Introduction
Let's clear up the confusion first: when this article says "RDS," it means Microsoft Remote Desktop Services, the Windows Server role that delivers remote desktops and applications. It does not mean Amazon Relational Database Service, the managed database product AWS also calls "RDS."
Many organizations running Windows Server on Amazon EC2 hit this wall fast. Windows Server ships with only two concurrent administrative Remote Desktop connections by default. The moment a third employee needs simultaneous remote access, you need a properly licensed multi-user RDS deployment, not just an open RDP port.
This guide walks through AWS-provided Subscriber Access Licenses (SALs), alternative licensing paths like BYOL, the setup sequence in AWS License Manager, what it actually costs, and how to verify everything works before your team depends on it.
Key Takeaways
- Budget Microsoft RDS licensing apart from EC2, Windows Server, and Amazon RDS database charges.
- AWS-provided SALs are purchased and managed through AWS Marketplace and AWS License Manager.
- Active Directory, network design, and service-account security determine whether a deployment succeeds.
- Confirm current pricing, eligibility, and billing terms before you commit budget; rules change.
What AWS RDS Licensing Means for Microsoft Remote Desktop Services
Microsoft RDS is a Windows Server role built to support multiple simultaneous user sessions for remote desktops and published applications. It is a set of role services that work together, and most environments only need a few of them.
The Five RDS Roles
| Role | What it does |
|---|---|
| RD Session Host | Runs the actual multi-user desktop and application sessions |
| RD Licensing | Issues and tracks Client Access Licenses (CALs) |
| RD Connection Broker | Load-balances sessions and manages reconnections |
| RD Web Access | Provides a web portal listing available desktops and apps |
| RD Gateway | Allows encrypted RDP access over HTTPS without exposing internal RDP ports |
A small team accessing one session host might only need Session Host and Licensing. A larger deployment with external access typically adds Gateway and Web Access.
Those same roles apply when you host Microsoft RDS on AWS. You still need a properly licensed RD Session Host and CALs (or AWS-provided RDS SALs) for every user or device that connects—AWS does not waive Microsoft’s multi-session licensing rules.
Here's the part people miss: Windows Server's built-in two-admin-connection limit is not a licensing workaround. It exists for administrative troubleshooting, not for running a multi-user remote work environment. Once you exceed that, you need an RD Session Host role plus valid CALs for every user or device connecting.
User-Based vs. Device-Based Licensing
Microsoft's CAL model gives you two choices, and picking the wrong one creates real headaches later:
- Per-user CALs are assigned to Active Directory users and tracked by the license server. They make sense when employees use multiple devices — laptop, tablet, home PC.
- Per-device CALs are assigned to physical devices and can even be tracked without Active Directory. They fit shared-device environments like call centers or shift-based workstations.
On AWS you will also hear “RDS SAL,” which is easy to confuse with neighboring acronyms:
Terminology check: Microsoft RDS delivers remote Windows sessions. AWS-provided RDS SALs are the licenses AWS sells to access those sessions. Amazon RDS is an unrelated managed database service. All three share an acronym; none share a function.
Before choosing a licensing model for RDS on AWS, document:
- Total user count and concurrent access patterns
- Active Directory domain structure
- Number and location of session hosts
- Business-critical applications running on the environment
Microsoft RDS Licensing Options on AWS
Once you know you need multi-user RDS, you have real choices about how to license it. Each path trades off differently on cost, control, and complexity.
AWS-Provided SALs
AWS sells Microsoft RDS SALs as a consumption-based subscription through AWS Marketplace, managed via AWS License Manager. There's no long-term commitment. You subscribe, assign users, and get billed per user, per month. License Manager also provisions the licensing infrastructure and connects it to either AWS Managed Microsoft AD or a self-managed directory you already run.
Bring Your Own License (BYOL)
If your organization already owns Microsoft RDS CALs, BYOL might apply, but eligibility isn't automatic. Related Windows Server rules often determine whether your stack can move cleanly.
According to AWS's Windows FAQ, Windows Server itself is not eligible for License Mobility under Microsoft's Product Terms. Licenses purchased through a Cloud Solution Provider (CSP) agreement don't qualify for BYOL on AWS either. Software Assurance isn't required for Windows Server BYOL specifically, but it's frequently required for other Microsoft server products moved under License Mobility. Verify your specific licensing agreement before assuming BYOL is available.
Why SPLA Isn't a Drop-In Substitute
Service Provider License Agreements (SPLA) exist for companies hosting services for third-party customers, licensed monthly under a multi-year agreement. SPLA and AWS-provided SALs are structured differently and generally aren't interchangeable. If your organization currently licenses through SPLA, confirm current Microsoft and AWS policy before assuming it transfers directly.
Comparing the Options
| Factor | AWS SALs | BYOL | SPLA |
|---|---|---|---|
| Ownership | AWS-provided, subscription | Customer-owned licenses | Provider-licensed monthly |
| Billing | Per user, per month | Existing license cost | Monthly per SAL |
| Operational effort | Lower: AWS manages infrastructure | Higher: customer manages compliance | Provider-managed |
| Scalability | Flexible, add/remove users | Constrained by owned license count | Depends on agreement terms |
| Compliance documentation | AWS Marketplace records | Customer must retain proof of eligibility | Provider agreement records |
Choose AWS SALs when administrative simplicity and flexible per-user billing matter most. Investigate BYOL when you have existing license investments or contractual rights that make repurchasing wasteful. Either way, confirm eligibility against your current Microsoft agreement and AWS documentation before you commit. Re-check when contracts renew or AWS licensing terms change.
Prerequisites and Configuration Workflow
Before touching AWS License Manager, get your foundation right. Skipping this step is the number one cause of failed RDS deployments.
Infrastructure and identity prerequisites:
- Windows Server EC2 instances sized for expected session load
- A functioning Active Directory domain (AWS Managed Microsoft AD or self-managed)
- VPC and subnet design with DNS resolution between session hosts, domain controllers, and licensing services
- Network connectivity verified against current AWS documentation for supported directory types, security groups, and required ports
Don't rely on a port list from a blog post, including this one. AWS updates these requirements, so check the current AWS License Manager documentation before opening firewall rules.
Service account security matters just as much as network design. Create a dedicated domain service account for RDS licensing operations rather than reusing administrator credentials. Apply least privilege so the account can perform licensing functions only.
Store those credentials in AWS Secrets Manager with rotation enabled, and restrict access to the roles that genuinely require it.
Implementation Sequence in AWS License Manager
- Subscribe to the Microsoft Remote Desktop Services SAL product through AWS Marketplace and confirm the subscription shows Active status in License Manager.
- Register your Active Directory (AWS Managed Microsoft AD or self-managed), selecting the correct VPC, subnets, and the securely stored service-account secret.
- Configure the RDS licensing server, recording its endpoint information for later reference.
- Assign user subscriptions and configure RD Session Hosts through Group Policy or supported Windows Server licensing settings.
Validate Before Anyone Depends on It
Run a controlled test with a small group before rolling this out organization-wide. Confirm:
- Domain authentication succeeds
- User entitlements match the intended licensing mode
- Session-host connectivity works end-to-end
- Business-critical applications launch correctly through the session
This kind of multi-system dependency spans AWS infrastructure, Active Directory, licensing servers, and session hosts. Internal teams without dedicated cloud staff often lose time here.
Verdant TCS works with small and mid-sized businesses on cloud migrations and secure Windows environment configuration when a team lacks the bandwidth to own those AWS and Microsoft dependencies alone.
Cost, User Management, and Licensing Governance
RDS licensing rarely shows up as a standalone line item. It interacts with several other costs, and treating it in isolation leads to budget surprises.
Total cost typically includes:
- Microsoft RDS SAL charges (per user, per month)
- EC2 instance costs for session hosts
- Windows Server licensing (often bundled into license-included AMIs)
- Storage and data transfer
- Directory services (AWS Managed Microsoft AD or equivalent)
- Networking, backup, and AWS support charges
- Any managed-service fees for ongoing oversight
As of the AWS Marketplace listing checked for this article, the Win Remote Desktop Services SAL was priced at $10.00 per user, per month, based on actual usage with no long-term commitment.
Marketplace pricing changes. Region, taxes, and eligibility can all affect your bill, so confirm current rates in the AWS Pricing Calculator before you budget.
A Simple Costing Approach
Multiply the current per-user rate by your billable user count, then add infrastructure and shared-service costs. Users added mid-cycle, removed, or moved between environments change what you are billed, so plan for that churn instead of a static headcount.
Don't Pay for Access Nobody Uses
License billing does not track your HR system automatically. When someone leaves or changes roles, update both AWS License Manager subscriptions and Active Directory group membership. Those are separate steps.
AWS documentation describes token-based billing tied to when a license is issued, not only when someone unsubscribes. Timing matters. Verify current token-expiration and unsubscribe rules before you assume access and billing stop right away.
Build a recurring governance process:
- Maintain a license inventory mapped to business owners
- Review license utilization and access logs on a set schedule
- Document exceptions instead of letting them accumulate silently
- Reconcile AWS billing against Active Directory records monthly
Verdant TCS managed security services include identity and access management and compliance reporting, which can support access reviews and this kind of governance work. Licensing responsibility still sits with your organization, not with a managed provider.
How to Verify Licensing and Troubleshoot Common Issues
A working login doesn't mean licensing is correct. Users can authenticate successfully and still hit an RDS licensing error if entitlement, licensing-server discovery, or session-host policy is misconfigured.
On the Windows Server Side
Use the RD Licensing Diagnoser (Server Manager > Tools > Terminal Services) to confirm:
- The licensing server endpoint matches what's configured
- Licensing mode is correctly set to Per User or Per Device
- Licenses are available and properly assigned
- No diagnoser warnings are present
On the AWS Side
In AWS License Manager, check:
- Marketplace subscription status (should read Active)
- Registered Active Directory status
- Managed licensing-server status and endpoint
- Subscribed user list against expected headcount
- CloudTrail logs and billing records for anomalies
Common Failure Patterns
| Symptom | First diagnostic step |
|---|---|
| Users can't connect at all | Check licensing mode (Per User vs. Per Device) |
| Intermittent access failures | Verify DNS resolution and security group rules |
| "No license server available" error | Confirm licensing server is reachable and registered |
| Access denied despite valid login | Check service-account credential status in Secrets Manager |
| New users not appearing | Confirm AD domain matches the registered directory |
When something breaks in production, resist the urge to make sweeping changes immediately. Remove user subscriptions carefully and preserve configuration and audit records. Consult current AWS or Microsoft guidance, or a qualified licensing advisor, before altering production settings further.
Frequently Asked Questions
How much does AWS Remote Desktop Services cost per user per month?
Pricing depends on the current AWS Marketplace or License Manager offering, billing region, user eligibility, and applicable taxes. Check the AWS Pricing Calculator and current Marketplace listing before budgeting.
How do I check if RDS is licensed?
Use the Windows RD Licensing Diagnoser to verify licensing mode, server endpoint, and user or device assignments. Then confirm subscription and directory status in AWS License Manager.
Does AWS include Microsoft RDS licensing?
No. EC2 and Windows Server charges are separate from Microsoft RDS licensing. AWS-provided SALs are available as a separate subscription through AWS Marketplace, subject to current terms.
What is the difference between Microsoft RDS and Amazon RDS?
Microsoft RDS delivers remote Windows desktops and applications to users. Amazon RDS is an unrelated managed relational database service. They share an acronym only.
Can I use my existing Microsoft RDS CALs on AWS?
BYOL eligibility depends on your specific Microsoft licensing rights, Software Assurance terms, and license mobility rules, plus AWS's own requirements. Verify eligibility with current official guidance before assuming it applies.
Do I need Active Directory to use Microsoft RDS on AWS?
Generally, yes. AWS License Manager requires subscription users to be defined in a supported directory — either AWS Managed Microsoft AD or self-managed Active Directory — depending on your chosen licensing model.