How many Windows guests does Standard still cover?

The gap is the guest count

The order page has two Windows tiers: Windows Server Standard and Windows Server Datacenter. Both offer 2019, 2022, and 2025. The monthly add-on is $22 or $25. The $3 gap matches guest count. It does not mean one tier is missing half the roles. IIS, file services, and the Hyper-V role install on both. The order separates how many Windows environments run on this physical machine at the same time.

Microsoft’s licensing notes count operating system environments once the physical cores are covered. The guest allowance is the same on 2019, 2022, and 2025. With the cores covered, Standard may use two operating system environments, or two Windows containers with Hyper-V isolation. If both environments are virtual machines, the physical system may still be present, but only to host and manage those virtual machines. It does not also run a web site, a database, or another workload. Windows containers without Hyper-V isolation do not use those two places. Datacenter does not cap Windows Server virtual machines on that same covered host, and it does not cap containers with Hyper-V isolation.

A Linux guest does not use a Windows operating system environment. A Hyper-V host whose guests are all Linux stays on Standard. The third Windows guest moves the order to Datacenter. This order page is one edition, not stacked Standard licenses, and it does not trade extra Standard copies for a third guest. When the plan includes a third Windows guest, the order is Datacenter.

Containers with Hyper-V isolation count as virtual machines in the same allowance: two on Standard, uncapped on Datacenter. Ordinary Windows containers do not count. The count is environments that run together, not environments that started once during a week. A guest that is off during the day does not use the daytime allowance. A set that runs together at night is a second count. Both sets have to fit the edition.

Where Standard stops

One Windows workload on the machine itself is Standard. The physical system is the web site, the database, or the file server, and it does not also run a Windows guest. That is one environment. Standard adds $22 a month. The display language follows the menus the operator reads. The session is RDP on port 3389.

When the host already runs a workload, one more Windows guest still fits. The host counts as 1 and the guest counts as 1. Two environments remain Standard. A second Windows guest makes three. The host exception does not apply, because the host is not only managing virtual machines. That plan is Datacenter. “Only two guests” is the wrong test once the host itself has a workload.

When the host runs no workload and only Hyper-V, Windows guests may reach two. A domain controller and a file server, with no extra site on the host, is the Standard ceiling, not the starting point. A third Windows guest is outside this tier. Linux guests may sit beside those two Windows guests and do not use the allowance. Counting the Linux guests into the “two” moves a valid Standard order onto Datacenter.

Automatic Virtual Machine Activation is a side difference. A Datacenter host can activate the Windows guests on it. A Standard host does not offer that. One or two guests that can be activated on their own do not need Datacenter for the activation method. Once the count is already past the table, the edition follows the count, and activation follows the edition.

Datacenter starts at the third guest

Many Windows guests on Hyper-V means Datacenter, at $25 a month. The third guest is the line, not “ten counts as many.” Three Windows application servers on a Hyper-V-only host are already past Standard’s two virtual environments. Ten guests use the same edition. The difference is whether memory and disks hold them, not the edition name.

Datacenter does not add cores or memory. The machine is still an AMD EPYC 7543P, 32 cores / 64 threads, 2.8–3.7 GHz. Memory is still DDR4-3200 ECC RDIMM at 128GB or 256GB, and no module is added after the order. Ten Windows guests fixed at 8GB each are 80GB, and the host still keeps its own share. 80GB is under the 128GB label, and that does not prove the 128GB machine is enough. Fixed memory and the remaining margin follow the memory note. This note does not reuse the Proxmox ARC figure on Windows. The right edition with the wrong memory tier still cannot take another module after install.

A host workload plus two Windows guests is the same tier as a management-only host with a third Windows guest. Both are Datacenter. “Fewer than three guests” does not keep the first plan on Standard. Ask first whether the host itself has a workload. If it does, the host counts as 1 and guests start at 1. If it does not, guests count from 1 to 2.

A container with Hyper-V isolation counts as a virtual environment in that table. Two isolated containers already fill Standard. A third isolated container is Datacenter. Windows containers without isolation may sit outside Standard’s two environments. They are not two extra virtual machines.

Version, language, and the add-on

Guest count picks the tier. The year does not. 2019, 2022, and 2025 do not change “two or unlimited.” The workload picks the year inside the tier. Standard with 2025 is still two environments. Datacenter with 2019 is still uncapped. A newer year does not buy the third guest.

Language appears only after Windows is selected: English, Traditional Chinese, or Simplified Chinese. That is the display language, not the keyboard layout. A Simplified Chinese interface in front of an English keyboard still orders Simplified Chinese. The keyboard is aligned after the session connects. Language does not change the guest allowance. It does change menu words and some error text. The firewall group name later follows these three images.

The machine is an AMD EPYC 7543P, 32 cores / 64 threads. Memory is DDR4-3200 ECC RDIMM: 128GB at $462 a month, 256GB at $595. The default disks are 2×1TB NVMe, no hardware RAID, each direct-attach, usable capacity 2TB. The facility is Tokyo, Japan. There is no setup fee. The amount due is the monthly total times the number of months, with no discount. The Windows add-on is prepaid on the same term. On 128GB, no extra disk, 250M, and no extra address, the month is $462 plus the system add-on: $484 for Standard, $487 for Datacenter.

The table is only the system add-on, not the machine rent. The yearly gap is $36. It still matches guest count, not a second processor. Linux has no row in this table, and the session is SSH. Windows changes the session to RDP. After payment, the address and account are in the console: SSH and RDP are in the console after payment. The default port is 3389.

The console may list more than one address. RDP uses only the first. The others do not go into the same connection. How extra addresses count with the included one is in How extra IPv4 addresses count with the included one. Connecting to a later address produces a timeout or a refusal that looks like the system never started.

Timeout, refusal, and credentials

Read the error text before choosing the port, the firewall, or the account. Do not change all three at once. A wrong password does not sit in a timeout. A firewall that drops packets blocks a correct account. Changing the password first mixes the next error.

A timeout starts at the address and port

A timeout means the packet left and no session came back. Check the first address in the console and port 3389. The connection string is the address, a colon, and 3389. On the client, run Test-NetConnection -ComputerName HOST -Port 3389. HOST is that first address. When TcpTestSucceeded is True, the port is open. Stop editing the firewall and move to the account. A long wait with False, after the address and port are already correct, means the system may be dropping TCP 3389.

When the RDP path itself is closed, use the graphical session in the console and run the checks below. Do not turn the whole firewall off. Add one inbound allow, or enable the Remote Desktop rule group for the installed language. The English group is Remote Desktop, Traditional Chinese is 遠端桌面, and Simplified Chinese is 远程桌面. A rule by port does not depend on the display name: New-NetFirewallRule -DisplayName 'RDP 3389' -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow. Do not add it again when that name already exists. Enabling the group is Enable-NetFirewallRule -DisplayGroup 'Remote Desktop'. On a Traditional Chinese image the group is 遠端桌面. On a Simplified Chinese image it is 远程桌面.

A refusal means nothing is listening

Connection refused is an immediate reset. Nothing useful is listening on 3389, or the firewall rejects instead of dropping. On the system, run Get-NetTCPConnection -LocalPort 3389 -State Listen. No output means it is not listening. Then Get-Service TermService. Status should be Running and the start type Automatic. If it is stopped: Set-Service TermService -StartupType Automatic, then Start-Service TermService.

The Remote Desktop switch is fDenyTSConnections under HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server. A value of 1 denies connections. A value of 0 allows them. Read it with Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections. To open it, set 0: Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0. Check the listener again. After it appears, Test-NetConnection on the client should become True. If the result is still a timeout, return to the firewall. Do not change the account.

Credentials wait until the port is open

Check the account only when TcpTestSucceeded is True, or the error says the user name or password is incorrect. The user name is the account from the console. The password is the string in the console. A local account takes .\ before the name, so the client does not prefix its own computer name. When the password contains @, #, or $, check the keyboard layout in the next section first. A mismatched layout leaves the interface language correct and sends the wrong symbols into the password box. Fix the layout or the input. Do not reset the password first.

An authentication error or CredSSP, rather than an incorrect user name or password, usually means the port is already open. Try a current Remote Desktop client. Network Level Authentication expects the client to authenticate before the desktop appears. An old client stops there. That error is not a blocked 3389, and it is not a reason to turn the firewall off.

Display language and keyboard layout

English, Traditional Chinese, and Simplified Chinese on the order set the interface and some of the error wording. The RDP client brings its own keyboard layout into the session by default. The interface can be Simplified Chinese while punctuation and shortcuts still come from the client. Passwords, paths, and symbols shift. That is not the wrong edition, and it is not the port.

In a session that is already open, run Get-WinUserLanguageList. Read LanguageTag and InputMethodTips. The first is the language. The second is the keyboard. They can differ. An interface of zh-CN with a keyboard of en-US is a Chinese menu with English symbols.

To put one layout first, build a new list with that language, then add any other language to keep. This replaces the current user’s language list. Simplified Chinese first, English kept:

$Lang = New-WinUserLanguageList 'zh-CN'
$Lang.Add('en-US')
Set-WinUserLanguageList -LanguageList $Lang -Force

Traditional Chinese uses zh-TW as the first item. English interface and an English keyboard use en-US first. Sign out of this session and connect again. Switching the input method once inside the session does not keep the client layout from returning on the next connection.

When the client keeps sending its layout and the server setting does not stick, the session should use the layout in the user profile instead of the client’s layout. Write IgnoreRemoteKeyboardLayout as a DWORD with value 1: New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Keyboard Layout' -Name IgnoreRemoteKeyboardLayout -PropertyType DWord -Value 1 -Force. The value is machine-wide and covers the users on this machine. Disconnect and connect again. The new session follows the server layout. To restore the client layout, set the value back to 0 or delete it, then connect again.

Count before the order

The edition is chosen on the order page. After install, asking Standard for a third Windows guest does not match the allowance. The memory tier is chosen on the same page. Datacenter does not turn 128GB into 256GB. Both are settled before payment.

1. Count the Windows environments that run together. A host with a workload counts as 1. A Hyper-V-only host does not use one of the two places.
2. The host plus 1 guest, or a host with no workload and 1 or 2 Windows guests, is Standard at $22 a month. Linux guests do not count.
3. Two Windows guests beside a host workload, or a third Windows guest, is Datacenter at $25 a month. Do not stack extra Standard copies.
4. Inside that tier, pick 2019, 2022, or 2025. The language is English, Traditional Chinese, or Simplified Chinese. Language is the interface. The keyboard is aligned after connect.
5. A physical machine that will run Proxmox does not take either tier. The Windows guest allowance does not follow Proxmox.
6. Split a failed connection by the error. A timeout checks the first address and 3389, then the firewall. A refusal checks the listener and fDenyTSConnections. Credentials wait until the port is open. Shifted symbols check the keyboard first.

Walk two guests and three. A Hyper-V host with no site, two Windows guests, and several Linux guests: the Windows count is 2, so the edition is Standard. The same host with a third Windows guest is Datacenter. A database already running on the host, plus two Windows guests, is 1+2 and Datacenter. The database alone on the host is Standard. All four plans still have 32 cores. The memory tier follows the fixed memory. RDP uses the first console address and port 3389.

The tier follows the guest count. The error splits into timeout, refusal, and credentials. The count is finished before the order, so a failed connection does not start from the password.