Windows Server Standard and Datacenter are licensed by core, and every person or device that accesses the server also needs a Client Access Licence (CAL). Buy User CALs when people use several devices each. Buy Device CALs when several people share one device. CALs must be the same version as, or newer than, the server they access.
Written by the Softkeyworld technical team · Updated October 2026
CALs are the part of Windows Server licensing that people most often get wrong. A small business buys the server licence, installs it, and finds nothing in Windows asks for CALs. Standard Windows Server CALs are not technically enforced. They are a licensing obligation rather than a key you type in, and the shortfall only shows up later in an audit or a supplier review. This guide explains what a CAL covers, how to choose between user and device CALs, the version rules, the exceptions, and how to count what you need, with worked examples.
Key takeaways
- Server licence (cores) plus CALs (access) together make a correctly licensed Standard or Datacenter deployment.
- One CAL covers access to any number of licensed Windows Servers of the same or earlier version in your organisation.
- Remote Desktop Services needs RDS CALs in addition to Windows Server CALs.
- Windows Server Essentials needs no CALs, but it is capped at 25 users and 50 devices.
What a CAL is, and what it is not
A Windows Server CAL is a licence that grants a user or a device the right to access the services of a Windows Server: file shares, printing, Active Directory authentication, DHCP, DNS, a line-of-business app hosted on the server, and so on. The server licence itself, sold in core packs for Standard and Datacenter, only covers running the operating system. Microsoft's licensing guidance for Windows Server 2025 sets the core minimums at 8 core licences per physical processor and 16 per server, and requires CALs for user and device access on top of that.
A CAL is not:
- Tied to one server. A Windows Server CAL covers access to every licensed Windows Server in the organisation, as long as the versions line up (see the version rule below).
- A concurrent-connection licence. You license named users or named devices, not the number connected at the same moment.
- A Remote Desktop licence. RDS needs its own CALs on top.
- Valid for other products. SQL Server and Exchange Server have their own separate CALs.
User CAL vs Device CAL
Microsoft's CAL licensing page defines both clearly. With User CALs, you buy one for every user who accesses the server, regardless of how many devices they use. With Device CALs, you buy one for every device that accesses the server, regardless of how many people use it.
| Question | User CAL | Device CAL |
|---|---|---|
| What is licensed | A named person | A specific PC, thin client, scanner or phone |
| Best when | Staff use a laptop, phone and home PC | Shift workers share fixed workstations |
| Covers remote/home access | Yes, from any device | Only from the licensed device |
| Counting basis | Number of people | Number of devices |
| Reassignment | Permanently to a new user (for example, a leaver's replacement) | Permanently to a replacement device |
You can mix the two in the same environment. Office staff can be on User CALs while a warehouse full of shared terminals is on Device CALs. What you cannot do is leave anyone or anything uncovered: each access must be covered by either a user CAL for that person or a device CAL for that device.
A quick rule of thumb
Count your people and count your devices that touch the server, and buy the smaller number of the matching type. In modern offices, where each person typically has a laptop and a phone that both authenticate or sync with the server, User CALs almost always work out lower. Device CALs win in shift-based environments such as manufacturing, healthcare reception desks, retail tills and call centres.
The version rule
CALs permit access to servers of the same or an earlier version. In practice, the CAL version must match the newest Windows Server that users or devices connect to.
| CAL version | Can access | Cannot access |
|---|---|---|
| Windows Server 2025 CAL | 2025, 2022, 2019, 2016 | Future versions |
| Windows Server 2022 CAL | 2022, 2019, 2016 | 2025 |
| Windows Server 2019 CAL | 2019, 2016 | 2022, 2025 |
This matters when you upgrade. Adding a single Windows Server 2025 machine, even just a new domain controller, means every user or device that authenticates against it needs 2025 CALs. Plan CAL purchases as part of any server migration. With Windows Server 2016 reaching end of support in January 2027, many small businesses face this now; our Windows Server 2016 end-of-support guide covers the wider upgrade plan, and our summary of what's new in Windows Server 2025 vs 2022 helps you choose the target version.
When you do not need a CAL
Microsoft's licensing terms carve out several situations where no Windows Server CAL is required:
- Server-to-server access between licensed Windows Servers.
- Unauthenticated public access, such as anonymous visitors to a public website hosted on the server (a "web workload").
- Hyper-V hosts, where the physical installation is used only to host and manage virtual machines. Access to the VMs' services still needs CALs.
- Administrative access by up to two users or devices that access the server only to administer it.
Microsoft publishes the authoritative wording in the Product Terms and its Windows Server 2025 licensing guidance. When in doubt, check the current terms rather than relying on forum answers.
Multiplexing does not reduce CALs
If a web app, middleware or shared service account sits between your users and the server, the users behind it still need CALs. Microsoft calls this multiplexing or pooling. Routing 40 staff through one application login still means 40 User CALs, not one. This catches out businesses running a line-of-business app that authenticates everyone with a single SQL or service account.
External users: the External Connector
For authenticated users who are not your employees or on-site contractors (for example, customers logging into a portal), you can buy CALs for each of them or one External Connector licence per server. The External Connector permits unlimited external user access to that server. It is usually only worthwhile once the external user count is large.
Remote Desktop Services CALs
If users run desktops or applications on the server through Remote Desktop Services (session-based desktops or RemoteApp), each one also needs an RDS CAL, again user or device. These are additional to Windows Server CALs, not a replacement. Unlike base CALs, RDS CALs are enforced. They are installed on an RD Licensing server, and once the initial grace period (120 days) expires, connections are refused if licences are missing. Admin-mode Remote Desktop, used for up to two simultaneous administrative sessions, does not need RDS CALs.
How many CALs do you need? Worked examples
| Scenario | Count | What to buy |
|---|---|---|
| Accountancy firm: 18 staff, each with laptop and phone, one file server and one domain controller | 18 users vs 36+ devices | 18 User CALs |
| Factory: 75 workers across three shifts sharing 25 terminals | 75 users vs 25 devices | 25 Device CALs |
| Mixed: 12 office staff (multiple devices) plus 10 shared warehouse scanners | 12 users + 10 devices | 12 User CALs + 10 Device CALs |
| Same accountancy firm adds a Remote Desktop server for 8 remote staff | 8 RDS users | 18 User CALs + 8 RDS User CALs |
| Public website on IIS, no logins | Anonymous visitors | No CALs for visitors |
To count accurately, start from Active Directory. Run Get-ADUser -Filter 'Enabled -eq $true' | Measure-Object in PowerShell on a domain controller for enabled user accounts. Then subtract service accounts and disabled leavers, and remember that some genuine users, such as contractors, may not have AD accounts. Keep the calculation, invoices and licence documents together in your records; this is what an auditor or Microsoft partner will ask for.
CALs, virtual machines and Standard vs Datacenter
The edition you choose changes how many virtual machines you may run, not how many CALs you need. Standard licenses two operating system environments per fully licensed server, and Datacenter allows unlimited. CALs, by contrast, are counted per user or device across the whole organisation. Ten staff accessing five VMs on one Datacenter host need ten User CALs, exactly the same as ten staff accessing one physical Standard server. The edition decision is about virtualisation density; our Windows Server 2022 Standard vs Datacenter comparison explains that trade-off.
Common CAL mistakes we see
- Buying CALs for the old version during an upgrade. If a 2025 domain controller is going in, 2019 or 2022 CALs no longer cover the users authenticating against it.
- Forgetting non-PC devices. With Device CALs, networked scanners, handheld terminals and thin clients that authenticate or use server services all count.
- Assuming RDS CALs include the base CAL. Remote Desktop users need both.
- Counting only "people who log in daily". Part-time staff, seasonal workers and contractors with accounts count too.
- Not keeping records. Because base CALs are not entered into Windows, the invoice and licence documentation are your only proof of compliance.
A sensible habit is to review the count once a year, or whenever headcount changes significantly. Reassign CALs from leavers to their replacements rather than buying new ones.
Where Windows Server Essentials fits
For very small organisations, Essentials removes the CAL question entirely. It needs no CALs, but it is limited to 25 user accounts and 50 devices, and to a single-processor server with up to 10 cores. Windows Server 2025 Essentials is available only through OEMs, preinstalled on new servers. Earlier releases such as Windows Server 2022 Essentials are still widely used by small offices. If you expect to grow beyond 25 users, start on Standard with CALs, because migrating later is more disruptive. Essentials also lacks some features of Standard, so check that the roles you need are supported before choosing it on cost alone. If you start on Essentials and later outgrow it, you move to Standard and buy CALs for every user or device at that point.
Frequently asked questions
Do I need CALs for Windows Server 2025 Standard?
Yes. Standard and Datacenter both require a Windows Server 2025 CAL for every user or device that accesses the server, in addition to the core licences.
Can I use Windows Server 2019 CALs with a 2022 or 2025 server?
No. CALs only cover servers of the same or an earlier version. 2019 CALs are valid for Windows Server 2019 and 2016 servers.
Are Windows Server CALs installed on the server?
Standard Windows Server CALs are not entered or enforced in Windows. You keep proof of purchase for compliance. RDS CALs are different: they are installed on an RD Licensing server and enforced.
Can I mix User and Device CALs?
Yes. Many organisations use User CALs for office staff and Device CALs for shared terminals, as long as every access is covered by one or the other.
Does one CAL cover multiple servers?
Yes. A Windows Server CAL lets that user or device access any licensed Windows Server of the same or an earlier version in your organisation.
Do I need CALs if users only connect through a web app?
If they authenticate, yes. Multiplexing through an app or a shared account does not reduce the number of CALs needed. Only unauthenticated public access is exempt.
Our recommendation
Decide your target server version first, then count users and devices and buy CALs of that version. For a new deployment, Windows Server 2025 Standard is the current release and pairs with 2025 CALs. If you are maintaining an existing Windows Server 2019 environment, Windows Server 2019 User CALs cover access to 2019 and 2016 servers, and our Windows Server 2019 CAL guide explains the setup steps. If you are unsure how to count, email support@softkeyworld.com with your user and device numbers, and we will help you check them.
View Windows Server 2025 Standard
Related reading
| Resource | Why read it |
|---|---|
| Windows Server 2016 end of support | Plan the upgrade that triggers new CALs |
| Windows Server 2025 vs 2022 | Choose your target server version |
| Windows Server 2019 CAL guide | Set up CALs in a 2019 environment |