Client Access Licences (CALs) are the part of Windows Server licensing that most small businesses miss. Licensing the server itself covers the software on the hardware; CALs cover the people or devices that connect to it. This guide explains User versus Device CALs, how Remote Desktop Services (RDS) CALs fit in, the version rules, and how to install RDS CALs. It is general guidance, not legal advice; your exact rights come from Microsoft's Product Terms and your licence agreement.
| User CAL | Device CAL | |
|---|---|---|
| Assigned to | A named person | A specific computer or device |
| Covers | That person on any number of devices | Any number of people using that device |
| Best fit | Staff who use a laptop, phone and home PC | Shared PCs, shift workers, kiosks, warehouse terminals |
| RDS tracking | Not enforced by the licence server; cannot be tracked in a workgroup | Issued and tracked per device; cannot be over-allocated |
| Workgroup RDS deployment | Not permitted for RDS | Required for RDS |
What is a Windows Server CAL?
A Windows Server CAL is a licence that gives a user or device the right to access the services of a licensed Windows Server, such as file sharing, printing or Active Directory authentication. Microsoft describes it as "not a software product": you do not install the base CAL anywhere, you buy enough to cover everyone who connects.
Microsoft's Windows Server 2025 licensing guidance states that each user or device accessing a licensed server requires a Windows Server CAL, also called a Base CAL. Standard and Datacenter both work this way.
Cause and effect: because server licences are core-based and say nothing about how many people connect, a server can be correctly licensed for its cores and still be under-licensed for access. The CAL count is what closes that gap.
Some access does not need CALs, for example another licensed server connecting, public and unauthenticated web workloads, or a physical instance used only to manage virtual machines. External users such as customers can be covered by an External Connector licence instead.
What is the difference between a User CAL and a Device CAL?
A User CAL licenses one named person to access the server from any number of devices. A Device CAL licenses one device to access the server, no matter how many people use it. You can mix both types in the same organisation, so choose per group based on whether people or devices are the smaller number to count.
Microsoft's own example: User CALs suit employees who roam across several devices, while Device CALs suit shared devices such as PCs used by different shifts.
- Office with laptops and phones: 15 staff, each with a laptop and phone, means 15 User CALs rather than 30 Device CALs.
- Factory with shared terminals: 5 shared PCs used by 40 people over three shifts means 5 Device CALs rather than 40 User CALs.
What we commonly see: buyers count employees and forget about smartphones and home PCs that also sign in to the server. Counting the smaller number, people or devices, is the simplest way to decide.
What is an RDS CAL and do you need both?
An RDS CAL is an additional licence required when a user or device runs a remote desktop or remote app session on a Windows Server session host. It is added on top of the Windows Server CAL, not instead of it. Anyone connecting through Remote Desktop Services therefore needs both a Base CAL and an RDS CAL.
Microsoft's licensing guidance calls the RDS CAL an Additive CAL that is "required (in addition to Base CAL)" for using Windows Server to host a graphical user interface. RDS CALs also come in Per User and Per Device types.
Advanced nuance: the built-in administrative remote desktop connection used to manage a server is not the same as a Remote Desktop Session Host deployment. RDS CALs apply when you install the RD Session Host role to let users work on the server.
LicenceHouse offers Windows Server 2016 RDS 10 User CAL packs and Device CAL packs, and you can browse the full range in our access licences and CALs collection. Check the version rule below before choosing.
Do CAL versions have to match the server version?
CALs must be the same version as the server, or newer. Microsoft states that CALs "permit access to the same version, or earlier versions, of the server software". A Windows Server 2022 CAL works with Server 2022, 2019 and 2016, but not with Server 2025. Older CALs cannot access newer servers.
For RDS, Microsoft's RDS CAL documentation gives the compatibility in two parts:
| Session host | RDS CAL versions that work |
|---|---|
| Windows Server 2025 | 2025 |
| Windows Server 2022 | 2025, 2022 |
| Windows Server 2019 | 2025, 2022, 2019 |
| Windows Server 2016 | 2025, 2022, 2019, 2016 |
The licence server must also run a version at least as new as the CALs installed on it. For example, a 2022 licence server can hold 2022, 2019 and 2016 RDS CALs but not 2025 CALs.
Cause and effect: a business that upgrades its session host from Server 2016 to Server 2022 without buying new RDS CALs will find users cannot get licences after the grace period, because 2016 CALs do not cover a 2022 host. That is why 2016 RDS CALs are the right choice only for Windows Server 2016 session hosts.
Does Windows Server Essentials need CALs?
Windows Server Essentials does not use standard Base CALs. Microsoft positions it for small businesses with up to 25 users and 50 devices, licensed per server rather than per core, and available through OEM hardware vendors. Its Remote Desktop support is limited to the RD Gateway role, so it is not an RDS session host platform.
If your business is near those limits or needs RDS, Standard with CALs is the usual route. Our comparison of Windows Server Standard vs Datacenter vs Essentials covers the edition choice in more detail.
How do you install RDS CALs on the licence server?
Open Remote Desktop Licensing Manager, right-click the activated licence server, select "Install licenses", choose the licence programme you bought through, enter the licence code or agreement number, then select the product version, licence type and quantity. The wizard contacts the Microsoft Clearinghouse to validate and install the CALs.
- Make sure the RD Licensing role is installed and the licence server is activated.
- Open Remote Desktop Licensing Manager.
- Right-click the licence server name and select Install licenses, then Next.
- Select the licence programme you purchased through and select Next.
- Enter the licence code or agreement number as requested, then select Next.
- Choose the product version, licence type (Per User or Per Device) and number of licences, then select Next.
- Select Finish.
Microsoft notes that the computer running RD Licensing Manager needs internet access to activate licences, although the licence server itself does not. The full procedure is in Microsoft Learn's article on installing RDS CALs.
How do you set Per User or Per Device licensing mode?
Set the licensing mode in Server Manager under Remote Desktop Services > Overview > Edit Deployment Properties > RD Licensing, choosing Per User or Per Device and adding the licence server. Without a Connection Broker, use Group Policy under Remote Desktop Services > Remote Desktop Session Host > Licensing.
- Server Manager: on the RD Connection Broker, open Edit Deployment Properties > RD Licensing, select the mode, specify the licence server and select Add.
- Group Policy: under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Licensing, enable "Use the specified Remote Desktop license servers" and "Set the Remote Desktop licensing mode".
The mode must match the CAL type you installed. Microsoft notes that workgroup (non-domain) RDS deployments must use Per Device CALs, because Per User CALs need Active Directory. A mismatch is a common reason users are refused after the grace period ends.
What we commonly see: the CALs are installed correctly but the session host still shows "no licence server specified" because the policy or deployment property was never set. Checking the mode and server name resolves most of these cases.
What is the RDS grace period?
RDS has a licensing grace period of 120 days during which no licence server is required. Once it ends, clients must receive a valid RDS CAL from a licence server before they can sign in to a remote session. Install and configure CALs well before day 120 to avoid users being locked out.
The grace period is a setup window, not a free licence. Using RDS beyond what you have licensed remains a breach of the licence terms even where the software does not block it, which is especially relevant for Per User CALs because they are not enforced.
Frequently asked questions
Do I need CALs if users only access a file share?
Yes, in most cases. Accessing file shares, printers, authentication or other server services counts as access to Windows Server, so each user or device needs a Windows Server CAL. RDS CALs are only needed on top if people run remote desktop or remote app sessions on the server.
Can I mix User CALs and Device CALs?
Yes. Windows Server CALs of both types can be combined in the same organisation, for example User CALs for office staff and Device CALs for shared terminals. For an RDS deployment, the session host uses one licensing mode, so pick the RDS CAL type that matches how that deployment is configured.
Do I need new CALs when I upgrade the server?
Usually yes. CALs cover the same version of Windows Server or earlier versions, so upgrading the server to a newer release generally requires CALs of the new version. Newer CALs can access older servers, which helps if you run a mix of server versions during a migration.
Are RDS CALs tied to a single server?
No. RDS CALs are installed on an RD licence server and issued to users or devices, which can then connect to the session hosts that use that licence server. The licence server's version must be equal to or newer than the CAL version you install on it.
What happens when the 120-day grace period ends?
After the 120-day grace period, the session host requires a valid RDS CAL from a configured licence server for each connection. If no licence server is set or no matching CALs are available, users cannot sign in to remote sessions until licensing is configured correctly.