Microsoft Licensing. Schemes, features, pitfalls

Product description

Software Microsoft Windows Server CAL is an official document (not software) that gives the user the right to access Windows server online. A client license is required: to access the server from a device on the network, or remotely, regardless of the OS used; to use basic server services. With this licensing scheme, the total number of CALs must be equal to the total number of client PCs or users on the network.

License Microsoft Windows Server CAL is required for Microsoft Windows Server Standard and Datacenter editions. Additionally, incremental CALs are purchased in addition to the Microsoft Windows Server CAL for Remote Desktop Services (RDS CAL) and Active Directory Rights Management Services (AD RMS CAL).

Microsoft Windows Server CALs can be per device and per user. Device license Allows any number of users to access the server software from one device. This type of CAL is convenient for those organizations where several users work on the same device.

User license allows one user to access the server software from any number of devices. This type of CAL is convenient for those organizations where there are many mobile employees who need access to corporate network from arbitrary devices, or employees using multiple devices to access the network.

What's new in Windows Server 2016

Windows Containers: Support for containers in Windows Server 2016 provides performance improvements, simplified network management, and the use of Windows containers in Windows 10.

Nano Server

Nano Server has an updated module for creating Nano Server images. This update includes additional delineation of functionality between the physical host and the guest virtual machine, as well as support for different editions of Windows Server. In addition, the recovery agent has been improved: the firewall rules for inbound and outbound traffic have been delimited, and the ability to restore the WinRM service settings has been added.

Remote Desktop Services

Deploying a highly available Remote Desktop Services environment enables a base SQL data Azure for RD Connection Brokers in High Availability.

Identity and access

The new identity components increase the level of protection for organizations' Active Directory environments, as well as help move towards cloud-only and hybrid deployments where some applications and services are hosted in the cloud and others are hosted on-premises.

Active Directory Certificate Services

What's new in Active Directory Certificate Services. For Active Directory Certificate Services (AD CS) in Windows Server 2016, support for TPM key attestation has been increased. You can now use KSP smart cards for key attestation. For non-domain joined devices, you can now use NDES registration to obtain a certificate that can be validated for keys in the TPM.

Active Directory Domain Services

Active Directory Domain Services contains enhancements to help organizations secure Active Directory environments and improve the efficiency of identity management tasks for corporate and personal devices.

Active Directory Federation Services (AD FS)

Active Directory Federation Services (AD FS) in Windows Server 2016 includes new features that allow you to configure AD FS to authenticate users stored in LDAP directories.

Web Application Proxy

The latest version of Web Application Proxy provides new publishing and pre-authentication capabilities additional applications as well as the user experience.

Control and automation

Windows PowerShell 5.0 contains important new features, including support for class-based development and new security features, that enhance usability, usability, and simplify end-to-end management of Windows environments.

Software-defined networking

Mirroring and traffic routing is now available for new or existing virtual units. Along with distributing firewall and network security groups, the user can dynamically segment and protect workloads in the same way as in Azure. In addition, an entire Software Defined Networking (SDN) stack can be deployed and managed using System Center Virtual Machine Manager.

Improved TCP performance

The default initial congestion period (ICW) has been increased from 4 to 10, and TCP Fast Open (TFO) has been implemented. TFO reduces the time it takes to establish a TCP connection, and the extended ICW period allows larger objects to be transferred as part of the initial send. This combination can significantly reduce the time it takes to transfer an Internet object between the client and the cloud.

Just Enough Administration

Just Enough Administration in Windows Server 2016 is a security technology that allows you to delegate administration of all components that can be managed through Windows PowerShell. Features include support for running with an online identity, connecting via PowerShell Direct, copying files securely from and to JEA endpoints, and configuring the PowerShell console to run in the default JEA context.

Credential Guard

Credential Guard uses virtualization-based security to protect secrets so that only privileged system software can access this data.

Remote Credential Guard

Credential Guard supports RDP sessions so that user credentials remain on the client side and are not exposed on the server side. It also provides remote desktop single sign-on.

Device Guard (code integrity)

Device Guard maintains Kernel Mode Code Integrity (KMCI) and User Mode Code Integrity (UMCI) by creating policies that specify which code can run on the server.

Shielded virtual machines

Windows Server 2016 provides new Hyper-V based shielded VMs to protect any Gen 2 VM from a compromised fabric.

Windows Defender

Windows Server Antimalware will update antimalware definitions and protect your computer without a user interface.

Control flow protection

Control Flow Guard (CFG) is a platform security component designed to combat memory corruption vulnerabilities.

Direct Attached Storage Spaces

Storage Spaces Direct allows you to create scalable storage with high availability using local storage servers. They simplify the deployment and administration of software-defined storage systems and enable the use of new classes of disk devices such as SATA SSD and NVMe.

Within the framework of

promotions all Softline clients who have purchased Microsoft licenses will be able to receive standard and extended support free of charge, including with the option of leaving!

Product Licensing

Windows Server 2016 licensing models

Windows Server 2016 has two licensing models: core-based and client-side license (CAL) licensing. For Windows Server Standard, Datacenter, or Multipoint editions, each user and / or device must purchase a Windows Server CAL or Windows Server and Remote Desktop Services (RDS) CAL. A Windows Server CAL gives a user or device the right to access any edition of Windows Server equal to or greater than early version... Window Server CAL provides access to multiple Windows Server licenses.

Windows Server 2016 licenses for Standard and Datacenter editions are priced based on cores, not processors. This model is better suited for multi-cloud environments, making it easier to migrate workers. Windows loads Server thanks to the Azure Hybrid Benefit and reduces the discrepancy between different licensing methods.

To use Remote Desktop Services, Active Directory Rights Management Services, and other additional and enhanced features, you must purchase specific CALs.

Windows Server 2016 Standard and Datacenter Editions: Licensing by Core

• All physical server cores are licensed. The cost of a license for each physical server is determined based on the number of cores of the processors installed in it.
• Each server must be licensed with a minimum of 16 cores.
• Each physical processor must be licensed for a minimum of 8 cores.
• Licenses will be sold in bundles of two cores.
• You must purchase at least eight dual-core license kits for each physical server. A dual-core license is priced at one-eighth of the dual-processor license cost for the corresponding edition of Windows Server 2012 R2.
• The Standard edition grants rights to two OSEs, or two Hyper-V containers if all physical server cores are licensed. For every two additional virtual machines Requires re-licensing of all server cores.
• The 16-core license cost for the Windows Server 2016 Datacenter and Standard editions is the same as the dual-processor license cost for the corresponding Windows Server 2012 R2 editions.

Up to 8 cores per processor and 16 cores per server: Customers will receive licenses for a minimum of 8 cores per processor or 16 cores per server.

More than 8 cores per processor and 16 cores per server: Customers will receive licenses for servers with more than 8 cores per processor or 16 cores per server.

So how are server products licensed? The topic is very complex, so we will try to explain it in specific example.

Let's say that there is a company with a small park of PCs about 5 workstations on which a licensed Windows Vista, (you must take into account the fact that the license for operating system does not give any rights to connect to the server). The company has a need to purchase a server, they decided to install Windows Server Standard 2008 on this server, so the company will need to purchase a license for Windows Server Standard itself, and in order to gain access to this server, you need client licenses (CAL - Client Access License). Since the company has 5 PCs, 5 CALs are required.

Suppose that after a while the company needs to install another server, let's say Windows Server Enterprise 2008. In this case, the company will need to purchase a license only for Windows Server Enterprise 2008 itself, in this case it is not necessary to purchase additional client licenses, since all 5 workstations already have Windows licenses Server CAL. Client licenses for Windows Server give the right to connect to any of the editions of both Standard and Enterprise, but you need to consider another important fact that the CAL version must be at least the version of the server to which you are connecting. Example: using CALs to Windows Server CAL 2008, you can connect to Windows Server 2003, but not vice versa, the exception is that using Windows Server CAL 2003, you can connect to Windows Server 2003 R2. Now let's assume that Exchange Server 2007 is installed on one of the servers, so you will have to purchase a license for the Exchange Server itself and Exchange Server CAL for five PCs.

One more point: in the supply of OEM and boxed versions client licenses are included in the package of 5 pieces for volume licenses, OLP are purchased separately.

There is another version of licenses - Terminal CAL - licenses are intended for terminal access. Let's try to figure it out with an example: let's say a company decided to expand its PC park and buy 5 more thin clients (terminals) to save money and space (more detailed information O thin clients can be found on the Internet). In this case, the company will have to purchase 5 more Windows Server CALs and 5 Terminal CALs. the latter, give the right only to connect terminals.

There are two types of CALs, user CAL and device CAL. The most common device CAL, that is, the device itself is licensed to connect to the server, and multiple employees can connect from that device to the server. The second option “user license” is beneficial in cases where the number of employees who need access to the server is limited, say, 20 PCs and only two employees need access. In this case, it will be more profitable to purchase 2 client licenses, and these two employees will be able to connect to the server from any PC, but only these two employees who are assigned a user license. It is fixed by an order for the enterprise, otherwise during the check you will not prove in any way that only two employees are connected to the server.

Multiplexing.

The concept of multiplexing is extremely difficult to explain to a non-technical person, but let's try to explain it with a specific example. Let's imagine two servers connected to each other, let's call them C1 and C2. The company needs to install SQL Server and ensure the work of 10 employees with the database and, accordingly, the company wants to save on the purchase of client licenses. What they do: Install SQL Server on C2, and on C1 some free database that does not require any client licenses. As a result, it turns out that the main database lies on SQL Server, which is installed on C2, and employees actually contact C1, which in turn receives a request, takes data from C2 and sends it to the client, i.e. works as an intermediary and thus 10 employees connect to SQL Server for free.

This C1, an intermediary switch, is a multiplexer and this scheme is prohibited and, if checked, will entail criminal liability under Art. 146 of the Criminal Code of the Russian Federation. The rules clearly state that multiplexing and intermediate equipment does not affect either the licensing rules or the number of licenses.

To summarize, you need 10 SQL Server CALs to get 10 employees working with SQL Server.

External Connector.

Let's try to analyze what the External Connector is with a specific example.

In this case the best example may be the need to create an online store. Imagine that a certain company decided to open an online store or a certain information portal to provide goods or services to its company. In this case, you will have to provide access to external users to their resources and this requires all appropriate CALs for each connection. It is necessary to calculate exactly how many client licenses will be needed in a given period of time, in principle, it is impossible, since we do not know how many clients will simultaneously contact the online store, and it is simply not profitable to purchase many client licenses at once in order to guarantee enough. This is where the External Connector is needed - this is a license for unlimited connection to the server, that is, instead of huge amount client licenses, one External Connector can be purchased.

But there is one nuance here: only external users who are not employees of the company can connect via the External Connector, in any form. Those. in our case, only customers of the online store can connect.

Processor licensing.

Now let's take a look at processor licensing and look at the example of the most common server product licensed for a processor - this is SQL Server.

What's the best way to license SQL Server? Here it works standard version: you can license the server itself and purchase the required number of client licenses for it, but you can also buy a processor license.

Again, imagine physical server, on which we are going to install SQL Server and connect five users to it, which we need for this, in addition to the Windows Server license and client licenses to it. Since we will be installing SQL on Windows Server, we will consider licensing the SQL Server itself. So, in a situation where we need to connect five users, we purchase a license for the SQL Server itself and, accordingly, five CALs for it SQL Server CAL. This scheme beneficial when you need to connect a small number of users. Now suppose we need to connect 100 users to SQL Server, buying a license for the server itself and for 100 client connections is not economically viable, in this case it will be profitable to buy a processor license and then we will not need a license for SQL Server itself and no CALs are required as the processor license includes a license for the server itself and unlimited client connections, both internal and external.

That is, the physical processor itself, the piece of hardware itself, is licensed, regardless of the number of processor cores. The following server products are licensed under this scheme:

Microsoft BizTalk Server 2006

Microsoft Commerce Server 2007

According to this model, a network based on Microsoft server products needs at least one server license and usually more Client Access Licenses (CALs).

Server license is a document (not software) that:

• Required for every server running Microsoft server software.
• Gives the licensee the right to use (install and operate) Microsoft server software on one server.

Client Access License- an official document (not software) that gives the user the right to access a server on the network.

A client license is required:

• To access the server from a device on the network, or remotely, regardless of the OS used.
• To use basic server services (see the individual product descriptions in the following sections for details).

External connector license- an official document (not software) that gives the right to external users (customers and business partners) of the company to access the services of the server software organizations.

Client license types

Distinguish between device and user CALs

Device CAL	User CAL
Allows any the number of users to access the server software from one device	Allows one user access server software from any number of devices.
This type is the most beneficial and convenient in administration for those organizations where several users, for example, in shifts, work on one device.	This type is most beneficial and convenient in administration for those organizations where there are many mobile employees who need access to the corporate network from arbitrary devices, or employees who use multiple devices to access the network.

Client Access Licensing Schemes

There are several ways to provide client access to the server software: CALs for each device or for each user, limiting the number of simultaneous connections to the server, and using an External Connector license to connect unlimited external users.

Licensing per device or per user means that the license applies to a single device or user using a server application residing on any server on the network. This method is often used on a multi-server network and is suggested for all of the above server products. With this licensing scheme, the total number of CALs must be equal to the total number of client PCs or users on the network.

Limiting the number of connections to the server(licensing mode "per server" or "per server") means that the required number of CALs is equal to the maximum number of devices or users simultaneously accessing a single server at any given time. When the maximum number of concurrent access sessions is reached, other devices or users trying to access the services of this server will not be able to do so. This licensing method is more suitable for the case of a network with a single server, rare use of basic server functions, or in the case of remote access to the server, for CD-ROM servers, or other server solutions that take into account the non-standard use of the server. (Keep in mind, however, that each computer can run multiple applications concurrently accessing different servers on the network). Therefore, the number of CALs purchased for each server should be equal to the maximum number of concurrent connections to the server. This CAL licensing scheme applies only to Microsoft Windows Server.



Licensing Using the External Connector Eliminates the need to calculate and purchase individual CALs for each business partner or end user in an organization and allows you to provide access to the server software to an unlimited number of non-employees. The External Connector license may not be used by employees, external contractors, agents, service providers, or other persons performing services on behalf of the organization (or affiliates, if any). An External Connector license must be purchased for each copy of the server software. Therefore, the number of External Connector licenses must be equal to the number of servers accessed by external users or devices.

When is it more profitable to purchase client licenses	When is it more profitable to buy an External Connector
This type is most beneficial if the organization has a small number of customers and partners and it is not difficult to count them.	This type is most beneficial if the organization has a large number of customers and partners who have authenticated access to the server.
This scheme can also be more beneficial if the organization has a large number of servers.	This model also applies in cases where the number of external users or devices is difficult or impossible to count.

Server license version and CAL

The server software and CAL are identified by a specific version number. A client access license allows you to access a server program with the same (or lower) version number. For example, an Exchange 2007 CAL can be used to access Exchange Server 2003, but not vice versa.

The same CALs are used to access server services of any edition. For example, Windows 2008 CAL license or license Windows price 2008 External Connector can be used to access Microsoft Windows Server 2008 Server Standard Edition and to access Microsoft Windows Server 2008 Enterprise Edition.

Using software or hardware multiplexers for client access

The use of software or hardware that reduces the number of devices directly accessing server services does not affect the need to acquire CALs. The number of CALs required is equal to the total number of input devices for that device. In the example below, three CALs are required to be purchased, even though only one device directly connects to the server:



• Standard Edition. Designed to support mailboxes small and medium-sized organizations. Suitable for other Exchange roles - besides the Mailbox server - in larger organizations. This release supports 1 to 5 mailbox databases.
• Enterprise edition. Designed for larger organizations that may need more mailbox databases. This release supports 1 to 100 mailbox databases.

Client Access Licenses (CALs)

• Standard Edition. Created for productive work when using almost any platform, browser or mobile device... New tools in Exchange Server 2019 help improve user productivity, wherever they are, while protecting corporate data. To use the features in this release, you must obtain a Standard CAL.
• Enterprise edition. Helps organizations achieve compliance with lower costs with new built-in archiving and information protection capabilities. Therefore, to access the Enterprise CAL functionality, the user will need to purchase both Standard and Enterprise CALs.
The company "1001 SOFT" is an official partner of Microsoft in St. Petersburg and sells licensed Microsoft programs Server. In addition, you can buy the entire line of licensed Microsoft products... To make a purchase, you need to call in St. Petersburg / SPb / (812) 670-02-06 or send a request to the address. Our experts will answer your questions and select the best option delivery.

Microsoft Windows Server Client Access Licenses (Server CALs)

Name	Price, rub per piece	Comments (1)
Windows Server CAL 2019 Device License	1762	OLP (Corporate Named Delivery). For organizations and individual entrepreneurs only. Delivery time: within 2 days, electronic access to licenses is provided. Within 2 more days, shipment takes place according to accounting documents, together with the provision of a license on paper and license stickers. Not subject to VAT.
Windows Server CAL 2019 User License	2236


See also: Windows Server 2019 and Windows Server 2019 Terminal Licenses

Windows Server 2019 Client Access License (Server CAL) grants the user or device the right to access the server software.

A Windows Server 2019 CAL is required if a user or device is accessing or using Windows Server server software. However, if the access is over the Internet and is anonymous (for example, when browsing a public Web site), this license is not required. In addition, an organization can purchase External Connector licenses to license external user access. In addition, Windows Server CALs are not required if Windows Server 2019 is used exclusively as a virtualization host, except for configurations that use virtual Windows machines Server, requiring Windows Server CALs. For example, if virtual machines running Windows Server 2003 are deployed on a server under Windows control Server 2008, virtual machine users do not need Windows Server 2008 CALs. However, they do need CALs for editions of Windows Server deployed on virtual machines(in this case, Windows Server 2003).

Do I need a Server CAL if the user only occasionally uses certain protocols or server software services (such as Network Access Protection or DHCP)?

Yes. A Windows CAL is required to access and use the server software, regardless of frequency.

What is the difference between Windows Server CALs and TS CALs (Terminal Licenses)?

If a user or device is accessing Windows Server directly or indirectly, they need a Windows Server CAL. In addition, if a user or device is accessing or using Windows Server Terminal Services, you must purchase a Terminal Services CAL in addition to a CAL. However, up to two users or devices can access the server software for administrative purposes only, without using TS CALs and Windows Server CALs.