How to Configure Windows Server Volume Activation Services (KMS) via PowerShell

The Nightmare of MAK Keys

In a small business, IT administrators activate Windows Server and Windows 10/11 endpoints by manually typing a 25-character Multiple Activation Key (MAK) into each machine. In an enterprise environment with 5,000 servers and 20,000 laptops, this manual process is mathematically impossible.

To solve this, Microsoft requires the use of Key Management Service (KMS). Instead of every laptop reaching out to Microsoft’s licensing servers over the internet, you designate one central Windows Server in your datacenter as the KMS Host. You install a master KMS Host Key on this single server and activate it with Microsoft. From that point on, every other server and laptop on the corporate network silently locates the KMS Host via DNS and requests activation locally. The KMS Host keeps a rolling count, and as long as the laptops check in every 180 days, they remain fully activated.

Configuring a server to act as a KMS Host requires precise execution via PowerShell to ensure the licensing service is properly instantiated and broadcasted to Active Directory.

Step 1: Installing the Volume Activation Role

First, you must install the software role on the server you intend to act as the KMS Host (e.g., KMS-SRV-01).

Open an elevated PowerShell session as an Administrator and execute:

Install-WindowsFeature -Name VolumeActivation -IncludeManagementTools

Step 2: Installing the KMS Host Key

You must obtain your KMS Host Key from the Microsoft Volume Licensing Service Center (VLSC). Ensure you grab the key specifically labeled “KMS,” not “MAK.”

To inject the key into the server’s Software Licensing Manager (slmgr), execute the following command (replace the X’s with your actual 25-character key):

slmgr.vbs /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX

A popup box will appear confirming the product key was installed successfully.

Step 3: Activating the KMS Host with Microsoft

The KMS Host now has the key, but it must validate itself against Microsoft’s servers one single time.

Ensure the KMS server has internet access, and execute:

slmgr.vbs /ato

Wait for the popup confirming the product was activated successfully. Your server is now officially recognized by Microsoft as a legitimate licensing authority for your enterprise.

Step 4: Configuring the DNS SRV Records

For the 20,000 laptops on your network to find the KMS server, the server must publish a specific Service (SRV) record in your Active Directory DNS.

By default, the KMS service attempts to do this automatically. You can force it to publish the record immediately:

slmgr.vbs /sdns

To verify the record exists, open a Command Prompt on any other machine and run:

nslookup -type=srv _vlmcs._tcp

It should return the hostname of your KMS server.

Step 5: The Activation Threshold (Crucial Detail)

Your KMS server is now fully operational, but it will not activate any client machines immediately. Microsoft enforces a strict minimum threshold to prevent abuse.

• The KMS Host will refuse to activate Windows Server endpoints until at least 5 unique servers have requested activation.
• The KMS Host will refuse to activate Windows 10/11 endpoints until at least 25 unique laptops have requested activation.

To check the current count of machines that have contacted your KMS Host, execute:

slmgr.vbs /dli

Look at the Current Count metric. Once that number hits 25, the KMS engine will unlock, and all machines on your network will instantly transition to a fully activated, licensed state without any human intervention.