Windows 2019 RDS avoid assigning TS CAL for admins

k3tiv 1 Reputation point
2021-11-18T08:24:14.313+00:00

I need to run a small Windows 2019 server with RDS role for ~15 users with TS User CAL licence and typical administrators (lets say admin1, admin2, admin3) which will have strictly access to administrative activities
Does assigning them to group 'domain admins' is enough to to avoid assigning CAL User licence or running RDP client by 'mstsc.exe /admin' is the only way?
I'm afraid that some day they'll forgot about that also some of them want to use Android RD Client which I'm not sure if it has that option..

Remote Desktop
Remote Desktop
A Microsoft app that connects remotely to computers and to virtual apps and desktops.
4,706 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Leon Laude 85,871 Reputation points
    2021-11-18T08:59:03.357+00:00

    Hi @k3tiv ,

    When you connect to a server that has Terminal Server installed

    If a member of the Administrators group starts a Remote Desktop session to a Windows Server 2008-based server or later that has the Terminal Server role service installed, they must use the /admin switch to connect to a session to remotely administer the server. The following conditions are true for the session:

    • You do not have to have a TS CAL to remotely administer a terminal server.
    • Time zone redirection is disabled.
    • Terminal Services Session Broker redirection is disabled.
    • Plug and Play device redirection is disabled.
    • The remote session theme is changed to Windows Classic.
    • Terminal Services Easy Print is disabled.

    Reference:
    https://web.archive.org/web/20190121054744/https://support.microsoft.com/en-us/help/947723/changes-to-remote-administration-in-windows-server-2008

    Domain Administrators are local administrators by default on all servers so it should be fine.

    ----------

    If the reply was helpful please don't forget to upvote and/or accept as answer, thank you!

    Best regards,
    Leon


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.