Remote Desktop Services (RDS) is a potential Achilles heelfor service providers.  While not overlycomplicated, RDS is the most reported product (outside of Windows and SQL) forservice providers and end-customers alike. I will provide an example of a service provider who has accidentallyunder-licensed RDS in this article. These cases highlight the seriousconsequences of under-licensing.   Don’tbe these guys!

 

Example

Small hosting company that provides desktops as a serviceusing Windows Server and RDS from their data center.  They have roughly 300 users each monthaccessing RDS.  Their customer informsthe hosting company how many users they have, and they bill themaccordingly.  They base their licensingnot on who has access but on what they invoice their customers for every month.  They did this for several years until theyreceived an audit notification.  

Since the hosting company had no way of tracking the users,the auditors informed them to run a script to understand everything installedon their network and the users in their active directory.  They quickly discovered that they weresignificantly underreporting RDS based on indirect access.  They only reported users in the organizationthat used the application during a specific month.  Not once did they disable users or havesecurity policies restricting access.   As it turns out, over 50 additional usersshould have been licensed each month. During an audit, Microsoft will look back a total of 3-5 years!  Fifty users a month times thirty-six months(3 years) is A LOT of RDS licenses owed.

What they should have done:

1.        Do not license based on what you invoice.

2.        Each user with the potential to access must belicensed.  Not who does access.

3.        Have security policies in place to restrictaccess.

4.        Run a tool like Octopus to help automatereporting and track users monthly.  Check out this quick video on reporting: https://www.youtube.com/watch?v=6NvwLqXEojw&t=19s

5.        Have a software asset management (SAM) practicein place.  

 

In conclusion, RDS licensing is not difficult. Still, whenyou do not accurately license it (or any product for that matter), you are outof compliance with Microsoft and indicate you are not charging your customersaccurately either.  In the above example,imagine going back to your customers and telling them they owe an additionalfifty licenses every month they consumed the service!  Don’t be that guy!

Thanks for reading,

SPLA Man

 

 

‍