Networknet archive Blog

Windows Server: KMS client behind a firewall

Originally published 2 comments

The Software Protection Windows service manages activation with KMS (Key Management Server). Over the last couple of months, I have been deploying and managing Windows Server 2008 R2 VMs behind a firewall. These VMs run in a dedicated VLAN, with a gateway controlling the allowed network traffic.

The servers were initially installed and configured on a VLAN with access to Active Directory, DNS and the central KMS server, which activates server and client licenses. The KMS service was published in the Active Directory DNS zone. After configuration, the servers were moved to the dedicated VLAN, where they could no longer communicate with the Active Directory network. The KMS client could not renew its activation.

The following events started appearing in the Application log in Event Viewer:

License Activation Scheduler (sppuinotify.dll) was not able to automatically activate.
Event ID 12288 Security-SPP: The client has sent an activation request to the key management service machine.

After reviewing the events and trying C:\Windows\System32>cscript slmgr.vbs /ato, I realized that KMS client communication was blocked. I used TCPView.exe and saw connections in the SYN_SENT state. My KMS infrastructure used the default TCP port, 1688, and this traffic was being dropped.

Allow KMS client communication

  1. Make sure the KMS client can reach the server by FQDN. If no DNS server is available, add a HOSTS entry.
  2. Allow traffic from the KMS clients to the central KMS server on TCP port 1688.
  3. Run C:\Windows\System32>cscript slmgr.vbs /ato to activate the client.

Software Protection will receive the activation or renew its current one.

Command output and events

This output appeared when communication with the KMS server was blocked:

Code5 lines
1
2
3
4
5

C:\Windows\System32>cscript slmgr.vbs /ato
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved. 
Activating Windows Server(R), ServerStandard edition.On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x8007007B' to display the error text.
Error: 0x8007007B

This output appeared when communication with the KMS server was allowed:

Code5 lines
1
2
3
4
5

C:\Windows\System32>cscript slmgr.vbs /ato
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.
Activating Windows Server(R), ServerStandard edition 
Product activated successfully.
Event ID 1003 - Security-SPP
The Software Protection service has completed licensing status check.

Reference

1 comment

Comments from the original WordPress site, kept read-only.

1 mention