How to Activate Windows with KMS Server

Key Management System (KMS) is used to automate the process of activating Microsoft products on computers within an enterprise’s corporate network.

Instead of manually activating each computer with a MAK (Multiple Activation Key), a KMS host enables your devices to activate automatically, eliminating the need for each computer to connect individually to Microsoft’s activation servers over the Internet.

A KMS host is a supported Windows system configured in order to provide Key Management Service activation. The host is activated with a valid KMS Host Key (CSVLK) using the Windows Software Licensing Management Tool (slmgr.vbs).

On Windows Server, the optional Volume Activation Services role provides management tools and is also used for Active Directory-Based Activation (ADBA); it is not required for basic KMS host operation.

Our article describes how to deploy a KMS server and use it to activate Windows client computers.

KMS hosts can also run on supported Windows client OSs (including Windows 10 and Windows 11). However, Windows Server is generally the preferred choice for a dedicated enterprise KMS host.

Understanding KMS Activation

The KMS activation server is used to activate volume editions of the Windows OS and Microsoft Office products on a local network, eliminating the need for individual computers to connect to Microsoft. KMS is based on a client-server architecture. The general KMS activation scheme is shown below.

The KMS volume activation architecture is based on a computer running Windows Server with the Volume Activation Services role installed (1). This server is known as the KMS Host.

KMS Host is activated using the KMS Host Key, which is obtained from the Microsoft Volume Licensing Service Centre (VLSC) or an authorized Microsoft reseller. KMS Server requires one-time activation through Microsoft Activation Services (by phone or online) (2).

A special record is registered in the DNS (3) by the KMS server so that domain clients can discover it (4).

Corporate computers (KMS clients) can automatically (or manually) connect to the KMS server (on default port TCP/1688) and activate Windows (5).

Windows Server 2025: KMS Hardware-Secured readiness

Windows Server 2025 supports preparation for KMS Hardware-Secured activation, which uses TPM 2.0 attestation to establish hardware-based trust for the KMS host. Starting with the August 2026 cumulative update for Windows Server 2025, KMS hosts provide readiness info that shows whether the server meets the hardware-security requirements.

Note that this readiness info does not change the current KMS activation behavior. Existing non-hardware-secured KMS hosts continue to activate clients normally. Microsoft recommends preparing eligible KMS hosts for the hardware-secured model, which is intended for future versions of Windows Server.

To check if the server supports TPM key attestation, run PowerShell as Administrator:

Get-TpmSupportedFeature -FeatureList "Key Attestation"

You can also use command:

slmgr /dlv

and check the KMS hardware-security readiness message.

A KMS Hardware-Secured host requires TPM 2.0 and Windows Server-certified hardware.

Important. You need to ensure that TCP port 1688 is open between KMS clients and the KMS host. In case the port is blocked by a firewall (Microsoft Defender Firewall, network firewall, or security appliance), your KMS clients won’t be able to contact the KMS host, and activation attempts may fail with errors like 0xC004F074.

In order to verify connectivity, you can use the following command:

Test-NetConnection <KMS_server> -Port 1688

A successful test should return TcpTestSucceeded : True.

It’s important to mention that KMS activation requires a minimum number of clients (activation threshold):

• 25 unique Windows client devices (Windows 10/11)
• 5 Windows Server devices

Until this threshold is reached, KMS clients will not activate and may return errors such as 0xC004F038.

Important. KMS activation requires a supported Windows edition and a valid volume licensing entitlement. A GVLK (KMS Client Setup Key) configures Windows as a KMS client; it is not a license key and does not grant a volume license.

Microsoft supports installing the appropriate GVLK on supported Windows editions (including when converting an existing Retail or MAK installation to a KMS client). After installing the GVLK, slmgr /dlv can report the VOLUME_KMSCLIENT channel, and the machine can attempt activation against a KMS host.

However, the GVLK itself does not provide a license entitlement. You must have the appropriate Microsoft volume licensing rights for the Windows edition being activated. Do not use KMS/GVLK as a way to activate an unlicensed/unsupported Windows installation.

The main advantages of KMS activation

• KMS infrastructure is simple and scalable. A single KMS host can support large KMS client environments;
• KMS server can be used to activate both desktop Windows editions (Windows 11 and 10) as well as supported Windows Server versions, including 2025, 2022, 2019, and 2016;
• KMS activation is valid for 180 days. By default, KMS clients attempt to renew their activation every 7 days. If a client cannot contact a KMS host, Windows displays a renewal notification 30 days before the 180-day activation period expires. If the activation is not renewed, Windows enters a notification state;
• For domain-joined computers, you can use Active Directory-Based Activation (ADBA), which requires no user interaction;
• A KMS Server with the Microsoft Office Volume License Pack installed can be used to activate the Microsoft Office product on client computers (described in detail in our Microsoft Office KMS activation).

Note. In domain environments, ADBA is often preferred over KMS because it does not require a dedicated KMS host, activation occurs automatically when the computer joins the domain, and no DNS SRV record config is required. KMS is more suitable for workgroup environments, isolated networks, and mixed environments where domain join is not available.

Deploying a KMS Host on Windows Server

Keep in mind that a KMS host does not require the Volume Activation Services role in order to provide KMS activation. On a supported Windows system, you can config the KMS host by installing a valid KMS Host Key (CSVLK) and activating it with Microsoft.

Windows Server is generally preferred for a KMS host. Supported Windows client versions can also be configured as KMS hosts when the appropriate KMS host key and licensing requirements are met.

The Volume Activation Services role is useful for management cases (including Active Directory-Based Activation), and provides the Volume Activation Tools wizard.

Optional: Install Volume Activation Services

The Volume Activation Services role is optional for a KMS host. You should install it if you need the Volume Activation Tools/plan to config Active Directory-Based Activation (ADBA). On Windows Server, you can install it with the following command:

Install-WindowsFeature -Name VolumeActivation -IncludeManagementTools

You can config and activate a KMS host without this role by using slmgr.vbs and a valid KMS Host Key.

Once the role has been installed, open TCP port 1688 in the Windows Defender Firewall:

Set-NetFirewallRule -Name SPPSVC-In-TCP -Profile Domain,Private -Enabled True

Obtain your KMS Host Key

The next step is to obtain your KMS Host Key, which is required to activate the KMS host:

1. First, obtain the KMS Host Key (CSVLK) from VLSC or from the Microsoft 365 Admin Center (depending on your licensing program).
   

   

2. Install this KMS host key on your server using the following command:
   

   slmgr /ipk <Windows_Server_2025_CSVLK>

3. Authorize your KMS host by performing a one-time online activation on Microsoft Activation Services.
   

   slmgr /ato

4. KMS normally registers the _VLMCS SRV record automatically in DNS. In case automatic registration doesn’t occur, you can force DNS publication with:
   

   slmgr /sdns

5. Check that the SRV record for your KMS server has appeared in the Forward Lookup Zone on your DNS server. You can use the nslookup command to locate the KMS server entry in the DNS:
   

   nslookup -q=SRV _VLMCS._TCP.theitbros.com

   

   This command lists all registered KMS host entries.

6. Check the KMS host activation status:
   

   slmgr /dlv

You can now configure KMS clients to activate using your KMS server.

Note. The examples in our guide use slmgr.vbs, Microsoft’s documented command-line tool for Windows volume activation and KMS config. However, VBScript is deprecated in Windows and is being phased out. We recommend migrating activation automation to PowerShell before VBScript is removed from future Windows releases.

PowerShell-based activation automation

Where supported by the target Windows release, you need to use the OSLicense PowerShell module for activation automation and inventory. And don’t forget to check module availability and supported operations on each Windows version before deploying it across production systems. 

The slmgr.vbs commands shown in our guide remain useful for interactive KMS administration and troubleshooting, but you should avoid creating additional dependencies on VBScript in new automation.

The following CIM query can be useful for PowerShell-based licensing inventory and reporting (note that it is a read-oriented alternative for retrieving licensing info; it does not replace all KMS config and activation operations provided by slmgr.vbs):

Get-CimInstance -ClassName SoftwareLicensingProduct |
Where-Object { $_.PartialProductKey } |
Select-Object Name, Description, LicenseStatus, PartialProductKey

Important. In case the _VLMCS SRV record is missing or not accessible, your KMS clients won’t be able to automatically discover the KMS host, or activation attempts may fail with errors such as 0xC004F074. In such cases, you must either fix DNS configuration or manually specify the KMS server on clients using the /skms option.

Notes

• A KMS host running an older version of Windows Server may require specific updates to activate newer Windows versions. For example, Windows Server 2019 KMS hosts can activate Windows Server 2022 and Windows Server 2025 after installing the required updates.
• If the KMS host is too old or does not meet the required update level, you need to upgrade the KMS host or install the required updates before activating newer Windows clients.

How to Activate a Windows Computer on a KMS License Server

Install a KMS Client Key (GVLK) on Windows

KMS server can only activate Windows clients installed with a specific product key — public KMS Client Setup Key (formerly known as the Microsoft Generic Volume License Key, GVLK). This means that you should first change the Windows product key to KMS client key from the Windows GUI (use the command slui.exe 3) or using slmgr command-line tool.

The complete list of public GVLK product keys for Windows is available on the Microsoft website (https://learn.microsoft.com/en-us/windows-server/get-started/kms-client-activation-keys).

Find and copy the GVLK for your version of Windows. For example, the W269N-WFGWX-YVC9B-4J6C9-T83GX KMS Client Product Key should be used for Windows 11 and 10 Professional edition.

Install the GVLK volume key on a Windows client device:

slmgr.vbs /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX

Wait until the confirmation message “Product key XXXXX installed successfully” appears.

Now you can activate your Windows on the KMS server:

slmgr.vbs /ato

And wait until the message Product activated successfully appears;

In this case, the Windows client used the SRV (_VLMCS) record in the Active Directory DNS to discover the KMS server on a domain.

Manually Activate Windows with KMS Server

If the SRV entry in the DNS is missing or the client device is not joined to the AD domain (in case of a Workgroup environment), you can manually specify the KMS server address on the client computer using the slmgr with the /skms option

slmgr.vbs /skms <KMS_server_name_or_IP>:1688

Before attempting activation, you should check connectivity to the KMS host:

Test-NetConnection <KMS_server_name_or_IP> -Port 1688

Then activate Windows client with the KMS server:

slmgr.vbs /ato

To activate Windows on a KMS server in silent mode and prevent a pop-up message from appearing, run the previous command as follows:

cscript //NoLogo c:\windows\system32\slmgr.vbs /ato

Check the Windows Activation Status

To check the Windows activation status, run:

slmgr.vbs /dli

The command returns the following:

• Name — the OS version and edition;
• Description — distribution channel VOLUME_KMSCLIENT channel;
• License status — licensed;
• Volume activation expiration date — 180 days;
• KMS machine IP address and DNS name (Registered KMS machine name).

For more detailed KMS diagnostics, run the following command:

slmgr.vbs /dlv

This command displays additional info, including:

• Registered KMS machine name
• KMS machine IP address
• Activation interval
• Renewal interval
• Current activation count
• Detailed licensing status

Note that the /dlv option is one of the most useful troubleshooting tools when diagnosing KMS activation problems.

To check the expiration date of the current Windows activation, run:

slmgr /xpr

KMS activation on remote Windows computers with slmgr.vbs tool

The slmgr.vbs tool can be used to check activation status on remote Windows machines. However, you need to avoid passing credentials in plain text (this can expose sensitive information in command history, process lists, or security logs). Instead, you should use PowerShell remoting or run the command under an authenticated session.

Invoke-Command -ComputerName nywsdx3323 -Credential (Get-Credential) -ScriptBlock {
    cscript //NoLogo C:\Windows\System32\slmgr.vbs /dli
}

Note. Most KMS activation problems fall into one of the following categories:

• DNS discovery issues (_VLMCS SRV record missing/incorrect)
• Network/firewall blocking TCP/1688
• Activation threshold not reached
• Incorrect product key (non-GVLK or unsupported edition)
• Time sync issues

You will speed up troubleshooting significantly in case you understand which of these categories apply.

KMS Activation Known Errors

Most often users face the following errors when activating Windows with the KMS server:

0xC004F074

Possible Cause or Error Description: No Key Management Service (KMS) could be contacted

Check the DNS SRV record and server connectivity. Flush DNS caches on client machines (ipconfig /flushdns)

First, you need to check if the client can discover the KMS host through DNS:

nslookup -type=SRV _vlmcs._tcp

Or you can specify the AD DNS suffix explicitly with the command:

nslookup -type=SRV _vlmcs._tcp.theitbros.com

Note that the command should return the DNS name of the registered KMS host. In case no SRV records are returned, you should check DNS registration on the KMS host and DNS replication.

0xC004F038

The count reported by your Key Management Service (KMS) is insufficient.

Fixing

The required number of activation requests on the KMS server (called the activation threshold) has not been reached. Minimum number of KMS clients:

• 25 – desktop clients running Windows 10/11
• 5 – Windows Server clients

Get the current count of hosts connected to the KMS server with the command slmgr.vbs /dli. Target more Windows hosts to your KMS server

slmgr.vbs /dlv

0x80072F8F

We can’t activate Windows on this device at the moment. You can try activating later.

Fixing

Check if the time and date on your device are correct. If necessary, synchronize the time with the NTP server.

0xC004F035

This error is usually associated with legacy BIOS/SLIC-based activation and is uncommon in modern Windows KMS environments. If it occurs, first you should verify if the installed Windows edition supports volume activation and that slmgr /dlv reports the expected VOLUME_KMSCLIENT channel.

How to View Detailed KMS Activation Diagnostics

When troubleshooting KMS activation problems, you should start by checking the current licensing status and activation details with the command:

slmgr /dlv

This command displays the following:

• Current activation status
• Licensing channel (VOLUME_KMSCLIENT)
• Registered KMS host name
• KMS host IP address
• Activation and renewal intervals
• Current activation count info

You can also review activation-related events in the Application log:

Get-WinEvent -FilterHashtable @{
LogName = 'Application'
ProviderName = 'Microsoft-Windows-Security-SPP'
}

In case you need a detailed description for a specific activation error code, you can use the slui.exe tool:

slui.exe 0x2a 0xC004F074

For example, this command displays the detailed description of activation error 0xC004F074.

The error description contains detailed information:

Windows Activation
Code:
0xC004F074

Description:

The Software Licensing Service reported that the product could not be activated. No Key Management Service (KMS) could be contacted. Please see the Application Event Log for additional information.