The Microsoft COA (Certificate of Authenticity) is a security label/sticker that serves as proof of a genuine Microsoft software license. A COA demonstrates that the software is a legitimate, original copy from Microsoft, and it is designed with security features like holograms and color-shifting inks to prevent counterfeiting. COAs are the physical representation of your OEM/ROK license and as such must be permanently retained by the end user. Do not lose or discard your COA because neither Lenovo nor Microsoft can replace your COAs. Among other things COAs include:

• The name of the manufacturer
• The name and edition of the software or the type and quantity of Client Access Licenses (CALs)
• A unique serial number or tracking ID allowing Microsoft to track the software
• A software activation code behind a concealment layer (in the case that activation is required for the particular software)

[image: Example of a Lenovo COA with activation code]

[image: Example of Lenovo COA without activation code]

The OEM/ROK licensing model is a physical licensing model and the COA is the physical proof of license entitlement. COAs may also include an activation key (often referred to as 5X5) behind a concealment layer.

As such the COA is the most important part of your OEM/ROK license and the COA and/or the activation key cannot be replaced or reproduced by either Lenovo or Microsoft. Lenovo strongly recommends that you keep a secure digital record of your 5X5 product key as COA stickers may be inaccessible once the server is racked. However in the case of a Microsoft software audit only physical COA stickers will be accepted as proof of license.

Microsoft OEM/ROK licensing is a physical licensing model and activation codes are printed on the COA sticker. ROK/OEM activation codes cannot be shared digitally by Microsoft and Lenovo and Lenovo in particular has no knowledge of activation codes.

When buying a genuine license, the activation code is hidden behind a concealment layer, which has to be removed similar to a scratch-off lottery ticket. Please study the following documentation carefully in order to avoid destroying the COA while removing the concealment layer:

• Certificate of Authenticity (COA) Concealment Guidance - PDF
• Certificate of Authenticity (COA) Concealment Removal Demonstration – Video

In the unlikely case of a production defect or partial destruction of the COA during concealment layer removal Microsoft can provide a replacement activation code via Email.

Do not contact Microsoft directly but send your email to XXXXX@lenovo.com and provide high-resolution photographic evidence of your damaged Lenovo COA. Blurry photos cannot be accepted, and the serial number of the COA must be clearly legible.

Lost COAs or completely undecipherable COA stickers cannot be replaced.

The Lenovo OS Interoperability Guide (OSIG) is your comprehensive source of information about operating system compatibility with Lenovo servers – this includes Windows Server of course.

You can find out which versions of Windows Server are supported and certified for certain Server Families or individual Server models.

Of course you can also consult the Windows Server Catalog from Microsoft in order to identify and verify the status of tested products for Windows Server.

Yes, Lenovo offers a Windows Server Datacenter ROK license with explicit reassignment rights. While this ROK license must be sold together with a Lenovo server like any other Windows Server ROK license, it includes the right to move/reassign the license to another server once every 90 days and/or if you retire the licensed server due to permanent hardware failure.

Please note that this license is not available as an OEM/Feature Code license and can also not be preloaded.

https://www.microsoft.com/en-us/useterms#areaheading-uid6738237

A Client Access License (CAL) is a license that gives users or devices the legal right to access and use services provided by Windows Server software. CALs are not software—they are a licensing requirement.

Yes. The Windows Server license covers the installation and operation of the server software. CALs are required for each user or device accessing the server.

• User CAL: Assigned to a person. That user can access the server from multiple devices.
• Device CAL: Assigned to a device. Any user can access the server from that device.

Choosing the right type helps optimize both costs and administration.

• Choose User CALs for employees who use multiple devices.
• Choose Device CALs if multiple users share a single device (e.g., in shift work).

Sales Tip: Ask your customer if their users share devices, or if individuals use multiple devices. This helps determine the most cost-effective CAL type.

A Remote Desktop Services (RDS) CAL is an add-on license required for users or devices accessing the server via Remote Desktop or RemoteApp.

None. CALs are purchased separately from the Windows Server license.

Depending on your setup and use case, you may need Windows Server CALs and Remote Desktop Services (RDS) CALs.

• Windows Server CALs are required for each user or device accessing a Windows Server. These are base CALs that grant access to the server OS features like file sharing, printing, etc.
• Remote Desktop Services (RDS) CALs are required in addition to Windows Server CALs if users or devices are accessing the server via Remote Desktop Protocol.

Yes, device and user CALs can be used on the same server but you must track and manage them separately. You can't assign both types to the same user or device.

No. CALs are perpetual. RDS CALs can only be used for the version they're purchased for. Windows Server CALs are backward-compatible, so Windows Server CALs for the most recent release of Windows Server will work with earlier versions.

No. CALs must match or exceed the version of the Windows Server they are accessing.

Yes. You can buy extra Lenovo CALs independently from a new server. Lenovo offers flexible packs: 1, 5, 10, or 50 packs of User or Device CALs and 5 packs of RDS User or Device CALs.

No. Since the virtual machine runs on a Windows Server 2025 license, access requires Windows Server 2025 CALs—even if the VM itself is Windows Server 2022.

Windows Server CALs are backward-compatible, so a CAL for the latest Windows Server release will work with earlier versions. RDS CALs, however, can only be used for the version they're purchased for.

Yes. Each new Windows Server release requires matching-version CALs. You can either buy new CALs when the version is released or purchase Software Assurance within 90 days of purchasing the prior-version CALs. Software Assurance includes upgrade rights.

The Operating System (OS) license grants the right to install and run the OS on a server. CALs are separate because they license access - per user or device. Separating the OS and CALs helps keep upfront costs low and lets organizations scale licensing based on actual usage.

Exceptions: Windows Server Essentials does not require separate CALs for users or devices. It is licensed for up to 25 users and 50 devices, so you do not need to purchase additional CALs for those users/devices. Remote Desktop Services (RDS) are not supported in Essentials. You cannot use RDS CALs to enable full Remote Desktop functionality.

No—CAL packs are either all user or all device. Lenovo offers 1, 5, 10, or 50 CAL packs so you can buy exactly what you need.

Yes. CALs are not shared or floating licenses. They are assigned to a specific user or device, but you can reassign them if someone leaves, or a device is decommissioned.

Windows Server CALs are not enforced by product keys. The value of the CAL pack COA is the proof of purchase. Your invoice acts as a proof of purchase so there is no need to replace the CAL if it's lost.

RDS CALs are enforced. You must enter the license key into the RDS Licensing Manager within the OS. RDS CALs cannot be reissued if lost, so treat RDS CAL activation keys like cash - access should be carefully managed.

To access Windows Server, you need a Windows Server CAL. This CAL grants access to basic server services like file sharing, printing, and authentication. It is required for any user or device accessing the server, directly or indirectly.

A Remote Desktop Services (RDS) CAL is an additional license required for Remote Desktop Services such as remote desktop sessions or virtual apps. Both a Windows Server CAL and an RDS CAL are needed for remote access.

RDS CALs include a product key and must be activated. Windows Server CALs do not require activation.

Exception: Up to two users or devices can access the server for admin purposes only—no CALs required.

On the server where you want to install the downgraded CALs:

1. Launch the Remote Desktop Licensing Manager.
2. Choose Telephone Activation.
3. Right-click your license server, go to Properties, and set the Connection Method to "Telephone."
4. Select your country and proceed to the activation screen.
5. Call the Microsoft Clearinghouse telephone number shown for your country.
6. You'll be asked to provide your license server ID, proof of purchase, and the version you want to downgrade to (e.g., Server 2022 or 2019).
7. Microsoft will issue a downgrade-compatible key.
8. Enter it into the Licensing Manager to activate the CALs for the older server version.