Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesConfiguration Manager (formerly SCCM) can deploy the commands that activate Windows, but it is not the activation service. Each client must be correctly licensed for volume activation, have a supported Windows edition, and be able to reach your authorized Key Management Service (KMS) host. The deployment normally runs slmgr.vbs locally to install the edition-specific KMS Client Setup Key when needed, request activation, and report the resulting licensing state.
This procedure applies to properly licensed Windows 10, Windows 11, and supported Windows Server volume-activation deployments. It does not legitimize retail activation, create a KMS host, or replace a volume-license agreement.
As an Amazon Associate I earn from qualifying purchases.
How KMS activation works
KMS is a client-server volume-activation model. A KMS client contacts an organization’s KMS host instead of Microsoft’s retail activation service. Clients normally discover the host through the _vlmcs._tcp DNS SRV record; an administrator can also configure a host explicitly. The default KMS communication port is TCP 1688, although an organization may use another configured port. See Microsoft’s KMS troubleshooting guidance.
A KMS client periodically renews its activation by contacting the KMS infrastructure. Entering a GVLK (Generic Volume License Key, also called a KMS Client Setup Key) only configures the client for KMS; it is not a standalone license and cannot activate a machine that cannot reach an authorized KMS host.
#1 Best Overall
- Instantly productive. Simpler, more intuitive UI and effortless navigation. New features like snap layouts help you manage multiple tasks with ease.
- Smarter collaboration. Have effective online meetings. Share content and mute/unmute right from the taskbar (1) Stay focused with intelligent noise cancelling and background blur.(2)
- Reassuringly consistent. Have confidence that your applications will work. Familiar deployment and update tools. Accelerate adoption with expanded deployment policies.
- Powerful security. Safeguard data and access anywhere with hardware-based isolation, encryption, and malware protection built in.
The KMS host itself must be installed and activated with the organization’s valid KMS host key. Do not use public KMS servers or third-party “KMS activators”; they are not an authorized licensing method.
Prerequisites and licensing checks
- Your organization has a qualifying Microsoft volume-license agreement and an authorized KMS host (or an approved alternative such as Active Directory-based activation or MAK).
- The installed Windows edition supports volume activation. Retail and OEM editions may require reimaging, edition conversion, or another activation method; simply running
/ipkis not a universal conversion procedure. - You know the exact edition and release of every target image. Use Microsoft’s KMS Client Setup Keys list to select the matching GVLK. Never publish one key as if it applied to every edition.
- The KMS host supports the client operating-system version and edition, and any applicable KMS client-count requirements are satisfied. Thresholds vary by product generation; Microsoft’s historical examples include 25 Windows clients and five Windows Server systems, not a universal rule for every current deployment.
- Clients can resolve the KMS DNS record or are permitted to use an approved static host, and network policy allows the KMS TCP port.
- You have a pilot device collection, permission to author and approve scripts, and a plan to report actual license state rather than merely script execution.
Choose a Configuration Manager deployment method
| Method | Best use | Important behavior |
|---|---|---|
| Run Scripts | One-time remediation, a controlled collection, or rapid troubleshooting | PowerShell runs under the local SYSTEM/computer account, returns output through state messages, and has a one-hour timeout. No distribution point is required for a self-contained script. |
| Package and program | Repeatable deployments, legacy SCCM environments, or scripts with supporting files | Provides explicit content, scheduling, rerun, retry, and program settings. Content must be distributed to distribution points. |
| Application | Managed installation state with requirements, detection, dependencies, or supersedence | Use a detection script that verifies licensing state; do not detect only whether a script file exists. |
| Task sequence | Bare-metal deployment, refresh, or provisioning | Run after Windows, the correct edition, networking/DNS, and (when applicable) the Configuration Manager client are ready. |
For current-branch Run Scripts, Microsoft documents the feature and its permissions, execution context, monitoring, and logs at Create and run PowerShell scripts with Configuration Manager. Packages and applications are described in Microsoft’s Configuration Manager application-management documentation.
Use a conservative, repeatable PowerShell script
The script below is suitable for a controlled deployment. It accepts an optional, edition-appropriate GVLK and an optional approved KMS host. With no host supplied it preserves DNS discovery. It prints slmgr.vbs output because the text is often more informative than the process exit code, then returns a failure code unless the final status contains License Status: Licensed.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →[CmdletBinding()]
param(
[string]$KmsClientSetupKey,
[string]$KmsHost
)
$ErrorActionPreference = 'Stop'
$slmgr = Join-Path $env:windir 'System32slmgr.vbs'
if (-not (Test-Path $slmgr)) { throw "slmgr.vbs was not found at $slmgr" }
function Invoke-Slmgr {
param([Parameter(Mandatory)][string[]]$Arguments)
$text = (& cscript.exe //nologo $slmgr @Arguments 2>&1 | Out-String).Trim()
[pscustomobject]@{ ExitCode = $LASTEXITCODE; Output = $text }
}
Write-Output "Computer: $env:COMPUTERNAME"
$current = Invoke-Slmgr @('/dlv')
Write-Output $current.Output
if ($current.Output -match 'License Status:s+Licensed') {
Write-Output 'RESULT=AlreadyLicensed'
exit 0
}
if ($KmsClientSetupKey) {
$install = Invoke-Slmgr @('/ipk', $KmsClientSetupKey)
Write-Output $install.Output
if ($install.ExitCode -ne 0) { throw "GVLK installation returned exit code $($install.ExitCode)." }
}
if ($KmsHost) {
$configured = Invoke-Slmgr @('/skms', $KmsHost)
Write-Output $configured.Output
if ($configured.ExitCode -ne 0) { throw "KMS host configuration returned exit code $($configured.ExitCode)." }
} else {
Write-Output 'Using DNS-based KMS discovery.'
}
$activation = Invoke-Slmgr @('/ato')
Write-Output $activation.Output
$xpr = Invoke-Slmgr @('/xpr')
Write-Output $xpr.Output
$final = Invoke-Slmgr @('/dlv')
Write-Output $final.Output
if ($final.Output -match 'License Status:s+Licensed') {
Write-Output 'RESULT=Licensed'
exit 0
}
Write-Output 'RESULT=NotLicensed'
exit 1Why these commands are used
/dlvdisplays detailed edition, channel, license status, CMID, and KMS information./ipkinstalls a product key. Supply only the GVLK matching the installed edition./skms host:portsets a specific KMS host. Use it only when policy intentionally bypasses DNS discovery./ckmsremoves a manually configured host and restores automatic discovery./atorequests activation, while/xprreports the current expiration state.
Microsoft documents these options in slmgr.vbs command-line options. Run the script elevated; the Configuration Manager SYSTEM context supplies the required privilege. Avoid rebooting the computer or restarting the Configuration Manager agent from a Run Scripts script.
Make the workflow idempotent
- Query the current state.
- Return success without changes if the approved system is already licensed.
- If it is volume licensed but not active, try
/ato. - Install the approved GVLK only when the key/channel is wrong or missing.
- Use a preapproved static host only when DNS discovery is not the policy; otherwise clear stale settings with
/ckms. - Retry activation and verify the final state.
This prevents every recurring deployment from reinstalling keys or overwriting a valid KMS configuration.
Deploy with Run Scripts
- In the Configuration Manager console, open Software Library > Scripts.
- Select Create Script, choose PowerShell, and import the script.
- Submit it for approval. An authorized script approver must approve it before execution.
- Open Assets and Compliance > Device Collections, select a pilot collection, and choose Run Script.
- Select the approved activation script and provide parameters only from controlled, approved values.
- Review results under Monitoring > Script Status. Retarget devices that were offline during the execution window.
Author, approver, and runner permissions are separate by default. Because the script runs as SYSTEM, it cannot rely on a logged-in user’s profile or credentials; network access is made as the computer account.
Deploy as a package, application, or task sequence
Package and program
Place the script and any wrapper or documentation in a source folder, for example:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Activate-WindowsKMS.ps1
Activate-WindowsKMS.cmd
README.txtA typical command line is:
powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File .Activate-WindowsKMS.ps1Prefer a signed script and your organization’s approved execution policy. If a controlled deployment must use -ExecutionPolicy Bypass, treat that as a deliberate security exception. Configure the program to run whether or not a user is logged on, with administrative rights and the local SYSTEM account; distribute content to required distribution points; pilot first; and configure rerun behavior. Microsoft provides package cmdlets at New-CMPackage and New-CMPackageDeployment.
Application deployment type
Use an application when activation needs requirements, dependencies, supersedence, and clear installation-state reporting. A detection script should confirm the expected edition, the VOLUME_KMSCLIENT channel where applicable, and a Licensed status. “The script file exists” is not a valid activation detection rule. See Microsoft’s script deployment type documentation.
Task sequence
Run activation after Windows is installed, the edition is confirmed, networking and DNS are available, and the device has joined the required network or domain. Configuration Manager’s PowerShell task-sequence step is documented at New-CMTSมStepRunPowerShellScript.
Rank #2
- STREAMLIMED AND INTUITIVE UI | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- JOIN YOUR BUSINESS OR SCHOOL DOMAIN for easy access to network files, servers, and printers.
- OEM IS TO BE INSTALLED ON A NEW PC WITH NO PRIOR VERSION of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE PRODUCT SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
Verify activation independently of SCCM status
Use an elevated command prompt or run these commands through Configuration Manager:
cscript.exe //nologo %windir%System32slmgr.vbs /dli
cscript.exe //nologo %windir%System32slmgr.vbs /dlv
cscript.exe //nologo %windir%System32slmgr.vbs /xpr
cscript.exe //nologo %windir%System32slmgr.vbs /ato/dlishows basic licensing information./dlvshows detailed edition, channel, partial key, license status, CMID, and KMS data./xprreports whether activation is permanent or when the current KMS activation expires./atoattempts activation.
Configuration Manager reporting that a script launched successfully is not proof that Windows activated. Require License Status: Licensed in /dlv, and optionally validate the expected channel and KMS host. Do not expose full product keys in logs. Script execution and messaging logs are commonly found at C:WindowsCCMLogsScripts.log and C:WindowsCCMLogsCcmMessaging.log.
Check DNS, connectivity, and KMS readiness
DNS discovery
nslookup -type=SRV _vlmcs._tcpThe result should identify the organization’s KMS host. If the record is missing or published in an inaccessible DNS zone, clear any stale manual setting and retry:
cscript.exe //nologo %windir%System32slmgr.vbs /ckms
cscript.exe //nologo %windir%System32slmgr.vbs /atoIf policy permits static configuration:
cscript.exe //nologo %windir%System32slmgr.vbs /skms kms01.example.com:1688
cscript.exe //nologo %windir%System32slmgr.vbs /atoMicrosoft describes DNS and static host configuration in its Windows client activation overview.
TCP connectivity
Test-NetConnection kms01.example.com -Port 1688A successful TCP test does not prove that licensing will succeed, but a failure strongly indicates routing, firewall, VPN, host-availability, or port problems. Do not expose a KMS host directly to the public internet.
Diagnose common failures
0x8007232B DNS name does not exist
Check the SRV record, the client’s DNS servers, VPN or corporate-network connection, and any stale /skms value. Run /ckms followed by /ato, or set the approved host explicitly. Microsoft’s error-specific procedure is at 0x8007232B troubleshooting.
0xC004F042
This usually indicates an unusable or mismatched KMS configuration: wrong edition or GVLK, an incompatible host, or a stale host setting. Inspect /dlv, clear the old host, set the approved host if necessary, and retry. See Microsoft’s 0xC004F042 guidance.
The script runs but Windows remains unlicensed
- The GVLK does not match the installed edition.
- The image is retail or OEM rather than volume licensed.
- The KMS host threshold or host-version requirement is not satisfied.
- DNS, TCP 1688, firewall, VPN, or host availability prevents contact.
- The client has a stale static host or the host key does not support the client.
- Cloned machines share an inappropriate client machine identifier (CMID).
Collect slmgr.vbs /dlv output and relevant event logs. A unique CMID for each KMS client matters; repeated /ato commands will not fix an image-preparation problem.
Remote or offline machines
A laptop outside the corporate network may not reach an internal KMS host. Establish the corporate VPN before activation, provide an approved network path, or choose Active Directory-based activation or MAK where the licensing design calls for it. Do not solve this by publishing a KMS host publicly.
Free tools Windows power users keep installed
One-click scans. No signup required.
Security and compliance rules
- Distinguish the public Microsoft GVLK from the organization’s confidential KMS host key. Never put the host key in a client script.
- Restrict script authoring, approval, and execution permissions; pilot the deployment and retain an audit trail.
- Use code signing where practical and avoid arbitrary command-string concatenation. Prefer fixed, approved hostnames and an edition-to-GVLK mapping maintained under change control.
- Minimize key exposure in parameters, logs, source folders, and application content.
- Use only authorized KMS infrastructure. “KMS activator” utilities and public KMS hosts are neither legitimate nor safe.
Microsoft’s Run Scripts documentation warns that scripts are powerful and that parameters and script injection require security review: Configuration Manager scripts.
Rank #3
- Video Link to instructions and Free support VIA Amazon
- 24/7 Tech Support!
- key code included
When KMS scripting is the wrong solution
| Option | Better fit | Trade-off |
|---|---|---|
| Automatic KMS activation | Clients already have the correct GVLK and reliable DNS/KMS access | Lowest maintenance; no SCCM remediation script is needed. |
| Active Directory-based activation | Domain-joined environments with suitable AD activation infrastructure | Reduces dependence on repeated direct KMS-host connectivity. |
| VAMT | Centralized volume-activation administration and reporting | Focused on activation management rather than general software deployment; see VAMT key-installation guidance. |
| MAK | Small, isolated, or infrequently connected populations | Consumes a finite activation allowance and does not use KMS renewal. |
| Intune or cloud management | Predominantly cloud-managed, internet-connected endpoints | Changes the management platform, not the underlying Windows licensing requirement. See Microsoft Intune. |
Windows activation tooling is distinct from Office volume activation; Office uses its own tools and configuration, as Microsoft explains at Tools to manage Office volume activation.
Frequently Asked Questions
Can SCCM activate Windows without a KMS host?
No. SCCM only executes the local commands. The client still needs an authorized KMS host or another approved volume-activation method such as Active Directory-based activation or MAK.
Do I always need to install a GVLK?
No. If the image already has the correct KMS Client Setup Key and can discover the KMS host, run activation and verify the result. Install a GVLK only when the key or channel is wrong or missing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Can retail Windows be activated with KMS?
Not simply by running /ipk. Retail and OEM editions may require reimaging, edition conversion, or a different activation method.
What port does KMS use?
TCP 1688 is the default KMS port. Your organization may configure another port.
Why can /ato work locally but fail from SCCM?
Run Scripts uses the SYSTEM/computer account and may run while the device is off-network. Check DNS, VPN, firewall rules, and computer-account network access.
Does KMS activation expire?
KMS clients renew periodically. Losing access to the KMS infrastructure eventually affects activation status; /xpr shows the current state.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Should I use /skms or DNS?
Prefer DNS discovery unless policy requires a fixed host. Use /skms only with an approved hostname and clear stale settings with /ckms when returning to discovery.
What is the difference between a GVLK, MAK, and KMS host key?
A GVLK identifies a volume client for KMS, a MAK activates directly with a finite allowance, and a KMS host key authorizes the organization’s KMS host. They are not interchangeable.
Can the same script activate Office?
No. Office volume activation uses separate tooling and configuration from Windows slmgr.vbs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
