Setting up KMS

A KMS deployment for Windows Server requires a compatible Windows KMS host, your organization’s Customer Specific Volume License Key (CSVLK), DNS discovery, TCP port 1688 connectivity, and at least five unique Windows Server activation requests within 30 days.

Prerequisites

• Volume licensing: The servers being activated must run volume-licensing editions of Windows Server.
• KMS host key: Obtain your organization’s CSVLK—also called the KMS host key—from the Microsoft 365 admin center’s volume-licensing product keys.
• Supported host: Use a supported physical or virtual Windows Server system. It does not need to be dedicated. A Windows Server KMS host can activate supported Windows Server and Windows client versions.
• Version compatibility: Verify that the host OS and CSVLK support every Windows Server version being activated. An older host may require current Windows updates to activate newer releases.
• Permissions: The account configuring the host must belong to its local Administrators group.
• Initial activation: The KMS host needs Internet access for online activation or access to phone activation.
• Minimum count: Windows Server activation begins only after five unique qualifying computers contact the host. KMS counts unique contacts from the preceding 30 days.

Microsoft documents the host compatibility matrix and operational requirements here: ^1^.

Install and activate the KMS host

On the selected Windows Server, open an elevated PowerShell session and install Volume Activation Services:

Install-WindowsFeature -Name VolumeActivation -IncludeManagementTools

Set-NetFirewallRule `
  -Name SPPSVC-In-TCP `
  -Profile Domain,Private `
  -Enabled True

vmw.exe

In Volume Activation Tools:

1. Select Key Management Service (KMS).
2. Enter localhost when configuring the current server.
3. Select Install your KMS host key.
4. Enter the organization’s CSVLK, then select Commit.
5. Select Activate online, or use phone activation if Internet activation is unavailable.
6. After activation succeeds, review the settings and select Close.

These are the documented role-installation and host-configuration steps ^2^.

Configure network and DNS discovery

Clients use RPC over TCP/IP and contact KMS on TCP 1688 by default. Permit this connection through host, network, and perimeter firewalls as applicable.

By default, the activated KMS host dynamically publishes a DNS SRV record so clients can discover it automatically. Confirm that DNS contains:

If DNS does not support dynamic updates, create this SRV record manually. The KMS host needs permission to create or update its SRV, A, and AAAA records when automatic publication is used ^3^.

Prepare and activate Windows Server devices

Windows Server installations from volume-licensing media are KMS clients by default. Do not install the private CSVLK on clients; it belongs only on KMS hosts.

For each server, use an elevated Command Prompt:

cscript.exe slmgr.vbs /ato
cscript.exe slmgr.vbs /dlv

• /ato requests activation using the installed key.
• /dlv displays detailed licensing data, including the KMS channel and activation state.

The first four unique Windows Server devices will not activate because the count is below the server threshold. Once the fifth qualifying server contacts KMS, eligible servers can activate. A “count too low” result before that point can therefore indicate that discovery and communication work but the threshold has not yet been reached ^4^.

KMS activation remains valid for 180 days. Clients attempt renewal every seven days and must reach a KMS host at least once during each 180-day interval ^5^.

If activation fails

Check, in order:

1. The KMS host key supports the exact Windows Server client version.
2. The KMS host has required Windows updates, particularly when activating a newer server release.
3. The _vlmcs._tcp SRV record resolves to the correct host.
4. TCP 1688 is reachable from the server being activated.
5. slmgr.vbs /dlv on the host shows a current count of at least five.
6. The client is a volume edition and has the correct KMS client setup key rather than a retail, MAK, or incompatible key.

References

1. Key Management Services (KMS) activation planning
2. Create a Key Management Services (KMS) activation host
3. Activate clients running Windows
4. Activate using Key Management Service
5. Guidelines for troubleshooting the Key Management Service (KMS)