How RDS Licensing Works: An Overview

Remote Desktop Services Client Access Licenses define how users or devices may access a Microsoft Remote Desktop Services deployment. This overview explains the main RDS CAL models, how an RD Licensing server supports them and which technical details administrators should verify.

Microsoft licensing depends on the operating system, installed roles, user population and agreement governing the deployment. This article provides technical context in preparation for your subsequent licensing determination.

What Is an RDS CAL?

Why RDS Licenses

RDS Licensing is the system Microsoft uses to manage and provide access to its Remote Desktop Services. The licensing process ensures organizations have the appropriate licenses for users or devices connecting to the RDS infrastructure. As such, it is a critical component in managing and providing remote desktop access to users in a Windows Server environment.

What are Client Access Licenses?

So, rather than a software product, an RDS Client Access License, or RDS CAL, is a licensing right associated with access to Remote Desktop Services. It is not client software (unlike Remote Desktop Protocol) nor does it create a remote session by itself.

In a conventional Windows Server RDS deployment, administrators should consider both the underlying Windows Server access rights and the additional rights associated with Remote Desktop Services. An RDS CAL should not be treated as a replacement for any Windows Server CALs or other licenses that may apply.

RDS CALs and Remote Desktop Protocol (RDP)

Remote Desktop Protocol, or RDP, is the native connection technology. Remote Desktop Services, or RDS, is the Windows Server role-based platform which delivers shared desktops and RemoteApp programs to users. Our Windows Server Remote Desktop guide provides a broader explanation of this architecture and its main server roles.

Limited remote administration rights are distinct from providing everyday desktops or business applications to end users. Organizations should verify the applicable Microsoft terms before treating administrative access as an end-user remote application service.

Now, before going into further detail, here are some basics and the vocabulary to navigate this topic.

Basic Workings, Definitions and Interactions:

1. Types of RDS licenses

RDS CALs, aka Client Access Licenses, can be assigned in two ways: 

• User CAL: This license allows a specific user to access RDS from any device. It is ideal for scenarios where individual users need flexibility to connect from multiple devices, such as desktops, laptops, or tablets.
• Device CAL: This license is assigned to a specific device, allowing multiple users to access the RDS server from that device. It is suitable for environments where several users share a single workstation.

2. Licensing process

1. License Server: You must install and activate the RDS License Server role on a Windows Server to manage the distribution of CALs. The License Server is then responsible for managing and issuing RDS CALs to users or devices.
2. Activating License Server: Once the License Server role is installed, you must activate it through the Microsoft Licensing website, via a phone call, or automatically if internet access is available.
3. Installing CALs: Following activation, you can install the purchased RDS CALs on the License Server. This process usually involves entering a license key provided by Microsoft. These CALs will then be distributed to users or devices as they connect to RDS.
4. Issuing CALs: When a user or device connects to an RDS session, the RDS License Server issues a CAL if one is available. The License Server tracks the usage of each CAL to ensure compliance.

3. Grace period

Upon first installation of the RDS role, there is a grace period during which no RDS CALs are required. This allows you to configure and test your RDS environment without immediate licensing concerns. After the grace period, proper RDS licensing must be in place.

4. License enforcement

• Per User: The License Server doesn’t strictly enforce per-user licensing; it simply tracks the number of issued User CALs. You need to ensure you have enough User CALs purchased to cover all users.
• Per Device: The License Server actively tracks the devices and ensures each device has a valid Device CAL.

5. License types

• Permanent: Regular CALs are permanently assigned until manually revoked or expired.
• Temporary: Temporary CALs might be issued when a new user or device connects to the RDS for the first time. These typically last for 90 days and are then replaced by a permanent CAL if available.

6. Licensing compliance

Compliance is crucial. The License Server tracks the number of issued CALs to ensure you don’t exceed your purchased licenses. It’s important to ensure uninterrupted access. While User CALs are not strictly enforced, Device CALs are closely monitored to ensure each device has a valid license. The License Server can produce reports to help track usage and compliance.

7. High availability

For environments where uptime is critical, RDS License Servers can be configured in high availability modes. This ensures that even if one License Server fails, another can continue issuing licenses.

8. External Connector License

For scenarios where users are external (e.g., partners or customers), an External Connector License may be more appropriate than individual CALs.

9. Session Hosts and licensing modes

The RDS Session Host must be configured to use the correct licensing mode (Per User or Per Device) and be pointed to the correct License Server.

10. When in doubt, check

Remember, this remains a high-level overview. As the specifics can vary depending on your environment and Microsoft licensing agreements, it is always a good idea to consult with a licensing expert or Microsoft representative to ensure full compliance and optimal configuration.

With those notions rounded up, below are specific aspects in greater precision and with illustrations or examples where needed.

TSplus Remote Support Free Trial

Cost-effective Attended and Unattended Remote Assistance from/to macOS and Windows PCs.

Start a Free Trial

When Are RDS CALs Typically Required?

CALs for different infrastructures and uses

Each user or device connecting to an RD Session Host running Windows Server needs an appropriate RDS CAL. The licensing analysis can change when an environment uses other Microsoft services, hosted infrastructure, external users or different access technologies.

The first step is therefore architectural. Identify whether the RD Session Host role is installed, which services users access and whether the connection supports server administration or a multi-user application-delivery environment.

Internal and external users

Employees, contractors, partners and customers may not always fall under the same licensing approach. Microsoft offers External Connector licenses for some products and external-user scenarios, but the applicable conditions depend on the product, server environment and agreement.

An External Connector should not automatically be treated as a replacement for User or Device CALs. Deployments involving customers, hosted services or large external populations should be reviewed with Microsoft or an authorized licensing specialist.

RDS User CAL vs Device CAL

User CALs or Device CALs

Microsoft provides two main RDS CAL models. The suitable model depends on whether users or endpoints are the more stable population.

Main distinctions:

• A User CAL follows the licensed user across devices.
• A Device CAL covers the licensed device when different people use that endpoint to access RDS.

Microsoft also notes that Per User tracking has limitations in workgroup environments, whereas Device CALs can be tracked without Active Directory membership.

Examples:

• An organization with 30 employees connecting from office computers, laptops and tablets may evaluate their need as 30 User CALs.
• A factory with 45 shift workers sharing 15 terminals may evaluate they require 15 Device CALs overall to be shared throughout shifts.

These examples illustrate the counting logic rather than provide licensing advice for a particular deployment.

Are RDS CALs concurrent licenses?

RDS CALs should not normally be counted as a floating pool based only on simultaneous sessions. Per User licensing is based on the relevant user population, while Per Device licensing is based on the relevant device population.

This distinction matters when a business has many authorized users but only a few active sessions at once. Session concurrency can affect infrastructure capacity, but it does not automatically determine the required CAL count.

How Does RDS Licensing Work Technically?

How does the process unfold?

An RDS deployment uses an RD Licensing server to install, issue and track RDS CALs. The normal administrative sequence is:

1. Install the RD Licensing role service.
2. Activate the licensing server.
3. Install a compatible RDS CAL pack.
4. Configure each RD Session Host with the correct licensing mode.
5. Point the Session Host to the appropriate licensing server.
6. Monitor issuance, configuration warnings and available licenses.

Potential issues

When a user or device connects, the RD Session Host determines whether an RDS CAL is required and contacts the licensing server. A correct CAL pack alone is not sufficient. Issues will arise if ever the Session Host uses the wrong licensing mode or cannot reach the licensing server.

Licensing specifics and groups

The TSplus guide to configuring Remote Desktop licensing mode explains the related Group Policy, PowerShell and server settings.

For Per Device licensing, the licensing server actively issues and tracks licenses for endpoints. Under Per User licensing, Microsoft places greater responsibility on administrators to maintain the correct number of licenses because technical over-allocation can occur.

For simpler application and desktop publishing without the operational weight of a full RDS stack, why not start a free TSplus Remote Access trial? A great way to test simple centralized application delivery in your own environment.

What of Grace Periods and Temporary CALs?

120 days of grace period

A newly deployed RD Session Host has a 120-day licensing grace period during which a license server is not required. After this period, eligible clients need a valid RDS CAL issued by an available licensing server before they can start a remote session.

A deployment window, not a derogation

The grace period is a deployment window, not a permanent licensing model. Administrators should use it to activate the licensing server, install the CAL pack and validate Session Host configuration.

Temporary CALs

Temporary CALs are a separate mechanism. In the Per Device model, a device can receive a temporary CAL on its first sign-in. Microsoft documents that temporary Device CAL as valid for 90 days. Temporary CALs are not available under the Per User model.

RDS CAL Version Compatibility

RDS CAL compatibility involves two separate checks:

Session Servers

For example, a Windows Server 2025 RDS CAL can cover an eligible connection to a Windows Server 2022 Session Host. A Windows Server 2022 RDS CAL cannot cover a Windows Server 2025 Session Host.

Windows Server versions

Likewise, a Windows Server 2022 licensing server cannot host a Windows Server 2025 RDS CAL pack. The licensing server needs to run Windows Server 2025 to install that CAL version.

Administrators planning a Windows Server upgrade should review the Session Hosts, RD Licensing server and installed CAL versions as one change.

Common RDS Licensing Mistakes

Several recurring problems are technical rather than purchasing errors:

• counting only concurrent sessions
• confusing Windows Server CALs with RDS CALs
• installing CALs but leaving the Session Host licensing mode unconfigured
• using a licensing server that cannot host the CAL version
• assuming that a successful connection proves licensing compliance
• allowing the 120-day grace period to expire before testing the licensing path

RD Licensing Diagnoser, Event Viewer and Remote Desktop Licensing Manager can help identify configuration and communication problems. When an RD Session Host cannot locate an appropriate server, look to our “No Remote Desktop License Servers Available” error guide for a focused troubleshooting path. Still, while those tools show a technical status, they do not replace a review of the applicable licensing agreement.

What Does TSplus Remote Access Add to the Discussion?

TSplus Remote Access

TSplus Remote Access licensing and Microsoft licensing should be assessed separately. TSplus support guidance distinguishes deployments using Microsoft RDS functionality and the RDS role from deployments where that role is not installed. While RDS provides a robust framework for remote access, TSplus offers solutions extending and simplifying the management and usage of your remote infrastructure.

Here is how TSplus can enhance your remote desktop experience:

Simple, and frees your operating system

TSplus Remote Access offers a cost-effective way of using traditional RDP, providing seamless remote desktop access with easy configuration and administration. It has the option for device and operating system-agnostic HTML5 access, opening up the Windows horizon so certain departments are not held at bay by system specifics. TSplus Remote Access supports a wide range of devices and allows you to instantly publish applications or desktops with minimal setup.

Agreements and requirements

Applicable Microsoft requirements depend on the Windows operating system, installed roles, services used and governing agreement. Organizations should therefore distinguish a TSplus license from any Microsoft licenses which may apply to the underlying server environment.

The TSplus support article on Microsoft EULAs and CALs sets out the product-specific technical position. However, TSplus hold no sway on determination about organizations’ compliance with Microsoft agreements.

Whether or not the Microsoft RDS role and RDS functionality are used, administrators should review Microsoft’s current RDS requirements. Indeed, even when the RDS role is not used, the organization should still assess any Windows Server, desktop operating system and application licensing obligations.

For a final assessment, document the architecture and consult Microsoft, an authorized licensing partner or another qualified specialist.

How Can the TSplus Suite of Software Enhance and Reinforce Your Setup?

TSplus Advanced Security

Security is a top priority in any remote desktop environment. TSplus Advanced Security enhances your RDS environment with features such as multi-factor authentication, IP address restrictions and comprehensive access control, ensuring that your remote connections are secure.

TSplus Server Monitoring and load balancing

For businesses that require high availability and scalability, TSplus Load Balancing distributes user sessions across multiple servers, ensuring optimal performance and reliability, even during peak usage times.

TSplus Remote Support

TSplus Remote Support simplifies remote troubleshooting and assistance, allowing IT support teams to connect to user sessions quickly and resolve issues without the complexity of traditional RDS support tools.

Conclusion

Understanding how RDS licensing works is essential for maintaining a compliant and efficient remote desktop environment. Effective RDS licensing implies addressing the questions: who connects, which devices do they use and which Windows Server roles deliver the session. From there, administrators can evaluate a User or Device model, configure RD Licensing correctly and verify version compatibility.

A working remote session does not in itself prove licensing compliance. Keep technical records, review Microsoft’s current terms and seek specialist advice when the deployment involves external users, hosting, mixed licensing models or an unusual architecture.

By leveraging TSplus products, you can enhance your RDS setup with improved security, simplified management and greater flexibility. Want simpler application and desktop delivery administration and usage, cost-effective remote access or advanced features? TSplus solutions can be tailored to meet your needs: explore TSplus Remote Access and start your free 15-day trial.

TSplus Remote Access Free Trial

Ultimate Citrix/RDS alternative for desktop/app access. Secure, cost-effective, on-premises/cloud

Start a Free Trial