Microsoft Key Management Service (KMS)
at the University of Michigan
This document provides information for system administrators on the Microsoft Key Management Service (KMS) and the university's KMS server.
What Is KMS?
Beginning with Windows Vista and Windows Server 2008 products, Microsoft implemented the Key Management Service (KMS) for validating its Enterprise software. Future Enterprise products will also be KMS-capable.
KMS offers many advantages — especially to computer lab administrators — and must be used on any machine capable of connecting to a U-M KMS-served network. In the rare circumstances where this is not possible, system administrators may request a Multiple Activation Key (MAK). There is only one situation where you should use an MAK: the machine is located off-campus and is unlikely to connect to the campus network — even through a Virtual Private Network (VPN) — for at least 6 months.
KMS Server at U-M
A university-wide KMS server is available at no charge for university-owned workstations and servers. Co-hosted by Information and Technology Services (ITS) and the University Library, this secure service is reliable and redundant.
FOR UNIVERSITY-OWNED MACHINES ONLY: U-M policy prohibits using KMS on a personally-owned computer, even if it is used for university business and is running university-licensed software.
The server's addresses are:
-
mskms.umich.edu
-
141.211.175.165 141.213.143.150 141.213.238.150
We highly recommend U-M system administrators use this service to manage KMS-capable Microsoft Enterprise products deployed on university-owned computers. You should only consider running a separate KMS server under very rare circumstances.
Activating Products
-
AUTOMATIC: Microsoft KMS-capable products will automatically find the university-wide KMS server under either of the following conditions:
-
the machine is within the UMROOT domain.
-
uses a DNS server that includes an SRV record for the to-be-activated workstation.
-
-
MANUAL: You can manually set up KMS activation if the machine:
-
has an IP address within a university-owned subnet, including Virtual Private Network (VPN) connections
-
is able to use in- and outbound TCP port 1688 to access mskms.umich.edu.
FIREWALL? You only need to provide access to the U-M's network using either mskms.umich.edu, university subnets, or the KMS server's IP addresses. For those who use Virtual Firewall, you should be covered by a Global Rule, but please check with the service owners.
-
Additional Resources
Visit ITS's Information System to obtain ITS computing documentation and other resources. A list of relevant documents follows:
-
Microsoft Multiple Activation Keys (MAK) at the University of Michigan
-
Set Up Microsoft Office Professional Plus 2010 Key Management Service at the University of Michigan
Microsoft Documentation
ITS's IT Staff section provides a variety of help resources for its products and services.
The ITS Service Center provides a variety of computing help resources.
For further help with this or any other topic, call 734-764-HELP [4357] or submit an online service request.
Appendix A: Manually Activating Machines
If the machine cannot be set up for automatic activation but meets the manual activation criteria noted in Activating Products, follow these steps:
-
From the Start menu, select All Programs then Accessories.
-
RIGHT-click Command Prompt and select Run as administrator.
-
In the User Account Control window, click Continue.
-
In the Command Prompt window, enter the commands appropriate for your product.
NOTE: The first command points the activation to the U-M KMS server. The second command activates the workstation or server.-
Windows Vista and Server 2008 up to R1:
%windir%\system32\cscript slmgr.vbs -skms mskms.umich.edu
%windir%\system32\cscript slmgr.vbs -ato -
Windows 7 and Server 2008 R2 and later:
%windir%\system32\cscript slmgr.vbs /skms mskms.umich.edu
%windir%\system32\cscript slmgr.vbs /ato
-
Appendix B: Creating an SRV Record
NOTE: In order for auto-discovery to work, the DNS domain corresponding to one or both of the following must contain the KMS SRV record:
-
The primary DNS suffix of the computer
-
The DNS domain name assigned by DHCP
To create an SRV record:
-
In the DNS server, open the Bind zone file.
-
Enter a line (SRV record) in the form of
_vlmcs._tcp.[your subdomain].umich.edu. 3600 IN SRV 0 100 1688 mskms.umich.edu
replacing [your subdomain] with the correct subdomain without the brackets. For example, at the School of Public Health, the line would look like
_vlmcs._tcp.sph.umich.edu. 3600 IN SRV 0 100 1688 mskms.umich.edu
Appendix C: Troubleshooting
You can fix most failed KMS activations by re-registering the software and then manually activating the machine.
-
From the Start menu, select All Programs then Accessories.
-
RIGHT-click Command Prompt and select Run as administrator.
-
In the User Account Control window, click Continue.
-
In the Command Prompt window, enter the command appropriate for your operating system.
-
Windows Vista and Server 2008 up to R1:
%windir%\system32\cscript slmgr.vbs -ipk MS Universal Product Key
-
Windows 7 and Server 2008 R2 and later:
%windir%\syswow64\cscript slmgr.vbs /ipk MS Universal Product Key
-
-
Proceed with step 4 of Appendix A: Manually Activating Machines.
REDUCED FUNCTIONALITY MODE: If the machine you're attempting to recover is already in Reduced Functionality Mode, you'll need to use Internet Explorer to access the Command Prompt.
-
In Internet Explorer's Address Bar, enter C: and press the Enter key.
-
If you receive an Internet Explorer Security dialog box, click Allow.
-
In the Windows Explorer window, navigate to C:\Windows\System32.
-
RIGHT-click the cmd file and select Run as administrator.
-
Proceed to step 4 (Command Prompt) at the beginning of this troubleshooting section.
Microsoft maintains a Knowledgebase article on troubleshooting Volume Activation error codes that you might find helpful. However — for error code 0x800706BA: The RPC server is unavailable — the Microsoft-provided solution is incorrect. You should instead follow the re-registering the UPK and manually configuring steps at the beginning of this troubleshooting section.
Appendix D: Running Your Own KMS Server
The university provides — at no charge — a secure, reliable and redundant KMS server. We highly recommend you use this service.
In the following rare events, you may need to provide your own KMS server.
-
The cluster you want to activate:
-
is not located within the U-M networks.
-
cannot use the university's VPN.
-
-
A local firewall restricts access to mskms.umich.edu through in- and out-bound TCP port 1688.
CAVEATS
-
You must fully understand the terms and conditions of the university's Microsoft Enterprise Agreement.
-
Your KMS service must absolutely prevent machines and virtual machines not owned by the university to validate.
-
You must be prepared to accept personal legal liability and for that of U-M in the event your KMS service permits even one machine not owned by the university to illegally validate.
Appendix E: KMS-Capable Products with Universal Product Keys (UPK)
| Windows 7 | |
| Enterprise | 33PXH-7Y6KF-2VJC9-XBBR8-HVTHH |
| Enterprise N | YDRBP-3D83W-TY26F-D46B2-XCKRJ |
| Enterprise E | C29WB-22CC8-VJ326-GHFJW-H9DH4 |
| Professional | FJ82H-XT6CR-J8D7P-XQJJ2-GPDD4 |
| Professional N | MRPKT-YTG23-K7D7T-X2JMM-QY7MG |
| Vista | |
| Business | YFKBB-PQJJV-G996G-VWGXY-2V3X8 |
| Business N | HMBQG-8H2RH-C77VX-27R82-VMQBT |
| Enterprise | VKK3X-68KWM-X2YGT-QR4M6-4BWMV |
| Enterprise N | VTC42-BM838-43QHV-84HX6-XJXKV |
| Windows Server 2008 (see also R2 product keys) | |
| Standard w/ Hyper-V | TM24T-X9RMF-VWXK6-X8JC9-BFGM2 |
| Enterprise w/ Hyper-V | YQGMW-MPWTJ-34KDK-48M3W-X4Q6V |
| Datacenter | 7M67G-PC374-GR742-YH8V4-TCBY3 |
| Datacenter w/ Hyper-V | 22XQ2-VRXRG-P8D42-K34TD-G3QQC |
| for Itanium | 4DWFP-JF3DJ-B7DTH-78FJB-PDRHK |
| Web Server | WYR28-R7TFJ-3X2YQ-YCY4H-M249D |
| Windows Server 2008 R2 | |
| Standard R2 | YC6KT-GKW9T-YTKYR-T4X34-R7VHC |
| Enterprise R2 | 489J6-VHDMP-X63PK-3K798-CPX3Y |
| Datacenter R2 | 74YFP-3QFB3-KQT8W-PMXWJ-7M648 |
| R2 for Itanium | GT63C-RJFQ3-4GMB6-BRFB9-CB83V |
| R2 HPC Edition | FKJQ8-TMCVP-FRMR7-4WR42-3JCD7 |
| Web Server R2 | 6TPJF-RBVHG-WBW2R-86QPH-6RTM4 |
