As expected, I got conflicting information from many people who were all pretty confident that they were correct... I think the following is as close to the facts as we're likely to get:
A great link can be found here (thanks to Dan Stoner):
http://www.microsoft.com/windows2000/server/howtobuy/pricing/model.asp
I think a great way to sum up is that anyone who authenticates to the server needs a CAL. This includes internet connections (websites) that are password protected, as well as domain (active directory) account logins. I'm not sure if this includes FTP connections, but assume that it probably does. If you have 293 machines that could connect to your server then you need 293 CAL's, even if you only have 10 users. This is the MS traditional licensing model that they cal 'per seat' licensing.
They do offer a new type of CAL that isn't shown on this website; the User CAL. With the user CAL a user could log in from any computer and still just need the one CAL since it is based on their user account, rather than 'per seat' as it is in the old CAL's. In the above scenario with 293 machines and 10 users, you would only need 10 user CAL's. This seems like a much better, and certainly more economical license model.
We purchased user CAL's through the UF Dell contract for $4.94 per CAL. This doesn't seem too unreasonable.
Hope this helps some of you!
Erik C. Schmidt
Webmaster
MS Network Administrator
Coordinator, Computer Technical Support
College of Veterinary Medicine
University of Florida
(352) 392-4700 x4329