Windows Server RDS CAL: Does a service account connecting via RDP back to the same server (localhost) require a CAL?

Question

Windows Server RDS CAL: Does a service account connecting via RDP back to the same server (localhost) require a CAL?

A.I. Pro 0

Service: Windows Server Remote Desktop Services (RDS) Licensing

Our software creates a single Windows service account on the

customer's Windows Server. That service account is used exclusively

by our Windows system service to establish an RDP session back to

the same server (localhost). The user account is not used by a human.

The RDP session exists solely to provide the Windows desktop GUI

required for our application to operate.

Our planned deployment model:

Enable the 120-day RDS licensing grace period at installation
If the customer purchases our software, we require them to purchase one RDS CAL before the grace period expires
That CAL is assigned to their Windows Server for use by our service account so the software continues to operate

Question:

Does this use case — a single service account connecting via RDP

to localhost (same server), used only by a software service with

no human interaction — require one RDS User CAL or Device CAL

to remain properly licensed after the 120-day grace period?

Confirmation needed:

We need written confirmation of the correct CAL type and quantity

required per server for this specific deployment model.

0 comments

1 answer

Your answer

Answer 1

Hi A.I. Pro,

Your deployment model strictly requires a Client Access License because Microsoft licensing terms mandate that any connection leveraging Remote Desktop Services for application operation requires a CAL. While Windows Server natively permits two concurrent RDP sessions without an RDS CAL, this exemption is legally restricted to server administration only. Because your automated service account uses the RDP session to render a desktop GUI for application functionality, Microsoft's multiplexing and automated access rules apply. You must purchase and assign a dedicated RDS CAL before the 120-day grace period expires. Attempting to bypass this limitation by improperly deleting the GracePeriod key located in the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\GracePeriod is a direct violation of Microsoft licensing agreements and will leave the system in an unsupported state.

The decision between a Per User and a Per Device CAL depends entirely on the customer's directory infrastructure. If the customer operates your software on a standalone server within a Workgroup rather than an Active Directory domain, you must instruct them to purchase a Per Device CAL. The Remote Desktop Licensing server architecture cannot track user license assignments without Active Directory. If you attempt to force a Per User configuration in a Workgroup, the system will log Event ID 4105 in the Event Viewer and eventually block the connection. To ensure the correct licensing mode is applied, administrators can navigate to the registry path HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\Licensing Core and verify the LicensingMode value is set to 2 for Per Device, rather than 4 for Per User. Since your service connects via a localhost loopback, the server itself acts as the client device, meaning a single Per Device CAL will successfully assign to the local hardware and keep your software compliant and operational.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN