RDS License Server HA in an Active-Active Multi-Site (DC/DR) Architecture

Jannatul Nayeem 0 Reputation points
2026-11-07T12:34:23.3333333+00:00

Hello Experts,

I am currently designing an Active-Active multi-site RDS infrastructure across our Primary Data Center (DC) and Disaster Recovery (DR) site.

My Scenario & Architecture:

  • We have an Load Balancer distributing RDP traffic 50/50 to our DC and DR sites.
  • The traffic comes through a PAM (Privileged Access Management) solution, hits the LB, and is routed to Windows Server Bastion/Jump Servers (which have the RD Session Host role installed).

Users then RDP from these Jump Servers into our internal target servers (Active Directory, Exchange, etc.).

  • We have purchased EX: 85 RDS CALs under a single volume license agreement/key.

Architecture Validation: Before diving into licensing, I would love to hear your thoughts on this overall architecture. Is this 50/50 Active-Active, load-balanced Jump Server setup the right approach for this scenario? Are there any better or more standard ways to configure this to ensure zero downtime and optimal resource utilization?

My Dilemma regarding RD Licensing High Availability: Since my Jump Servers (RDSH) are active in both DC and DR, I need to ensure the RDS License Server is highly available. I am confused between two approaches:

  • Approach 1 (Splitting CALs): Deploy two separate RD License Servers (one in DC, one in DR). Then, "split" the 85 CALs between them (e.g., install 50 CALs on the DC server and 35 CALs on the DR server) and configure the RDSH servers via GPO to query both license servers.
  • Approach 2 (Backup & Restore): Deploy only one RD License Server in the DC site with all 85 CALs. Regularly backup its System State and database. If the DC site goes down, manually restore the backup to a new server in the DR site to bring the licensing service back up.

My Questions:

  1. Architecture: Does my overall PAM -> LB -> DC/DR Jump Server flow look solid, or would you recommend a different architectural approach?
  2. Licensing Standard: Which licensing approach (Splitting vs. Backup/Restore) is the official Microsoft standard and recommended best practice for this Active-Active scenario?
  3. Splitting Mechanics: If Approach 1 (Splitting) is recommended, how do I actually activate it? Can I use my single License Key / Agreement Number twice (once on the DC server and once on the DR server) to allocate the 50 and 35 CALs respectively?

Restore Limitations: If Approach 2 (Backup) is used, I read that restoring to a server with a newly installed OS will not restore unissued licenses without a manual telephone activation. Is this true?

Any guidance on optimizing this architecture and appropriately distributing the licenses across the two sites would be highly appreciated.

Thank you!

Windows for business | Windows Server | User experience | Remote desktop services and terminal services
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-11-07T12:35:28.6833333+00:00

    For an active-active deployment, deploy and activate an RD License Server in each site, divide the purchased 85-CAL entitlement between them, and configure every RD Session Host to use both servers; do not install the full 85-CAL pack on both servers.

    Microsoft supports associating all RDS servers with two RD License Servers so new sessions can continue when one licensing server is unavailable.^1^

    For your example:

    • DC license server: 50 CALs
    • DR license server: 35 CALs
    • Every RDSH: configured with both license-server FQDNs
    • Both license servers: same licensing mode as the RDSH deployment
    • Total installed entitlement across both servers: no more than the 85 CALs purchased

    Installing the same complete CAL pack on both servers would create duplicate active pools and is not the supported way to provide redundancy.^2^

    A 50/35 split does not provide 85 CALs at the surviving site. If either site must support the entire environment independently—especially with Per Device CALs—size each valid pool for its expected failover demand or retain one pool and use the supported CAL-migration procedure during disaster recovery. The latter provides full capacity but requires an administrative recovery action.

    Installing the split CAL quantities

    First install and activate the RD Licensing role independently on both servers:

    1. Server Manager → Manage → Add Roles and Features.
    2. Select Remote Desktop Services → Remote Desktop Licensing.
    3. Open Remote Desktop Licensing Manager.
    4. Right-click the server and select Activate Server.^3^

    Then install the assigned quantity on each server:

    1. In Remote Desktop Licensing Manager, right-click the activated server and select Install Licenses.
    2. Select the volume-license program under which the CALs were purchased.
    3. Enter the requested agreement or license-program information.
    4. Select the CAL version and type.
    5. Enter only that server’s allocation—50 on the DC server and 35 on the DR server.
    6. Allow the wizard to contact Microsoft Clearinghouse and complete installation.^4^

    An agreement number is not necessarily a reusable product key. The installation wizard can request the same volume agreement information while processing specified quantities, but a CSP 5×5 activation code cannot be used again on another license server.^5^ If the second partial installation is rejected, use the wizard’s Microsoft Clearinghouse process rather than attempting to duplicate the first key pack.

    Configure the RDSH servers through a domain GPO:

    1. Edit a GPO targeting all jump-server RDSHs.
    2. Go to Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Licensing.
    3. Enable Use the specified Remote Desktop license servers.
    4. Enter both license-server names, separated by commas.
    5. Enable Set the Remote Desktop licensing mode and select the purchased Per User or Per Device mode.^6^

    For domain-joined license servers, publish each server in AD DS so that the two licensing servers recognize communications from one another:

    # Run elevated as a domain administrator on each RD License Server
Invoke-WmiMethod `
  -Class Win32_TSLicenseServer `
  -Name PublishLS

    This is particularly relevant after the CVE-2024-38231 security update.^7^ Do not place RD Licensing on domain controllers; Microsoft advises keeping unrelated roles off DCs.

    Architecture adjustment

    A generic load balancer distributing connections directly to RDSHs is not equivalent to an RDS farm managed by RD Connection Broker. Connection Broker:

    • Balances new connections across collection members.
    • Detects an existing disconnected session.
    • Sends the user back to the RDSH holding that session.

    Microsoft specifically states that DNS round-robin directly to RDSHs is unsupported when Connection Broker is enabled.^8^

    For a standard highly available RDS design, use:

    • Two or more RDSHs across the sites.
    • Highly available RD Connection Brokers.
    • Two RD License Servers.
    • Redundant RD Gateway/RD Web roles if your PAM design does not already provide equivalent controlled ingress.
    • Health probes that remove failed site components instead of unconditional 50/50 routing.

    Microsoft’s reference architecture duplicates the infrastructure roles and keeps RDSHs as dedicated session servers.^9^ Validate whether your PAM product supports broker-aware RDS connections and reconnection; that third-party integration detail is not established by the RDS documentation.

    Backup, restore, and DR migration

    Your restore statement is correct for the documented backup scenario: restoring system state and the licensing database to the original OS installation restores unissued licenses, but after replacing/reinstalling the OS, unissued licenses are not restored automatically. The older recovery procedure uses telephone activation to recover them.^10^

    For a planned standby or failed license server, the current supported process is Manage Licenses → Migrate RDS CALs from another license server to this license server. The destination must first be activated. Migration can use:

    • Automatic Clearinghouse connection over TCP 443—the recommended method.
    • Web browser.
    • Telephone.

    The wizard explicitly supports the reason The source license server is no longer functioning, so telephone recovery is not universally required.^11^

    Therefore, retain system-state/database backups, but document CAL migration through Microsoft Clearinghouse as the primary clean-OS DR runbook rather than relying solely on database restoration.

    References

    1. Remote Desktop Services roles
    2. Can a Redundant RDS Licensing Server Contain the Same Device CAL Key? - Microsoft Q&A
    3. Activate the Remote Desktop Services license server
    4. Install Remote Desktop Services client access licenses
    5. Sell on-premises software through the Cloud Solution Provider (CSP) program
    6. License Remote Desktop session hosts
    7. Use multiple Remote Desktop license servers
    8. Remote Desktop Services roles
    9. Remote Desktop Services architecture
    10. How to move Terminal Services CALs from one license server to another in Windows
    11. Migrate your Remote Desktop Services Client Access Licenses (RDS CALs)
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.