How do RDP User CALs work?



  • If we have (say) 25 employees, and I reckon 15 of them are likely to want to use RDP with a given terminal server, and I buy 15 User CALs, and the licensing server issues them all, and then two of the people who have had CALs issued leave the organization, what happens to their CALs? Do they just evaporate, or do they become available for re-issue after an expiry time of some kind, or what?

    What if those two people don't leave the org, but simply stop needing to use the terminal server? Can I re-use their User CALs for somebody else, or are they permanently tied to those particular people, or is there some kind of timeout, or some mechanism for handing an issued CAL back to the licensing server for subsequent re-issue, or what?

    Interested in answers that cover both the contractual obligations associated with RDP licensing on the User CAL model and the technical enforcement measures that RDP and its licensing service use to ensure that those obligations are being met.



  • If someone logs in more than twice, the licensing server "permanently" assigns the CAL to their user account. CALs are domain wide, so if a user has a CAL, they can use any number of client stations to connect to any number of Remote Desktop Session Host servers in the domain (https://social.technet.microsoft.com/Forums/en-US/af4c33fb-acc4-41eb-856d-c132d42450d7/single-rd-license-server-multiple-rd-server-user-cals?forum=winserverTS). Any user accessing domain resources, including the terminal server, must also have a domain CAL, though there isn't any sort of licensing server for domain CALs (it comes down to having the licensing to point to if you get audited).

    From what I can see, there wasn't a way to manually revoke a user CAL within the RDS licensing server as of 2008 R2. I haven't found any articles that speak one way or the other to later versions of RDS licensing. If a user does not access the RDS environment within 90 days, or if their account is deleted from the AD environment, then their associated user CAL will be reclaimed.

    From a technical standpoint, the RDSH servers / licensing host will not impose a hard limit on sessions v licensing - the licensing server will issue "temporary" licensing in excess of the applied licensing. It will just result in the end users seeing some "contact your system administrator" type bitching messages, and you'll get event log entries indicating the licensing problem. As with most MS licensing things, you don't want to be caught short if the auditor shows up.



  • @izzion said in How do RDP User CALs work?:

    CALs are domain wide, so if a user has a CAL, they can use any number of client stations to connect to any number of Remote Desktop Session Host servers in the domain

    Could you point me to the MS licensing document that actually lays out all these rules in excruciating legalese? All I can ever find by poking around MS's various websites is vague and occasionally contradictory hints.

    Is the "domain wide" thing legal or technical or both?


  • Notification Spam Recipient

    @flabdablet for a moment I got a little freaked out that :@system: was talking...



  • @flabdablet

    I'm not coming up with much in the way of official sourced (TechNet, etc) confirmation of the "one CAL, all RDS hosts in domain" rule, just MS representative responses in some community forums. Ultimately, I think if you need official legalese confirmation, your best bet would be your MS licensing rep (via CDW or wherever you source volume licensing from). But everything I've ever found is that the domain wide thing is legal and technical both.

    Most of the places that I've worked that had more than one RDS server, the servers were all lumped together in a single server farm, so it made a lot of sense there that the CALs were one pool for the entire farm. I can't speak with experience as to how the licensing server reacts technically if Jim Bob tries to open a session on two different RDS servers in different farms, sorry.

    Also, be aware of the hidden licensing time bomb that is Office VL on an RDS host - if Jim Bob has Office installed on his computer, that requires 1 Office CAL. If he is also logging into a RDS server that has Office installed on it, that is a second CAL required. Or, more succintly, installing Office on an RDS server (farm) requires 1 Office CAL per user / device that is accessing the RDS server (farm), in addition to and irrespective of any licensing for individual users (or devices) for user workstations. And, naturally, you can't install retail (non-VL) versions of Office on an RDS server at all.



  • @izzion said in How do RDP User CALs work?:

    the domain wide thing

    We don't have a farm so much as a cottage garden. I've only set up two RDS hosts, one for each of our domains (we have two because we're required to keep the admin subnet, where all the school record keeping happens, separate from the curriculum subnet where all the educational stuff goes on).

    Admin boxes can open connections to curric boxes but not the other way around. I had thought that I'd need to acquire separate sets of CALs for each of our two RDS hosts, but depending on what "domain" actually means (Active Directory domain? The collection of hosts owned by a single entity? DNS domain?) I might be able to get away with having an RDS licensing server sitting on the curric subnet that both RDS hosts can talk to.

    Our MS enterprise agreement has been negotiated by the Catholic Education Office rather than by our specific school, and so far I've had even less luck getting specific information from them than I've had finding it from MS.



  • @Tsaukpaetra said in How do RDP User CALs work?:

    @flabdablet for a moment I got a little freaked out that :@system: was talking...

    My apologies.


  • Notification Spam Recipient

    @flabdablet said in How do RDP User CALs work?:

    @Tsaukpaetra said in How do RDP User CALs work?:

    @flabdablet for a moment I got a little freaked out that :@system: was talking...

    My apologies.

    Eh, no worries. I seem to be a little on-edge from my game playing last night...



  • @flabdablet I think if you connect the RDP server from "Business" versions of Windows (Say those Pro/Business/Ent/Ult versions), the CAL is included. Only if you try to connect from the "Consumer" versions of Windows (Say those "Home" version), a seperate CAL for RDP session is needed.

    At least I'm sure that's the model being used at the time of Win2k/XP/Vista to Win2003. Not sure whether it's changed on newer system because I don't have a need to look at those EULA updates.



  • @cheong
    This is not correct, and it never has been. The only "included remote desktop CALs" are that if you are using RDP to manage Windows Servers, you can have two concurrent sessions for administration. But that doesn't really cover regular use.



  • @izzion http://www.microsoftvolumelicensing.com/Pur Archive/ts_transition.doc

    TS is the name they use before RDS. What I said is true for Win2k and Win2003, but you're right that this is no longer applicable to later server versions.


Log in to reply