Disclaimer

This discussion applies to both Microsoft Windows Server 2003 and also Microsoft Windows Small Business Server 2003 licensing and may or may not apply to other Microsoft products.  Quark IT is not privy to any information other than the Microsoft Licensing agreements published on the Microsoft website and the EULAs (End User Licensing Agreements) that come with all Microsoft software and hardware.  We are also not lawyers and the following discussion should therefore not be interpreted as legal nor financial advice.  Think of it more as a fairy tale...

Introduction To Client Access Licenses

A Client Access License (CAL) is really a piece of paper that gives you rights to access something.  As far as servers go, a CAL is the right to access the server - you need to have separately licensed the server oerating system and the client operating system.  In the Microsoft world, this means that you need to buy Windows Server 2003 or Windows Small Business Server 2003 (from now on known as SBS2003) as the server operating system (OS) and Windows XP as the client or workstation OS.  Neither the purchase of the Server OS nor the Workstation OS gives you the right to connect to the server from any machine other than the server - basically, without CALs, the server can serve only its own simple needs.  You can buy a bundle that has the Server OS and some CALs in it, but these are separate components of the bundle.

To clarify, a CAL isn't a piece of software and no Microsoft server nor client operating system license includes Windows Server CALs per se, although you may buy a bundle with both the server OS and CALs.

How CALs Are Assigned

Microsoft basically assigns a CAL to a bag.  This bag can contain meat (in the case of User CALs) or a machinery (in the case of Device CALs).  You can mix and match User CALs and Device CALs on the one network, but when you buy CALs you buy either a User CAL or a Device CAL and that particular CAL cannot change its colors.  You can use 5 Device CALs in the warehouse for you 12 warehouse staff and 15 User CALs in the office for your 15 office staff, but to do this you must have purchased 5 Device CALs and 15 User CALs.

Reader Participation Time

OK everybody, can you all stand up.  Great.  Now, here's where we split into two groups to hand out "assignment tools"- those who don't mind getting their hands dirty need to get a pneumatic nail gun and those who don't like too much blood will be given a roll of gaffer tape (it sticks WAY better than masking tape or cellotape).  Everyone also needs a pad of sticky notes.  Now, keep this with you at all times for the rest of the discussion as you're going to need it.  You can now sit back down with your "assignment tool" of choice.

User CALs

A User CAL, as suggested by its name, is assigned to a user.  There's no big revelation there.  People try to read all sorts of things into what Microsoft means by user, but the best definition is "a bag of meat that needs to authenticate to your Server".  User CALs are used where a particular "bag of meat" access your network from more than one device - for example, any combination of their workstation, laptop, smartphone, pda and checking their email using Outlook Web Access from home.  (If you allow anyone to access your network from an Internet Cafe, now is the time to put down your "assignment tool", walk to the boss' office and resign.)

It is really easy to assign a User CAL - look out the door and ask the closest person who requires a User CAL to come in and help you with this exercise for a second.  Write "User" on a sticky note and place it on this person's forehead.  Now, as we all know the oils naturally present in our skin will cause this sticky note to fall off in a few seconds, so here's where our "assignment tool" comes in handy.  Once you've done that, you have assigned your first User CAL.  All you now need to do is to walk around the rest of the office (or offices) and assign User CALs to those people needing them.  Don't forget to keep count of the number you have used.

Device CALs

A Device CAL, again as suggested by its name, is assigned to (all at once) a device.  People try to imagine Microsoft doing all sorts of unimaginable things to the English language here, but quite simply a device is "a bag of machinery that needs to authenticate to your Server".  Device CALs are used where a particular "bag of machinery" is accessed by a number of "bags of meat" that don't have sticky notes affixed to their foreheads - for example, a nurse station, the goods inward terminal in a warehouse or the computers located in the sales office hotdesking area.

It is a lot less fun to assign Device CALs as all you have to do is to walk around the business using your "assignment tool" to affix sticky notes to the "bags of machinery" (including workstations, thin terminals, PDAs and smartphones but excluding pens, paper, LCD displays, mice, keyboards, printers and the vacuum cleaner) that are accessed by non-sticky-noted "bags of meat".

When To Assign User Or Device CALs

A simple rule of thumb is to buy and assign User CALs all the time unless Device CALs will save you a tidy sum of money.  This allows your staff ("bags of meat") to access the network resources from wherever they need (as long as those places are not public access terminals such as Internet Cafes as they are unsafe, to say the least).  Device CALs are quite suited to workshops, warehouses, nurse stations and similar locations where numerous "bags of meat" will access the "bag of machinery" during the normal course of business.

Remember that if a "bag of meat" without a sticky note on their forehead who is accessing a "bag of machinery" with a sticky note on it decides to buy (or is assigned) a PDA to use whilst out of the office, this PDA will need a Device CAL assigned to it.  Again, this is why it is better to use User CALs where possible.

What Happens If The Nail Hit Something Important?

In the unfortunate situation where the affixing of the sticky note caused irreparable damage to the particular bag in question, then that bag's CAL can be assigned elsewhere.  If a "bag of meat" who is assigned a User CAL chooses to move to another employer, then that User CAL can be placed back into the pool and assigned to the "bag of meat" that replaces the original "bag of meat".  You cannot reassign User CALs on a willy nilly basis to try and avoid buying adequate CALs.

As for Device CALs, these can only be reassigned on a temporary basis if a particular "bag of machinery" is away for repair.  They can be reassigned permanently if a particular "bag of machinery" has been retired or replaced.  Again, you cannot keep reassigning Device CALs to try and avoid buying adequate CALs.

But We Run Two Shifts So We Can Reuse User CALs

No, you can't.  This is called "concurrent licensing" and Microsoft does not support this any longer.  As I have said, a User CAL is nailed to the forehead of a particular "bag of meat" and the likelihood that a nail long enough to connect two foreheads leaves the owner of the first forehead in a state whereby they can perform useful work is rather unlikely.  Microsoft won't support you anyway and you will be running unlicensed (that's spelled P I R A T E D) software.

OK, So I Have One User Logging In As Bob, Sales And Accounts

I hope he gets paid well!

Aside from that, if he has a sticky note nailed to his forehead, he's perfectly allowed to do this with the use of a single User CAL.  Alternatively, if he's using a "bag of machinery" that has a sticky note nailed to it and never needs to access the network from his home or PDA, then the Device CAL assigned to the "bag of machinery" he uses allows him to legally log in with as many names as he so chooses, as well as allowing someone else to use that "bag of machinery" if they need to.

So, What About Distribution Groups And Exchange Contacts

As none of these are "bags of meat" neither "bags of machinery" and as none of these actually authenticate to the Server, then none of these need a CAL.  In other words, you can have as many Distribution Lists and Exchange Contacts as you like regardless of the number of CALs you own.