server · reference

🖧

Remote Desktop Services (Windows Server 2025)

RDS on Windows Server 2025 — per-user vs per-device CALs, the RD Licensing role, and AVD as the cloud alternative.

← All products Licensing FAQ

On this page

Editions · channels · activation · audit notes · FAQs

Editions covered

Edition matrix with feature differences and the right audience.

In-depth sections

Channels, activation, audit, modern management & more.

FAQs answered

Common questions buyers and IT admins ask before purchase.

Words of reference

0.7k

Plain-English, no vendor agenda, updated to current Product Terms.

Edition matrix

Pick the right edition

Each edition targets a specific scale and feature set. Match the workload, not the price tag.

Edition 1

RDS User CAL

Per named user. Covers that user across any number of devices. Best for mobile workforces.

Edition 2

RDS Device CAL

Per device. Covers any user from that device. Best for shared workstations and kiosks.

Edition 3

RDS External Connector

Per server. Covers an unlimited number of external (non-employee) users connecting to that server. Specialised use cases only.

Side-by-side

Edition comparison

Heuristic capability matrix derived from each edition's intended use. For binding commitments, always confirm against the current Product Terms.

Capability	RDS User CAL	RDS Device CAL	RDS External Connector
Target audience	General	Workstation	General
Domain / Entra join	—	—	—
Virtualisation rights	—	—	—
Advanced security	—	—	—
Centralised management	—	—	—
Volume Licensing path	—	—	—

Deep dive

Remote Desktop Services (Windows Server 2025) — what to actually know

Remote Desktop Services on Windows Server 2025 lets multiple users run a Windows Server desktop or published applications concurrently from thin clients, laptops, tablets or browsers. RDS is licensed in addition to Windows Server — every RDS user or device needs both a Windows Server CAL and an RDS CAL. The 2025 release keeps the architecture stable (Connection Broker, Session Host, Gateway, Web Access, Licensing) and adds incremental improvements in protocol efficiency, GPU partitioning and Azure Arc-based management.

Per-user vs per-device — the choice that drives everything

Per-user RDS CALs roam with the identity — they are the right pick when users connect from multiple devices (a laptop, a home PC, a tablet, a phone). The RDS infrastructure does not pin the licence to any one endpoint; a single per-user CAL covers all of that user's devices. Per-device CALs are anchored to the endpoint — the better choice for shift workers sharing kiosks, training rooms, or factory-floor terminals where many people use a few stationary devices. Critically, you cannot mix per-user and per-device CALs on the same RD Session Host: pick one model per host (or per collection) and stick with it.

The RD Licensing role and the 120-day grace period

Install the Remote Desktop Licensing role on a domain member, activate it against Microsoft (online, via a web portal, or by telephone for air-gapped sites), and install the RDS CAL packs into the licence server. Each Session Host requests a licence from the licensing server on connection. Without an activated licence server, RD Session Host enters a 120-day grace period during which it serves connections; once that grace expires, no new RDS connections are accepted. The grace period exists for genuine deployment scenarios, not as a workaround — running a Session Host indefinitely in grace mode is unlicensed use.

Connection Broker, Gateway and Web Access

A production RDS deployment has more roles than just Session Host. The Connection Broker distributes user sessions across hosts in a collection and reconnects users to their existing sessions after disconnect. The RD Gateway tunnels RDP over HTTPS so that remote users can connect without a VPN, with multi-factor authentication enforced via Azure MFA NPS Extension or Entra ID. RD Web Access publishes a browser portal that lists the RemoteApp programmes and full desktops a user is entitled to. None of these support roles consume additional CALs — they are licensed under the host Windows Server.

RemoteApp vs full desktops

RemoteApp publishes a single application (Excel, a line-of-business app, a legacy Win32 client) so that it appears to run locally on the user's machine while actually executing on the Session Host. Full desktops give the user a complete server desktop with the start menu, taskbar and any installed applications. RemoteApp is the better experience for users who only need one or two apps; full desktops fit when users need the entire environment (engineering workstations, training labs, helpdesk fleets). Both are licensed identically — the CAL is the same.

RDS in Azure — AVD and Windows 365 use a different model

Azure Virtual Desktop and Windows 365 do not use RDS CALs at all. AVD is licensed via Microsoft 365 E3 / E5 / F3 / A3 / A5, Windows 10 / 11 Enterprise per-user (E3 / E5), or Windows Education per-user — any of those subscriptions includes the right to use AVD with Azure compute billed separately. Windows 365 Cloud PC is licensed per user as a single SKU that bundles the compute and storage. RDS CALs apply only when you host RD Session Hosts yourself on Windows Server, on-premises or on IaaS — including Windows Server on Azure VMs that you manage as a session host pool.

GPU partitioning and protocol improvements

Server 2025's RDS introduces GPU partitioning (GPU-P) on supported NVIDIA and AMD hardware, letting multiple sessions share a single GPU with hardware-level isolation. This dramatically reduces the cost of GPU-accelerated session hosts for CAD, GIS and AI inference workloads. The Remote Desktop Protocol gets incremental codec improvements for video and the new AV1 codec is supported end-to-end where the client also supports it, reducing bandwidth for moving content. URL redirection and clipboard policies are tighter, with new Group Policy controls for clipboard direction and file-extension allowlists.

Licensing-server topology and DR

For production estates, run at least two licence servers in the same site (the RDS role replicates licence usage between them) plus a tertiary in a DR site. Back up the RD Licensing database regularly — losing it and rebuilding the licences is a manual reconciliation with Microsoft licensing. Licences are issued per user or device and tracked in the licence server's database; per-user issuance is tracked but not strictly enforced, so accurate tracking depends on you running the RD Licensing diagnostics tool to spot over-issuance and trueing up.

By channel

Where to buy this product

Relative fit of each licensing channel for typical buyers of this product. Calibrate against your own scale and renewal strategy.

Channel fit (typical buyer)

Retail / FPP2

OEM (pre-installed only)6

Volume Licensing10

CSP / Azure8

Retail / FPPIndividuals & small teams

Boxed or ESD keys, transferable, registered to a Microsoft account.

Volume LicensingMid-market & enterprise

MAK / KMS activation, centralized VLSC, optional Software Assurance.

CSP / Microsoft 365Subscription, per user

Monthly / annual seats, managed through partner or admin center.

OEM is not a buying channel for end users. OEM keys are supplied pre-installed by hardware manufacturers and are not sold standalone — choose Retail, Volume or CSP instead.

Support timeline

Lifecycle phases to plan against

Server licensing is per-core with strict minimums, and almost every workload also needs Client Access Licences. Get the core math wrong and you either fail an audit or buy twice the licences you actually need.

Phase 1

General availability

Launch

Standard, Datacenter and (where applicable) Essentials open through Volume Licensing and CSP. Evaluation ISOs available for 180 days.

Phase 2

Mainstream support

5 years

Bug fixes, security updates, feature rollups via the Long-Term Servicing Channel cadence. Hotpatch where supported via Azure Arc.

Phase 3

Extended support

Years 5–10

Security updates only. No new features. SA-covered customers can buy ESU after year 10 for up to three more years.

Phase 4

Beyond ESU

Year 13+

No supported path. Azure offers a 'free ESU on Azure' programme to nudge migration of legacy workloads to Azure VMs.

Procurement checklist

Do this, not that

The small set of decisions that determine whether you overpay, fail an audit, or land in the right place.

Count every physical core on every populated socket, apply the 8-per-processor / 16-per-server minimum, and round up to the nearest 2-pack.

DON'T

Assume hyperthreaded logical cores reduce the licence count — they never do.

Buy User CALs when users access from multiple devices, Device CALs when shared devices have many users (call centres, shop floors).

DON'T

Mix CAL types within the same agreement without a clear split — auditors will pick the worst case for you.

Use Datacenter whenever a host runs more than ~10 Windows VMs — the break-even versus stacking Standard licences arrives quickly.

DON'T

License only the active node of a failover cluster — every node that could host the VM needs cores licensed unless SA mobility applies.

Activate Azure Hybrid Benefit on SA-covered cores to halve Azure VM cost or stack with reservations.

DON'T

Forget that AHB requires Software Assurance or a subscription — perpetual-only licences without SA are not eligible.

Typical deployments

How buyers actually use Remote Desktop Services (Windows Server 2025)

Three reference deployments — find the closest match and adapt rather than starting from zero.

Scenario 1

Single-host file & print

One Standard server licensed for all physical cores, plus Device or User CALs for everyone who reads a share or prints a job. Essentials only if you genuinely stay under 25 users and never need a second box.

Scenario 2

Hyper-V cluster (3 nodes)

Datacenter on every node, sized to the largest host's core count. Cluster-aware updating, Storage Spaces Direct optional, and live migration without licence movement headaches.

Scenario 3

RDS farm

Per-user or per-device RDS CALs in addition to the Windows Server CAL. License the broker and session hosts identically; do not forget the redundancy node.

Cost optimisation

Where the savings actually live

None of these are tricks — they are the same levers Microsoft's own licensing specialists pull on every renewal.

💰

Datacenter for dense virtualisation

On hosts running more than ~10 Windows guests, Datacenter is almost always cheaper than stacking Standard 2-OSE blocks, and it unlocks Storage Replica, S2D and shielded VMs at no extra cost.

📊

Azure Hybrid Benefit

Reuse on-prem core licences with active SA on Azure VMs for up to 180 days of dual-use during migration, then keep the discount on the Azure side indefinitely while SA is current.

🎯

Right-size CALs

Audit who actually authenticates against the server — service accounts, scanners and IoT devices often need an External Connector or Device CAL, not a User CAL.

Counterfeit & risk

Red flags when buying second-hand

These four signals show up in every counterfeit-licence case we have seen. If any of them is present, walk away — no discount makes it worthwhile.

⚠ 01

Standalone OEM key sold below market

OEM keys are distributed only pre-installed on hardware and stay bound to that device for life. A separately sold OEM key is almost certainly leaked, harvested from scrapped hardware, or fully counterfeit.

⚠ 02

Lifetime key with no invoice or VLSC record

Microsoft entitlement always leaves a paper trail — a Volume Licensing Service Center record, a CSP invoice, a sealed Retail box with a COA, or a Microsoft Store order. No proof = no defence in an audit.

⚠ 03

Key works once, then 'not genuine' after the next cumulative update

Classic symptom of a MAK key that has exceeded its activation pool, or a KMS key being abused outside its volume programme. Microsoft revokes these centrally; the activation grace period is short.

⚠ 04

Seller refuses to put the entitlement in your tenant

Legitimate CSPs and LARs transfer the licence into your Microsoft 365 / Azure / VLSC tenant under your domain. If the seller insists on activating 'for you' on their account, you do not own anything.

Acronyms

Licensing terms used on this page

Quick definitions — the full glossary lives at /en/glossary if you need to dig deeper.

CSP

Cloud Solution Provider — Microsoft's primary indirect channel for subscriptions and cloud services.

VLSC

Volume Licensing Service Center — the portal where Volume Licensing keys, agreements and downloads live.

MAK

Multiple Activation Key — a Volume Licensing key with a finite activation count, used for isolated machines.

KMS

Key Management Service — an on-premises activation host that activates clients on a 180-day re-check cycle.

Enterprise Agreement — Microsoft's largest commitment-based volume contract, typically a 3-year term with annual true-ups.

Software Assurance — the upgrade-and-benefits add-on to Volume Licensing; required for new version rights and several mobility scenarios.

Browse the full glossary →

FAQ

Frequently asked questions

Do administrators connecting via RDP need an RDS CAL?+

Up to two simultaneous administrative sessions are allowed without RDS CALs — that is the 'Remote Desktop for Administration' mode built into every Windows Server. A third concurrent admin session, or any non-admin RDP session, immediately requires the full RDS CAL stack.

Can I run RDS on a Windows 10 / 11 device?+

No. RDS is a Windows Server-only feature; client Windows is licensed for one concurrent interactive session. Tools that claim to enable multi-session RDS on Windows 10 / 11 violate the EULA — the legitimate multi-session client experience exists only on Windows 11 Enterprise multi-session via AVD or Windows 365.

How do we move from per-device to per-user CALs?+

You cannot 'convert' the licence packs directly. The practical pattern is to buy the new per-user CALs, install them on the licensing server, change the collection's licensing mode to per-user, and decommission the per-device entitlements at the next renewal. Microsoft does not credit unused per-device CALs against per-user purchases.

Where can I legitimately buy a license?+

Through Microsoft's Retail channel, an authorised Cloud Solution Provider (CSP), or a Volume Licensing partner (MPSA, Enterprise Agreement, Open Value, Server & Cloud Enrollment). OEM keys are distributed only pre-installed by hardware manufacturers and stay bound to that device for life — they are not sold to end users as standalone products. If someone offers you a standalone OEM key, treat it as a red flag: it almost always means either a leaked volume key, a counterfeit, or a key harvested from decommissioned hardware, none of which Microsoft will honour at audit time.

What gets checked in a Microsoft licensing audit?+

Auditors map every installed copy of a product to a proof of purchase (Volume Licensing Service Center record, CSP invoice, or sealed Retail packaging with the original key). They also verify edition alignment — for example that every server reporting a Datacenter feature actually carries a Datacenter license — and that CAL counts cover the maximum number of authenticated users or devices during the audit window. Soft enforcement (warnings, true-up invoices) is common for small variances; large gaps escalate to formal Software Asset Management engagements and back-billing at list price.

Other products in this category

🖥️

Windows Server 2025

Windows Server 2025 — Standard vs Datacenter, per-core licensing, CALs, virtualisation rights and Azure Hybrid Benefit.

Read reference →

⚙️

System Center 2025

System Center 2025 — SCOM, SCCM/MECM, SCVMM, DPM and Orchestrator for on-prem infrastructure management.

Read reference →

🖥️

Windows Server 2022

Windows Server 2022 — secured-core server, SMB over QUIC, hotpatching, Azure Arc integration: still the right choice for many on-prem refreshes.

Read reference →