Skip to main content
Solved

BT Password Safe Cloud SaaS (RDS CAL)

  • February 11, 2026
  • 2 replies
  • 72 views

Forum|alt.badge.img

Hi All,

Please correct me if I am wrong. Based on the architecture diagram (refer to the part highlighted in red), does this mean that the Resource Broker server requires an RDS CAL license for users to start a proxy session through the resource broker server (on port 4489 or port 4422) to the managed system like windows server, linux server and network devices?

Thanks again.

 

 

Best answer by GloriaB

No, the Resource Broker does not need a Windows RDS cal license to start a session.  

When the user initiates a proxied RDP session via Password Safe the user connects to port 4489 on the  Resource Broker (RB) for Password Safe Cloud and the RB creates a RDP session to the target server on port 3389 with the managed account credentials.

 

The only time an RDS license would be needed would be for doing Windows based application where more than 2 users need to connect to the app. 

 

For more information, refer to the following:

How do remote sessions (SSH and RDP) work when proxied via Password Safe

https://docs.beyondtrust.com/bips/docs/ps-cloud-resource-broker-install

 

 

2 replies

GloriaB
BeyondTrust Employee
  • BeyondTrust Employee
  • Answer
  • February 13, 2026

No, the Resource Broker does not need a Windows RDS cal license to start a session.  

When the user initiates a proxied RDP session via Password Safe the user connects to port 4489 on the  Resource Broker (RB) for Password Safe Cloud and the RB creates a RDP session to the target server on port 3389 with the managed account credentials.

 

The only time an RDS license would be needed would be for doing Windows based application where more than 2 users need to connect to the app. 

 

For more information, refer to the following:

How do remote sessions (SSH and RDP) work when proxied via Password Safe

https://docs.beyondtrust.com/bips/docs/ps-cloud-resource-broker-install

 

 


Forum|alt.badge.img

Hi ​@GloriaB , much appreciated for the clarification. At first, I thought the Resource Broker still require an RDS CAL license to operate as a proxy, since the Resource Broker OS usually prepared by the customer/organization before the RB installation. This is different from UVM (on-prem), where the OVA package already includes both the OS and BeyondTrust components. Thanks again for the clarification.