Licensing a Domain Controller Refresh: Windows Server 2025 Standard vs Datacenter for DCs, the 16-Core Minimum, and Why the CAL Version Matters More Than the Server License

Every physical server that runs Windows Server 2025 is licensed for all of its physical cores, with a minimum of 8 core licenses per processor and 16 per server. A host fully licensed with Standard may run two operating system environments; Datacenter may run any number. Every user or device that accesses the server software needs a Windows Server CAL, and authenticating against a domain controller is access; a CAL covers its own version and earlier versions only, so a 2022 CAL does not reach a 2025 server. People who are not your employees or onsite contractors are covered by an External Connector per server accessed, not by CALs. All four rules are on Microsoft's Windows Server 2025 licensing guidance page and in the Product Terms, retrieved October 2026 (see Sources).

At Microsoft list price, October 2026 price list, a Standard 16-core pack is $1,176, a Datacenter 16-core pack $6,770, a 2025 user CAL $50, a device CAL $39 and an External Connector $2,443. Twelve domain controllers on Standard come to $14,112; a thousand users on 2016 CALs without Software Assurance come to $50,000.

A domain controller itself never needs Datacenter; the edition question belongs to the host.

Standard wins for the domain controller that stands alone: a physical server at each site, or a small host running the DC and one other virtual machine. At least one domain controller per site should stay off any cluster that needs Active Directory to boot, and that machine is one 16-core Standard pack.

Datacenter wins on the Hyper-V host that carries the DC alongside everything else. Standard stacks, two more virtual machines per additional pack, but on a 16-core host six stacked packs cover twelve virtual machines for $7,056 at list, more than one Datacenter pack at $6,770, and Datacenter also brings Automatic Virtual Machine Activation; see our Windows Server 2025 licensing article. A virtual DC on a Datacenter 2025 host adds no license; on a Standard host it consumes one of the two OSEs.

Replacing the servers is what makes the CALs insufficient. A CAL bought for Windows Server 2016 covers a 2016 domain controller and nothing newer, so every user and device that authenticates against a 2025 domain controller is accessing a 2025 server. The exception is Software Assurance: new version rights are a Software Assurance benefit, so a 2016-era CAL with Software Assurance still active counts as a current CAL.

User or device is the second decision. A user CAL covers one person on any number of devices; a device CAL covers one device used by any number of people, and the two can be mixed. At Microsoft list price, October 2026 price list, a 2025 user CAL is $50 perpetual, $14 per year or $43 for a three-year term billed once; a device CAL is $39, $12 per year or $36. The External Connector is $2,443 per server accessed and covers any number of external users, people who are not your or your affiliates' employees or onsite contractors, such as suppliers' staff signing in to a portal that authenticates against your domain. RDS CALs are a separate line.

For a server that retires inside a year, a subscription is the honest answer: a medical practice being acquired by a hospital group is rebuilding servers the acquirer will retire after the conversion, and a one-year Standard subscription at $550 for 16 cores covers each until then, against $1,176 perpetual. For a domain controller that will run five years, perpetual costs less at list: three one-year terms come to $1,650 and the three-year pack to $1,408, against $1,176 once.

The reason to pay the premium anyway is that a subscription carries the rights Software Assurance carries on a perpetual license. Azure Hybrid Benefit needs active Software Assurance or qualifying subscription licenses (see our Azure Hybrid Benefit article). Extended Security Updates, the paid safety valve for a 2016 domain controller not replaced by 12 January 2027, need active Software Assurance, active subscription licenses or SPLA licensing; Microsoft's Azure Arc page for Windows Server 2016 states that machines licensed through SPLA or with a Server Subscription do not need Software Assurance. The Flexible Virtualization Benefit, which lets the licenses run on an authorized outsourcer's shared hardware, needs one or the other; License Mobility through Software Assurance does not exist for Windows Server.

Azure Arc sits on both sides of the line. Hotpatching a 2025 domain controller needs an Arc connection, Secure Boot and Virtualization-Based Security and has carried no additional Microsoft charge since 19 May 2026, but Azure Update Manager, which orchestrates it, is included at no extra charge from Microsoft for servers attested under Windows Server Management enabled by Azure Arc (active Software Assurance or subscription licenses), for servers enrolled in ESU through Arc and for subscriptions with Defender for Servers Plan 2; a CSP perpetual license without Software Assurance pays per server per month. Arc add-ons, Update Manager where it is not included, ESU and Azure consumption are Microsoft meters billed to you.

The Cloud Solution Provider program sells Windows Server two ways. Perpetual software is license-only: you own it, it never expires, it carries no Software Assurance, and it fits a domain controller that will run its whole life on your hardware. Software subscriptions run one or three years, are paid up front and carry the subscription-license rights; every license price here is the CSP figure from the Microsoft NCE Software price list for October 2026. Open Value adds Software Assurance to a perpetual purchase over a three-year agreement with annual payments.

An Enterprise Agreement bundles Software Assurance, is sized for 500 or more users or devices and reconciles growth at an annual true-up; the Microsoft Products and Services Agreement is transactional, with Software Assurance optional. We quote CSP perpetual licenses, CSP subscriptions and Open Value; Enterprise Agreements and MPSA are bought through their own program channels, and for a customer inside one we read the agreement, count the entitlements and size the true-up so the order goes through the existing reseller.

A hardware manufacturer with six sites on three continents is replacing about ten Windows Server 2016 domain controllers before 12 January 2027; two per site makes twelve, and fourteen when two more sites open in the first quarter of 2027. Five questions come before any price: which edition each existing host runs, how many physical cores each new or reused server has, whether the current CALs are user or device CALs and how many there are, whether those CALs and the server licenses carry Software Assurance, and which purchasing program the organization prefers.

The server side is twelve to fourteen Windows Server 2025 Standard licenses at the 16-core minimum, $1,176 each at Microsoft list price, October 2026 price list, because at least one DC per site stays off the cluster it authenticates and that physical server is Standard territory. Hotpatching is why the customer chose 2025, so each new DC is Arc-connected at build time; whether Update Manager is included depends on the Software Assurance answer.

The CALs are the open question. If they are 2016-era without Software Assurance, every user and every piece of factory and lab equipment that authenticates needs a 2025 CAL, and at $50 per user CAL that line is larger than the services fee for the multi-site domain controller migration itself. Windows Server 2016 ESU stays priced as the safety valve if Phase 1 slips, not as the plan; the sequencing is in our order of operations article.

Server entitlements live in volume licensing statements, CSP invoices and OEM stickers rather than in an admin center. We quote only what makes sense against what you already own: CALs with Software Assurance mean server packs alone, Microsoft 365 equivalency is checked before any CAL is priced, and a server with a retirement date gets a subscription.

We're replacing 12 domain controllers with Windows Server 2025: what licenses and CALs do we need, and does the CAL version matter?

Twelve Standard licenses at the 16-core minimum, $1,176 each at Microsoft list price, October 2026 price list. The CAL version matters more: a CAL covers its own version and earlier only, so every user or device that authenticates needs a 2025 CAL unless the existing CALs carry Software Assurance.

Standard or Datacenter for a domain controller?

Standard for a physical DC or a host with the DC and one other VM; Datacenter for the Hyper-V host carrying the DC with about twelve or more VMs on 16 cores.

Do we need new CALs if we only replace the servers?

Yes, if they are 2016, 2019 or 2022 CALs without Software Assurance. CALs with active Software Assurance carry new version rights and stay valid.

Subscription or perpetual for servers that retire in a year?

A one-year subscription: $550 for a 16-core Standard server against $1,176 perpetual, with ESU eligibility and Arc attestation while it runs. For a server that will run five years, perpetual costs less at list.

Can we license a virtual domain controller by its virtual cores instead of the whole host?

Yes, at a minimum of 8 core licenses per VM, with subscription licenses or active Software Assurance only; on a Standard host it is the alternative to stacking.