[Samba] Samba4, MS CAL and Windows Server as domain member

[Marc Muehlfeld]

Hello Dennis,

sorry, this answer got longer ... :-)


First: MS Licensing is a very complicated thing. Distributors getting 
special trainings for that. That's why I recommend to ask at Microsoft 
and tell them about your environment and they will tell you what you 
have to license.



This is what I remember from my last talk with MS about a similar 
situation (no warranty for correctness!):

If you have only Samba servers and MS Windows Workstations, then you 
don't need to license anything (you only have to buy the Workstation 
license, like Win7 Pro, of course).

If you have at least one MS Server in your network, then this situation 
changes: Like on the page you have linked, you can decite between client 
CALs or user CALs. If you have more user accounts in your network than 
machines (every device counts!), then you should buy client CALs. If 
it's the other way around, you buy user CALs. BUT: You can't mix and you 
can't switch. And it doesn't matter what kind of services (Terminal 
Server and SQL Server are special here. See later) your user/clients are 
accessing on the Windows Server.

In the next examples I use user CALs (but it's the same for client CALs):

For every user who access your window(s) server, you have to buy one 
CAL. There it doesn't matter, if the user only access a file share or 
spool his printjobs over this server. If the Windows machine is a DC, 
then it's the same (the workstations access LDAP/AD and at least the 
sysvol share - and so it is an access).

If you only have a single Windows Member server, that is accessed in any 
way from only 5 of your 100 users, then you only have to buy 5 user 
CALs. But if you have 100 users total and 5 access only the first 
server, 50 only the second, 10 only the third and the rest access all, 
then you have to buy CALs for all users.

MS Terminal Server and MS SQL servers have additional CALs. For all 
user/clients accessing TS or SQL, you have to buy TS/SQL CALs 
additionally to the windows server CALs.

When you buy server CALs for all user/client - lets say for Server 2012 
- then it doesn't matter, if your Windows server are running all on a 
previous version. The license is downgradeable. So if you have bought 
all licenses for Server 2012 and you bring one 2012r2 into your domain, 
then your CALs are not valid for that and you have to buy new ones (or 
you have Software assurance or something that allows you).




Am 05.11.2013 10:38, schrieb Denis:
> I have a licencing question : do one need to buy CAL for every
 > user in a Samba4 domain when there is a Windows Server as a
 > domain member, knowing that the Windows server will be accessed
> using SMB by Windows workstations?

If no one is accessing the Windows server in any way (share access or 
anything else on the server), then you don't need CALs. But then you 
don't need this server. :-)




> As per http://www.samba.org/samba/docs/using_samba/ch01.html
> and many other web sites, one of the main advantage of samba is
> that no user CALs are required. And I think the case is clear
 > when there are only Windows workstation and one samba server.

Not just one Samba server. If all your servers are Samba and no Windows 
server is in the network, then you don't need CALs.




> I have a client with an old Windows 2003 AD with all the associated
 > CALs that would need get an upgrade, and they would prefer to go
 > on the samba4 path. However if they have to pay all the user CALs,
 > the boss don't see any financial interest, but only sees the risk
 > associated with the migration.

If you replace your Windows servers with Samba, and have no Windows 
server left, that your user/clients access, you don't need CALs.




> So, here are my questions... First a weird one : does the 2003
 > user CAL are "compatible" (in the licencing legal way) with a samba4
 > server in 2008R2 forest mode in order for the windows workstation
 > to access both linux and windows server on the network?
 >
 > Second : Is the CAL version requirement relative to the
 > Active Directory version or to the highest Windows server version
 > on the network? That is to say, if I add a win2k8 server on a domain
 > managed by an win2k3 AD, do I have to buy win2k8 CAL?

You need to have MS server CALs for the highest version of a windows 
server that is in your network. If your newest Windows OS is server 
2003r2, then CALs for that old version would be fine. But if you bring a 
newer server version to your network, this CALs are not valid for that 
any more. But you can buy Server 2012 CALs. They can be used for older 
version, too. And when you install a version up to 2012 (not r2! for 
this example) then it's covered.




So as you see, it's very complicated and I really recommend to talk with 
MS or a distributor about your environment. They will tell you, what and 
how many licenses you will need.



Once again: I give no warranty for correctness of the above!


Regards,
Marc