If you are an IT administrator, you have likely stared at a Microsoft licensing quote and asked: “Why do I need two different types of CALs for the same user?”
You are not alone. The distinction between a Windows Server User CAL and a Remote Desktop Services (RDS) CAL is the single most common source of licensing non-compliance audit fines.
This guide clarifies exactly what each license does, when you need them, and how to stop overpaying (or under-licensing) your infrastructure.
The Core Concept: “Access” vs. “Function”
To understand the difference, you must separate the “Server Access” from the “Service Function”.
1. Windows Server User CAL (The “Doorman”)
Think of the Windows Server User CAL (Client Access License) as the cover charge to enter the building.
- What it does: Legally allows a specific user (or device) to access any file, print, or authentication service provided by Windows Server.
- When you need it: If your user logs into the domain (Active Directory), gets an IP address from DHCP, saves a file to a shared folder, or prints to a network printer.
- Rule: Every single user or device accessing your Windows Server environment needs a User CAL or Device CAL. Period.
- Price: Inexpensive (~$30-50).
2. RDS CAL (The “VIP Pass”)
Think of the RDS (Remote Desktop Services) CAL as a ticket to the VIP lounge inside that building.
- What it does: Legally allows a user to “start a session” on the server’s graphical interface. This includes using Remote Desktop Protocol (RDP) to reach a Terminal Server, Citrix Farm, or VDI environment.
- When you need it: The moment a user sees a Windows Desktop hosted on a server, or runs a RemoteApp.
- Rule: You CANNOT buy just an RDS CAL. You must have the “Doorman” ticket (User CAL) plus the “VIP Pass” (RDS CAL).
- Price: Expensive (~$140-180).
The “Admin” Exception (Read Carefully)
This is where 90% of the confusion comes from.
Technically, Windows Server allows 2 simultaneous RDP sessions for free, without RDS CALs.
* Purpose: These are strictly for maintenance and administration (e.g., patching the server, checking logs).
* Trap: If you let “Jane from Accounting” RDP into the server to run QuickBooks using one of these admin slots, you are non-compliant. She is doing “work,” not “administration.” You need an RDS CAL for her.
Comparison Matrix
| Feature | Windows Server User CAL | RDS User CAL |
|---|---|---|
| Allows File Sharing Access? | ✅ Yes | ❌ No (Requires User CAL) |
| Allows Active Directory Auth? | ✅ Yes | ❌ No (Requires User CAL) |
| Allows DHCP/DNS Usage? | ✅ Yes | ❌ No (Requires User CAL) |
| Allows Remote Desktop (GUI)? | ❌ No | ✅ YES |
| Allows RemoteApp? | ❌ No | ✅ YES |
| Required for Citrix/VMware Horizon? | ✅ Yes | ✅ YES (Microsoft taxes the OS layer) |
| Typical Cost | Low | High |
User vs. Device CALs: Which to choose?
Both “Base” CALs and “RDS” CALs come in two flavors: User and Device.
Choose USER CALs if:
- Your employees have multiple devices (e.g., a laptop, a smartphone, and a home PC).
- You have roaming users.
- Math: 1 User x 5 Devices = 1 License.
Choose DEVICE CALs if:
- You have shift workers sharing a single station (e.g., a nurse’s station or a factory floor PC).
- Math: 3 Users (shifts) x 1 Device = 1 License.
Warning: You essentially cannot mix/match User and Device RDS CALs on the same License Server without headaches. Pick one model for your farm and stick to it.
The Compliance Checklist
To be 100% safe in an audit, ensure you have:
- Server License: A license for the Windows Server OS itself (Standard/Datacenter cores).
- Base CAL: One for every human being or device touching your network.
- RDS CAL: One for every human being or device initiating a remote desktop session.
Example Scenario
- Company: 50 Employees.
- Infrastructure: File Server + Virtual Desktop Server.
- Workforce: Everyone works from home on laptops.
You Need:
* 50 x Windows Server User CALs (for the File Server + Auth).
* 50 x RDS User CALs (for the Virtual Desktop).
If you only bought the 50 RDS CALs, you are missing the Base CALs and are liable for fines.
Summary
- Base CAL = Network Access.
- RDS CAL = Screen Sharing/GUI Access.
- You almost always need both if you are doing remote work.
Don’t let the similar names fool you. They are separate keys for separate locks, and Microsoft expects you to hold both.