Managing CAL Licenses in Windows Server 2022: Complete Administrator’s Guide

A Windows Server 2022 CAL gives one user or one device the right to connect to the server. CAL stands for Client Access License. Day 121 of an RDS trial, and no license server in sight? Remote Desktop sessions suddenly fail.

The server license covers the server only. Every person or computer that uses its file shares, Active Directory or printers needs a Windows Server CAL. Remote Desktop sessions need an RDS CAL on top.

Choosing between the two kinds of RDS CAL has its own page: RDS CAL Per User vs Per Device.

Here’s how we set up, activate and keep track of both kinds. Plus the mistakes that bite admins during an audit.

What a Windows Server 2022 CAL is and who needs one

It lets one named user or one specific device access a server running the Standard or Datacenter edition. We count every user or device that does any of the following.

• Authenticates to the server.
• Reads its file shares.
• Prints through it.
• Uses its other services.

That holds whether or not anyone ever logs on interactively.

The server license and the CAL are two separate purchases. The first licenses the machine, by core. CALs license the people and computers that talk to it.

Small shops tend to find this out during an audit. Or on the 121st day of an RDS trial.

A few exceptions exist.

Windows Server CALs and RDS CALs

Windows Server CALs cover basic access to the server. RDS CALs cover Remote Desktop sessions on a session host. A user who works in a published desktop needs both.

Only RDS CALs are tracked by Windows itself. Base CALs are never typed into any console, so you prove them with purchase records.

User CALs or Device CALs

Buy User CALs when each person works from several devices. Buy Device CALs when several people share one computer.

Count honestly before you order. In typical offices, desk staff with a laptop plus a phone usually tip the sum toward User CALs.

A factory floor is different. Whole shifts share a few terminals there, and that almost always favours Device CALs.

You can mix the two models for base CALs. A single RDS deployment runs in one mode at a time, though.

How to install the Remote Desktop Licensing role

The role is only needed for RDS CALs. Base CALs are never installed anywhere. If you don’t run Remote Desktop Services, skip this whole section.

1. Sign in to the server with an administrator account.
2. Open Server Manager, click Manage in the upper-right corner and choose Add Roles and Features.
3. Pick Role-based or feature-based installation and select the server.
4. On Server Roles, tick Remote Desktop Services. Click Next until you reach Role Services.
5. Tick Remote Desktop Licensing and accept the management tools it offers. Then click Install.
6. Click Close when the progress bar finishes.

The same with PowerShell, run as administrator:

Install-WindowsFeature RDS-Licensing, RDS-Licensing-UI -IncludeManagementTools
Get-WindowsFeature *RDS*

The second line lists the RDS role services. Remote Desktop Licensing should now show as installed.

One license server can serve every session host in the domain. In larger setups, two servers with split CAL packs give you redundancy.

Activating the license server

You do it in Remote Desktop Licensing Manager. The wizard registers the server with the Microsoft Clearinghouse. Directly over the internet, or through a web page opened on another computer.

Until activation succeeds, the server can only hand out temporary licenses. And you can’t install CAL packs.

1. Open Remote Desktop Licensing Manager from Server Manager, Tools, Remote Desktop Services.
2. Right-click your server under All servers and select Activate Server.
3. Choose Automatic connection if the server has internet access. It talks to the Clearinghouse over TCP 443. No internet on the box? Pick Web Browser and finish the form on any PC that’s online.
4. Fill in the company information and finish the wizard.
5. In a domain, right-click the server and choose Review Configuration. Click Add to Group.

That last step puts the server into the Terminal Server License Servers group in Active Directory. Per User CAL tracking depends on it.

After activation, we’d run the RD Licensing Diagnoser on the session host. It opens with lsdiag.msc. One window shows whether the host can find the license server, which licensing mode it uses and how many CALs are available.

Installing Windows Server 2022 RDS CALs on the license server

The Install Licenses wizard does it. With an automatic connection, the license server contacts the Microsoft Clearinghouse and adds the pack to its inventory within seconds.

1. In Remote Desktop Licensing Manager, right-click the activated server and select Install Licenses.
2. Choose the license program you bought under.
3. Enter the 25-character license code. For volume licensing, enter the agreement and authorization numbers.
4. For volume programs, select the product version, the CAL type and the quantity.
5. Finish the wizard. Then expand the server node and check that the new pack appears, with the right total and available counts.

Version rules trip people up more than the wizard does. These RDS CALs install on a license server of the same version or newer. An older license server won’t take them. They cover session hosts from 2016 up to 2022.

Microsoft keeps the full matrix on its RDS client access license page.

The second half of the rule is about the license server. It has to run the same version as the CAL pack or a newer one. A 2019 license server simply won’t take a 2022 pack.

Planning both 2022 and 2025 packs? Then we’d put the license server on 2025 from day one. It takes every pack in the table.

If the hosts move to Windows Server 2025 within a year or two, 2025 RDS CALs bought now save a second purchase.

Need CALs? Our Windows Server 2022 Remote Desktop Services 50 User CAL comes as a genuine license. We email it instantly after payment.

Buying a Windows Server 2022 CAL license: packs and versions

Two shopping lists, really. Base CALs for everyone who touches the server. RDS CALs only for people who work in Remote Desktop sessions.

Versions follow one rule. A CAL covers its own server version and older ones. So a 2022 server wants 2022 CALs, or 2025 ones. CALs for 2019 don’t cover it, not even the base kind.

Ten people on Remote Desktop? That’s ten base CALs plus ten RDS CALs. Don’t forget the first part.

Price depends on the channel and the pack size, so check the live figure on the product page. For larger rollouts our Windows Server 2022 RDS 50 Device CAL sits next to the user pack, and every CAL we carry is listed under Windows Server CALs.

Pointing Remote Desktop Services at the license server

There are two routes: the deployment properties in Server Manager, or Group Policy for a standalone session host. Both set the same two things. The license server name, and the licensing mode.

A mode that doesn’t match the installed CALs is the most common reason sessions fail.

In an RDS deployment with a Connection Broker:

1. Open Server Manager and go to Remote Desktop Services, Overview.
2. Under Deployment Overview, open Tasks, Edit Deployment Properties.
3. Select RD Licensing and choose Per User or Per Device. Add the license server by its FQDN.
4. Click OK. The RD Licensing icon in the deployment diagram should no longer show a warning.

The same thing in PowerShell, handy when you rebuild a broker:

Import-Module RemoteDesktop
Set-RDLicenseConfiguration -LicenseServer "LicenseServer.domain.com" -Mode PerUser -ConnectionBroker "RDBroker.domain.com"
Get-RDLicenseConfiguration -ConnectionBroker "RDBroker.domain.com"

On a standalone session host with no broker, use the local policy editor or a domain GPO.

The 120-day grace period

During the grace period, a new Remote Desktop Session Host accepts connections with no license server at all. After that, users with no valid RDS CAL can’t sign in.

So install and configure licensing well before day 120.

Don’t look for registry tricks that “reset” the grace period. They break the license terms, and Microsoft doesn’t back them. The server then fails again a few months later, at the worst possible moment.

Per Device and Per User CALs after installation

Per Device RDS CALs are handed out and enforced by the license server. Per User CALs are tracked in Active Directory and not enforced. Keeping their number honest is your job.

To revoke, right-click the CAL under the server in Remote Desktop Licensing Manager and choose Revoke License.

A workgroup session host should use Per Device RDS CALs.

Per User CALs are never blocked. So a server can happily keep working while you’re out of compliance. That’s exactly what auditors look for.

Tracking Windows Server 2022 CAL usage with PowerShell

The license server exposes two WMI classes. One lists the installed packs. The other lists the CALs already handed out.

Remote Desktop Licensing Manager also builds a Per User usage report. Right-click the server, then Create Report, CAL Usage.

Installed packs and free licenses:

Get-WmiObject -Namespace "Root/CIMV2/TerminalServices" -Class "Win32_TSLicenseKeyPack" -ComputerName "LicenseServer.domain.com" |
    Format-Table KeyPackType, ProductVersion, TotalLicenses, AvailableLicenses -AutoSize

Issued licenses, exported to CSV for the audit folder:

Get-WmiObject -Namespace "Root/CIMV2/TerminalServices" -Class "Win32_TSIssuedLicense" -ComputerName "LicenseServer.domain.com" |
    Export-Csv -Path "C:\LicenseReport.csv" -NoTypeInformation

A warning when fewer than 10% of CALs are left. Schedule it in Task Scheduler, and replace the mail relay with yours.

$LicServer = "LicenseServer.domain.com"
$Packs = Get-WmiObject -Namespace "Root/CIMV2/TerminalServices" -Class "Win32_TSLicenseKeyPack" -ComputerName $LicServer
$Available = ($Packs | Measure-Object -Property AvailableLicenses -Sum).Sum
$Total = ($Packs | Measure-Object -Property TotalLicenses -Sum).Sum
if ($Available -lt ($Total * 0.1)) {
    Send-MailMessage -To "admin@company.com" -From "alerts@company.com" -SmtpServer "mail.company.com" -Subject "Low RDS CAL warning" -Body "Only $Available of $Total RDS CALs left."
}

Several license servers at once:

$LicenseServers = "LicServer1", "LicServer2", "LicServer3"
foreach ($Server in $LicenseServers) {
    Write-Host "License information for $Server" -ForegroundColor Green
    Get-WmiObject -Namespace "Root/CIMV2/TerminalServices" -Class "Win32_TSLicenseKeyPack" -ComputerName $Server |
        Format-Table KeyPackType, TotalLicenses, AvailableLicenses -AutoSize
}

None of this counts base Windows Server CALs. Windows never records them.

For those, a simple spreadsheet does the job: purchases against the number of AD users or managed devices. A dedicated asset tool helps once you pass a few hundred seats.

Fixing common licensing errors

Most errors come from four causes.

• The session host can’t reach the license server.
• The licensing mode doesn’t match the CAL type.
• The CALs are the wrong version.
• The pack is used up.

We’d start every investigation with the RD Licensing Diagnoser on the session host. It usually names the culprit in plain words.

“No Remote Desktop license servers available”

The session host can’t find a license server it trusts. Usually the server name was never set. Or the license server service is stopped. Or a firewall blocks RPC between the two machines.

• Set the server explicitly, with the cmdlet or the Group Policy setting shown above.
• Confirm that the Remote Desktop Licensing service, TermServLicensing, is running on the license server.
• Open RPC traffic between the hosts: TCP 135 plus the dynamic RPC port range.
• When the hosts sit in another domain, check that the license server is in the Terminal Server License Servers group.

Licenses don’t show up after installation

Packs that seem to install and never appear usually have one of two causes. The server isn’t activated. Or the CAL version is newer than the license server.

Activate first, then add CALs. Keep the license server on a version equal to the CALs, or newer.

Restart-Service TermServLicensing

Still missing after the restart? Rerun the Install Licenses wizard and read any error it shows. Then open the Product Activation portal at aka.ms/aoh, with your license code or agreement number at hand. Volume License Key Management lives there too. Live chat as well, when the case qualifies.

“The remote session was disconnected because there are no Remote Desktop client access licenses available”

This error appears after the grace period. A device or a user asks for a CAL the license server can’t issue.

CALs are used up faster than expected

That almost always comes from Per Device mode with shared or reimaged machines. Each rebuilt PC looks like a new device. Thin clients that are rebuilt nightly are the classic case.

• Revoke CALs from devices that no longer exist, up to 20% of the Per Device CALs.
• Re-check whether Per User would fit better now.
• Look for unknown devices in the issued-licenses export. They sometimes reveal unwanted remote access.

“Too many sessions”, or idle sessions hogging the server

Disconnected sessions don’t free an RDS CAL. They do eat memory, and they can push a host past its session limit. Clearing them gives quick relief while you investigate.

Get-RDUserSession | Where-Object {$_.SessionState -eq "STATE_DISCONNECTED"} |
    ForEach-Object { Invoke-RDUserLogoff -HostServer $_.HostServer -UnifiedSessionID $_.UnifiedSessionId -Force }

For a lasting fix, set time limits for disconnected and idle sessions. They’re in the collection properties, or in Group Policy under the Session Time Limits folder of the Session Host.

Server versions this guide is written for

The steps are written for Windows Server 2022 machines acting as license server and session host, managed from a Windows 11 workstation.

The consoles, the PowerShell module and the Group Policy paths are the same on the 2019 and 2025 releases. The procedure carries over. Only the CAL versions differ, as in the compatibility table.

Best practices for managing Windows Server 2022 CALs

It comes down to a few habits. Do this, and an audit becomes an afternoon of printing, not a month of panic.

A move to hot desks or a new shift pattern can flip the User-or-Device answer. And we’d forecast growth before the pack runs dry, not after users call.

On upgrades: servers bought from now on are often Windows Server 2025. Its CALs also cover your 2022 hosts. That makes them the safer purchase if both versions will run side by side.

Our overview of Windows Server 2025 editions and changes helps with that plan.

Technical enforcement differs between CAL types. The legal requirement doesn’t. Every base CAL and every RDS CAL in use must be owned.

Still activating the server itself? Our Windows Server 2022 activation guide covers every edition. The guide to enabling RDP on Windows Server handles the remote access side.

Browse the full range of Windows Server licenses when you plan the next upgrade.

Before an audit: a short checklist

• Invoices and license codes for every CAL pack, in one folder.
• A current export of issued RDS CALs.
• The count of AD users or managed devices, with the date.
• The licensing mode of each RDS deployment.
• A note of every Per User reassignment.
• Records of servers taken out of service.
• The name of the person who owns the license file.
• The date of the last reconciliation, written next to the totals.

Typical CAL licensing problems

Sessions stop after 120 days

Symptom: a session host works for four months with no license server, then nobody can sign in. Cause: the grace period ran out. Fix: install the licensing role, add the pack and set the mode. Sessions come back.

Licensing mode doesn’t match the CALs

Per User CALs installed, deployment set to Per Device. Devices keep getting temporary licenses until those run out. One change in the deployment properties ends it.

A 2019 CAL pack on a 2022 session host

An older CAL pack goes in for a new session host. The diagnoser reports no licenses available for that version. A 2022 pack on the same license server is accepted at once.

Reimaged thin clients draining Per Device CALs

Per Device CALs vanish week by week. Thin clients reimaged every night? Each rebuild counts as a new device. A switch to Per User stops the drain. Domain-joined hosts only, though.

Per User CALs on a workgroup server

A session host in a workgroup, with Per User CALs. The license manager can’t track them there. In Per Device mode the counts become clear.