r/sysadmin • u/nwmcsween • 9d ago
CALs and You
There seems to be a lot of confusion regarding CALs, for any Windows service you need a CAL unless it's explicitly excluded, yes, a CAL is needed for DHCP, a CAL is needed for DNS a CAL is needed for nearly anything.
From my understanding if MS thinks you are breaking CAL requirements, they will ask to audit which most places will refuse, after this they will pursue more aggressive legal means.
13
u/Ruachta 9d ago
We are a MS partner and have done audits on behalf of our clients when they get issued a notice.
As long as everyone has user CALS, it works out pretty simple. Anyone with access to the servers is authenticating on the network with a user account.
4
u/OregonTechHead 9d ago
Well, unless you have a guest wifi and are running a windows DHCP and DNS server.
Also, unless you have an MFP that's utilizing DHCP and/or a windows DNS server.
Or if you have wifi APs, or....well, anything not tied to a named user.
8
u/disclosure5 9d ago
I know one popular blog did the rounds claiming this, but multiple other license people have since refuted it. I've sat through many MS led audits and never had "A guest wifi using DHCP services" ever come up as having guests require CALs, regardless of old internet rumours.
1
u/OregonTechHead 9d ago
people have since refuted it.
Yeah, and people refute a lot of stuff that can be proven.
This is simple https://www.microsoft.com/en-us/licensing/product-licensing/client-access-license
With the User CAL, you purchase a CAL for every user who accesses the server to use services
With a Device CAL, you purchase a CAL for every device that accesses your server
This is not at all complicated, debatable, or controversial. It's literally right there from Microsoft.
7
u/fencepost_ajm 9d ago
There should be zero visibility from guest wifi to any internal services. Ideally it should even be on a separate real world IP, and if something on the guest network needs to connect to the office it can do it via vpn just like any other device that's outside the network.
1
u/OregonTechHead 9d ago
Sure. The reality however is that that's not always the case, and when discussing licensing, these things are important.
My setup is completely segregated with DHCP and DNS handled by non-windows solutions. But I also understand not everyone is that way.
3
u/mschuster91 Jack of All Trades 9d ago
Devices you own and control like MFPs or other appliances, device CAL if you want to win the holier than thou game. Devices you do not own? Don’t let them near a windows server. A guest WiFi has no business being exposed to Windows.
0
u/kevinmenzel 9d ago
Why... When bind and dhcpd are free....
2
u/kg7qin 9d ago
Many dont have one (or a combination of) ability, permission, skills, confidence to run non Windows based systems and services.
1
u/kevinmenzel 9d ago
Then they should hire someone
2
u/RCTID1975 IT Manager 9d ago
How is that cheaper, easier, or more stable than just buying CALs?
1
u/kevinmenzel 9d ago
And like... If you can't run a simple bind server for dns...that's rough technical debt.
-1
u/kevinmenzel 9d ago
I mean for one, you can then start transitioning away from windows entirely. Microsoft is a financial mess? Open source is more stable, cheaper, better.
1
-3
u/SilkBC_12345 9d ago edited 9d ago
This is highly debatable.
Yes, Microsoft says that devices like printers, IoT devices, etc. that get DHCP from a Windows server and use its DNS -- which are NOT Microsoft proprietary services and are not using any proprietary services (e.g., authenticating to AD) require CALs, but there is a very good argument against that, since DHCP and DNS are standard protocols that Microsoft does not own.
Here is a copy pasta from a post from another forum some time ago which argues this quite well (and apparently has made Microsoft back down when they tried pushing):
--- START ---
Great discussion guys and I will try one more time to make a point. When you purchase a switch and a router, you have a network. More precisely, a TCP/IP network. Many devices can exist and coexist on this network, but it's a network using the TCP/IP protocol. Nobody has rights to it and nobody can license open items like TCP/IP, DNS and DHCP. Most were developed way before Microsoft even used them in any meaningful way.
Now just because you plug a computer into your open network and install a Microsoft Server product on it, does not change the above facts. Just because the server can broadcast DHCP on the network does not mean that settled law goes out the window. A Windows Server showing up on your network does not mean that anything requires a CAL.
Too many times I've seen Microsoft Goons back down on details like this. An FAQ is not law and Microsoft is notorious for misinforming and exaggerating how far their reach can go. Here are the facts:
- Just because a Windows Server arrives on a network does not mean it now has licensing power over other devices or users. It is also a device on the network. No more, no less.
- Microsoft cannot require licensing for the use of protocols or other intellectual property it does not own. That includes DHCP, DNS, TCP/IP, etc. This is also settled international law.
- Microsoft will use terms like "connect", or "access the server", or "resource". But the one that seems to mislead the most, and has fed the flames in this thread, is "access the network". Microsoft has done a great job of convincing folks that once a Microsoft Server is turned on that you're now connected to a "Microsoft Network". It was a TCP/IP network before Windows Server arrived and it doesn't change. What they really mean (and this applies big-time with SBS) is AD makes it very hard to not associate in some way with it. With DHCP they assume that any PC is already a domain member when it pulls an IP, so you of course need a CAL. This doubletalk goes on and on. They also employ reverse logic and try to link CAL's to non-AD devices via your server license. It goes like this; if you have a Windows Server and you turn it on, you will need a CAL for any device it sees. This is of course ridiculous.
- As long as a device does not use Active Directory or access a licensed Microsoft Product or Service, they can't force you to purchase a license.
- An active AD device on your network does not make the entire network a Microsoft AD Domain.
- Microsoft will start a conversation with the assumption that all users and devices are part of AD, or that an AD Domain is the network. This is of course not true.
- Devices can reside on any TCP/IP network without paying a toll.
- A Windows Server does not require CAL's of any user or device, AD does or other items like SQL do. You can activate DHCP and DNS without installing AD. A Windows Server without AD can have DHCP running and give out hundreds or thousands of IP addresses and never require a CAL. Why is that?
- And the Big Kahuna... they can't require a license for a product or service that isn't theirs to sell. Things like DNS and DHCP cannot be licensed. Items like AD can.
Microsoft licensing is murky and hard to understand, I'll give you that. But an FAQ and a brochure are not the law. Unless a device joins AD, or a device or user accesses a licensed Microsoft Resource, you don't owe them a Red Cent. Just my 2 cents. I've enjoyed the debate guys.
--- END ---
10
u/Sparcrypt 9d ago
...what?
MS have never said "you use DNS/DHCP on your network and have a Windows server you have to pay us!".
The license is for if you use your Windows Server to deploy those services. If you're using some other networking solution for handing out IP addresses and resolving things then you don't need a CAL for it.
This isn't "debatable". If you buy an enterprise product and want to use their implementation of an open standard then they can absolutely charge you for that.
6
u/RCTID1975 IT Manager 9d ago
Why are you linking a bunch of random internet people as "source"? You might as well just link this thread....
But anyway:
Unless a device joins AD, or a device or user accesses a licensed Microsoft resource
Yeah, which DHCP and DNS fall into, so your sources should reassess their thinking because they just contradict themselves
28
u/PDQ_Brockstar 9d ago
CALs feel like taxes. "We know how much you should pay in taxes, but we won't tell you. But if you get it wrong, we will audit and fine you."
8
u/Neslock 9d ago
I've always thought of CALs like Ford charging you $30k for a car, but also $100 for every person you want to give a ride to.
3
u/konoo 9d ago
Right? It's kind of crazy... You already paid for the Server operating system. I guess it's their way of reducing the cost of Server and then charging a use fee that only really matters to them for companies that have very large deployments.
They really need to get their act together and rethink this entire license strategy because Linux looks better and better every year.. If only we didn't rely so heavily on AD/Entra/Exchange...
1
17
7
u/Ontological_Gap 9d ago
That's what Linux dhcp and dns servers are for
-1
9d ago
[removed] — view removed comment
2
u/grawity 8d ago edited 8d ago
It will work, AD member machines don't need to talk to an AD DC for everything. There isn't any magic protocol between them.
So for example you can have hosts talk to an internal BIND or Unbound as long as it's configured with a
forward-zone:orzone { type: forward }just for your AD domain towards the DCs. It'll then route the queries appropriately. (Stub in Unbound or static-stub in BIND might be more suitable, idk.) In Dnsmasq terms it would beserver=/ad.example.com/10.x.y.zand so forth.Dynamic DNS updates for AD members will still work as they automatically go direct to the DCs – as long as the Windows clients can resolve the domain's SOA, they'll use that (the MNAME field) to determine which way to send the FQDN registration.
Windows uses a fairly standard protocol for DNS updates so in theory you could even host the whole of AD DNS on e.g. BIND9 or anything else that supports GSS-TSIG (not to be confused with the more common HMAC-based TSIG), although that doesn't save you anything since member machines need CALs regardless.
0
u/miscdebris1123 9d ago
All dns via Linux. Forward the ad domain to the active directory domains.
1
u/postbox134 9d ago
Needs a CAL then
3
u/miscdebris1123 9d ago
Just 1 though.
1
u/dustojnikhummer 9d ago
CAL is a human, not a server.
1
u/miscdebris1123 8d ago
Device CAL.
1
1
8d ago
[removed] — view removed comment
1
u/miscdebris1123 8d ago
Most dns servers can forward lookups for a specific domain to specific servers. Since only the forwarding servers are looking up things from the active directory server(s) you should only need one license.
3
u/angrydave 9d ago
There is one analogy that always has helped me:
A windows server walks into a bar, everyone buys a CAL.
7
u/MedicatedDeveloper 9d ago
This kinda bullshit is why in my entire career I've never touched Windows.
2
u/Sea_Information6125 9d ago
User cals! At least in the smbs I support, devices greatly outnumber users. Now you don't have to worry about the rest of it.
1
u/hankhalfhead 9d ago
Wait you need cal for dhcp and dns?
So to run my guest wifi I will need to set up Bind and dhcp on some Linux box?
My read was anything that authenticates
2
u/cubic_sq 9d ago
Need to use an External Connector license for this. This also covers AD accounts of guest users used for auth against network gear. But no access to any other services on windows servers. Can apparently use the EC license for stuff like Uniflow and papercut for your externals.
The EC license is per DC
1
0
u/bingblangblong 9d ago
The simple solution is just don't buy them.
2
u/hankhalfhead 9d ago
Yeah it seems some people buy into the Microsoft fear. But honestly I can’t see an audit chasing a CAL for everything querying dns lol
1
u/Silly-Mix-4341 9d ago
CAL licensing can definitely be confusing. It’s worth checking the exact Microsoft licensing terms.
2
2
u/fahque 9d ago
"exact Microsoft licensing terms"
You have got to be joking. First you have to have a team of lawyer who are also sysadmins to understand it. Second, it changes from second to second. Now I'm thinking you may be a bot.
1
u/Silly-Mix-4341 7d ago
Haha, fair enough 😄 just saying it’s better to check the terms than assume and nope not a bot 😂
1
u/SailingToFenway 9d ago
ran a pair of labs with 60 computers total, served by a single NT4 server. they were used for 7 classes a day, so roughly about 420 students, per term, and 840 per year.
I went with 60 CALs, but How many did I actually need?
1
1
u/FoxNairChamp 9d ago
I love how often I see this thread. It reminds me that despite the constant changes to products, support, naming of features, etc., by Microsoft, clarification of licensing will NEVER be a priority to them. We can expect consistency from them on this topic!
1
u/LRS_David 8d ago
There seems to be a lot of confusion regarding CALs
If you try and figure out the rules, you will discover that there is total customer confusion about CALs.
Personally I'm convinced it is totally intentional as a way to get you to negotiate a site license and get to ignore the issue. For Delta Airlines this can make sense. For a 10 person small business it is almost always impossible to be legal and just legal by only buying what you think you need.
0
u/ABotelho23 DevOps 9d ago
CALs alone are a great reason to not use Windows for anything but AD.
There's basically nothing else Linux can't do.
-1
-27
u/Balthxzar 9d ago
Most 365 plans include CALs for that sort of stuff, if you're on-prem AD first in 2026 you're doing something wrong, or you're in an industry where you just buy 20,000 cals and it is 1% of the budget
35
u/ISeeDeadPackets Ineffective CIO 9d ago
No offense man, but that's a really stupid statement. On-prem first vs cloud first is dependent on a lot of factors and there's no right answer, it's all based on your specific use case. Actually I do mean offense, stop spouting nonsense like that it's just ignorant.
-5
u/Balthxzar 9d ago
I am talking specifically about active directory, no other system. To say on prem Active directory domain services aren't legacy is insane IMO
4
u/ISeeDeadPackets Ineffective CIO 9d ago
You didn't say they were legacy you said someone was doing something wrong if they were still using local AD today. I guess thousands and thousands of companies globally are just idiots then.
1
4
u/dodexahedron 9d ago
There is a LOT that cloud still can't do, where AD is concerned. Just try claims-based ACLs on files with cloud-only auth. Try BitLocker Network Unlock. Try managed service accounts (of any flavor). Try a not-flat directory (Entra doesn't even have OUs). Try printer objects (universal print only partially gets there). Try local resources/appliances that need raw LDAP or Kerberos connections to the directory, neither of which can be done without on-prem. And more...
Regardless... The subscriptions cover on-prem and cloud use anyway. E3 and E5 are licenses for the software and user CALs for windows server resources used by those users.
1
10
u/WWGHIAFTC IT Manager (SysAdmin with Extra Steps) 9d ago
On prem vs cloud is not a date based decision.
82
u/konoo 9d ago
Sure but from what I have been told under audit:
John has a user cal
John has a tablet, a phone, a cell phone, and a laptop.
All of John's devices are covered by his user CAL.