By Paul DeGroot [bio]
Posted: Jan. 13, 2003

• Chart: Windows Server 2003 Client Access License Options
• Chart: Terminal Server CAL Changes in Windows Server 2003

The following is the full text of an article published by Directions on Microsoft, an independent research firm focused exclusively on Microsoft strategy & technology. Each month we make one or more key articles available to non-subscribers.

Windows Server 2003 will usher in significant changes for Windows Client Access Licenses (CALs), including CALs used to access terminal services running on Windows Server 2003. Microsoft is introducing per-user licensing, making it easier to license Windows for use over the Internet, and phasing out free terminal-services access for recent desktop operating systems (OSs). The changes, which apply only to Windows Server 2003 and not to server applications, such as Exchange, will give customers additional licensing options and will relax some licensing restrictions, but knotty transition issues and unresolved questions, particularly with regard to terminal services, could lead to higher costs and administrative headaches for some customers.

The changes cover two distinct types of CALs. The first changes affect the Windows Server CAL, which gives a client PC the right to access most of the services on Windows Server. The second set of changes affect the separate Terminal Server (TS) CAL, which is required to access the Windows Terminal Server. This server is built into Windows 2000 Server and Windows Server 2003, but the CALs are sold separately from those required to access Windows itself.

(For a summary of the changes in chart format, see "Windows Server 2003 Client Access License Options" and "Terminal Server CAL Changes in Windows Server 2003".)

Windows Server 2003 Licensing

Most users who access a Windows server are required to have a CAL. (The most common exception is when they are anonymous users accessing a Web site hosted on a Windows server.) Windows Server CALs are only licenses to access a server; they are not software, and other than being recorded on a server in certain situations, they are not "installed" on computers. Microsoft currently offers two modes for applying CALs:

• In per-server mode, CALs are assigned to a single Windows server and allow as many concurrent connections as the server has CALs.
• In per-seat mode, CALs are assigned to the devices (desktops, portables, cell phones) that access Windows servers. Any device with a CAL assigned to it can access any Windows server in an organization.

In general, only small organizations with a single Windows server use CALs in per-server mode; larger organizations with many Windows servers generally find the per-seat mode more economical, because one PC usually needs to access multiple Windows servers, such as file servers, e-mail servers, and corporate portals, and a single CAL assigned to the PC permits that.

Changes in Windows Server 2003

Windows Server 2003 will change per-seat mode to "per-device or per-user mode." This means that a CAL can now be assigned to a user rather than to a device. That user can then access any Windows server in the organization from any device.

Per-user CALs will be most useful for organizations in which the number of devices exceeds the number of users. With an increasing number of users equipped with multiple computing devices—such as personal digital assistants (PDAs), portable computers, and desktops at both work and home (for telecommuting)—many organizations find the cost of CALs rising. Per-user licensing will help them contain these costs.

In addition, per-user CALs will make it easier for companies to remain compliant with the legal limits of their licensing agreements when they upgrade to Windows Server 2003. Each time a server OS is upgraded, the CALs on every device used to access such servers must be upgraded to be the same version—in other words, only devices or users with Windows Server 2003 CALs will have the right to access Windows Server 2003 servers in an organization. Because these CALs can also be used to access previous versions of the server OS, the easiest (if not the cheapest) solution for organizations that upgrade to Windows Server 2003 will be to upgrade all their CALs (or purchase new ones if their current CALs are not covered by Software Assurance upgrade rights) for every user, even if they continue to use earlier versions of Windows Server on their network. One additional benefit of this approach: CALs assigned to Windows Server 2003 users (rather than devices) are also valid when used to access Windows 2000 and Windows NT Servers, for which per-user licensing was previously unavailable.

A per-user CAL is an additional licensing option rather than a replacement. The existing options, per-server and per-seat licensing, remain, although per-seat licensing has been renamed per-device licensing (which is what it always meant, anyway). Thus, organizations can now apply CALs either to devices or users when they elect the "per-device or per-user" licensing mode. For example, a company would find per-device licensing more economical for a call center where operators working different shifts share the same terminals, or a manufacturing center where multiple employees use a few PCs to monitor processes or receive instructions. In both cases, multiple users share one device. But that same company could assign per-user CALs to individuals, such as mobile sales-force workers, who often use multiple devices to access Windows servers.

CALs will cost the same regardless of how they are applied—to a server, a device, or a person. Pricing for Windows Server 2003 CALs has not been released, but Windows 2000 CALs purchased through a volume licensing program typically cost US$30 or less.

Microsoft produces a special bundle of CALs, called the Core CAL, for volume customers. This bundle includes CALs for Windows Server, Exchange, SharePoint Portal Server and Systems Management Server (SMS). The company says a per-user Core CAL will be available in the future. However, only Windows Server access will be affected by the per-user provision, since Exchange, SharePoint, and SMS do not have per-user licensing.

Licensing External Users

The Internet complicated the CAL picture for Windows servers hosting Internet services that require users to be authenticated (such as a server used for remote access) using Windows Server’s own authentication services. It could be prohibitively expensive to purchase CALs for the hundreds of PCs that might potentially access one Windows server over the Internet.

To meet this need, Microsoft came up with the Internet Connector, a special license that offers, in effect, an unlimited number of CALs in per-server mode. However, Internet Connector licenses are expensive—about US$2,000 to license each server—and are designed for use by customers only. The Internet Connector cannot be used for a company’s own employees, contractors, or business partners.

With Windows Server 2003, Microsoft will replace the Internet Connector with two options—customers can purchase a more flexible External Connector license, or they can purchase CALs for external business partners and customers.

External Connector

The External Connector removes the distinction between customers and business partners (although Microsoft is still wrestling with how to license independent contractors who are working for a company). Buying an External Connector will allow any number of customers or business partners (i.e., non-employees that work with the organization, such as distributors, resellers, and suppliers) to access a particular Windows server over the Internet through an authenticated log-on.

The External Connector will be valuable in scenarios such as business-to-business e-commerce, supply chain management, sales force automation, and other situations where employees, business partners, and customers all need secure access to a server over the Internet. (Employees will need—but probably already will have—per-seat or per-user CALs that allow them to access the company’s server. Others are licensed by the External Connector.) It will also reduce the inconvenience and expense of working around the limitations of the Windows 2000 Server–vintage Internet Connector.

CALs for External Users

CAL purchasing rules currently make it difficult to purchase CALs for third parties associated with a company’s business, such as an office-supply vendor that accesses an internal ordering application to fulfill order requests. Volume licensing agreements specify that licenses purchased under the agreement are for the purchaser’s use only and cannot be assigned to other companies.

With the launch of Windows Server 2003, Microsoft will permit an organization to buy CALs for customers or business partners who need to access its Windows servers. (The customers or business partners will still need to buy their own CALs for accessing servers within their organizations.)

This option will be particularly useful for organizations that require authenticated access over the Internet for only a small set of users. Rather than spending US$2,000 or more on the External Connector, they can purchase a few CALs for external devices or users.

Terminal Server Changes

Changes to TS will require a more complex transition, because TS is one of the few Microsoft products that actually checks client machines to make sure that they have been issued a CAL, in the form of an electronic "token" stored on the client device. TS uses a special license manager to enforce access with CALs, and Microsoft electronically distributes and monitors CALs through a centralized database, the Microsoft Licensing Clearinghouse.

As a general rule, a PC accessing TS running on any version of Windows Server requires not only a Windows CAL but an additional TS CAL (which costs about US$80 when purchased through volume licensing).

However, to encourage customers to upgrade their desktop OSs when Windows 2000 came out, and also on the principle that customers who licensed Windows 2000 desktops should be able to freely run the same "desktop" over terminal services that they run on their local machine—a principle that Microsoft calls "OS equivalency"—Microsoft allowed any Windows 2000 Professional desktop to access a Windows 2000 TS without purchasing an additional TS CAL. When Windows XP Professional came out, this exemption was continued—that is, Windows XP Professional users do not need to purchase an additional TS CAL to access a Windows 2000 TS.

When Windows Server 2003 is released, OS equivalency will end. Every device or user accessing Windows Server 2003's Terminal Services will need a TS CAL, regardless of which desktop OS it is using. (To enforce this rule, the server will first check to determine whether a user's device has a TS CAL associated with it; if not, it will then ask the user to log on to determine whether the user has a personal TS CAL.)

The TS CAL can be applied either to devices or users, but because of changes in the way TS looks for valid CALs, the new TS User CALs will not work on downlevel servers: Windows Server 2003 TS User CALs cannot be used to access Windows 2000 Terminal Server, for example. However, customers may purchase TS Device CALs for a Windows Server 2003 TS and use them to access a Windows 2000 TS.

Microsoft is also canceling TS work-at-home licenses for Windows Server 2003. Organizations could purchase these CALs to permit users to access a corporate TS server from their homes, although they are not required (because of OS equivalency) if the home user’s PC is running professional versions of Windows 2000 or Windows XP. But beginning with Windows Server 2003, home users of TS will need to purchase either a separate device CAL for their home PC, or a user CAL (which requires the TS server to be running Windows Server 2003).

In effect, Microsoft is reverting back to the licensing rules that were in place before it allowed OS equivalency: then, as will be the case with Windows Server 2003, customers always needed to purchase a TS CAL when they used TS. Although the net result of these changes is that customers are back to earlier rules, the transition back to the old way—which requires customers to obtain TS CALs for devices that did not require them before—will be harder and more expensive than the transition to Windows 2000, which relieved users of that requirement when they were using Windows 2000 or Windows XP professional desktops.

External TS Access

Like its host, Windows 2000 Server, the TS service on Windows 2000 can be used anonymously over the Internet by customers if the owner purchases a special Terminal Server Internet Connector that allows up to 200 users to access TS over an external network. This license is even more expensive than a Windows Server 2003 Internet Connector—about US$10,000.

In the same way that the standard Windows Server 2003 Internet Connector was renamed and restrictions were lifted, the TS version will be renamed the Terminal Server External Connector, it will no longer be limited to 200 connections, and both business partners and customers will be able to access it. In addition, these users will be able to be authenticated; with Windows 2000, TS Internet Connector users had to be anonymous Internet users. (In this configuration it was most useful for demonstrating Windows software for customers on a terminal server, thus eliminating the requirement that potential customers download and install the software on their own machines.)

Transition Issues

The transition to the new Windows Server 2003 CALs will be smoother for organizations that adopt the new server OS rapidly and broadly, and for customers with Software Assurance (SA), Microsoft’s upgrade rights program, than for those that upgrade incrementally or that have not already purchased SA on all of their products.

But the licensing changes in Windows Server 2003 are still likely to entail some thorny transition issues, and explaining the changes will require a major educational effort on Microsoft’s part. Depending on what desktop OSs they currently use, how much they use TS, and whether they have purchased upgrade rights, transition costs will vary significantly from customer to customer.

Windows Server 2003 CALs

The transition to Windows Server 2003 CALs will be relatively easy, or at least no more difficult than the normal transition to a new server operating system. Since CALs for client desktops must always match (or be for a more recent version than) the Windows Server OS, Windows Server 2003 purchasers face the usual cost of upgrading their CALs, but (depending on what Microsoft charges for the CALs) upgrade costs could actually drop if customers have licensed more devices than they have users (a common scenario with Windows 2000 and earlier server OSs). By taking advantage of per-user CALs, the number of CALs they need to purchase or upgrade could go down.

Customers with SA on their Windows Server CALs, or who have purchased Windows CALs for all their desktops enrolled in an Enterprise Agreements, will be able to upgrade their CALs at no additional cost. Others will need to purchase new Windows Server CALs at regular prices.

Reassigning CALs

Deciding how to best use the new per-user mode presents another opportunity—and a management challenge. Although the right to mix CALs assigned to devices with CALs assigned to users sounds convenient, it could prove messy in practice. Most business users are ignorant of CALs (as are many help desks, technical specialists, and even IT administrators), and they might not understand the implications of acquiring a new device. A user who has hitherto used only a single device with a per-device CAL might not understand why her acquisition of another device, such as a Pocket PC, requires the purchase of another CAL when her colleague in the next cubicle is covered by a per-user CAL and does not need extra CALs.

In addition, once a CAL has been assigned in either per-device or per-user mode, converting it to the other mode is not easy. CALs not covered by SA cannot be converted at all. For example, an organization cannot reassign a CAL assigned to a user’s PC to the user—in effect converting the per-device CAL to a per-user CAL—such as when the user acquires a second device. (However, per-device CALs can be transferred to different devices, and per-user CALs can be transferred to different users.)

If a CAL is covered by SA, the customer can convert it to a different mode, but only at the time that they renew their SA on the CAL. In addition, customers that have SA on their per-device server CALs at the time that Windows 2003 Server is released will have a one-time opportunity to reassign those CALs to users.

Microsoft recommends that companies standardize on one type of CAL, either companywide or by department, to reduce the management hassles. A call center or other organization that clearly has more users than devices can use per-device CALs. Other departments might want to standardize on per-user CALs which will give them more flexibility to add devices without increasing their CAL costs in the future.

The TS CAL Transition

To reduce the cost associated with the transition to requiring TS CALs, Microsoft will offer no-charge Windows Server 2003 TS CALs in the following situations:

• All Windows desktops covered by upgrade rights purchased through Enterprise Agreements, SA, or Upgrade Advantage (an earlier upgrade rights offering) at the time of Windows Server 2003’s release will be entitled to a no-charge TS CAL.
• All devices running a legal copy of Windows XP Professional on the date that Windows Server 2003 is released will be entitled to a no-charge TS CAL. In effect, OS equivalency will be honored on a one-time basis for these customers.

Orders for no-charge CALs will be handled by Microsoft Licensing Clearinghouse. Customers must supply a volume licensing agreement number or a product key from an OEM or retail purchase to establish their eligibility for Windows 2003 TS CAL licenses.

Some organizations will need to undertake some research to determine exactly how many no-charge TS CALs they are entitled to. For example, some organizations have downgraded new PCs from OEM versions of Windows XP Professional to Windows 2000 Professional (a downgrade permitted by the terms of the Windows XP Professional OEM end-user license agreement). Without checking their purchase records carefully, organizations have no way of knowing whether a PC running Windows 2000 originally came with Windows XP, and is thus entitled to a no-charge Windows Server 2003 TS CAL. Even management tools such as Systems Management Server (SMS) are unable to tell the difference between a PC running Windows 2000 that is licensed for Windows XP and one that is not.

In addition, telecommuters who work from home and benefited from OS equivalency when accessing a corporate TS server will need to be brought into the new CAL-required regimen if the server is upgraded to Windows Server 2003. The problem is not entirely new; employees who worked from home in the past have been required to purchase (or have purchased for them) TS CALs if their home PCs were not using Windows 2000 or Windows XP Professional desktops. But the changes will kick off a new round of TS CAL purchasing for Windows 2000 desktops that need to access Windows Server 2003.

Migrating to External Connectors

As with server CALs, the migration story for external connectors depends a lot on whether the customer has existing upgrade rights through SA at the time that Windows Server 2003 is released.

Customers who have SA for their Internet Connector (either Windows Server Internet Connector or Windows Terminal Server Internet Connector) will be able to upgrade these products to External Connectors at no additional charge.

Customers without SA will need to pay the full price for a new External Connector.

The Windows Server 2003 External Connector can be used with a Windows 2000 server, but the Windows Terminal Server External Connector cannot, because of differences in the way the two server TS versions handle TS CALs.

CAL Strategy

Microsoft says it has made these licensing changes for three main reasons: to resolve situations where its licensing terms no longer reflect the way customers actually use its products, to make licensing of TS more consistent with the licensing of Windows Server, and to simplify complexities that have crept into terminal services licensing.

Bringing CALs Up to Date

The new per-user licensing option reflects the fact that requiring separate CALs for every device penalizes customers whose employees use multiple devices (many of them running a Microsoft client OS). For these customers, the increasing cost of CALs and CAL management overhead could become a significant disincentive for upgrading the server software itself, and could retard adoption of Windows Server 2003 or make competitors more attractive. Novell, for example, has offered per-user licenses for years, and Linux requires no CALs at all.

Per-user licensing simplifies and reduces the cost of many scenarios, including work-at-home access (both via VPNs and terminal services); the rapidly growing use of wireless PDAs and smart phones to access data on corporate servers; and access to corporate servers from kiosks, Internet cafes, and other temporary locations for which customers could not be expected to license the devices they use.

The Internet Connector was similarly problematic. In particular, it forced organizations to make careful distinctions between the types of users who could access a Windows server and those who could not. Server administrators, among others, were rarely equipped to make these distinctions: if an executive wanted to grant an outside party authenticated access to one of the organization’s Web servers, few administrators would demand evidence that the outside party was eligible for such access.

The External Connectors for Windows Server 2003 and TS, and the right to purchase CALs for external users, will make it easier for customers to comply with licensing terms.

Revising TS

Microsoft says it is trying to simplify TS licensing, although customers will have to make a complex transition from TS licensing under Windows 2000 to TS licensing under Windows Server 2003 before they reap the benefits of this simplification. Nonetheless, both Microsoft and customers agree that TS licensing under Windows 2000 was complex, particularly when calculating the number of CALs required or when dealing with TS licensing as Microsoft rolled out future server OSs.

Calculating CALs. Kurt Springman, a manager in the Microsoft Global Alliance Team at Citrix Systems, which offers advanced TS products (MetaFrame XP) that run in conjunction with Microsoft’s TS systems, says that organizations purchasing TS CALs found it difficult to determine how many they needed. They had to know how many devices would be using terminal services, how many of those devices were using professional desktop systems that didn’t require TS CALs, how many "unowned" devices—airport kiosks or desktop PCs at a customer’s site—needed to access the terminal server, and other facts.

Citrix’s own licensing is based on the number of concurrent users, so it will be unaffected by the change. But customers will find it much easier to calculate the number of TS CALs required under the new rules. The per-user TS CAL will be particularly popular for roaming users, who might access a corporate server from a kiosk or from a PC owned by a different organization, Springman says.

OS discrimination. The exemption for certain desktop OSs caused frequent problems for both Microsoft and customers. For example, under a volume licensing plan that includes upgrade rights, customers are automatically entitled to the latest OS, whether they use it or not. So customers with upgrade rights who wanted to access a Windows server from a downlevel client (e.g., to access Windows 2000 TS from a Windows NT workstation) had to be issued special no-cost TS CAL licenses; otherwise, they would have had to buy TS CALs that were already covered by their volume licensing agreements. Later, when these customers upgraded to a desktop OS that did not require the purchase of separate TS CALs (e.g., from Windows NT Workstation to Windows XP Professional), the license management system would balk and the customer could be considered to be violating their TS licensing terms.

The problem of tracking TS CALs is exacerbated by the fact that the release of Windows professional desktop OSs is no longer synchronized with releases of Windows Server. This leads to confusion as some desktop OSs lose TS rights while others retain them when the server is upgraded. So, from now on, all desktop TS CALs will need to be upgraded when the TS server is upgraded.

Unresolved Issues

The new licensing program is still in its early stages, and a number of issues remain unresolved, such as costs and how flexible the licensing will be in practice.

Cost. The company has said that the cost of a Windows Server 2003 CAL will be the same regardless of whether a CAL is assigned to a user or a device, but it has not said what the price will be. If it is the same as a Windows 2000 CAL, customers will benefit from the new per-user option. If it is higher, customers who do not benefit from per-user licensing could find costs rising.

The External Connector and the TS External Connector offer a similar dilemma: compared with previous versions they offer greater flexibility and allow access for a wider range of customers and business partners, but the company has not yet determined how much more, if any, organizations will pay for this greater flexibility.

Exact pricing is not likely to be available until shortly before Windows Server 2003 is released (expected in Apr. 2003).

The transition scenarios also illustrate how customers who have not purchased SA on certain products face much higher upgrade costs. For example, although upgrading an organization’s terminal server to Windows Server 2003 comes "free" with the upgrade to the new server OS, organizations that have purchased the TS Internet Connector cannot upgrade it to an External Connector if it is not covered by SA. Instead, they might have to pay another US$10,000 (depending on the final price) for an External Connector license to continue to let external customers access their terminal server.

Finally, customers could find that adoption of Windows Server 2003 raises costs by US$80 or so (depending on a company's volume license discount) per TS user. Organizations that make extensive use of TS will need to factor this cost into their overall evaluation of Windows Server 2003, balancing this additional cost against the additional utility of TS in Windows Server 2003 that they gain by the per-user TS CAL.

Ongoing license rights. TS CALs are not among the basic products covered by Microsoft’s Enterprise Agreements (EAs). Even the Core CAL, a bundle of common CALs, covers Windows Server, Exchange, SharePoint and SMS, but not TS. Instead, TS CALs must be purchased as "additional products" in an EA.

To ease the transition to Windows Server 2003, Microsoft says customers covered by an EA at the time the new server OS ships will receive no-charge TS CALs for all desktop PCs covered by their EA. But the company has announced no plans to include TS CALs in EAs signed after Windows Server 2003 ships (in theory, TS CALS are included in current EAs because of OS equivalency) or whether TS CALs will become part of the Core CAL.

Server CAL management. Because Windows Server 2003 requires each TS client to have a CAL and Windows 2000 had different rules for different client OSs, TS User CALs purchased for Windows Server 2003 TS cannot be used to access Windows 2000 TS (although CALs applied to devices can be used to access Windows 2000). Organizations might need to maintain multiple TS license management servers so that they can continue to use the less expensive Windows 2000 TS licensing with their Windows 2000 clients.

Per-User CALs for Other Servers

One of the most burning questions, with the introduction of per-user CALs for Windows Server and TS, is whether customers can expect other Microsoft server products, such as Exchange, SQL and SharePoint, to introduce per-user licensing. In most cases, CALs for these products must be purchased for each device that accesses them.

SharePoint has already taken steps in this direction: in 2002, Microsoft introduced the SharePoint External Connector (priced at US$30,000) to permit external users to access a SharePoint server. But Microsoft says other server products might follow the path set by Windows Server 2003: according to a FAQ on the CAL changes, "we expect that Microsoft servers licensed on a Server/CAL basis will introduce a User CAL option."

Resources

A FAQ on the new licensing program can be found at www.microsoft.com/licensing/resources/server_faq.asp.

For a complete discussion of current Microsoft licensing options, see the June 2002 Research Report, "Understanding Microsoft Licensing."

For a description of Microsoft’s Terminal Services license management technology, see "Windows 2000 Terminal Services Gets New License Manager" on page 8 of the Nov. 1999 Update.

For more information about TS licensing in Windows Server 2003, see www.microsoft.com/technet/prodtechnol/windowsnetserver/proddocs/server/ts_chm_top.asp.