit, the account, the fiscal officer, is already filled in. If a device is dismissed but keeps phoning home, it quietly resurfaces later with a "you dismissed this before" note, so a still-active machine can never be silently forgotten.
✓ Toil removed reviewing everything by hand. The human now triages only the genuinely ambiguous, and confirms the rest with a click.
Reconnecting a machine to reality
Reverse DNS as the source of truth Adobe will not give you.
Machines drift. They get re-imaged, renamed, and handed new addresses. Every night the Engine re-resolves each licensed device, forward and reverse, to keep its real identity current. The insight that shaped the whole design is a measured fact: the name Adobe reports matches the machine's actual DNS name in only three of fifty-three cases. Ninety-four percent of the time the obvious approach, trusting the name, would be wrong. So the design was inverted around the one thing that does resolve cleanly: the IP address, turned back into a canonical name.
Why it is clever
For a bare machine name that resolves nowhere, the Engine tries it against roughly thirty campus subdomains in a smart order, testing the zone that matches the machine's own prefix first. It guards against "wildcard" zones that answer every possible name with one bogus address, by first probing a nonsense label and skipping any zone that lies. Its doctrine is precision over recall: it would rather leave a machine unresolved than stamp it with a wrong identity. And the exact same algorithm runs in three places, the cloud, an on-campus service, and a plain script, kept in lockstep, because some internal machines are simply invisible from the internet.
✓ Toil removed manually cross-checking every shared machine against DNS to see whether it is still real and still where you thought it was.
Knowing when a machine is gone
A two-phase revocation and a self-closing state machine.
Retiring a shared license is where most systems fall apart, because there is no API to ask Adobe "is this machine still real?" The Engine infers it. The moment a decommission is requested, billing stops immediately, so a unit is never charged for a machine it is trying to retire, but the entitlement itself survives until the physical device is confirmed gone. From there the machine's own silence becomes the proof: a device that stops answering DNS for two weeks is treated as genuinely gone and retires itself, with no human click. Between one and two weeks dark, it raises a flag for a person to verify. A machine that stays online is never dropped automatically; someone has to finish the job by hand.
Why it is clever
Billing and physical teardown are decoupled, which is exactly right: units stop paying when they ask, not weeks later when someone finally drives to the lab. Every step of the state machine is guarded so the nightly robot and a human clicking "finalize" at the same moment can never double-apply. And underneath it all sits the rule that protects everything: a shared license is never treated as a person, so revoking a lab machine can never accidentally cut off a real employee's Adobe access.
✓ Toil removed chasing down whether a machine is truly decommissioned, and the closeout paperwork that otherwise never gets done.
Keeping the books honest, and closing the loop by force
Census, ghost-seat cleanup, auto-activation, and a clever last resort.
Around the core, a ring of jobs keeps the ledger clean. A weekly census answers the question a raw count cannot: the total moved from 121 to 134, so exactly which machines are new? A dedup report clusters paid-but-machineless "ghost seats" against the real machines on the same account, so a unit is not recharged next year for a computer that was already found under a different record. Another report chases orders where a license was bought but no machine ever appeared. Because every shared license belongs to exactly one machine, License Commander's own order form takes one device per order, and since October a multi-device order arriving from the older order form is split into one order per device as it comes in, with a note to whoever placed it asking for each machine's name and address. And a separate loop quietly promotes each approved package inside the Adobe console from "available" to "included," so the device can actually check out the license it was billed for, closing the last manual step an administrator used to do by hand.
Why it is clever
For a machine nobody can identify, the Engine has a final, behavioral move: it blocks the device in the console. A blocked machine stops working and cannot revive itself, which means its owner finally calls in, and the identity gap that no query could close, closes itself. It is automation that reaches through the software and nudges the physical world. Blocking is offered only for the license type where it actually works; on a true shared seat, which simply re-activates on next sign-in, the Engine refuses and explains why.
✓ Toil removed reconciling rosters by hand every week, hunting ghost seats before each recharge, and the never-ending question of "whose machine is this?"
An inventory Adobe will not give you, maintaining itself
Discovery, classification, billing inference, human-reviewed approval, nightly re-identification, self-closing retirement, and a ledger that reconciles itself. A multi-step manual chore became a background system that emails you only when it genuinely needs you. As far as we know, no one else automates this licensing model at all.