Direct answer: A Remote Desktop Session Host can run without a licence server during a 120-day grace period. After that, Microsoft states that clients "must have a valid RDS CAL issued by a license server before they can sign in a remote session". That needs four links to work: an activated licence server the host can reach, a licensing mode (Per User or Per Device) set on the host, the source of that setting (Group Policy overrides Server Manager), and client access licences (CALs) of a type and version the host accepts. How refusals show depends on the mode: Per Device CALs are issued and tracked per device, while Microsoft states that in Per User mode "licensing isn't enforced" by CAL count, so compliance there is an administrator's duty rather than something the host blocks. Read the host's licence servers and mode and their source, run RD Licensing Diagnoser, and compare CAL and host versions. Microsoft does not recommend resetting the grace period; the remedy is a licence server with a licence pack.
Why it matters
Licensing failures appear abruptly when the grace period ends on a host never pointed at a licence server, when a rebuilt or restored host points at a licence server that no longer exists, or when an upgraded host asks for a CAL version the licence server does not hold. Reinstalling roles or buying licences can look like the fix when the fault is a policy setting, a blocked port or a version mismatch. Microsoft also documents the same messages appearing with correct licensing.
How it works
The CAL request
A Remote Desktop licence server installs, issues and tracks RDS CALs. When a user or device connects, the session host decides whether a CAL is needed and requests one from a licence server; if an appropriate CAL is available, it is issued. Microsoft states that each user and device connecting to a Windows Server session host needs an RDS CAL.
The grace period
Microsoft: "There's a licensing grace period of 120 days during which no license server is required. Once the grace period ends, clients must have a valid RDS CAL issued by a license server before they can sign in a remote session." During it, a missing configuration produces a reminder balloon ("Remote Desktop Services will stop working in x days"); afterwards, refusals. On resetting it, Microsoft's guidance states: "we don't recommended this approach. Instead, you must implement a license server together with a license pack."
Two licensing modes
There are two CAL types. Per Device CALs are assigned to each device; a temporary CAL is issued on a device's first sign-in, valid for 90 days, and upgraded to a permanent CAL on a later connection if the licence server is activated and has CALs available. Per User CALs are assigned to a user in Active Directory. Microsoft states that in the per user model "licensing isn't enforced", that Per User CALs can be over-allocated "in breach of the Remote Desktop licensing agreement", and that it is the administrator's responsibility to make sure all users have valid licences. Per User CALs cannot be tracked in a workgroup; Microsoft states that workgroup deployments must use Per Device CALs.
The session host must be told which mode to request; if it is wrong or missing, the host asks for the wrong kind of CAL, or none.
Where the session host gets its settings
There are three places, and Microsoft documents their order:
- Server Manager (RD Connection Broker deployments): Edit Deployment Properties, RD Licensing. Stored under
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\Licensing Core(LicensingMode) andHKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters\LicenseServers(SpecifiedLicenseServers). - Local or domain Group Policy: Computer Configuration, Administrative Templates, Windows Components, Remote Desktop Services, Remote Desktop Session Host, Licensing: "Use the specified Remote Desktop license servers" and "Set the Remote Desktop licensing mode". Stored under
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services(LicenseServers,LicensingMode). LicensingModevalues: 2 is Per Device, 4 is Per User.
Microsoft: "Settings configured through Group Policy override those configured using the Remote Desktop Services console in Server Manager." A leftover or unexpected GPO silently overrides what Server Manager shows.
CAL version compatibility
Microsoft states that CALs for an earlier Windows Server version cannot be used to access a later version, while later CALs can access earlier versions. Windows Server 2022 CALs work with a 2022 or earlier session host, not with 2025. CALs must also be installed on a licence server running the same version or later: a Windows Server 2022 licence server cannot hold 2025 CALs. Upgrading a session host without the licence server and CALs produces refusals.
The licence server itself
The licence server needs the RD Licensing role and activation through the Microsoft Clearinghouse (automatically over TCP 443, by web browser, or by telephone), a separate path from host-to-licence-server traffic. Microsoft's port reference lists the RD Licensing service (TermServLicensing) as using RPC on TCP 135, randomly allocated high TCP ports (49152 to 65535), NetBIOS on UDP 137 and 138 and TCP 139, and SMB on TCP 445, and notes that it "offers its services by using RPC over named pipes" with "the same firewall requirements as the File and Printer Sharing feature". Microsoft's checklist also verifies the server's scope and membership of the "Terminal Server License Servers" domain group.
Read-only checks
None of these were run for this article.
- Grace period remaining, on the session host, Microsoft's example in Windows PowerShell 5.1:
$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting $obj.GetGracePeriodDays()gwmi(Get-WmiObject) is removed from PowerShell 7, so run this in Windows PowerShell 5.1; no PowerShell 7 equivalent is offered here. - What the session host is using (Windows PowerShell 5.1):
$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting $obj.GetSpecifiedLicenseServerList() $obj.LicensingType - Where it comes from: read the policy and Server Manager keys above; policy values, if present, apply. Microsoft's checklist uses
gpresult /H <file>.htmlto confirm the GPO; it writes a report file, so use a new folder. - RD Licensing Diagnoser: Server Manager, Tools, Terminal Services, RD Licensing Diagnoser. It lists detected problems with possible causes, for example "License server
is not available". - Licence server: in Remote Desktop Licensing Manager, confirm the server shows activated, holds the CAL type and version needed with available counts, and read its scope.
- Licence server events: Event Viewer,
Application and Services Logs\Windows\TerminalServices-Licensing\Operational(path as Microsoft gives it). - Ports between host and licence server: compare firewall rules on both and on the path with the RD Licensing ports above. TCP 443 matters only for automatic activation.
Diagnostic output (writes a report, no licensing change): for Per User, Remote Desktop Licensing Manager can create a CAL Usage report (Create Report, CAL Usage) on the licence server; it does not change allocations. It cannot report Per User CALs in a workgroup or with Entra Domain Services.
Common causes
| Cause | Evidence | Fix layer |
|---|---|---|
| Grace period ended, no licence server configured | Diagnoser: grace period expired, no licence server configured | Configure licence server and mode |
| Licensing mode not configured | "licensing mode is not configured" balloon; LicensingType unset |
Mode setting |
| Policy overrides Server Manager | Values under the Policies key; gpresult shows the GPO | The GPO or local policy |
| Licence server unreachable | Diagnoser: "not available"; RPC or SMB blocked on the path | Network or licence server service |
| Licence server not activated | Licensing Manager shows not activated | Activation |
| CAL version older than session host | 2022 CALs, 2025 host | CALs and licence server version |
| Wrong CAL type for mode or workgroup | Per User CALs on a workgroup deployment | Mode and CAL type |
| Licence server certificate problem | The specific "security error" message Microsoft names | Microsoft's X509 Certificate procedure, by a specialist (see below) |
Microsoft notes the reminder balloon also appears, with correct settings, when connecting with a local account in Per User mode or with an administrative session.
Decision guidance
Every item is a change needing a change record; none were executed for this article.
| Finding | Decision |
|---|---|
| Licence server or mode missing or wrong | Set them in the source that actually applies. If a GPO is in force, change the GPO; editing Server Manager has no effect |
| Licence server unreachable | Open the RD Licensing ports on the path between host and licence server, per Microsoft's port reference |
| Licence server not activated | Activate through the Clearinghouse by the method your network allows |
| Licence server version too old for the CALs needed | Plan a licence server on a compatible release before installing new CALs |
| CALs missing or wrong type or version | Obtain them through your licensing agreement; quantities and terms are for your licensing provider |
| Diagnoser shows the certificate "security error" Microsoft names | Microsoft's "Refresh the X509 Certificate registry keys" procedure applies only to that case. It removes registry keys, needs a registry backup, a restart and reactivation, and is disruptive. Hand it to a specialist with an approved plan; do not use it as a general repair |
What not to do
- Do not reset the grace period as a fix. Microsoft states that it does not recommend it.
- Do not use Per User mode to get round CAL counts. Microsoft states that over-allocation is in breach of the licensing agreement.
- Do not edit Server Manager settings while a GPO overrides them.
- Do not delete licensing registry values outside the certificate case Microsoft names, and then only through the specialist plan.
- Do not install new CALs on a licence server whose version cannot hold them.
Limitations
- No command was run for this article. Lab validation is outstanding.
- This describes product behaviour as Microsoft documents it, not licensing advice; quantities, terms and compliance belong with your licensing provider.
- Azure Virtual Desktop specifics are not covered.
- Cross-domain and workgroup licensing best practice is referenced by Microsoft but was not fetched.
Acceptance checklist
- [ ] Every session host shows the intended licence servers and mode, from one known source.
- [ ] RD Licensing Diagnoser reports no problems.
- [ ] The licence server is activated and reachable from each host on the RD Licensing ports.
- [ ] CAL type and version match the selected mode and the session host release.
- [ ] Per Device: CALs are issued from the licence server and available counts are sufficient.
- [ ] Workgroup deployment: Per Device mode and Per Device CALs are used (Microsoft states workgroups must use Per Device).
- [ ] Per User, in a domain where reporting is supported: the CAL Usage report is within the installed count. In a supported Per User environment where Licensing Manager cannot report (Entra Domain Services), compliance is recorded by another agreed method.
- [ ] The grace period was not reset.
Sources
Displayed dates as shown when accessed on 30 October 2026.
- Microsoft Learn, License Remote Desktop Services with Client Access Licenses (CALs). 2025-06-16.
- Microsoft Learn, Activate the Remote Desktop Services license server. 2025-02-14.
- Microsoft Learn, Track your Remote Desktop Services client access licenses (RDS CALs). 2024-11-01.
- Microsoft Learn, Guidance for troubleshooting RDS Licensing. 2026-02-12.
- Microsoft Learn, Cannot connect to RDS because no RD Licensing servers are available. 2026-02-12.
- Microsoft Learn, Remote Desktop licensing mode is not configured warning. 2026-02-12.
- Microsoft Learn, Service overview and network port requirements for Windows. 2026-02-12.
- Microsoft Learn, Differences between Windows PowerShell 5.1 and PowerShell 7.x. 2026-04-08.
Related articles
- Group Policy not applying on a hosted server: gpresult, event logs and SYSVOL replication
- Print Spooler crashes on Remote Desktop hosts: suspected driver faults, isolation and Point and Print
- Windows firewall rules stopped working after a move: network profile switched to Public
Learning notes
- After the 120-day grace period, a session host needs a reachable activated licence server, a licensing mode and a compatible CAL; Per User licensing is not enforced by CAL count.
- Group Policy settings override Server Manager; find the source before changing anything.
- CALs work for the same or earlier session host versions, and must sit on a licence server of the same or later version.
- RD Licensing Diagnoser names the failing link.
- Microsoft does not recommend resetting the grace period; it is not a fix.