samba - Nov 2013 - Samba4, MS CAL and Windows Server as domain member

Hi everyone,

I have a licencing question : do one need to buy CAL for every user in a Samba4
domain when there is a Windows Server as a domain member, knowing that the
Windows server will be accessed using SMB by Windows workstations?

As per http://www.samba.org/samba/docs/using_samba/ch01.html and many other web
sites, one of the main advantage of samba is that no user CALs are required. And
I think the case is clear when there are only Windows workstation and one samba
server.

However, in the case where I have a Windows member server joined to the Samba4
domain, do I need user CAL to access that windows server throught SMB protocol?
The MS licencing seems to say yes
(http://www.microsoft.com/licensing/about-licensing/client-access-license.aspx).
But I cannot imagine how this could not be considered as anticompetitive
practice, at least here in Europe... Indeed, it would remove the main financial
advantage of Samba4 over MSAD.

I have a client with an old Windows 2003 AD with all the associated CALs that
would need get an upgrade, and they would prefer to go on the samba4 path.
However if they have to pay all the user CALs, the boss don't see any
financial interest, but only sees the risk associated with the migration.

So, here are my questions... First a weird one : does the 2003 user CAL are
"compatible" (in the licencing legal way) with a samba4 server in
2008R2 forest mode in order for the windows workstation to access both linux and
windows server on the network?

Second : Is the CAL version requirement relative to the Active Directory version
or to the highest Windows server version on the network? That is to say, if I
add a win2k8 server on a domain managed by an win2k3 AD, do I have to buy win2k8
CAL?

I have not found any definitive answer on the internet. I can only imagine that
the CALs are associated to the number of Active Directory accounts and Active
Directory version, otherwise one get kafkaesque issues. But in the case of
samba4, the notion of Active Directory version seems exotic... Do any of you
have any experience on those licencing questions?

Thanks for you input. Samba4 rocks!

Cheers,

Denis

Hai,  
>-----Oorspronkelijk bericht-----
>Van: samba at cardon.it [mailto:samba-bounces at lists.samba.org] 
>Namens Denis
>Verzonden: dinsdag 5 november 2013 10:39
>Aan: samba at lists.samba.org
>Onderwerp: [Samba] Samba4, MS CAL and Windows Server as domain member
>
>Hi everyone,
>
>I have a licencing question : do one need to buy CAL for every 
>user in a Samba4 domain when there is a Windows Server as a 
>domain member, knowing that the Windows server will be 
>accessed using SMB by Windows workstations?
If your workstations connect to this server you need a device cal. ( for example
printing )
Every window "PRO" is included with a device cal.

IF the user connects to this server you need a user cal. ( share access /
authorisation )
but, for example, if you only have 5 user connecting to this server out of a
100.
You only need 5 user cal's ( which is included with the server licence ) 
>As per http://www.samba.org/samba/docs/using_samba/ch01.html 
>and many other web sites, one of the main advantage of samba 
>is that no user CALs are required. And I think the case is 
>clear when there are only Windows workstation and one samba server.
>
>However, in the case where I have a Windows member server 
>joined to the Samba4 domain, do I need user CAL to access that 
>windows server throught SMB protocol? The MS licencing seems 
>to say yes 
>(http://www.microsoft.com/licensing/about-licensing/client-acce
>ss-license.aspx). But I cannot imagine how this could not be 
>considered as anticompetitive practice, at least here in 
>Europe... Indeed, it would remove the main financial advantage 
>of Samba4 over MSAD.
If the user authorisation is done with samba4, and there is no connection done
to the windows server.
then you dont need a windows user/device cal.

If you have for example en MS SQL server running and you connect to the
database,
but not to printer and/or shares on the server, so only a connection by port for
sql,
then, you only need sql licences. ( and the server licence ofcourse) 
>
>I have a client with an old Windows 2003 AD with all the 
>associated CALs that would need get an upgrade, and they would 
>prefer to go on the samba4 path. However if they have to pay 
>all the user CALs, the boss don't see any financial interest, 
>but only sees the risk associated with the migration.
The same risk is also there when you migrate/upgrade to windows XXX servers. 
>
>So, here are my questions... First a weird one : does the 2003 
>user CAL are "compatible" (in the licencing legal way) with a 
>samba4 server in 2008R2 forest mode in order for the windows 
>workstation to access both linux and windows server on the network?
see above. ( note, a windows 2003 cal is not a windows 2008 cal ) 
but, if you keep the 2003 server, you can use the calls even in 2008 mode. 
if you upgrade the 2003 to 2008, then you wil need to upgrade the cal's
also.
>
>Second : Is the CAL version requirement relative to the Active 
>Directory version or to the highest Windows server version on 
>the network? That is to say, if I add a win2k8 server on a 
>domain managed by an win2k3 AD, do I have to buy win2k8 CAL?
depends on FSMO roles and how you are accessing the servers. 
>
>I have not found any definitive answer on the internet. I can 
>only imagine that the CALs are associated to the number of 
>Active Directory accounts and Active Directory version, 
>otherwise one get kafkaesque issues. But in the case of 
>samba4, the notion of Active Directory version seems exotic... 
>Do any of you have any experience on those licencing questions?
Yes, i have.. 

My setup is as follow, Windows 2008R2 ADC and samba 4 DC. all FSMO roles are
transferred to samba.
Samba handles the profiles/ user auth, printing, file share-ing. 
My windows server(s) are 1 x 2003 member server, 1 x 2008 R2 server ADC. 
The 2003 server is running Voip software, the 2008R2 is running MS SQL for my
voip software.
( a boss who bought something without consulting IT first...  :-((  ) 
I only have 5 user licences, de one included with the server. 
also, only 3 user connects to the windows server, everything else is done by
samba.

I've had a SAM-evaluation by MS, and im fully legit this way, acording to
microsoft.
So yes, you can save costs in licencing. 
>
>Thanks for you input. Samba4 rocks!
Totaly agreed with that. ! 
>
>Cheers,
>
>Denis
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>

Hello Dennis,

sorry, this answer got longer ... :-)


First: MS Licensing is a very complicated thing. Distributors getting 
special trainings for that. That's why I recommend to ask at Microsoft 
and tell them about your environment and they will tell you what you 
have to license.



This is what I remember from my last talk with MS about a similar 
situation (no warranty for correctness!):

If you have only Samba servers and MS Windows Workstations, then you 
don't need to license anything (you only have to buy the Workstation 
license, like Win7 Pro, of course).

If you have at least one MS Server in your network, then this situation 
changes: Like on the page you have linked, you can decite between client 
CALs or user CALs. If you have more user accounts in your network than 
machines (every device counts!), then you should buy client CALs. If 
it's the other way around, you buy user CALs. BUT: You can't mix and you
can't switch. And it doesn't matter what kind of services (Terminal 
Server and SQL Server are special here. See later) your user/clients are 
accessing on the Windows Server.

In the next examples I use user CALs (but it's the same for client CALs):

For every user who access your window(s) server, you have to buy one 
CAL. There it doesn't matter, if the user only access a file share or 
spool his printjobs over this server. If the Windows machine is a DC, 
then it's the same (the workstations access LDAP/AD and at least the 
sysvol share - and so it is an access).

If you only have a single Windows Member server, that is accessed in any 
way from only 5 of your 100 users, then you only have to buy 5 user 
CALs. But if you have 100 users total and 5 access only the first 
server, 50 only the second, 10 only the third and the rest access all, 
then you have to buy CALs for all users.

MS Terminal Server and MS SQL servers have additional CALs. For all 
user/clients accessing TS or SQL, you have to buy TS/SQL CALs 
additionally to the windows server CALs.

When you buy server CALs for all user/client - lets say for Server 2012 
- then it doesn't matter, if your Windows server are running all on a 
previous version. The license is downgradeable. So if you have bought 
all licenses for Server 2012 and you bring one 2012r2 into your domain, 
then your CALs are not valid for that and you have to buy new ones (or 
you have Software assurance or something that allows you).




Am 05.11.2013 10:38, schrieb Denis:
> I have a licencing question : do one need to buy CAL for every
 > user in a Samba4 domain when there is a Windows Server as a
 > domain member, knowing that the Windows server will be
accessed
> using SMB by Windows workstations?
If no one is accessing the Windows server in any way (share access or 
anything else on the server), then you don't need CALs. But then you 
don't need this server. :-)



> As per http://www.samba.org/samba/docs/using_samba/ch01.html
> and many other web sites, one of the main advantage of samba is
> that no user CALs are required. And I think the case is clear
 > when there are only Windows workstation and one samba server.

Not just one Samba server. If all your servers are Samba and no Windows 
server is in the network, then you don't need CALs.



> I have a client with an old Windows 2003 AD with all the associated
 > CALs that would need get an upgrade, and they would prefer to go
 > on the samba4 path. However if they have to pay all the user CALs,
 > the boss don't see any financial interest, but only sees the risk
 > associated with the migration.

If you replace your Windows servers with Samba, and have no Windows 
server left, that your user/clients access, you don't need CALs.



> So, here are my questions... First a weird one : does the 2003
 > user CAL are "compatible" (in the licencing legal way) with a
samba4
 > server in 2008R2 forest mode in order for the windows workstation
 > to access both linux and windows server on the network?
 >
 > Second : Is the CAL version requirement relative to the
 > Active Directory version or to the highest Windows server version
 > on the network? That is to say, if I add a win2k8 server on a domain
 > managed by an win2k3 AD, do I have to buy win2k8 CAL?

You need to have MS server CALs for the highest version of a windows 
server that is in your network. If your newest Windows OS is server 
2003r2, then CALs for that old version would be fine. But if you bring a 
newer server version to your network, this CALs are not valid for that 
any more. But you can buy Server 2012 CALs. They can be used for older 
version, too. And when you install a version up to 2012 (not r2! for 
this example) then it's covered.




So as you see, it's very complicated and I really recommend to talk with 
MS or a distributor about your environment. They will tell you, what and 
how many licenses you will need.



Once again: I give no warranty for correctness of the above!


Regards,
Marc