RDS License Server HA in an Active-Active Multi-Site (DC/DR) Architecture

Question

RDS License Server HA in an Active-Active Multi-Site (DC/DR) Architecture

Jannatul Nayeem 0

Hello Experts,

I am currently designing an Active-Active multi-site RDS infrastructure across our Primary Data Center (DC) and Disaster Recovery (DR) site.

My Scenario & Architecture:

We have an Load Balancer distributing RDP traffic 50/50 to our DC and DR sites.
The traffic comes through a PAM (Privileged Access Management) solution, hits the LB, and is routed to Windows Server Bastion/Jump Servers (which have the RD Session Host role installed).

Users then RDP from these Jump Servers into our internal target servers (Active Directory, Exchange, etc.).

We have purchased EX: 85 RDS CALs under a single volume license agreement/key.

Architecture Validation: Before diving into licensing, I would love to hear your thoughts on this overall architecture. Is this 50/50 Active-Active, load-balanced Jump Server setup the right approach for this scenario? Are there any better or more standard ways to configure this to ensure zero downtime and optimal resource utilization?

My Dilemma regarding RD Licensing High Availability: Since my Jump Servers (RDSH) are active in both DC and DR, I need to ensure the RDS License Server is highly available. I am confused between two approaches:

Approach 1 (Splitting CALs): Deploy two separate RD License Servers (one in DC, one in DR). Then, "split" the 85 CALs between them (e.g., install 50 CALs on the DC server and 35 CALs on the DR server) and configure the RDSH servers via GPO to query both license servers.
Approach 2 (Backup & Restore): Deploy only one RD License Server in the DC site with all 85 CALs. Regularly backup its System State and database. If the DC site goes down, manually restore the backup to a new server in the DR site to bring the licensing service back up.

My Questions:

Architecture: Does my overall PAM -> LB -> DC/DR Jump Server flow look solid, or would you recommend a different architectural approach?
Licensing Standard: Which licensing approach (Splitting vs. Backup/Restore) is the official Microsoft standard and recommended best practice for this Active-Active scenario?
Splitting Mechanics: If Approach 1 (Splitting) is recommended, how do I actually activate it? Can I use my single License Key / Agreement Number twice (once on the DC server and once on the DR server) to allocate the 50 and 35 CALs respectively?

Restore Limitations: If Approach 2 (Backup) is used, I read that restoring to a server with a newly installed OS will not restore unissued licenses without a manual telephone activation. Is this true?

Any guidance on optimizing this architecture and appropriately distributing the licenses across the two sites would be highly appreciated.

Thank you!

0 comments

2 answers

Your answer

Answer 1

Welcome to Microsoft Q&A!

Thank you for providing such a detailed description of your DC/DR design.

For the scenario you described, I would separate the RDS licensing design from the PAM → load balancer → DC/DR Jump Server design.

Microsoft supports environments with multiple RD License Servers. In a domain-joined deployment, the license servers can be configured so that they recognize and communicate with one another, and the appropriate RD License Servers can be specified for the deployment.

However, the important point is that deploying two RD License Servers should not be interpreted as creating two copies of the same CAL entitlement. RDS CALs are installed according to the licensing program, product version, license type, and quantity purchased, and the Microsoft Clearinghouse validates the request when the licenses are retrieved.

For that reason, having an agreement for 85 RDS CALs does not by itself establish that the same 85-CAL key pack may simply be installed independently on both license servers.

The distinction is between having more than one RD License Server for availability and having CAL entitlement available to install on those servers.

Microsoft documents how multiple RD License Servers can be used, but the actual license installation still depends on the licensing program and the purchased quantity. The installation wizard requires the applicable license code or agreement information and the number of licenses being installed.

Therefore, I would not recommend installing the same agreement/key on both servers on the assumption that this makes 85 CALs available on each server.

For an Active-Active DC/DR environment, I would proceed with two RD License Servers, one in each site, rather than relying on backup/restore of a single license server as the normal HA mechanism.

Configure the RD Session Hosts with the correct licensing mode and the intended RD License Servers. Then allocate the purchased CAL entitlement between the license servers according to your capacity and failover requirements, provided that the allocation is valid under your particular licensing agreement.

For example, if 50/35 is the allocation approved for your 85 CALs, each RD License Server would hold its corresponding allocation. Keep in mind that this does not provide 85 CALs of licensing capacity independently at each site.

I would not reuse the same Volume Licensing information on both servers to create duplicate capacity unless your licensing channel confirms that your agreement permits the requested allocation. The precise way the 85 CALs can be allocated depends on the program under which they were purchased.

For replacement or recovery of a license server, use the documented RDS CAL migration process rather than designing backup/restore of the licensing database as the primary HA mechanism. Microsoft supports migration through an automatic connection to the Microsoft Clearinghouse, a web browser, or telephone. The migration process also covers situations in which the original license server is no longer functioning.

This is also why I would not rely on a System State/database restore to a newly installed server as a guarantee that the unissued CAL entitlement will automatically become usable. Microsoft provides the CAL migration/recovery process for this scenario, and depending on the recovery situation, interaction with the Microsoft Clearinghouse may be required.

Regarding the PAM → LB → DC/DR Jump Server architecture, nothing in that traffic flow is inherently incompatible with RD Licensing. However, whether a 50/50 Active-Active topology provides the required end-to-end HA also depends on components outside RD Licensing, including authentication dependencies, network connectivity and latency, load-balancer health checks and persistence, application dependencies, and the availability design of the other RDS components.

After deploying the two RD License Servers:

Confirm that both license servers are activated.
Confirm the correct Per User or Per Device licensing mode on the RD Session Hosts.
Confirm that the RD Session Hosts are configured to use the intended license servers.
Run RD Licensing Diagnoser and verify that there are no discovery, connectivity, licensing-mode, or CAL compatibility errors.
Perform a controlled failover test with one license server unavailable and validate the DC and DR paths independently.
Confirm that the Windows Server/RDS CAL versions are compatible with the versions of the RD Session Hosts.

There is one important limitation I would like to clarify before you implement the 50/35 CAL allocation.

Microsoft Q&A can help with the technical configuration and explain the documented RDS licensing mechanisms, but the forum cannot inspect your organization's Volume Licensing agreement, validate the entitlement associated with your agreement number/key pack, authorize reuse of that key, or confirm/reissue a specific 50/35 CAL allocation.

Because that determination depends on your actual licensing agreement, please have your organization's licensing administrator/reseller or the applicable Microsoft licensing support channel confirm how your existing 85-CAL entitlement should be allocated between the two RD License Servers before installing the CAL packs.

This gives you the safest approach: use two RD License Servers for the Active-Active design, use Microsoft's documented CAL migration/recovery process rather than backup/restore as the HA strategy, and have the exact 85-CAL allocation confirmed through your licensing channel.

References: Use multiple Remote Desktop license servers | Microsoft Learn

Migrate your Remote Desktop Services Client Access Licenses (RDS CALs) | Microsoft Learn

Install Remote Desktop Services client access licenses | Microsoft Learn

If you find it useful, please click Accept Answer.

Thank you for choosing Microsoft Q&A.

Answer 2

For an active-active deployment, deploy and activate an RD License Server in each site, divide the purchased 85-CAL entitlement between them, and configure every RD Session Host to use both servers; do not install the full 85-CAL pack on both servers.

Recommended licensing design

Microsoft supports associating all RDS servers with two RD License Servers so new sessions can continue when one licensing server is unavailable.^1^

For your example:

DC license server: 50 CALs
DR license server: 35 CALs
Every RDSH: configured with both license-server FQDNs
Both license servers: same licensing mode as the RDSH deployment
Total installed entitlement across both servers: no more than the 85 CALs purchased

Installing the same complete CAL pack on both servers would create duplicate active pools and is not the supported way to provide redundancy.^2^

A 50/35 split does not provide 85 CALs at the surviving site. If either site must support the entire environment independently—especially with Per Device CALs—size each valid pool for its expected failover demand or retain one pool and use the supported CAL-migration procedure during disaster recovery. The latter provides full capacity but requires an administrative recovery action.

Installing the split CAL quantities

First install and activate the RD Licensing role independently on both servers:

Server Manager → Manage → Add Roles and Features.
Select Remote Desktop Services → Remote Desktop Licensing.
Open Remote Desktop Licensing Manager.
Right-click the server and select Activate Server.^3^

Then install the assigned quantity on each server:

In Remote Desktop Licensing Manager, right-click the activated server and select Install Licenses.
Select the volume-license program under which the CALs were purchased.
Enter the requested agreement or license-program information.
Select the CAL version and type.
Enter only that server’s allocation—50 on the DC server and 35 on the DR server.
Allow the wizard to contact Microsoft Clearinghouse and complete installation.^4^

An agreement number is not necessarily a reusable product key. The installation wizard can request the same volume agreement information while processing specified quantities, but a CSP 5×5 activation code cannot be used again on another license server.^5^ If the second partial installation is rejected, use the wizard’s Microsoft Clearinghouse process rather than attempting to duplicate the first key pack.

Configure the RDSH servers through a domain GPO:

Edit a GPO targeting all jump-server RDSHs.
Go to Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Licensing.
Enable Use the specified Remote Desktop license servers.
Enter both license-server names, separated by commas.
Enable Set the Remote Desktop licensing mode and select the purchased Per User or Per Device mode.^6^

For domain-joined license servers, publish each server in AD DS so that the two licensing servers recognize communications from one another:

# Run elevated as a domain administrator on each RD License Server
Invoke-WmiMethod `
  -Class Win32_TSLicenseServer `
  -Name PublishLS

This is particularly relevant after the CVE-2024-38231 security update.^7^ Do not place RD Licensing on domain controllers; Microsoft advises keeping unrelated roles off DCs.

Architecture adjustment

A generic load balancer distributing connections directly to RDSHs is not equivalent to an RDS farm managed by RD Connection Broker. Connection Broker:

Balances new connections across collection members.
Detects an existing disconnected session.
Sends the user back to the RDSH holding that session.

Microsoft specifically states that DNS round-robin directly to RDSHs is unsupported when Connection Broker is enabled.^8^

For a standard highly available RDS design, use:

Two or more RDSHs across the sites.
Highly available RD Connection Brokers.
Two RD License Servers.
Redundant RD Gateway/RD Web roles if your PAM design does not already provide equivalent controlled ingress.
Health probes that remove failed site components instead of unconditional 50/50 routing.

Microsoft’s reference architecture duplicates the infrastructure roles and keeps RDSHs as dedicated session servers.^9^ Validate whether your PAM product supports broker-aware RDS connections and reconnection; that third-party integration detail is not established by the RDS documentation.

Backup, restore, and DR migration

Your restore statement is correct for the documented backup scenario: restoring system state and the licensing database to the original OS installation restores unissued licenses, but after replacing/reinstalling the OS, unissued licenses are not restored automatically. The older recovery procedure uses telephone activation to recover them.^10^

For a planned standby or failed license server, the current supported process is Manage Licenses → Migrate RDS CALs from another license server to this license server. The destination must first be activated. Migration can use:

Automatic Clearinghouse connection over TCP 443—the recommended method.
Web browser.
Telephone.

The wizard explicitly supports the reason The source license server is no longer functioning, so telephone recovery is not universally required.^11^

Therefore, retain system-state/database backups, but document CAL migration through Microsoft Clearinghouse as the primary clean-OS DR runbook rather than relying solely on database restoration.

References