KMS Activation Explained: How Volume Licensing Works

Key Management Service, or KMS, is Microsoft’s official technology for activating Windows and Office across organizations that purchase volume licenses. Instead of activating each PC individually with Microsoft, companies run their own KMS host that activates computers on the local network. This guide explains how KMS works and how administrators configure it.

What Is KMS Activation?

KMS is part of Microsoft’s Volume Activation technologies. An organization installs a KMS host key, called a CSVLK, on a server. That host is activated once with Microsoft. Client computers configured with a Generic Volume License Key (GVLK) then contact the host instead of Microsoft’s servers to activate.

How the KMS Process Works

1. Discovery: The client finds the KMS host through a DNS SRV record named _vlmcs._tcp, or through an address set manually by an administrator.
2. Request: The client sends an activation request over TCP port 1688.
3. Count: The host counts unique clients that have requested activation.
4. Activation: Once the activation threshold is met, the host activates clients for 180 days.
5. Renewal: Activated clients attempt to renew every 7 days, which resets the 180-day period.

Activation Thresholds

These thresholds ensure KMS is used in managed environments rather than on single computers.

Key Terms

• KMS host: the server running the Volume Activation Services role that activates clients.
• CSVLK: the KMS host key obtained from the organization’s volume licensing agreement.
• GVLK: a publicly documented key that configures a device as a KMS client.
• MAK: a Multiple Activation Key used for devices that can’t reach a KMS host.
• ADBA: Active Directory-Based Activation, an alternative that stores activation objects in Active Directory.

Useful slmgr Commands for Administrators

Is KMS Legal?

Yes, when used as Microsoft intends. KMS is a legitimate service for organizations that hold valid volume licenses. However, third-party “KMS activators” that emulate a host without a real license are unauthorized. They violate Microsoft’s license terms and are a frequent source of malware, so they should never be used.

KMS vs MAK vs Retail Activation

Retail activation suits individuals. MAK works for smaller deployments or devices that rarely connect to the corporate network. KMS is best for larger organizations with many devices on a shared network, because it automates activation and renewal.

Best Practices for Running a KMS Host

• Use a reliable server. Install the Volume Activation Services role on a stable, always-on Windows Server.
• Publish DNS records. Let the host register its SRV record automatically so clients discover it without manual configuration.
• Open only what is needed. Allow TCP 1688 from client networks and keep the host off the public internet.
• Monitor the count. Run slmgr /dlv on the host to confirm the current client count meets the threshold.
• Consider ADBA. In Active Directory environments, Active Directory-Based Activation removes the need for a separate host and has no minimum threshold.

Frequently Asked Questions

What happens if a KMS client can’t reach the host?

The client remains activated for up to 180 days. If it doesn’t renew within that period, it shows a notification and tries again every two hours.

Can home users use KMS?

No. KMS requires a volume licensing agreement and a minimum number of devices. Home users should use a retail license or digital license.

Which port must be open for KMS?

TCP port 1688 by default, between clients and the KMS host.

Conclusion

KMS makes activation automatic for organizations with volume licenses. With correct DNS records, an open port 1688 and enough clients to meet the threshold, devices stay activated without any user effort.