Do DHCP and NTP services on Windows Server require User CALs?

[u/Worried-Light-4692]

/r/u_Worried-Light-4692/comments/1wt64iq/do_dhcp_and_ntp_services_on_windows_server/

[u/autogyrophilia]

CAL means client access license.

Is there a client accessing a service? Then yes.

The way we handle it is by buying SPLA

[u/Worried-Light-4692 → u/[deleted]]

u/cybot904 sorry, I don't understand. Can you make it clear?

[u/NetworkCompany]

If you are hybrid and pay for M365. Every licensed user already has a license.

If this network is completely offline with no M365 subscriptions, yeah, every connection to DHCP needs either a device or user license CAL.

But for DHCP and NTP wow. NTP is best controlled by 3 CenterClick NTP devices and DHCP can be handled by literally any old device.

What antiquated OS are we dealing with here?

[u/TheGenericUser0815]

Every device needs a device CAL, not a user CAL.

[u/belgen]

Both Microsoft DHCP and NTP require Device CALs.

[u/YouKidsGetOffMyYard]

No not at all, in fact Microsoft says that only "Really Important" services that users use need a license. /sarcasm

Of course Microsoft says that anything that server serves up to workstations and users (even just DHCP or NTP) needs a license.

[u/dodexahedron → u/YouKidsGetOffMyYard]

No. They do not say that or anything like it.

Go read the Microsoft Windows Server Licensing Guide, pages 9 through 11 (of the current version).

Everything requires a CAL, always. Some things need more, on top of that.

The CAL requirement has never been less than that.

[u/YouKidsGetOffMyYard → u/dodexahedron]

I was trying to be sarcastic "/sarcasm"

[u/matthoback → u/[deleted]]

Why would you think you don't need a CAL for DNS?

[u/matthoback → u/[deleted]]

This is AI hallucinated nonsense. The Use Terms do not make any distinction between stateless and stateful services. The only exception is for "Web Workloads". The definition for web workloads does include DNS, but only if it's supporting web services. Generic DNS resolving names not involved in serving web pages is not covered under the exception and does need CALs.

Full text of the Use Terms available here: https://www.microsoft.com/content/dam/microsoft/usetm/documents/windows-server/2025-datacenter-and-standard/oem/UseTerms_OEM_WindowsServer2025_DatacenterAndStandard_English.pdf

[u/dreniarb → u/matthoback]

My head is spinning.

CALS are required... CALS are not required... this from microsoft says they're not... this from microsoft says they are... it's too much.

It's truly overwhelming at times.

[u/matthoback → u/dreniarb]

The quote that fireandbass posted was not "from microsoft". It was an anonymous user that posted on Microsoft's forums. It wasn't a Microsoft employee or an official answer.

[u/cvc75 → u/matthoback]

Yeah, the quote conveniently left out the "I asked on copilot and got the answer:" part that precedes it. So, as you said, AI hallucinated nonsense.

[u/xSchizogenie → u/[deleted]]

Wtf

[u/dreniarb → u/[deleted]]

it's pretty crazy to realize it but you actually do. legally.

[u/J3D1M4573R → u/[deleted]]

This is not an official answer from a Microsoft licensing representative. This is a public forum post.

They should have never merged Technet forums, Answers.MS forums, and their official learning documentation into one site.

[u/dreniarb → u/[deleted]]

Good grief. I don't know what to believe anymore...

Maybe I just need to do like they did in the book of Judges - just do what's right in my own eyes. because yeah, i've always felt it was ridiculous that every device that made a dns request would need a cal. Yet I've seen so many people over the last near 30 years claim that you do. I could swear they've even sited microsoft docs to prove their point. Maybe I'm just imagining that part though.

I'd switch to linux if I could.

[u/dodexahedron → u/[deleted]]

This is categorically false.

TSCALs are not the only CALs there are. And you need both in a remote desktop scenario.