Only user objects that have the enatelSSOStorageV3 container assigned to them consume a license.
If licenses need to be reclaimed from users this can be done via the Console (as long as the user is disabled) or by using an LDAP browser and deleting the enatelSSOStorageV3 container.
The license is tied to the user not the computer. If the user is disabled in AD the license is not automatically reclaimed. The user needs to be removed in the console but if this is done then all their ESSO data will be lost and cannot be recovered