> can Windows Server 2003 be used

2003 reached end of life on July 14, 2015...

We did have WSUS running on our 2003 Secondary Domain Controller servicing Windows 7 and 2008 Server clients just fine. But as another poster said, 2003 is seriously EOL so the latest versions of WSUS might not work.

There was a time, at one point, when MSFT qualified that CALs were not needed for WSUS if the underlying Windows Server version did not require CALS: http://www.wsus.info/index.php?showtopic=5592

Getting definitive licensing answers out of MSFT has proven difficult for me. I've gotten varying answers from different people in the past (not necessarily about this topic). MSFT definitely keeps things vague, IMO, to keep their options open.