Volume Activation Technical Reference

Source and Reference: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn502529(v=ws.11)

• Volume Activation Technical Reference
  • Slmgr.vbs Options for Volume Activation
    

    Slmgr.vbs command-line options

    Option	Description
    [MachineName]	Name of a remote computer (default is local computer)
    [User]	Account with the required privilege on the remote computer
    [Password]	Password for the account with required privileges on the remote computer

    Global options

    Option	Description
    /ipk <ProductKey>	Attempts to install a 5×5 product key. The product key provided by the parameter is confirmed valid and applicable to the installed operating system. If not, an error is returned. If the key is valid and applicable, the key is installed. If a key is already installed, it is silently replaced. To prevent instability in the license service, the system should be restarted or the Software Protection Service should be restarted. This operation must be run from an elevated command prompt, or the Standard User Operations registry value must be set to allow unprivileged users extra access to the Software Protection Service.
    /ato [Activation ID]	For retail editions and volume systems with a KMS host key or a Multiple Activation Key (MAK) installed, /ato prompts Windows to attempt online activation. For systems with a Generic Volume License Key (GVLK) installed, this prompts an attempt at KMS activation. Systems that have been set to suspend automatic KMS activation attempts (/stao) still attempt KMS activation when /ato is run. Note: Starting with Windows 8 (and Windows Server 2012), the /stao option is deprecated. Use the /act-type option instead. The parameter [Activation ID] expands /ato support to identify a Windows edition installed on the computer. Specifying the [Activation ID] parameter isolates the effects of the option to the edition associated with that Activation ID. Run Slmgr.vbs /dlv all to get the Activation IDs for the installed version of Windows. If you need to support other applications, see the guidance provided by that application for further instruction. KMS activation does not require elevated privileges. However, online activation does require elevation, or the Standard User Operations registry value must be set to allow unprivileged users extra access to the Software Protection Service.
    /dli [Activation ID | All]	Display license information. By default, /dli displays the license information for the installed active Windows edition. Specifying the [Activation ID] parameter displays the license information for the specified edition associated with that Activation ID. Specifying [All] as the parameter will display all applicable installed products’ license information. This operation does not require elevated privileges.
    /dlv [Activation ID | All]	Display detailed license information. By default, /dlv displays the license information for the installed operating system. Specifying the [Activation ID] parameter displays the license information for the specified edition associated with that Activation ID. Specifying the [All] parameter displays all applicable installed products’ license information. This operation does not require elevated privileges.
    /xpr [Activation ID]	Display the activation expiration date for the product. By default, this refers to the current Windows edition and is primarily useful for KMS clients, because MAK and retail activation is perpetual. Specifying the [Activation ID] parameter displays the activation expiration date of the specified edition associated with that Activation ID.This operation does not require elevated privileges.

    Advanced options

    Option	Description
    /cpky	Some servicing operations require the product key to be available in the registry during Out-of-Box Experience (OOBE) operations. The /cpky option removes the product key from the registry to prevent this key from being stolen by malicious code. For retail installations that deploy keys, best practices recommend running this option. This option is not required for MAK and KMS host keys, because this is the default behavior for those keys. This option is only needed for other types of keys where the default behavior is not to clear the key from the registry. This operation must be run from an elevated command prompt.
    /ilc <license_file>	This option installs the license file specified by the required parameter. These licenses may be installed as a troubleshooting measure, to support token-based activation, or as part of a manual installation of an on-boarded application. Licenses are not validated during this process: License validation is out of scope for Slmgr. Instead, validation is handled by the Software Protection Service at runtime. This operation must be run from an elevated command prompt, or the Standard User Operations registry value must be set to allow unprivileged users extra access to the Software Protection Service.
    /rilc	This option reinstalls all licenses stored in %SystemRoot%\system32\oem and %SystemRoot%\System32\spp\tokens. These are “known-good” copies stored during installation. Any matching licenses in the Trusted Store are replaced. Any additional licenses—for example, Trusted Authority (TA) Issuance Licenses (ILs), licenses for applications—are not affected. This operation must be run from an elevated command prompt, or the Standard User Operations registry value must be set to allow unprivileged users extra access to the Software Protection Service.
    /rearm	This option resets the activation timers. The /rearm process is also called by sysprep /generalize. This operation will do nothing if the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\SkipRearm registry subkey is equal to 1. See the section “Registry Settings,” later in this guide, for details on this registry subkey. This operation must be run from an elevated command prompt, or the Standard User Operations registry value must be set to allow unprivileged users extra access to the Software Protection Service.
    /rearm-app <Application ID>	Resets the licensing status of the specified app.
    /rearm-sku <Application ID>	Resets the licensing status of the specified SKU.
    /upk [ActivationID]	This option uninstalls the product key of the current Windows edition. After a restart, the system will be in an Unlicensed state unless a new product key is installed. Optionally, you can use the [Activation ID] parameter to specify a different installed product. This operation must be run from an elevated command prompt.
    /dti [Activation ID]	Displays installation ID for offline activation.
    /atp <Confirmation ID>	Activate product with user-provided confirmation ID.

    Volume Licensing: KMS client options

    Option	Description
    /skms <Name[:Port] | : port> [Activation ID]	This option specifies the name and, optionally, the port of the KMS host computer to contact. Setting this value disables auto-detection of the KMS host. If the KMS host uses Internet Protocol version 6 (IPv6) only, the address must be specified in the format [hostname]:port. IPv6 addresses contain colons (:), which will be parsed incorrectly by the Slmgr.vbs script. This operation must be run from an elevated command prompt.
    /skms-domain <FQDN> [Activation ID]	Sets the specific DNS domain in which all KMS SRV records can be found. This setting has no effect if the specific single KMS host is set with the /skms option. Use this option, especially in disjoint namespace environments, to force KMS to ignore the DNS suffix search list and look for KMS host records in the specified DNS domain instead.
    /ckms [Activation ID]	This option removes the specified KMS host name, address, and port information from the registry and restores KMS auto-discovery behavior. This operation must be run from an elevated command prompt.
    /skhc	This option enables KMS host caching (default), which blocks the use of Domain Name System (DNS) priority and weight after the initial discovery of a working KMS host. If the system can no longer contact the working KMS host, discovery will be attempted again. This operation must be run from an elevated command prompt.
    /ckhc	This option disables KMS host caching. This setting instructs the client to use DNS auto-discovery each time it attempts KMS activation (recommended when using priority and weight). This operation must be run from an elevated command prompt.

    KMS host configuration

    Option	Description
    /sai <interval>	This option sets the interval in minutes for unactivated clients to attempt KMS connection. The activation interval must be between 15 minutes and 30 days, although the default (2 hours) is recommended. The KMS client initially picks up this interval from registry but switches to the KMS setting after it receives the first KMS response. This operation must be run from an elevated command prompt.
    /sri <interval>	This option sets the renewal interval in minutes for activated clients to attempt KMS connection. The renewal interval must be between 15 minutes and 30 days. This option is set initially on both the KMS server and client sides. The default is 10080 minutes (7 days). The KMS client initially picks up this interval from the registry but switches to the KMS setting after it receives the first KMS response. This operation must be run from an elevated command prompt.
    /sprt <port>	This option sets the port on which the KMS host listens for client activation requests. The default TCP port is 1688. This operation must be run from an elevated command prompt.
    /sdns	Enable DNS publishing by the KMS host (default). This operation must be run from an elevated command prompt.
    /cdns	Disable DNS publishing by the KMS host. This operation must be run from an elevated command prompt.
    /spri	Set the KMS priority to normal (default). This operation must be run from an elevated command prompt.
    /cpri	Set the KMS priority to low. Use this option to minimize contention from KMS in a co-hosted environment. Note that this could lead to KMS starvation, depending on what other applications or server roles are active. Use with care. This operation must be run from an elevated command prompt.
    /act-type [Activation-Type] [Activation ID]	This option sets a value in the registry that limits volume activation to a single type. Activation Type 1 limits activation to Active Directory only; 2 limits it to KMS activation; 3 to token-based activation. The 0 option allows any activation type and is the default value.

    Token-based activation configuration

    Option	Description
    /lil	List the installed token-based activation issuance licenses.
    /ril <ILID> <ILvID>	Remove an installed token-based activation issuance license. This operation must be run from an elevated command prompt.
    /stao	Set the Token-based Activation Only flag, disabling automatic KMS activation. This operation must be run from an elevated command prompt. This option has been removed beginning with Windows Server 2012 R2 and Windows 8.1. Use the /act–type option instead.
    /ctao	Clear the Token-based Activation Only flag (default), enabling automatic KMS activation. This operation must be run from an elevated command prompt. This option has been removed beginning with Windows Server 2012 R2 and Windows 8.1. Use the /act–type option instead.
    /ltc	List valid token-based activation certificates that can activate installed software.
    /fta <Certificate Thumbprint> [<PIN>]	Force token-based activation using the identified certificate. The optional personal identification number (PIN) is provided to unlock the private key without a PIN prompt when using certificates that are protected by hardware (for example, smart cards).

    Active Directory-based activation configuration

    Option	Description
    /ad-activation-online <Product Key> [Activation Object name]	Collects Active Directory data and initiates Active Directory forest activation using the credentials that the command prompt is running. Local administrator access is not required, but read/write access to the activation object container in the root domain of the forest is required.
    /ad-activation-get-IID <Product Key>	This option starts Active Directory forest activation in phone mode. The output is the installation ID (IID) that can be used to activate the forest over the telephone when Internet connectivity is not available. Upon providing the IID in the activation phone call, a CID is returned that is used to complete activation.
    /ad-activation-apply-cid <Product Key> <Confirmation ID> [Activation Object name]	With this option, enter the CID provided from the activation phone call to complete activation
    [/name: <AO_Name>]	Optionally, you can append the /name option to any of these commands to specify a name for the activation object stored in Active Directory. The name must not exceed 40 Unicode characters; use double quotation marks to explicitly define the name string. In Windows Server 2012 R2 and Windows 8.1, you can append the name directly after /ad-activation-online <Produce Key> and /ad-activation-apply-cid without having to use the /name option.
    /ao-list	Displays all of the activation objects that are available to the local computer.
    /del-ao <AO_DN> or /del-ao <AO_RDN>

  • Registry Settings for Volume Activation
    

    Registry settings

    Registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform

    Value	Type	Description	Scope
    Activation\AlternateURL	REG_SZ	Optionally contains an administrator-provided URL. If this key is populated, some activation dialog boxes will include a new link — Learn About Activation Online — that opens in the default browser.	All
    DisableDnsPublishing	REG_DWORD	Set this to a non-zero value to block auto-publishing to DNS by the KMS host.	KMS
    DnsDomainPublishList	REG_MULTI_SZ	Format: domain_name, <priority>, <weight> Optionally contains a list of fully qualified domains that KMS uses to auto-publish its DNS service (SRV) record. The KMS home domain is always used, so it is not necessary to include it here. This depends on the DisableDnsPublishing value. The priority and weight parameters are optional. If not supplied, these are set to 0 in the SRV record.	KMS
    EnableKmsLowPriority	REG_DWORD	Set this to a non-zero value to minimize contention from KMS in a co-hosted environment. Note that on a busy system, this can prevent the KMS host from maintaining a sufficient count.	KMS
    KeyManagementServiceListeningPort	REG_SZ	Set this on the KMS host to force KMS to listen on the TCP port specified. The host uses TCP port 1688 if this value is not specified.	KMS
    KeyManagementServiceName	REG_SZ	Set this value to force the use of a specific KMS host by the KMS client. No default. If you specify both App-ID and SKU-ID, this is created in a subkey under which the value is stored:..\SoftwareProtectionPlatform\APPID_GUID\SKUID_GUID\ KeyManagementServiceName If you specify only App-ID, SKU-ID is not allowed, and the resulting key is: ..\SoftwareProtection\APPID_GUID\ KeyManagementServiceName If you specify neither App-ID nor SKU-ID, the resulting key is: ..\SoftwareProtectionPlatform	KMS client
    KeyManagementServicePort	REG_SZ	Set this to force the use of a specific TCP port by the KMS client when it communicates with a KMS. The client uses port 1688 if this value is not specified.	KMS client
    KeyManagementServiceVersion	REG_SZ	Set this for Microsoft Operations Manager (MOM) 2005 automatic discovery of the KMS. Delete this value if the KMS is no longer functional on the computer.	KMS
    UserOperations	REG_DWORD	This value does not exist by default, and the default is 0, which requires elevation. Create this value and set it to 1 to enable standard users to install product keys and activate and rearm computers without requiring elevation. This setting can also be configured by GPOs, which are stored under the \policies registry subkey.	All (not just KMS)
    VLActivationInterval	REG_DWORD	This is set initially on both KMS server and client sides. The default is 120 minutes (2 hours). The KMS client initially picks up this interval from the registry but switches to the KMS setting after it receives the first KMS response. The minimum value is 15 minutes, and the maximum is 43,200 minutes (30 days).	KMS Client and Server
    VLRenewalInterval	REG_DWORD	This is set initially on both KMS server and client sides. The default is 10,080 minutes (7 days). The KMS client initially picks up this interval from the registry but switches to the KMS setting after it receives the first KMS response. As a result, the client-side setting will never be used. The minimum value is 15 minutes, and the maximum is 43,200 minutes (30 days).	KMS Client and Server
    \(APP-ID)\(SKU-ID)\VLActivationType	REG_DWORD	Limits the type of activation to a single type. 1 = Active Directory activation only 2 = KMS activation only 3 = Token activation only 0, blank, or values other than 1-3 = all activation types allowed (default value)	[???]

    Registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Activation

    Value	Type	Description	Scope
    Manual	REG_DWORD	0 = Allow automatic online activation (default) 1 = Disable auto-activation	MAK and KMS host but not KMS client

    Registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\slui.exe\

    Value	Type	Description	Scope
    NoGenTicket	REG_DWORD	Turns off Online Client Activation Validation Telemetry 0 = Allow automatic activation validation telemetry (default) 1 = Disable validation telemetry KMS Activation Timing and Discovery for Volume Activation

  • KMS and MAK Activation Scenarios for Volume Activation
  • KMS Host Keys to Products Activated for Volume Activation 
    

    KMS host keys matched to products they activate

    A KMS server running this operating system...	can activate these Windows products:	On the KMS server in Column 1, this key type...	can activate these specific Windows editions:
    Client operating systems:
    Windows 10	Windows 7 Windows 8 Windows 8.1 Windows 10	KMS	Windows 10 Enterprise Windows 10 Education Windows 10 Pro Windows 8.1 Enterprise Windows 8.1 Pro Windows 8 Professional Windows 8 Enterprise Windows 7 Professional Windows 7 Enterprise
    Windows 8.1, Windows 8	Windows Vista Windows 7 Windows 8 Windows 8.1 Windows 10 (once you install the update in the note below this table)	KMS	Windows 8.1 Enterprise Windows 8.1 Pro Windows 8 Professional Windows 8 Enterprise Windows 7 Professional Windows 7 Enterprise Windows Vista Business Windows Vista Enterprise
    Windows 7	Windows 7 Professional Windows 7 Enterprise	KMS	Windows Vista Business Windows Vista Enterprise Windows 7 Professional Windows 7 Enterprise
    Windows Vista	Windows Vista Business Windows Vista Enterprise	KMS	Windows Vista Business Windows Vista Enterprise
    Server operating systems:
    Windows Server 2012 R2	Windows Server 2012 Windows Server 2008 R2 Windows Server 2008 Windows 7 Windows 8 Windows 8.1 Windows 10 (once you install the update in the note below this table)	KMS	Windows Server 2012 R2 Server Standard Windows Server 2012 R2 Datacenter Windows Server 2012 R2 Essentials
    Windows Server 2012	Windows Server 2008 R2 Windows 7 Windows 8 Windows 8.1 Windows 10 (once you install the update in the note below this table)	KMS	Windows Server 2012 Windows Server 2012 N Windows Server 2012 Single Language Windows Server 2012 Country Specific Windows Server 2012 Server Standard Windows Server 2012 MultiPoint Standard Windows Server 2012 MultiPoint Premium Windows Server 2012 Datacenter
    Windows Server 2008 R2 Server Group A:	Windows® Web Server 2008 R2 Windows Server 2008 R2 HPC Edition Windows HPC Server 2008 R2	KMS_A	Windows Server 2008 R2 Group A Windows Server 2008 Group A Windows Vista Volume Editions Windows 7 Volume Editions
    Windows Server 2008 R2 Server Group B	Windows Server 2008 R2 Standard Windows Server 2008 R2 Enterprise	KMS_B	Windows Server 2008 R2 Group A Windows Server 2008 Group A Windows Server 2008 R2 Group B Windows Server 2008 Group B Windows Vista Volume Editions Windows 7 Volume Editions
    Windows Server 2008 R2 Server Group C	Windows Server 2008 R2 Datacenter Windows Server 2008 R2 for Itanium-Based Systems	KMS_C	Windows Server 2008 R2 Group A Windows Server 2008 Group A Windows Server 2008 R2 Group B Windows Server 2008 Group B Windows Server 2008 R2 Group C Windows Server 2008 Group C Windows Vista Volume Editions Windows 7 Volume Editions

  • Activation Policy Values for Volume Activation 
    

    Windows 8.1 and Windows Server 2012 R2 policy values

    Element	Client value	Server value	Range
    Rearm limit	1000	1000	Not configurable
    KMS Client Count Threshold	25	5	Not configurable
    KMS Activation duration	180 days	180 days	Not configurable
    KMS host listening port	1688	1688	Any open TCP port
    OOB Grace	Not available	Not available	Not configurable
    OOT Grace	Not available	Not available	Not configurable
    KMS client reactivation (in minutes)	10,080 minutes (7 days—default)	10,080 minutes (7 days—default)	15–43,200 minutes (30 days—default)
    Silent KMS retry interval—occurs on KMS activation failure	120 minutes	120 minutes	15–43,200 minutes (120 minutes—default)

  • KMS Client Setup Keys for Volume Activation
  • Activation Error Codes for Volume Activation 
    

    Table 10. Error codes and descriptions

    Error code	Error message	Activation type	Possible cause	Troubleshooting steps
    0xC004C001	The activation server determined the specified product key is invalid	MAK	An invalid MAK was entered.	Verify that the key is the MAK provided by Microsoft. Contact the Microsoft Activation Call Center to verify that the MAK is valid.
    0xC004C003	The activation server determined the specified product key has been blocked	MAK	The MAK is blocked on the activation server.	Contact the Microsoft Activation Call Center to obtain a new MAK and install/activate the system.
    0xC004C008	The activation server reported that the product key has exceeded its unlock limit.	KMS	The KMS key has exceeded the activation limit.	KMS host keys will activate up to 10 times on six different computers. If more activations are necessary, contact the Microsoft Activation Call Center.
    0xC004C020	The activation server reported that the Multiple Activation Key has exceeded its limit.	MAK	The MAK has exceeded the activation limit.	MAKs by design have a limited number of activations. Contact the Microsoft Activation Call Center.
    0xC004C021	The activation server reported that the Multiple Activation Key extension limit has been exceeded.	MAK	The MAK has exceeded the activation limit.	MAKs by design have a limited number of activations. Contact the Microsoft Activation Call Center.
    0xC004F009	The Software Protection Service reported that the grace period expired.	MAK	The grace period expired before the system was activated. Now, the system is in the Notifications state.	See the section “User Experience.”
    0xC004F00F	The Software Licensing Server reported that the hardware ID binding is beyond level the of tolerance.	MAK/KMS client/KMS host	The hardware has changed or the drivers were updated on the system.	MAK: Reactivate the system during the OOT grace period using either online or phone activation. KMS: Restart, or run slmgr.vbs /ato.
    0xC004F014	The Software Protection Service reported that the product key is not available	MAK/KMS client	No product keys are installed on the system.	Install a MAK product key, or install a KMS Setup key found in \sources\Product.ini on the installation media.
    0xC004F02C	The Software Protection Service reported that the format for the offline activation data is incorrect.	MAK/KMS client	The system has detected that the data entered during phone activation is not valid.	Verify that the CID is correctly entered.
    0xC004F038	The Software Protection Service reported that the computer could not be activated. The count reported by your Key Management Service (KMS) is insufficient. Please contact your system administrator.	KMS client	The count on the KMS host is not high enough. The KMS count must be ≥5 for Windows Server or ≥25 for Windows client.	More computers are needed in the KMS pool for KMS clients to activate. Run Slmgr.vbs /dli to get the current count on the KMS host.
    0xC004F039	The Software Protection Service reported that the computer could not be activated. The Key Management Service (KMS) is not enabled.	KMS client	This error occurs when a KMS request is not answered.	Troubleshoot the network connection between the KMS host and the client. Make sure that TCP port 1688 (default) is not blocked by a firewall or otherwise filtered.
    0xC004F041	The Software Licensing Service determined that the Key Management Service (KMS) is not activated. KMS needs to be activated. Please contact system administrator.	KMS client	The KMS host is not activated.	Activate the KMS host with either online or phone activation.
    0xC004F042	The Software Protection Service determined that the specified Key Management Service (KMS) cannot be used.	KMS client	Mismatch between the KMS client and the KMS host.	This error occurs when a KMS client contacts a KMS host that cannot activate the client software. This can be common in mixed environments that contain application and operating system-specific KMS hosts, for example.
    0xC004F050	The Software Protection Service reported that the product key is invalid.	KMS, KMS client, MAK	This can be caused by a typo in the KMS key or by typing in a Beta key on a Released version of the operating system.	Install the appropriate KMS key on the corresponding version of Windows. Check the spelling. If the key is being copied and pasted, make sure that em dashes have not been substituted for the dashes in the key.
    0xC004F051	The Software Protection Service reported that the product key is blocked.	MAK/KMS	The product key on the activation server is blocked by Microsoft.	Obtain a new MAK/KMS key, install it on the system, and activate.
    0xC004F074	The Software Protection Service reported that the computer could not be activated. No Key Management Service (KMS) could be contacted. Please see the Application Event Log for additional information.	KMS Client	All KMS host systems returned an error.	Troubleshoot errors from each event ID 12288 associated with the activation attempt.
    0xC004F06C	The Software Protection Service reported that the computer could not be activated. The Key Management Service (KMS) determined that the request timestamp is invalid.	KMS client	The system time on the client computer is too different from the time on the KMS host.	Time sync is important to system and network security for a variety of reasons. Fix this issue by changing the system time on the client to sync with the KMS. Use of a Network Time Protocol (NTP) time source or Active Directory Domain Services for time synchronization is recommended. This issue uses UTP time and is independent of Time Zone selection.
    0x80070005	Access denied. The requested action requires elevated privileges.	KMS client/MAK/KMS host	User Account Control (UAC) prohibits activation processes from running in a non-elevated command prompt.	Run slmgr.vbs from an elevated command prompt. Right-click cmd.exe, and then click Run as Administrator.
    0x8007232A	DNS server failure.	KMS host	The system has network or DNS issues.	Troubleshoot network and DNS.
    0x8007232B	DNS name does not exist.	KMS client	The KMS client cannot find KMS SRV RRs in DNS. If a KMS host does not exist on the network, a MAK should be installed.	Confirm that a KMS host has been installed and DNS publishing is enabled (default). If DNS is unavailable, point the KMS client to the KMS host by using slmgr.vbs /skms <kms_host_name>. Optionally, obtain and install a MAK; then, activate the system. Finally, troubleshoot DNS.
    0x800706BA	The RPC server is unavailable.	KMS client	Firewall settings are not configured on the KMS host, or DNS SRV records are stale.	Ensure the Key Management Service firewall exception is enabled on the KMS host computer. Ensure that SRV records point to a valid KMS host. Troubleshoot network connections.
    0x8007251D	No records found for given DNS query.	KMS client	The KMS client cannot find KMS SRV RRs in DNS.	Troubleshoot network connections and DNS.

  • WMI Properties and Methods for Volume Activation