Remote Desktop Licensing

Remote Desktop Licensing Deploying RDS for MSP’s and SPLA September 2017 Lighthouse Media, LLC

Disclosure: This information herein is informational purposes only. For full use rights please read the Product Terms, Service Provider Use Rights, and any other official licensing documentation for confirmation and compliance guidance. Although our team updates our guides, publishers can change their licensing rules at any time. Lighthouse Media MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS DOCUMENT. 2017 Lighthouse Media, LLC. All rights reserved. Lighthouse Media, LLC

The two products commonly underreported are SQL and Remote Desktop Services (RDS). SQL is what increases the cost of the audit simply because it is the most expensive product in the Microsoft portfolio. RDS, is simply misunderstood. In this article, we will take the complexity of RDS licensing and make it simple. Understanding the Licensing in SPLA RDS (FKA Terminal Services) is a user based (SAL). Each user that has access to the software directly and indirectly would need a Subscriber Access License (SAL). In conjunction with Windows Server (you cannot deploy RDS without Windows), RDS is used to deploy desktop applications, VDI, and other non-web based deployments. According to Microsoft’s volume Licensing Brief titled: Licensing Windows Server 2012 R2 Remote Desktop Services and Microsoft Desktop Applications for Use with RDS “Remote Desktop Services functionality is defined as those features or services that are running when enabling the Remote Desktop Services role and/or role service(s) in Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012 R2. This includes, but is not limited to, Remote Desktop Gateway, Remote Desktop Web Access, Remote Desktop Connection Broker, Remote Desktop Session Host, and Remote Desktop Virtualization Host.” The same is true for Windows Server 2016 (the article was written in 2014). Why so much confusion with licensing? The confusion is indirect access, demo accounts, test accounts, and generic accounts. There’s also confusion when deploying third-party applications such as Citrix. In this next section, let’s go over a few scenarios that will help solve your RDS licensing needs. Scenario 1 In this example, an end customer would like a service provider to host a desktop session using their own virtual desktop licenses. Let’s say the end customer is a factory with many shift workers (150 employees) that use dummy terminals to access company’s information. The customer would like to outsource a VDI solution using the licenses they just purchased. What they purchased They just purchased 150 VDA subscription licenses. VDA stands for Virtual Desktop Access and is used when the underlying device (such as a dummy terminal) does not have a qualified OS installed. What they need They can purchase 150 RDS device licenses (with or without Software Assurance) through their own volume licensing agreement or they can use the service provider’s RDS licenses through their SPLA. Lighthouse Media, LLC

What is required from the service provider? The service provider must do the following: 1. Have an active SPLA and report all server software used to support the hosted solution including Windows Server and RDS. 2. Have language in their agreement regarding customer owned licensing to cover off compliance risk. In other words, they should have a statement saying they are responsible for everything under their Microsoft agreement, but the service provider is responsible for anything under theirs. Make sure the customer is aware that VDA is a subscription license through volume licensing and RDS is a subscription through SPLA. If they don’t renew either one, they are out of compliant. 3. Report RDS SAL licenses in SPLA. Why RDS is required? According to the Commercial Licensing Brief – “Licensing Windows Server Remote Desktop Services and Microsoft desktop applications for use with RDS” guide, Server RDS CAL for each user or device that (i) directly or indirectly accesses any of the RDS functionality and/or (ii) directly or indirectly accesses the server software to interact with a graphical user interface (GUI) using RDS functionality or any other third-party technology.” In this example, the user is interacting with a graphical user interface. 4. The service provider must dedicate the entire infrastructure for that customer. For more information, please read our DaaS white paper. Scenario 2 VDI with Windows Server In this example, an end customer would like a service provider to host a desktop session but does not own any licensing. Let’s say the end customer is a small insurance firm with very little IT budget. Most business is conducted in the office with full internet access. They do not have a datacenter nor do they have plans to build one. Most of the computers are outdated and could use a refresh, they just don’t have the funds to do so. The customer a VDI solution without having to purchase and understand the complexities of the licensing. They also want the cheapest solution possible since the latest and greatest is not a top priority. What they need In this example, the customer just wants things to work without having to upgrade anything. In this scenario, one could argue a hosted desktop would make sense using Windows Server and RDS. The service provider can do the following to lower costs 1. Offer a virtual desktop using Windows Server and RDS. Why RDS? Again, they would be hosting a GUI interface which would require a RDS license for each user. 2. Windows Server – You cannot deploy RDS without Windows. 3. Host in a multitenant shared infrastructure. This would lower costs for the end customer (as oppose to an end customer VDI solution which would require isolated hardware). 4. Make sure the end customer knows and understands this is not a virtual desktop using a client OS but rather Windows Server. This is important as Microsoft consistently looks for organizations that promote Windows 10 without A) being QMH authorized and 2) offering lower costs which is viewed as a shared environment. Lighthouse Media, LLC

Scenario 3 Office with RDS In this example, an end customer would like a service provider to host their own application that uses Office. What they need This example is pretty straightforward, the service provider could provide Office through SPLA and host it in a multitenant environment. In this scenario, the service provider will report Office by SAL, Windows Server by core, and RDS by SAL. Why RDS? Again, they remotely accessing an application. If it was a web application (as an example) they could get away without licensing RDS because they are accessing through a browser, not remote access. A common mistake service provider make is reporting more Office licenses than RDS licenses. You should never have more Office than RDS; they should always match. On page 8 of the June 2017 SPUR states: “The delivery of a Desktop Application, such as Office, that is used by providing direct or indirect access to the server software that hosts the graphical user interface, such as Windows Server (using the Windows Server Remote Desktop Services functionality or other technology) requires a Windows Server Remote Desktop Services SAL.” Scenario 4 RDS using AWS Many service providers and/or end customers would like to outsource their datacenter environment to a third-party such as Azure or AWS. When deploying in a third-party datacenter, the service provider could purchase a Windows instance from the datacenter provider – which covers the Windows Server, and they would be report RDS licenses through SPLA if they are hosting for their end customers. The end customer could also purchase RDS with SA and use license mobility to transfer their licenses over to the datacenter provider. Please read our whitepaper on hybrid licensing to learn more. Below is how the licensing works in this scenario: Using AWS SPLA and Service Provider’s SPLA AWS Service Provider End Customer Datacenter Provider who provides Windows thru their own SPLA Agreement Provides RDS thru their SPLA and is contracted w/AWS Pays the Service Provider for all the licensing In the above analysis, there are two SPLA’s in play. AWS has their own SPLA and the service provider has theirs. Under the SPLA agreement, the SPLA provider must be able to track access to the server software. In this example, the customer is paying for a shared environment thru AWS and therefore, only AWS knows exactly how many cores are on the physical hardware. User licensing can be tracked individually, and can be reported through a third-party SPLA agreement. Lighthouse Media, LLC

Using AWS to supply all the licensing for end customer AWS Service Provider End Customer Datacenter Provider who provides Windows and RDS thru their own SPLA Agreement Acts as a Managed Service Provider Contracted with AWS and Service Provider to manage solution In the above analysis, AWS is reporting everything thru their own SPLA agreement. In this example, the service provider is more a managed service provider who will help their end customer deploy and manage their AWS environment. Using AWS SPLA and end customer’s own RDS licensing AWS Datacenter Provider who provides Windows thru their own SPLA Agreement Service Provider End Customer Acts as a Managed Service Provider Purchased RDS with Software Assurance and leverages license mobility In the above analysis, AWS is reporting Windows thru their SPLA agreement, but the end customer is providing their own licensing thru license mobility. The end customer must have software assurance for this to be applicable. Scenario 5 RDS used for Demonstration Purposes We get asked a lot about providing access for demonstration purposes. According to the 2017 SPLA Indirect Agreement (page 6 section F) allows a SPLA provider to demonstrate their solution (including RDS) to up to 50 active user ID’s for demonstration purposes. They can also provide a trial for up to 60 days for evaluation purposes (SPLA Indirect 2017 section G). Many customers do not take advantage of this use right. There are restrictions (i.e. you cannot charge for access during this period and keep active records). In addition, you are allowed up to 20 administrators per datacenter to access the server software. My recommendation is to ensure you label “admin” in active directory in case of an audit. Conclusion As mentioned at the beginning of this document, RDS is one of the most underreported products in SPLA and even Volume Licensing (thankfully it is one of the most least expensive). Make sure to pay attention to the specific use rights for both programs. There are also additional use rights we didn’t review in detail but I encourage you to understand. As an example, if an organization has external users (your customercustomer’s) they may require an external connector license if you host end-customer licenses. If you have additional questions, use our forum and our team of experts will do our best to answer. Lighthouse Media, LLC

Things to remember: 1. Review the demonstration and evaluation guidelines in your SPLA agreement. 2. Make sure you have specific language in your agreement if you have end customer licenses in your datacenter. 3. If you leverage a third-party datacenter to host your solution, ask if it is dedicated or shared? 4. Office licenses and RDS licenses should match. 5. If you offer Windows Server and RDS to deploy a VDI solution, make sure to advertise as such. 6. To activate RDS, you must enter your SPLA agreement number not a license key. This is the most important part! Lighthouse Media, LLC

Resources and References Microsoft Volume Licensing Brief - Licensing Windows Server 2012 R2 RDS and Microsoft desktop applications for use with RDS Azure FAQ Guide - g-faq/ AWS License Mobility - bility/ Microsoft SPUR - licensing/products.aspx Lighthouse Media, LLC

deploy RDS without Windows), RDS is used to deploy desktop applications, VDI, and other non-web based deployments. According to Microsoft's volume Licensing Brief titled: Licensing Windows Server 2012 R2 Remote Desktop Services and Microsoft Desktop Applications for Use with RDS "Remote Desktop Services functionality is