The information I'm getting from the software vendor from which my wife recently purchased her new small business's domain-specific office management software is giving me the creeps. My impression is that this is relatively low-volume software, but it's developed and sold by a larger company that's a well-known name in her field. The software uses MS SQL Server as its database and our purchase agreement included 1 server license and 5 CALs for SQL Server 2008 Standard.
The first thing that struck me as odd was when I discovered that their installer app had taken the liberty of changing the SA password on my server to something much less secure. When I asked about this I was told that their particular reseller arrangement with Microsoft required them to change the SA password so that their specially-licensed instance could only be used for their application. Practically this isn't a problem as I still have dbo access via my Windows login, but the explanation sounded extremely suspicious.
Then today I inquired again about when we could expect to receive our official SQL Server product key, since to date we've been running on an instance I installed from my MSDN media, temporarily activated using one of my MSDN product keys (the business isn't open yet and I've been assuming I'd have a valid product key by this point). I was told that their rep would need remote access to our server so that he could re-install SQL Server using their media which has an "embedded key". Is MSSQL even offered on pre-pidded media, and if so is anyone allowed to re-sell pre-pidded media? Because he's insisting on remoting in and installing himself, my assumption is that we would not end up with a copy of this pre-pidded media with our own product key embedded. He also claimed that my instance installed with MSDN media will not work with their license.
Am I being paranoid or does this sound fishy? I'm a .NET developer with almost zero experience with MS licensing, but I know it can be complicated so I suppose this all could be completely normal. At this point though I'm leaning toward insisting they either send us a valid product key and server/CAL certificates, or give us a refund on the MSSQL portion of our purchase.
UPDATE as of 3/21/11: The vendor does now claim to participate in the ISV Royalty program mentioned by @Sergey below. They don't appear to me to be complying with that program's requirements though; specifically the SQL Server EULA wasn't incorporated into our contract, and they offer SQL as an optional extra-cost component of their solution rather than an integral part. I contacted MSFT Licensing and was told they'd need the vendor's ISV agreement number in order to look into it further. The vendor's Director of IT agreed to send me a copy of their ISV agreement, but I have yet to see it (or any response for that matter).
So finally, about 2 weeks ago I filed a report with the BSA. I should find out in the next several weeks whether they're going to open an investigation or not, but the rep I spoke with didn't sound optimistic -- he said priority is usually given to cases where end-user employees are reporting their employers.
At any rate, the MSFT licensing rep told me that as long as my wife's business has an invoice from the ISV showing the required number of SQL licenses were included in the purchase, she's covered, regardless of whether the vendor is in compliance or not.