User vs device Cals vs real world

Forums › IT Pro and developers › User vs device Cals vs real world

1101

3141 posts

Uber Geek
+1 received by user: 1143

#267855 14-Feb-2020 13:02

Real world question .

User cals vs device cals, what do you buy for workstations ? and why ?

Device Cals : Ive been told by someone involved with MS Auditing that Cals are required for every device that connects to the server , even if just for DHCP or DNS
So IP phones , printers , Cellphones(DHCP ) all need a cal , either device cal or via the user cal

To what extent (real world) are device cal requirements simply ignored , being so over the top ?
Are device cal requirements pickup up during a MS Audit ?

nztim

4012 posts

Uber Geek
+1 received by user: 2710

ID Verified

Trusted

TEAMnetwork

Subscriber

#2420985 14-Feb-2020 13:13

Almost ALWAYS I go user CAL

A device CAL means they that each device on the network accessing resources on the server (which would Include IP phones etc if the server acted as a firewall) requires a CAL

Now days most users have 2-3 devices (sometimes more) so user CAL makes the most sense, that is based on how many Humans you have in your organisation

TBH the only place device cal makes sense is call centres or or organisations with shift workers, and the like were multiple users access the same device

Any views expressed on these forums are my own and don't necessarily reflect those of my employer.

fearandloathing

537 posts

Ultimate Geek
+1 received by user: 206

ID Verified

Lifetime subscriber

#2420997 14-Feb-2020 14:09

Microsoft:

CALs are required for every user or device accessing a server.

https://www.microsoft.com/en-us/licensing/product-licensing/windows-server

That means DNS and DHCP, I'm not aware of anyone ever having their DNS server audited for licenses.

So you would likely require a mix of CALs for users (people) and devices (Printer using DHCP, Scan to email, etc).

In my experience, CALs are heavily overlooked for SQL and server CALs and are not a consideration until they are audited.

e.g. People have 2012 CALs, upgrade their servers to 2019 or provision a new 2019 but fail to upgrade their 2012 CALs to 2019 CALs.

We now typically recommend purchasing Office 365 e3 licenses for user CALs

http://download.microsoft.com/download/8/7/7/877B1713-671E-43AA-BB79-AF8478C64AFF/Licensing-Microsoft-365.pdf

This will cover most of your user CALs, speak to your CSP or LAR to clarify what licenses are covered, I can't find the document, but it covers most of them.

BlakJak

1329 posts

Uber Geek
+1 received by user: 735

Trusted

#2433390 5-Mar-2020 21:12

Google gave me the following quote which might explain the CAL thing just a little bit more:

"I skimmed a bit, but if the computer is not a domain member and is not authenticating to a Windows server in any way, a CAL is not required. A CAL is required by a client if it has to authenticate to the Windows server in some way."

I've never worked on the assumption that an external client talking to a service like DNS would require a CAL.

No signature to see here, move along...

lxsw20

3689 posts

Uber Geek
+1 received by user: 2174

Subscriber

#2433457 6-Mar-2020 01:25

If you talk to 3 different MS licensing experts expect 3 different answers. IIRC that DNS/DHCP applies if you're using Windows server to provide those services but I'm probably wrong, or others probably understand it differently.

User CALs have always seemed the easier option to me.

1101

3141 posts

Uber Geek
+1 received by user: 1143

#2433500 6-Mar-2020 09:07

BlakJak:

Google gave me the following quote which might explain the CAL thing just a little bit more:

"I skimmed a bit, but if the computer is not a domain member and is not authenticating to a Windows server in any way, a CAL is not required. A CAL is required by a client if it has to authenticate to the Windows server in some way."

I've never worked on the assumption that an external client talking to a service like DNS would require a CAL.

unfortunately , and this is info is from someone involved in MS's auditing of businesses
If the computer or other device gets DNS or DHCP from the server, it requires a CAL .
If the computer accesses any shares on the server , it requires a CAL .

But ,and this is info I didnt know untill now (The reference on MS's site is now a dead link unfortunately)
"The one caveat is, if your users who use the printer have CALs then the printer is covered by their use via their CALs"
So printers IP phones etc are covered by the user's CAL .

but , (no official link so could be wrong)
"If a non-SBS user can print to the shared printer, you'll want a device CAL."

what a confusing mess. :-(
The one positive is Server Essentials includes enough CALs .

nztim

4012 posts

Uber Geek
+1 received by user: 2710

ID Verified

Trusted

TEAMnetwork

Subscriber

#2433532 6-Mar-2020 10:16

lxsw20:

If you talk to 3 different MS licensing experts expect 3 different answers. IIRC that DNS/DHCP applies if you're using Windows server to provide those services but I'm probably wrong, or others probably understand it differently.

User CALs have always seemed the easier option to me.

The only place you would EVER use device CAL would be a call centre where the number of devices is less that the number of users

Any views expressed on these forums are my own and don't necessarily reflect those of my employer.

Geekzone

Want to support Geekzone and browse the site without the ads? Subscribe to Geekzone now (monthly, annual and lifetime options).

dfnt

1553 posts

Uber Geek
+1 received by user: 1036

Trusted

Lifetime subscriber

#2433584 6-Mar-2020 11:44

We always try to go with user cals for our Citrix deployments

Device cals are a nightmare, especially with remote access peoples home devices consume device cals as well