Microsoft Key Management Service (KMS) at the University of Michigan (S4362)

http://www.itcs.umich.edu/itcsdocs/s4362/

Microsoft Key Management Service (KMS)
at the University of Michigan

S4362 • November 2009

This document provides information for system administrators on the Microsoft Key Management Service (KMS) and the university's KMS server.

Table of Contents

What Is KMS? KMS Server at U-M Activating Products Additional Resources

Appendix A: Manually Activating Machines Appendix B: Creating an SRV Record Appendix C: Troubleshooting Appendix D: Running Your Own KMS Server Appendix E: KMS-Capable Products with Universal Product Keys (UPK)

---

What Is KMS?

Beginning with Windows Vista and Windows Server 2008 products, Microsoft implemented the Key Management Service (KMS) for validating its Enterprise software. Future Enterprise products will also be KMS-capable.

KMS offers many advantages — especially to computer lab administrators — and must be used on any machine capable of connecting to a U-M KMS-served network. In the rare circumstances where this is not possible, system administrators may request a Multiple Activation Key (MAK). There is only one situation where you should use an MAK: the machine is located off-campus and is unlikely to connect to the campus network — even through a Virtual Private Network (VPN) — for at least 6 months.

Table of Contents

KMS Server at U-M

A university-wide KMS server is available at no charge for university-owned workstations and servers. Co-hosted by Information and Technology Services (ITS) and the University Library, this secure service is reliable and redundant.

FOR UNIVERSITY-OWNED MACHINES ONLY: U-M policy prohibits using KMS on a personally-owned computer, even if it is used for university business and is running university-licensed software.

The server's addresses are:

• mskms.umich.edu

• 141.211.175.165      141.213.143.150      141.213.238.150

We highly recommend U-M system administrators use this service to manage KMS-capable Microsoft Enterprise products deployed on university-owned computers. You should only consider running a separate KMS server under very rare circumstances.

Table of Contents

Activating Products

• AUTOMATIC: Microsoft KMS-capable products will automatically find the university-wide KMS server under either of the following conditions:

  • the machine is within the UMROOT domain.

  • uses a DNS server that includes an SRV record for the to-be-activated workstation.

• MANUAL: You can manually set up KMS activation if the machine:

  • has an IP address within a university-owned subnet, including Virtual Private Network (VPN) connections

  • is able to use in- and outbound TCP port 1688 to access mskms.umich.edu.
    FIREWALL? You only need to provide access to the U-M's network using either mskms.umich.edu, university subnets, or the KMS server's IP addresses. For those who use Virtual Firewall, you should be covered by a Global Rule, but please check with the service owners.

Table of Contents

Additional Resources

Visit ITS's Information System to obtain ITS computing documentation and other resources. A list of relevant documents follows:

• Microsoft Multiple Activation Keys (MAK) at the University of Michigan

• Set Up Microsoft Office Professional Plus 2010 Key Management Service at the University of Michigan

Microsoft Documentation

• Volume Activation

• Troubleshooting Volume Activation Error Codes

ITS's IT Staff section provides a variety of help resources for its products and services.

The ITS Service Center provides a variety of computing help resources.

For further help with this or any other topic, call 734-764-HELP [4357] or submit an online service request.

Table of Contents

---

Appendix A: Manually Activating Machines

If the machine cannot be set up for automatic activation but meets the manual activation criteria noted in Activating Products, follow these steps:

1. From the Start menu, select All Programs then Accessories.

2. RIGHT-click Command Prompt and select Run as administrator.

3. In the User Account Control window, click Continue.

4. In the Command Prompt window, enter the commands appropriate for your product.
   NOTE: The first command points the activation to the U-M KMS server. The second command activates the workstation or server.

   • Windows Vista and Server 2008 up to R1:

     %windir%\system32\cscript slmgr.vbs -skms mskms.umich.edu
     %windir%\system32\cscript slmgr.vbs -ato

   • Windows 7 and Server 2008 R2 and later:

     %windir%\system32\cscript slmgr.vbs /skms mskms.umich.edu
     %windir%\system32\cscript slmgr.vbs /ato

Table of Contents

Appendix B: Creating an SRV Record

NOTE: In order for auto-discovery to work, the DNS domain corresponding to one or both of the following must contain the KMS SRV record:

• The primary DNS suffix of the computer

• The DNS domain name assigned by DHCP

To create an SRV record:

1. In the DNS server, open the Bind zone file.

2. Enter a line (SRV record) in the form of

   _vlmcs._tcp.[your subdomain].umich.edu. 3600 IN SRV 0 100 1688 mskms.umich.edu

   replacing [your subdomain] with the correct subdomain without the brackets. For example, at the School of Public Health, the line would look like

   _vlmcs._tcp.sph.umich.edu. 3600 IN SRV 0 100 1688 mskms.umich.edu

Table of Contents

Appendix C: Troubleshooting

You can fix most failed KMS activations by re-registering the software and then manually activating the machine.

1. From the Start menu, select All Programs then Accessories.

2. RIGHT-click Command Prompt and select Run as administrator.

3. In the User Account Control window, click Continue.

4. In the Command Prompt window, enter the command appropriate for your operating system.

   • Windows Vista and Server 2008 up to R1:

     %windir%\system32\cscript slmgr.vbs -ipk MS Universal Product Key

   • Windows 7 and Server 2008 R2 and later:

     %windir%\syswow64\cscript slmgr.vbs /ipk MS Universal Product Key

5. Proceed with step 4 of Appendix A: Manually Activating Machines.

REDUCED FUNCTIONALITY MODE: If the machine you're attempting to recover is already in Reduced Functionality Mode, you'll need to use Internet Explorer to access the Command Prompt.

1. In Internet Explorer's Address Bar, enter C: and press the Enter key.

2. If you receive an Internet Explorer Security dialog box, click Allow.

3. In the Windows Explorer window, navigate to C:\Windows\System32.

4. RIGHT-click the cmd file and select Run as administrator.

5. Proceed to step 4 (Command Prompt) at the beginning of this troubleshooting section.

Microsoft maintains a Knowledgebase article on troubleshooting Volume Activation error codes that you might find helpful. However — for error code 0x800706BA: The RPC server is unavailable — the Microsoft-provided solution is incorrect. You should instead follow the re-registering the UPK and manually configuring steps at the beginning of this troubleshooting section.

Table of Contents

Appendix D: Running Your Own KMS Server

The university provides — at no charge — a secure, reliable and redundant KMS server. We highly recommend you use this service.

In the following rare events, you may need to provide your own KMS server.

1. The cluster you want to activate:

   1. is not located within the U-M networks.

   2. cannot use the university's VPN.

2. A local firewall restricts access to mskms.umich.edu through in- and out-bound TCP port 1688.

CAVEATS

• You must fully understand the terms and conditions of the university's Microsoft Enterprise Agreement.

• Your KMS service must absolutely prevent machines and virtual machines not owned by the university to validate.

• You must be prepared to accept personal legal liability and for that of U-M in the event your KMS service permits even one machine not owned by the university to illegally validate.

Table of Contents

Appendix E: KMS-Capable Products with Universal Product Keys (UPK)

Windows 7
Enterprise	33PXH-7Y6KF-2VJC9-XBBR8-HVTHH
Enterprise N	YDRBP-3D83W-TY26F-D46B2-XCKRJ
Enterprise E	C29WB-22CC8-VJ326-GHFJW-H9DH4
Professional	FJ82H-XT6CR-J8D7P-XQJJ2-GPDD4
Professional N	MRPKT-YTG23-K7D7T-X2JMM-QY7MG
Vista
Business	YFKBB-PQJJV-G996G-VWGXY-2V3X8
Business N	HMBQG-8H2RH-C77VX-27R82-VMQBT
Enterprise	VKK3X-68KWM-X2YGT-QR4M6-4BWMV
Enterprise N	VTC42-BM838-43QHV-84HX6-XJXKV
Windows Server 2008 (see also R2 product keys)
Standard w/ Hyper-V	TM24T-X9RMF-VWXK6-X8JC9-BFGM2
Enterprise w/ Hyper-V	YQGMW-MPWTJ-34KDK-48M3W-X4Q6V
Datacenter	7M67G-PC374-GR742-YH8V4-TCBY3
Datacenter w/ Hyper-V	22XQ2-VRXRG-P8D42-K34TD-G3QQC
for Itanium	4DWFP-JF3DJ-B7DTH-78FJB-PDRHK
Web Server	WYR28-R7TFJ-3X2YQ-YCY4H-M249D
Windows Server 2008 R2
Standard R2	YC6KT-GKW9T-YTKYR-T4X34-R7VHC
Enterprise R2	489J6-VHDMP-X63PK-3K798-CPX3Y
Datacenter R2	74YFP-3QFB3-KQT8W-PMXWJ-7M648
R2 for Itanium	GT63C-RJFQ3-4GMB6-BRFB9-CB83V
R2 HPC Edition	FKJQ8-TMCVP-FRMR7-4WR42-3JCD7
Web Server R2	6TPJF-RBVHG-WBW2R-86QPH-6RTM4