KMS uses a client-server model to active Windows clients and is used for volume activation on your local network. KMS clients connect to a KMS server, called the KMS host, for activation. The KMS clients that a KMS host can activate are dependent on the host key used to activate the KMS host. This article walks you through the steps you need to create a KMS host. To learn more about KMS and the initial planning considerations, see Key Management Services (KMS) activation planning.
Prerequisites
A single KMS host can support an unlimited number of KMS clients. If you have more than 50 clients, we recommend that you have at least two KMS hosts in case one of your KMS hosts becomes unavailable. Most organizations can operate with as few as two KMS hosts for their entire infrastructure.
KMS hosts do not need to be dedicated servers, and KMS can be co-hosted with other services. You can run a KMS host on any physical or virtual system that is running a supported Windows Server or Windows client operating system.
The version of Windows you use for your KMS host determines the version of Windows you can activate for your KMS clients. Please see the table of activation versions to help you decide which is right for your environment.
By default, KMS hosts automatically publish SRV resource records in DNS. This enables KMS clients to automatically discover the KMS host and activate without the need for any configuration on the KMS client. Automatic publishing can be disabled and the records can be created manually, which is also necessary for automatic activation if the DNS service does not support dynamic updates.
You will need:
A computer running Windows Server or Windows. A KMS host running on a Windows Server operating system can activate computers running both server and client operating systems, however a KMS host running on a Windows client operating system can only activate computers also running client operating systems.
The user account you use must be a member of the Administrators group on the KMS host.
A KMS host key for your organization. You can get this key from the Product Keys section of the Volume Licensing Service Center.
Install and configure a KMS host
From an elevated PowerShell session, run the following command to install the Volume Activation Services role:
Configure the Windows Firewall to allow the Key Management Service to receive network traffic. You can allow this for any network profiles (default), or for any combination of Domain, Private, and Public network profiles. By default, a KMS host is configured to use TCP on port 1688. In the example below, the firewall rule is configured to allow network traffic for the Domain and Private network profiles only:
Launch the Volume Activation Tools wizard by running:
vmw.exe
Select Next on the introduction screen. Select Key Management Service (KMS) as the activation type and enter localhost to configure the local server or the hostname of the server you want to configure.
Select Install your KMS host key and enter the product key for your organization, then select Commit.
Once the product key has been installed, you need to activate the product. Click Next.
Select the product you want to activate from the dropdown menu, then select whether you want to activate online or by phone. In this example, select Activate online and then Commit.
Once activation is successful, the KMS host configuration will be shown. If this is the configuration you want, you can select Close to exit the wizard. DNS records will be created and you can start activating KMS clients. See the section below if you need to manually create DNS records. If you want to change the configuration settings, select Next.
Optional: Change the configuration values based on your requirements and select Commit.
Note
You can now start activating KMS clients, however a network must have a minimum number of computers (called the activation threshold). KMS hosts count the number of recent connections and so when a client or server contacts the KMS host, the host adds the machine ID to its count and then returns the current count value in its response. The client or server will activate if the count is high enough. Windows clients will activate if the count is 25 or higher. Windows Server and volume editions of Microsoft Office products will activate if the count is five or greater. The KMS only counts unique connections from the past 30 days, and only stores the 50 most recent contacts.
Manually create DNS records
If your DNS service does not support dynamic update, the resource records must be manually created to publish the KMS host. Create DNS resource records for KMS manually with your DNS service using the information below (altering the default port number if you changed this in the KMS host configuration):
Property
Value
Type
SRV
Service/Name
_vlmcs
Protocol
_tcp
Priority
0
Weight
0
Port number
1688
Hostname
FQDN of the KMS host
You should also disable publishing on all KMS hosts if your DNS service does not support dynamic update to prevent event logs from collecting failed DNS publishing events.
Tip
Manually created resource records can also coexist with resource records that KMS hosts automatically publish in other domains as long as all records are maintained to prevent conflicts.
Disable publishing of DNS records
To disable publishing of DNS records by the KMS host:
Launch the Volume Activation Tools wizard by running:
vmw.exe
Select Next on the introduction screen. Select Key Management Service (KMS) as the activation type and enter localhost to configure the local server or the hostname of the server you want to configure.
Select Skip to Configuration, then select Next.
Uncheck the box for publish DNS records, then select Commit.
Select Key Management Service (KMS) as the activation type and enter localhost to configure the local server or the hostname of the server you want to configure. Select Install your KMS host key and enter the product key for your organization, then select Commit.
To activate, use the slmgr.vbs command. Open an elevated command prompt and run one of the following commands: To install the KMS key, run the command slmgr.vbs /ipk <KmsKey> . To activate online, run the command slmgr.vbs /ato .
Select the DNS server on which you have to create the SRV resource record. In the console tree, expand Forward Lookup Zones, right-click the domain, and then select Other New Records. Scroll down the list, select Service Location (SRV), and then select Create Record.
KMS activation is a client-server model in which each client requests activation from a KMS host computer. The keys needed to activate Office are installed on the KMS host computer. The client uses DNS to locate a KMS host computer to request activation.
If you have a valid product key, select Change product key, and then enter the 25-character product key. If you don't have a valid product key, select Go to Microsoft Store, and follow the instructions to buy a digital license for Windows.
KMS (Key Management Service) is one of the methods to activate Microsoft Windows and Microsoft Office. Activation ensures that the software is obtained from and licensed by Microsoft. KMS is used by volume license customers, usually medium to large businesses, schools, and non-profits.
The KMS clients find the KMS host via a DNS SRV record (_vlmcs._tcp) and then automatically attempt to discover and use this service to activate themselves. When in the 30 day Out of Box grace period, they will try to activate every 2 hours. Once activated, the KMS clients will attempt a renewal every 7days.
Navigate to the AWS KMS console and select Create a key. For this workshop we will use create a Symmetric key. Choose the key usage as Encrypt and decrypt. Expand the advanced section and choose the regionality as Multi-region key.
No, only customer managed KMS keys can be stored and managed in an AWS KMS custom key store backed by CloudHSM. AWS managed KMS keys that are created on your behalf by other AWS services to encrypt your data are always generated and stored in the AWS KMS default key store.
To use KMS, you need to have a KMS host available on your local network. Computers that activate with a KMS host need to have a specific product key. This key is sometimes referred to as the KMS client key, but it is formally known as a Microsoft Generic Volume License Key (GVLK).
The KMS requires a minimum number of computers (physical computers or virtual machines) in a network environment. The organization must have at least five computers to activate Windows Server 2012 R2 and at least 25 computers to activate client computers that are running Windows 10.
You will need at least 25 clients, the network must meet or exceed the activation threshold, or the minimum number of qualifying computers that KMS requires. Computers running Windows 7 must receive an activation count ≥25 to be activated.
On the client machine, from an elevated command prompt, type SLMGR.vbs /dlv. This will give you verbose output of the Software Licensing service. Refer to the "KMS machine name from DNS:" field for the FQDN of the KMS host.
The KMS (Key Management Service) server allows you to activate corporate versions of Windows within the network without having to connect to the MSFT activation center via the Internet or by phone.
To remain activated, KMS client computers must renew their activation by connecting to the KMS host at least once every 180 days. By default, KMS client computers attempt to renew their activation every seven days.
Run the following command line on the KMS server to retrieve all installed licences : cscript c:\windows\system32\slmgr.vbs /dli all >> c:\temp\KMS.log.
On Windows 10 and Windows Server 2022/2019/2016, go to Settings -> Update & Security -> Activation (or run the ms-settings:activation URI command to access the ms-settings quickly)
In Windows 11, open Settings -> System -> Activation.
Select Install product key in the Selected Items menu in the right-side pane to display the Install Product Key dialog box. The Install Product Key dialog box displays the keys that are available to be installed. Select the Automatically select an AD or KMS client key option and then select Install Key.
While Microsoft allows unlicensed users to use non-activated Windows, it does not allow them to modify the appearance of their operating system. Thus, you will be greeted with the same look every day, which may take away the charm of using the operating system.
KMS is a legitimate way to activate Windows licenses in client computers, especially en masse (volume activation). There is even a Microsoft document on creating a KMS activation host. A KMS client connects to a KMS server (the activation host), which contains the host key the client uses for activation.
We recommend only having a single KMS host for both Windows and Office. Having more than one KMS host on a network is not necessary and it adds more administration work to implement. The additional work involves preparing DNS to let multiple computers manage _VLMCS records.
For Windows Product Activation to succeed, configure firewalls or other devices that are between the client and the Internet to allow traffic to pass over ports 80, and 443. You can use Microsoft Internet Explorer or other Internet browsers to test connectivity through these ports.
Also, you can use the UpdateAlias operation to change the KMS key associated with an alias and the DeleteAlias operation to delete an alias. As a result, some KMS keys might have several aliases, and some might have none.
AWS managed keys, the KMS keys that AWS services create in your account for you, are always single-Region keys. You cannot convert an existing single-Region key to a multi-Region key.
A KMS Key is used to activate the KMS host computer with a Microsoft activation server and can activate up to six KMS hosts with 10 activations per host. Each KMS host can activate an unlimited number of computers.
Secrets Manager uses envelope encryption with AWS KMS keys and data keys to protect each secret value. Whenever the secret value in a secret changes, Secrets Manager generates a new data key to protect it. The data key is encrypted under a KMS key and stored in the metadata of the secret.
An asymmetric KMS key represents a mathematically related public key and private key pair. You can give the public key to anyone, even if they're not trusted, but the private key must be kept secret. In an asymmetric KMS key, the private key is created in AWS KMS and never leaves AWS KMS unencrypted.
In security, a master key is what you use to encrypt all other encryption keys in your system. Customer master keys are logical representations of a master key. They are the primary resources in AWS KMS. The CMK contains the key material used to encrypt and decrypt data.
When you encrypt, KMS stores the CMK information in the ciphertextblob (CiphertextBlob: Ciphertext including metadata) as metadata. So while calling decrypt, KMS knows which CMK to use.
Run Command Prompt as administrator, type “wmic path softwarelicensingservice get OA3xOriginalProductKey” into Command Prompt, and then hit Enter to find your Windows 10 product key. The command will only display a product key if your computer came with Windows 10 pre-installed.
On Windows 10/11, right-click on the windows start menu and select PowerShell or Terminal.You will see the activation options, and follow onscreen instructions. That's all.
You have to pay for each person or each device (each client) that you want to allow access the server or use of some service the server provides. You only need 1 CAL per user or per device regardless of how many servers you actually have.
According to the Microsoft article: Understanding KMS, in the KMS Activation Renewal section, it states that "KMS activations are valid for 180 days—the activation validity interval. To remain activated, KMS client computers must renew their activation by connecting to the KMS host at least once every 180 days.".
On the client machine, from an elevated command prompt, type SLMGR.vbs /dlv. This will give you verbose output of the Software Licensing service. Refer to the "KMS machine name from DNS:" field for the FQDN of the KMS host.
What is a KMS Host Key. A KMS Key is used to activate the KMS host computer with a Microsoft activation server and can activate up to six KMS hosts with 10 activations per host. Each KMS host can activate an unlimited number of computers.
A KMS default master key is used by an AWS service such as RDS, EBS, Lambda, Elastic Transcoder, Redshift, SES, SQS, CloudWatch, EFS, S3 or Workspaces when no other key is defined to encrypt a resource for that service. The default key cannot be modified to ensure its availability, durability and security.
Address: Suite 490 606 Hammes Ferry, Carterhaven, IL 62290
Phone: +8557035444877
Job: Forward IT Agent
Hobby: Fishing, Flying, Jewelry making, Digital arts, Sand art, Parkour, tabletop games
Introduction: My name is Otha Schamberger, I am a vast, good, healthy, cheerful, energetic, gorgeous, magnificent person who loves writing and wants to share my knowledge and understanding with you.
We notice you're using an ad blocker
Without advertising income, we can't keep making this site awesome for you.
