Use of CALs at VPN connected Site


  • Dear All,

    we have 2 Sites Site A and Site B both are connected with VPN with same domain.

    Site A (50 Users are there with 50 Server 2012 Device CALs) have a Server 2012 with Primary Domain Controller and File Server roles.


    VPN Connection


    Site B (25 Users are there with 25 Server 2008 Device CALs) have a Server 2008 R2 with Secondary/Additional Domain Controller and File Server roles.

    Question:- Should i purchase 25 Server 2012 Device CALs for Site B because primary domain controller having Server 2012 at VPN connected Site A OR 25 Server 2008 CALs are OK for Site B?????????? 


    Friday, March 15, 2013 3:02 AM


  • A couple of things to know.

    1. Most of the time, you'll have downgrade rights.  In your specific case, Server 2012 CALs have downgrade rights (although you don't really need downgrade rights in your scenario).
    2. You only need a single CAL for each user or device for connecting to a Windows Server (in other words, you won't need to purchase a new CAL every time you deploy a server such as a domain controller).  Quoting from Microsoft's 2008 R2 licensing guide:  "The number of Windows CALs required equals the number of users or devices accessing the server software (the number of servers accessed does not matter)".  You should check out the guide as it contains some important details and specific scenarios to help people understand licensing.
    3. In the scenario you described, a user CAL would be the right choice (more cost effective than a device CAL which is better suited when you have multiple people sharing a computer).  So you may want to check your CAL type and adjust as needed.

    Looking at the situation, if users from Site B access the 2012 DC at Site A, then they need a 2012 CAL for that.  The same 2012 CAL can be used to access the existing 2008 R2 server and any other Windows Servers in the environment (exceptions apply, but we are strictly talking about Windows access... not applications).  Some might say that you could configure the environment in such a way that Site B users/computers never contact the 2012 DC at Site A... but that wouldn't be worth the time in my opinion.  I'd opt for the 2012 CALs across the board (knowing that you'll likely be using 2012 at Site B in the near future anyway).


    Friday, March 15, 2013 3:56 AM