RDS licensing

How to Install and Activate the RDS Licensing Role on

Windows Server 2019/2016?

In this article, we’ll consider the installation, configuration, and activation of Remote Desktop Licensing
role on Windows Server 2019/2016, as well as the installation and activation of the RDS client access
licenses (CALs).

I remind that after the installation of Remote Desktop Session Host role, users can use it only for 120 days
of a trial period, and users can’t connect to an RDS host afterward. According to Microsoft licensing
scheme, all users or devices that used RDS features must be licensed. To register and issue remote
desktop client access licenses (RDS CALs), there is a separate service in RDS role called Remote Desktop
License Server.

Contents:
 Installing the Remote Desktop Licensing Role on Windows Server 2019/2016
 Activating the RDS License Server on Windows Server
 RDS CALs: Types of Remote Desktop Client Access Licenses
 Installing RDS CALs on Windows Server 2016/2019
 How to Remove RDS CALs from a RD License Server?
 Specify a License Server Address on an RD Session Hosts

1
Installing the Remote Desktop Licensing Role on Windows
Server 2019/2016
You can deploy the Remote Desktop License service on any domain server; it is not necessary to install it
on one of the servers onthe RDSH farm.

Before you start the installation, add a new server to the Terminal Server License Servers domain
group (or make sure you have the permission to change this group membership), otherwise the server
won’t be able to issue RDS Per User CAL to the domain users.
You can install Remote Desktop Licensing using Server Manager. To do it, select Remote Desktop
Services role in the Add Roles and Features Wizard.

2
Select Remote Desktop Licensing as the role service.

Wait untill the role is installed.

3
Additionally, install the utility for diagnosing licensing problems on RDS servers — Remote Desktop
Licensing Diagnoser (lsdiag.msc), which can be set using Server Manager: Features -> Remote Server
Administration Tools -> Role Administration Tools -> Remote Desktop Services Tools -> Remote Desktop
Licensing Diagnoser Tools (by default, when installing the RDS-Licensing service, only the Remote Desktop
Licensing Manager console [licmgr.exe] is installed).

You can also install the RDS Licensing service and lsdiag.msc tool using PowerShell:

Install-WindowsFeature RDS-Licensing –IncludeAllSubFeature –IncludeManagementTools

4
Activating the RDS License Server on Windows Server

In order to issue licenses to RDP clients, your RDS License Server must be activated. To do it, open
the Remote Desktop Licensing Manager, right-click the name of your server and select Activate
Server.

The RDS licensing server activation wizard will start. Here you will need to select the activation method you
prefer. If your server is connected to the Internet, it can automatically connect to Microsoft servers and
activate RDS license server. If there is no direct Internet access from the server, you can activate the
server using a web browser or by phone.

5
Then you must enter some information about your company (some fields are mandatory).

It remains to click the Finish button.

6
If you right-click the server name in the console and select Review Configuration, you can verify that
the RDS License Server is activated and can be used to activate RDSH clients in your domain.

7
 RDS CALs: Types of Remote Desktop Client Access Licenses

Each user or device that connects to Remote Desktop Session hosts must have a client access license
(CAL). There are two types of RDS CALs:

 Per Device CAL – is the permanent license type assigned to a computer or a device that connects to the
RDS server more than once (when a device is first connected, a temporary license is issued to it). These
licenses are not concurrent, i.e., if you have 10 Per Device licenses, only 10 hosts can connect to your RDS
server;

 Per User CAL – is the type of license that allows a user to connect to the RDS server from any number of
computers/devices. This type of license is associated with an Active Directory user and issued not
permanently, but for a specific period of time (90 days, by default).
If you try to use RDS 2019 Per User CAL in a workgroup (not in a domain), then the RDSH server will
forcibly ending a user session every 60 minutes with a message: “Remote Desktop License Issue: There is
a problem with your Remote Desktop license, and your session will be disconnected in 60 minutes”.
Therefore, for RDS servers in a Windows Workgroup environment, you need to use only device licensing –
Per Device RDS CALs.

Note. We should note that 2016 RDS CAL may be installed only on a licensing server running Windows
Server 2016, the installation of new CALs to the previous Windows Server versions is not supported. Those,
you cannot install 2016 RDS CALs on a Windows Server 2012 R2 licensing host.

8
Installing RDS CALs on Windows Server 2016/2019

Now you must install the package of remote desktop client licenses (RDS CAL) you have purchased on the
License Server.

Right-click your server in Remote Desktop Licensing Manager and select Install Licenses.

Select the activation method (automatic, online or by phone) and the license program (in our case, it is
Enterprise Agreement).

9
The next steps of the wizard depend on which license program you have selected. In case of Enterprise
Agreement, you must specify its number. If you have chosen License Pack (Retail Purchase), enter the 25-
character product key you got from Microsoft.

10
Specify the product version (Windows Server 2019/2016), license type (RDS Per user CAL) and the number
of licenses to be installed on the server.

After that, the server can issue licenses (RDS CAL) to clients.

You can convert User CAL RDS to Device CAL (and vice versa) using the Convert Licenses menu item in
the RD Licensing Manager console.

11
If you have run out of free RDS licenses, you can revoke previously issued RDS Device CALs for inactive
computers using the following PowerShell script:

$RevokedPCName=”lon-bc1-123”
$licensepacks = Get-WmiObject win32_tslicensekeypack | where {($_.keypacktype -ne 0) -and
($_.keypacktype -ne 4) -and ($_.keypacktype -ne 6)}
$licensepacks.TotalLicenses
$TSLicensesAssigned = gwmi win32_tsissuedlicense | where {$_.licensestatus -eq 2}
$RevokePC = $TSLicensesAssigned | ? sIssuedToComputer -EQ $RevokedPCName
$RevokePC.Revoke()

12
How to Remove RDS CALs from a RD License Server?
If you want to transfer your RDS CAL license set from one Remote Desktop licensing server to another, you
can remove installed CAL licenses pack from the licensing server using PowerShell.

Using the following cmdlet, you can list all the installed RDS CAL packages on the server:

Get-WmiObject Win32_TSLicenseKeyPack|select-object
KeyPackId,ProductVersion,TypeAndModel,AvailableLicenses,IssuedLicenses |ft

Find the KeyPackId value for the RDS CAL package that you want to remove and run the command:

wmic /namespace:\\root\CIMV2 PATH Win32_TSLicenseKeyPack CALL UninstallLicenseKeyPackWithId

yourKeyPackId

You can also completely remove all CALs by re-creating the RDS license database. To do this, stop the
Remote Desktop Licensing service:

Stop-Service TermServLicensing

Rename the file and start the service:

C:\Windows\System32\lserver\TLSLic.edb to C:\Windows\System32\lserver\TLSLic.edb_bak

Start-Service TermServLicensing

After that, all RDS CAL licenses will be deleted, and you must reactivate them.

13
Specify a License Server Address on an RD Session Hosts

After the RDS License Server is activated and being run, you can reconfigure RD Session Host to obtain
CAL licenses from this server. You can set the license type and specify the name of the license server from
the Server Manager GUI, using PowerShell or GPO.

To change the name/address of the licensing server on the RDS host, open Server Manager -> Remote
Desktop Services -> Collections. In the upper right menu “Tasks” select “Edit Deployment Properties”.

In the deployment properties, go to the RD Licensing tab, select the Remote Desktop licensing mode and
the RDS license server. Click Add -> Ok.

If the licensing type is not set on the RDSH server, you will receive the error “Licensing mode for the
Remote Desktop Session Host is not configured”.

14
 You can change the RDS license server address and CAL type using PowerShell:

$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting

Then specify the license type you need:

$obj.ChangeMode(4)

Note. Enter 4 if the server must use Per User licensing type, and 2, if it is Per Device.

Then specify the name of the RDS License Server:

$obj.SetSpecifiedLicenseServerList("rdslic2016.woshub.com")
And check the current settings:

$obj.GetSpecifiedLicenseServerList()

When configuring RDS licensing parameters for RD session hosts via GPO, you need to create a new GPO
and link it to the OU with RDS servers (or you can specify the name of the RDS licensing server using the
local Group Policy editor – gpedit.msc). The RD licensing settings are located in the following GPO section:
Computer Configuration -> Policies -> Admin Templates -> Windows Components -> Remote Desktop
Services -> Remote Desktop Session Host -> Licensing

There are 2 RD policies that we need to configure:

 Use the specified Remote Desktop license servers – the address of the License Server is set;
 Set the Remote Desktop licensing mode – select RDS CAL license type.

15
 RDSH hosts use the following ports to get RDS license from the Licensing server, make sure that they are
not blocked by firewalls (or Windows Defender Firewall):

 TCP/135 – Microsoft RPC;

 UDP/137 – NetBIOS Datagram Service;
 UDP/138 – NetBIOS Name Resolutio;
 TCP/139 – NetBIOS Session Service;
 TCP/445 – SMB;
 TCP/49152–65535 – RPC dynamic address range
You can check for open ports using the PortQry utility or the Test-NetConnection cmdlet.
Try to check the License Server status and the number of the issued licenses using RD Licensing Diagnoser
(Administrative Tools -> Remote Desktop Services -> RD Licensing Diagnoser).

If there are no warnings, and you see the message “RD Licensing Diagnoser did not identify any licensing
problems for the Remote Desktop Session Host server”, then the RDSH server can successfully receive RDS
CALs for remote users/devices.

Note. In our case, after we specified the new License Server address the following error started to appear
on the RDP client: “The remote session was disconnected because there are no Remote Desktop License
Servers available to provide a license”. The problem can be solved by removing the L$RTMTIMEBOMB key
from the registry.

16
DEMYSTIFYING RDP PART 1: UNDERSTANDING RDP, VDI &

RDS

When Windows XP was released back in 2001, it also baked RDP (Remote Desktop Protocol) into
the Windows client OS. RDP is a proprietary protocol from Microsoft and basically provides users
with a graphical interface to connect to another computer over a network. In essence, the protocol
helps in the setup of ‘Server Based Computing’. It helps “clients” connect to “servers” – and in the
context of RDP those servers will run operating systems (e.g. Microsoft Windows) or applications
(e.g. Sage BOB50, Microsoft Navison, etc).

Since then, the RDP technology has evolved rapidly. Truth be told, it’s become a complex
picture which only a few people really master. In, this blog post, we’ll try to bring some structure
into the picture, the different options, the different elements, the high-level benefits, and the
downsides. We’ll also explain how Awingu adds benefits on top of RDP and the different ways
to deploy it. We’re not yet going into the full detail in this post, but we’ll deep dive into some of
those areas in subsequent posts. Now, let’s get started.

RDP was first introduced when Windows XP launched in 2001

VDI vs. RDS
Microsoft’s Remote Desktop Protocol (RDP) is the main ‘glue’. It’s the protocol used to connect
clients (e.g. laptops, desktops) to operating systems and applications that are running on a
remote device. Typically, this will be a Server, but in some cases, it might also be a personal
computer. We can identify 2 models in which RDP is used.

17
The following picture tries to give a summarized overview – which we’ll explain in some more
detail below.

Virtual Desktop Infrastructure (VDI)

In VDI, the client connects to a dedicated “host” running a client version of Windows,
such as the Windows 7 or Windows 10 that is running on your laptop. The “host” will typically be a
Virtual Machine, but in theory it could also be a PC (on the condition that it’s connected to network
and power). This Virtual Machine is dedicated to the client and cannot be shared. We’ll touch on
Windows 10 multi-user capabilities in a later post (as the details are not known, nor public, at the
time of this writing).

As end users can access a remote but ‘dedicated’ operating system, they can also get admin rights
and install desktop applications etc. themselves. From an infrastructure perspective, VDI is
considered expensive as every user would typically have his own Virtual Machine
running a version of Windows and there is no resource sharing.

Microsoft has introduced Windows Virtual Desktop on Azure (in public beta since March 2019). As
part of WVD, Microsoft also introduces ‘multi-session Windows 10’. This is only available on Azure
(not on any other public or private cloud).
Remote Desktop Services (RDS)
Microsoft RDS, in contrast to VDI, is a server-based technology. (Note: previously, RDS was
named ‘Terminal Server’). It doesn’t run on the (for example) Windows 10 version you run on
your PC, but on ‘Windows Server’. The biggest benefit of that is that your infrastructure
resources can be shared: multiple users can access the same operating system at the same
time. What are end users accessing? This could be a full ‘desktop’ or a single ‘application’. In case
of the full desktop, this will be Windows Server – which is typically ‘skinned’ to make it look like a
desktop version of Windows. It is, however, not a desktop version, meaning that some desktop
applications might not be able to run.

RDS – Remote Desktop Services – is a framework of roles. These are explained below. For a
simple VDI connection (without RDS), you don’t need all these roles.

18
We already mentioned that RDS can be used to give access to full desktops, as well as to (single)
applications. For the latter, ‘RemoteApp’ comes into the picture. This is a subset of Microsoft RDS
which gives the end user the impression he only has access to a single and isolated application
(e.g. Microsoft Excel) without the operating system behind it. In the former, you would use
‘RemoteDesktop’ and install applications (e.g. Microsoft Excel) on this desktop. The end user will
then remotely launch his Windows (Server) and inside Windows open Excel. Note: RemoteApp is
only available as of Windows Server 2008R2. Technically, the RDS technology can also be used to
connect to VDI-based desktops. That means that you can connect via RDP to a VDI, but also via
RDP over an RDS platform to a VDI.

Given the fact that the infrastructure is shared, end users can’t enjoy admin access. From an
economic perspective, however, the consumed infrastructure will be considerably lower
compared with VDI.

19
DEMYSTIFYING RDP pt.2: UNDERSTANDING MICROSOFT’S RDS

& VDI LICENSING

In this blog post, we’ll try to put some structure in RDS and VDI licensing and explain some of the
main concepts and options. Just to be sure: by no means will this be a complete reference. Yes,
even in this 2000+ words post, we will (need to) cut some corners.

When we talk with partners and customers, we are frequently confronted with questions about
Microsoft RDS & VDI licensing. ”How much does it cost?” is one that we hear often, and that is…
pretty complex matter, to say the least. Firstly, because the technology and architecture basis
below RDS and VDI is complex, and secondly because the rules of the game have evolved over
time. The matrix of possibilities is vast! In short, when buying RDP related licenses, make sure
that you have a good advisor or that you work your way through Microsoft Product terms.

Before continuing this blog post, we would recommend the reader to read our blog post on the
options and components of RDP

THE BASICS

What is a CAL?

“If the workstations in your organization are networked, you likely depend on network server
software to perform certain functions, such as file and print sharing. To access this server
software legally, a Client Access License (CAL) may be required. A CAL is not a software product;
rather, it is a license that gives a user the right to access the services of the server.” Read more!

When do you need a Microsoft RDS (Remote Desktop Services) CAL?

Simply put, in every situation where you use ‘Remote Desktop Services’ (RDS). Microsoft writes:
“Each user and device that connects to a Remote Desktop Session host needs a client access
licenses (CAL).” Read more!

20
What about an RDP connection to a VDI (without the use of RDS)?

In that case, you won’t need an RDS CAL. However, you will need a Windows VDA (Virtual
Desktop Access) license. This is covered in Windows E3 and E5 licenses and can also be purchased
on top of Windows in case you don’t have the E3 or E5 flavour. Windows E3 or E5 is the evolution
of the former Windows SA (Software Assurance). The former is typically user-based, while the
latter was device-based licensing.

“Windows Virtual Desktop Access (VDA) is an authorization strategy that requires each device
seeking access to a Windows virtual desktop in a virtual desktop infrastructure (VDI) to be
licensed.” Read more!

VDA is included as a feature of Windows E3 and E5 subscriptions, meaning that primary users of
devices with such a license can access their virtual desktops at no extra charge.
As a “special case”: in case you would access a Windows client (and thus a VDI scenario) by using
an RDS platform, you would require both the Windows VDA license (as part of Windows E3 or E5,
or standalone) as well as an RDS CAL.

At the highest level, the picture below gives some guidance:

RDS and VDI licensing options at a glance

21
RDS CAL LICENSING OPTIONS

With the basics out the door, let’s go one level deeper into

RDS CAL licensing.

The RD License server

This is a mandatory role for Microsoft to be set up in your RDS environment. For small
deployments, it can be deployed on the RD Session Host. For larger deployments, a separate VM
is advised. When purchasing CALs, they must be uploaded in the license server. As such, if an
appropriate RDS CAL is available from a license server, the RDS CAL is issued to the client, and
the client can connect to the RD Session Host server and from there to the desktop or apps
they’re trying to use. There are typically grace periods during which the license server will accept
connection.

What types of RDS CAL existing?

Basically, you must choose between a “user CAL” and a “device CAL”. An overview:

Comparison for RDS CALs (for Windows Server 2016)

22
Not upwards compatible

As we explained in our RDP introduction blog, RDS is tied to a Windows Server version; ie. the
RDS version of Windows Server 2008R2 and 2016 are hardwired into each platform and are pretty
different from each other in terms of functionalities and performance.

Now comes the tricky part: the CALs you bought for a Windows Server 2012 deployment will not
be accepted on a Windows Server 2016 platform if you didn’t buy for the Software Assurance.
However, the 2016 RDS CAL is downwards compatible with RDS 2012. Microsoft writes: “Any RDS
license server can host licenses from all previous versions of Remote Desktop Services and the
current version of Remote Desktop Services. For example, a Windows Server 2016 RDS license
server can host licenses from all previous versions of RDS, while a Windows Server 2012 R2 RDS
license server can only host licenses up to Windows Server 2012 R2.”

However, upwards compatibility is possible if Software Assurance is purchased for the RDS CAL
licenses. In that case, you can just upgrade to the latest available version. If Software Assurance
is not purchased, new RDS CALs need to be purchased.

The following table puts the theory in the practice (in case of no Software Assurance):

Microsoft RDS CAL version compatibility

23
The Windows Server CAL

When writing about the RDS CAL, we didn’t talk about the Windows Server licensing yet. Given
that in most cases ‘desktops’ or applications are deployed on Windows Server, licensing applies
here too. Typically, you’ll need to take a Windows Server CAL (available ‘per user’ or ‘per device),
next to (or on top of) the RDS CAL into account.

Licensing model

And then, obviously, Microsoft has different models for the consumption of RDS CALs. From a
high-level perspective, there are 3 main categories:

Volume Licensing: this is a term used by Microsoft to describe a program for organizations that
need multiple Microsoft product licenses, but do not need multiple copies of the software media
and the documentation that comes with the software. Microsoft Volume Licensing typically offers
organizations lower pricing, two or three-year license agreements and often product use rights not
included with FPP (Full Packaged Product) licenses, such as rights to copy the software onto
multiple devices.

Within Volume licensing there are multiple options – have a look at this page for more info.

· Enterprise Agreement (EA)

· Open Value
· MPSA – Microsoft Product and Service Agreement

SPLA (Server Provider License Agreement): “With the SPLA, service providers and ISVs can
license eligible Microsoft products on a monthly basis, during a three-year agreement term, to
host software services and applications for their customers. The SPLA supports a variety of hosting
scenarios to help you provide highly customized and robust solutions to a wide set of
customers.” Read more!

CSP (Cloud Service Provider): On Nov 20th 2018, Microsoft announced that it would be possible
to also purchase RDS CALs via a CSP model. “Previously, your customers needed to bring their
own RDS CAL with SA to support your RDS deployment in the customers’ environment. Now a CSP
can directly sell RDS subscriptions through our CSP program, eliminating the extra step of
customers and partners acquiring different licenses through various programs. With this model,
one can enjoy a faster licensing cycle due to CSP integration with other Microsoft licenses
including Windows Server, SQL Server, and Office to make it easy for partners to simplify the
buying process.” Read more!

Next to the above license models, special pricing exists for organizations that are non-profit,
educational, etc. but those discounts don’t apply to all models.

24
VDI LICENSING OPTIONS

When do you need VDA?

In the VDI scenario, you remotely connect to a Windows Client (i.e. the operating system that
might run on your laptop/desktop). When using VDI, and thus not connecting to an RD Session
Host or a Windows Server, you don’t need RDS and Windows Server CALs. However, you do need
to make sure that your Windows (client) licensing is properly set up: in comes “Windows Virtual
Desktop Access, or VDA”.

You will require such a VDA license every time you connect to a Windows client that is centrally
hosted (i.e. running in a datacentre or on a virtual machine on a hypervisor). You will also require
VDA licensing if you remotely connect to a Windows desktop that is not your primary device (let’s
say, not your main desktop that is connected at work).

You will not require any additional VDA licensing if you remotely connect from a Windows device
to your primary desktop/laptop that is connected to the company network. A typical scenario is
that the desktop is left powered on in the office at night. Homeworkers can then access that
workspace from a personal home device over RDP. Clearly, this is not the most scalable, secure,
or cost-efficient scenario (from a power perspective), but it is an option, nonetheless.

Now, let’s assume a different user accesses your VDI. In that case, it’s not the primary user
accessing his principal device, and thus additional VDA licensing will apply to add this additional
user. A typical ‘extra user’ is a contractor or a colleague.

Let’s take it one additional step further: if you connect to your primary desktop/laptop that is
connected to the company network, and you try to connect from a non-Windows device (let’s say
an Apple MacBook) then you’ll also need a VDA license (or a Windows 10 Enterprise E3/E5 as
you’ll read below).

Are you still with us?

Windows 10 Enterprise E3, E5 and SA licensing

Windows “Virtual Desktop Access” (VDA) is included in Windows 10 Enterprise E3 and E5 licenses.
With Windows 10 Enterprise E3 and E5 user licensing, you have the rights for remote access for
up to 5 different devices (linked to the same user). Those include devices with non-Windows
operating systems (e.g. an iPad). The ‘host’ Windows client system can also be hosted in a
datacentre.

Windows 10 Enterprise E3 or E5 is available in ‘per device’ and ‘per user’ licensing. Windows SA
used to be exclusively available for licensing on a per-device basis. Starting December 1st 2014,
Windows SA and Windows VDA are also licensed on a “per-user” basis. Windows SA also came
with VDA built-in. These days, however, Microsoft is mainly selling Windows 10 E3 and E5 user
licenses.

25
Windows Virtual Desktop

Microsoft has introduced Windows Virtual Desktop on Azure, which is in public beta since March
2019. The licensing requirements for WVD on Azure are different compared to the default rules.
Read more in our blog post about the topic!

Can I connect to VDI over RDS?

Yes, that’s a possibility. In such a case, you access the Windows client by using the Remote
Desktop Services setup. You will need to purchase both a VDA license (which might be covered by
Windows 10 Enterprise E3 or E5) as well as an RDS CAL. You will not need the Windows Server
CAL, however.

Compatibility

Given Windows E3 and E5 basically include the Software Assurance, you have the right to upgrade
(or downgrade in theory) at any time.

License models

Similar to RDS, Windows E3, E5 and VDA are available in multiple licensing models. It’s “slightly”
more complex however. This table gives a good overview:

26
Summary table

The following tree tries to summarize the options for some scenarios:

RDP TO LINUX

Last but not least, another option we have not touched upon yet, is the option to use the Remote
Desktop Protocol (RDP) to access a machine without Windows. Let’s safely assume that’s Linux in
today’s world. From a Microsoft license perspective, no costs apply. Which only makes sense, give
you don’t use Windows client (no VDA needed), no Windows Server (no Windows Server CAL
needed) and no RDS (no RDS CAL needed). However, license costs might apply for other (non-
Microsoft) RDP suites.

RDP LICENSING AND AWINGU

Here, we can be short. Awingu doesn’t enable you to cut in RDS or VDI related licenses as such.
Awingu is a layer on top, and all the rules of the game will apply. On the bright side, however,
Awingu’s licensing is a lot less complex as it is user-based on a concurrent level. No matter what
features you use, how often you use them, from what device you use, or how many
applications/desktops you use. Simple and transparent.

27
http://woshub.com/install‐activate‐rds‐licensing‐role‐windows‐server/

https://www.awingu.com/demystifying‐rdp‐understanding‐rdp‐vdi‐rds/

https://www.awingu.com/demystifying‐rdp‐understanding‐microsofts‐rds‐vdi‐licensing/

28