On the surface, implementing a virtual desktop infrastructure (VDI) looks relatively simple – get rid of your desktops and replace them with thin clients that connect to server-based, centrally-managed images.  However, once you get beyond that initial seeming simplicity, things start to get a little more challenging.  In my last column, I brought you up to speed on where Westminster College is with its VDI testing.  In this column, I’ll bring to light some of the Microsoft licensing challenges that might take VDI out of reach for some organizations.

First of all, VDI can bring with it significant licensing headaches.  Beyond trying to decide if you need your VDI vendor’s light, silver, gold, platinum or titanium VDI solution, you need to think about the hypervisor on which VDI will run and how you will handle client connections – through a broker or not.  Those are difficult questions in and of themselves.  Once you get beyond those, Microsoft has also added another hurdle.  Unfortunately, even if you’re a volume license customer with Microsoft, you don’t get a free pass when it comes to moving your desktop images to a server-based solution.  Instead, Microsoft imposes a VDI tax on you in the form of the Virtual Enterprise Centralized Desktops (VECD) license. Your standard volume Windows license prohibits a number of use cases that are critical in order to stay in compliance as you move to a virtualized infrastructure.  According to Microsoft, VECD adds the following rights:

  • Ability to run a copy of Windows (client) in a datacenter
  • Rights to move virtual machines between servers for increased reliability
  • Unlimited backup of virtual machines
  • Ability to access up to four running VM instances per device
  • Rights to access corporate desktops from home for a user that has already been licensed at work
  • Availability to volume licensing keys, such as Key Management Service (KMS) and Multiple Activation Keys (MAK)

I’d imagine that this license is related to a somewhat similar stipulation found in Microsoft’s volume licensing agreements; that stipulation requires that a volume copy of Windows replace some other copy of Windows that was purchased with a computer.  You can’t, for example, use your volume Windows license to upgrade a machine you bought with Linux.  Because there are so many thin clients out there that run something other than Windows, this appears to be Microsoft’s way of making sure that they obtain the revenue on both sides of the equation – at both the client and the server side.  That said, VECD is required even if you’re connecting to a VDI-hosted desktop from an existing Windows desktop.

VECD licenses are available in two flavors:

  • VECD for Software Assurance: This is a device-based license that is available only to those customers with an active Software Assurance contract which, by extension, also means that it’s available only to those with volume licensing agreements with Microsoft. As of today, this license costs $23 per client per year.
  • VECD: Also available on a per-device basis, the VECD license is intended for those clients that are not able to run Windows, such as Wyse ThinOS terminals. This license can also be used to cover Windows clients that do not have Software Assurance. This license costs $110 per device per year.

Note that those are per year prices which could conceivably destroy any ROI that would be otherwise found with VDI.  It’s also important to note that this is a device-based license.  It’s not a user license. It’s not a server license.  It’s not even a desktop license.  Microsoft’s licensing guidelines do make provisions for working at home, though.  For each user of a device that falls under the VECD license, Microsoft will allow that user to access a VDI-based desktop image from a home device as well as the VECD-covered device.  Further exceptions are granted for administrators that might need to perform maintenance on a variety of hosted desktops.

It should also be noted that the underlying VDI technology makes no difference.  If you’re using VMware, you need VECD.  Even if you’re using Microsoft’s new VDI package, you still need to add VECD to the cost equation.

Microsoft provides complete Product Use Rights Guides for all of their products that definitively outline exactly what is and what is not allowed with each of their products.  In the section below, I’ve copied and pasted the exact text regarding VECD from the October 2009 use guide.  I include this here only because Microsoft is extremely specific is what you can do with VDI and the nuances are extremely important to understand.

Personally, I think that Microsoft is doing itself some serious long-term damage with the VECD license.  The license restricts the potential mobility of the solution and adds huge overhead that will definitely not help on the justifcation side of the implementation equation.

Here’s what I want: Use my volume Windows license any way I want and in the way that makes the most sense for my organization. At present, without VECD, I can’t use that volume license in a hosted container which, to me, makes no sense at all except for the fact that it adds to Microsoft’s bottom line.  The only saving grace for Westminster is that the VECD is really cheap under the Campus Agreement, but that doesn’t help non-academic entities that want to use VDI.  It also appears as if VECD prohibits me from allowing people to access their VDI-hosted desktop from anywhere they want.

If, after reading this column, you think I’ve completely misinterpreted the VECD license, please respectfully correct me in the comments.

Straight from the October 2009 Product Use Rights Guide

Windows Virtual Enterprise Centralized Desktop and Windows Virtual Enterprise Centralized Desktop for Software Assurance.
The Desktop Operating System section of the product use rights, as supplemented below, provides your license terms for the software. “Instance” and other terminology in the Universal Terms related to use of the software with virtualization technology apply. 
a) Assigning the License to the Device.

  • Windows Virtual Enterprise Centralized Desktop. Before you run any instance of the software under a license, you must assign that license to a device. A hardware partition or blade is considered to be a separate device. Despite the limitation in the General License Terms, you may reassign your license, but not on a short-term basis (i.e., not within 90 days of the last assignment). You may reassign your license sooner if you retire the licensed device due to permanent hardware failure.
  • Windows Virtual Enterprise Centralized Desktop for Software Assurance. The device to which you assigned your corresponding license and Windows Software Assurance coverage is the “licensed device.” If you move your Windows Software Assurance coverage to a replacement computer, that computer becomes the “licensed device.” You may also reassign your license to any other licensed device for which you have active Windows Software Assurance coverage, but not on a short-term basis (i.e., not within 90 days of the last assignment). You may reassign your license sooner if you retire the licensed device due to permanent hardware failure.

b) Running Instances of the Software. For each license you assign:

  • You may remotely access from the licensed device, at any one time:
    • one running instance of the software in one physical operating system environment, or
    • up to four running instances of the software in virtual operating system environments (only one instance per virtual operating system environment).
  • You may run the permitted number of instances, at any one time, on up to four different servers.
  • You may run an instance of Windows 7 Professional in place of the software in any of these virtual operating system environments.
  • Despite anything to the contrary in your license agreement, you may access the instances only from the licensed device, with the following exceptions.
    • You may remotely access the instances from any other device to which you have assigned an active Windows Virtual Enterprise Centralized Desktop or Windows Virtual Enterprise Centralized Desktop for Software Assurance license.
    • The single primary user of the licensed device may remotely access the instances from a single device in that user’s home, subject to the limitation on the number of users in the General License Terms.
    • You may use Remote Assistance and other similar technologies to share an active session.
    • You do not need a license to access your instances of the software (locally or remotely) only to administer those instances.
  • You have the following right if the licensed device is assigned a Windows 7 Professional license. You may run one or more of the permitted instances locally in a virtual operating system environment on the licensed device either using the Microsoft Desktop Optimization Pack component technology Microsoft Enterprise Desktop Virtualization (MEDV) or similar technologies or from a storage device, such as a network server, over an internal network. Your license does not otherwise permit you to run instances of the software locally on the licensed device or any other device to which you have assigned an active Windows Virtual Enterprise Centralized Desktop or Windows Virtual Enterprise Centralized Desktop for Software Assurance license.

c) Creating and Storing Instances on Your Servers or Storage Media. You have the additional rights below for each license you acquire.

  • You may create any number of instances of the software.
  • You may store instances of the software on any of your servers or storage media.
  • You may create and store instances of the software solely to exercise your right to run instances of the software under any of your Windows Virtual Enterprise Centralized Desktop or Windows Virtual Enterprise Centralized Desktop for Software Assurance licenses as described above (e.g., you may not distribute instances to third parties).
  • Except as permitted for a licensed device to which you assigned a Windows 7 Professional license, you may not create and store instances of the software on the licensed device.

d) Windows Virtual Enterprise Centralized Desktop and Windows Virtual Enterprise Centralized Desktop for Software Assurance Work at Home (WAH) License. The single primary user of the corresponding Windows Virtual Enterprise Centralized Desktop or Windows Virtual Enterprise Centralized Desktop for Software Assurance licensed device (work device), may run an instance of the software in a virtual operating system environment on a single qualifying home device using the Microsoft Desktop Optimization Pack component technology Microsoft Enterprise Desktop Virtualization (MEDV) or similar technologies.  All use must be for work related purposes.  A “qualifying home device” is a device assigned a license for any edition of Windows XP, Windows Vista or Windows 7, and on which that software is installed.  The WAH user’s right to use the software terminates when the corresponding rights on the work device expire or there is a change in the primary user status or when the WAH user leaves your organization. At that time, the organization will ensure that the WAH user will not have access to the virtual operating system.
e) Term of License. Despite anything to the contrary in your license agreement, your Windows Virtual Enterprise Centralized Desktop or Windows Virtual Enterprise Centralized Desktop for Software Assurance licenses and corresponding WAH licenses are non-perpetual.  You may not access or use the software under your licenses after your subscription or corresponding Windows Software Assurance coverage expires.