The proper way to ensure the session count doesn’t get this high is to train your users to click the logoff button when they are done.  I am not sure what version you are using but essentially yes you can control the time out session for Crystal Server.

There are four real places that determine the overall user session.  These being the logon token, the web session, the enterprise session and the cms fail over token.

What is of particular interest to you is the Web Applications session and the Enterprise session.

The Web Session time-out is what the customer may change.  This can be done by modifying the web.xml file of the desired application.  Ex. If you wanted to change the web session timeout, you would need to change the web.xml file for InfoView.  Or alternatively for .NET it would be the web.config file.

The default timeout for this is 20 minutes and can be adjusted as stated.  Once the Web application times out, the Enterprise Session will wait for 10 minutes from the last communication of the Web Applciation.  Once this occurs it will then be invalidated and then decrement the CMS session count.

So an example would be if you set the Web Application session timeout to 3 mintues, it could still take anywhere from 7 min to 13(conservatively 14/15) to decrement the user session and free a CAL.

If you need further help with how to configure this, if you are under maintenance you can contact your support representative.  Hope this helps!