Client access license

A Client Access License ("CAL") is a software license distributed by software companies to allow clients to connect to its server software and use the software's services.

Software licensing introduction

Main article: Software license

Most commercial software is licensed to end users or businesses. In a legally binding agreement between the proprietor of the software (the "licensor") and the end user or organization (the "licensee"), the licensor gives permission to the licensee to use the software under certain limitations, which are set forth in the license agreement. Microsoft usually has notices on the packaging of their products which state that removing the notice or using the software constitutes agreement of the license terms.

Microsoft's consumer retail or "off-the-shelf" products generally use very similar licences, allowing the licensee to use the software on one computer, subject to the usual terms and conditions. For businesses however, Microsoft offers several types of licensing schemes for a range of their products, which are designed to be cost effective, flexible, or both.

Server software, such as Windows Server 2003 and SQL Server 2005 require licenses that are more expensive than those which are purchased for desktop software like Windows Vista. In the more recent versions of many of their server products, Microsoft require that all clients that connect to these server applications have a license to connect to and use the services of that software. These special purpose licenses come in the form of a Client Access License.

Client access licenses

A Client Access License legally permits client computers to connect to Microsoft server software. They usually come in the form of a certificate of authenticity (CoA) and a license key, which is sometimes attached to the certificate itself. The various editions of most of Microsoft's server software usually include a small number of CALs, and this allows the software to be used by either a few users or a few computers, depending on the CAL licensing mode. If more connections to the server are needed, then additional CALs must be purchased.

Some Microsoft Server products require one CAL per concurrent connection, whereby one CAL is required for each unique client connection at any point in time. For example, consider a small business network where the computers are used by ten people, but there are never more than five people on site using the computers at any one time. In this scenario, only five CALs are needed. However, some of Microsoft's products and licensing modes require a CAL for each unique client regardless of how many will be connecting at any single point in time. Some of Microsoft's server software programs do not require CALs at all, as is the case of Windows Server Web Edition.

Some CALs, however, are electronically enforced: the server will refuse to service clients if there are not enough CALs to cover them all. In order for the CALs to be used, either the CAL files must be imported into the software or the CAL licence keys must be entered in. The software will not service clients unless there are valid CALs installed, and it will authenticate and serve the number of clients licensed under the CALs. Once that number is met, the server can either accept a small number of additional connections and then warn administrators before refusing to serve further connections, however usually it will simply refuse to authenticate additional clients until one or more of them disconnects. In this way, the server electronically enforces the Client Access licensing.

At present, there are only two Microsoft products that use this form of electronic license enforcement; Windows Small Business Server 2003 and Terminal Services. Presumably, the electronic enforcement in SBS is because most small businesses that run the Small Business Server do not have dedicated IT staff to ensure compliance, whereas larger organizations usually have dedicated IT staff that monitor CAL usage and organize the acquisition of additional CALs when necessary. Windows Small Business Server 2008 does not track CAL usage.

Per-user vs. per-device

CALs apply to either a "device" (as defined in the license agreement) or a "user". A business is free to choose either mode. In Per-User mode, a CAL is purchased to allow one user to connect to the server software. Any user can connect, but only one user may use a given CAL at any given time. Any number of CALs can be purchased to allow five, five hundred, or any number of users to simultaneously connect to the server. Any number of devices may connect to the server software, but only a set number of users can connect to it at once.

Per-device mode operates in much the same way, but limits connections made by devices, rather than users. One CAL enables one device to connect to and use the server software, regardless of how many users are connecting.

Although User and Device CALs are currently the same price, they may not be used interchangeably, and cannot be switched without buying new CALs. The price of User CALs is due to increase from December 2012 (in the UK), although the device CAL remains the same.

Much more in-depth information can be found on Microsoft's CAL Guide website.

Combined schemes

The Core CAL is a special CAL offered by Microsoft through corporate license agreements such as Enterprise, Select or Open Value. The Core CAL, is a combination of client access licenses for Windows Server, Exchange Server, SharePoint Server, System Center Configuration Client Management License, Lync Server and Forefront Endpoint Subscription License. Core CALs are approximately 30 percent cheaper than the sum of the aforementioned licenses.

With the release of the 2007 products, Microsoft started offering the Enterprise CAL Suite. The Enterprise CAL Suite combines 15 CALs, including the Core CAL combination, Enterprise functionality of Exchange, Lync and SharePoint Servers, as well as System Center Data Protection Manager, Operation Manager and Service Manager Client Management Licences. As for the Core CALs, Entreprise CALs are only available through Open, Entreprise or Select agreements.

Software editions

CALs usually enable connectivity to server software regardless of the edition of the software. For example, CALs purchased to enable client connectivity with Windows Server 2003 Enterprise Edition can be used with Windows Server 2003 Datacenter Edition. However, backwards compatibility is generally assured. For example, Windows Server 2012 CALs can not only be used to access servers running on Windows Server 2012, but they can be used to access one of the servers running Windows Server 2008, Windows Server 2008 R2, Windows Server 2003 and any previous versions at any given time.

Terminal Services

Terminal Services is a function of Microsoft Windows that allows several types of connections to the server components of the system. Windows Server versions prior to 2003 do not necessarily require the use of specialized Terminal Services CALs; rather, clients which are of at least the same or lower version of the operating system are allowed access automatically. For example, Windows NT 4.0 clients may connect to Windows NT 4.0 terminal servers but not Windows 2000 or later; Windows 2000 or Windows XP clients may connect to Windows NT 4.0 or Windows 2000 terminal servers. This is called the equivalency license.

The system for enforcing the number of TS Cals ("Microsoft Enforced Licensing") used on versions later than NT was abused by the "FLAME" malware, leading to a patch in 2012 restricting the Certificate Creation system used for Terminal Services.

The number of per-user TS CALS on Windows 2008 is not enforced: supposedly, this was because Microsoft did not have time to finalize technical enforcement before the release of the operating system.

See also

• Copyright

Further reading

• Understanding Microsoft CALs and External Connector Licenses (Part 1), Network World, 2010.