Troubleshooting Windows activation failures on Azure VMs


Azure VMs will activate using the Azure KMS service if all of the following are true:

  1. Windows is configured with the appropriate KMS client setup key for that version of Windows.
  2. Windows is configured to use the Azure KMS service kms.core.windows.net:1688.
  3. VM has network connectivity to kms.core.windows.net:1688. For example, if the guest firewall or Azure network security group (NSG) rule does not allow TCP port 1688 outbound, the activation request will be blocked.
  4. Source IP address of KMS activation requests from the VM must be an IP address within the Azure IP ranges. This is necessary because the Azure KMS service only allow requests through if the source IP is within the Azure IP ranges. If you are using ExpressRoute, please see Azure VM may fail to activate over ExpressRoute. If you are using site-to-site VPN please see Use Azure custom routes to enable KMS activation with forced tunneling.

Note that Windows activation works the same way regardless if the VM is using Azure Hybrid Use Benefit (HUB) or not.

Run slmgr.vbs /dlv from within the VM to check #1 and #2 above. In the example below, VOLUME_KMSCLIENT is what tells you a KMS client setup key was used, and Registered KMS machine name: kms.core.windows.net:1688 is what confirms that it is configured to activate against the Azure KMS service.

C:\>cscript c:\windows\system32\slmgr.vbs /dlv
Microsoft (R) Windows Script Host Version 5.812
Copyright (C) Microsoft Corporation. All rights reserved.

Software licensing service version: 10.0.14393.351

Name: Windows(R), ServerDatacenter edition
Description: Windows(R) Operating System, VOLUME_KMSCLIENT channel
Activation ID: 21c56779-b449-4d20-adfc-eece0e1ad74b
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 03612-03764-000-000000-03-1033-14393.0000-1642017
Product Key Channel: Volume:GVLK
Installation ID: 009858430382850574122213203392636030969202304948320740858134404
Partial Product Key: 8XDDG
License Status: Licensed
Volume activation expiration: 258206 minute(s) (180 day(s))
Remaining Windows rearm count: 1000
Remaining SKU rearm count: 1000
Trusted time: 6/14/2017 6:24:25 PM
Configured Activation Type: All

Most recent activation information:
Key Management Service client information
 Client Machine ID (CMID): 54653727-addd-4b5f-bde9-824359786b75
 Registered KMS machine name: kms.core.windows.net:1688
 KMS machine IP address: 23.102.135.246
 KMS machine extended PID: 06401-00206-001-010007-03-1033-9600.0000-2322016
 Activation interval: 120 minutes
 Renewal interval: 10080 minutes
 KMS host caching is enabled

If slmgr.vbs /dlv shows RETAIL channel, run the following commands to set the KMS client setup key for the version of Windows Server 2016 being used, and force it to retry activation.

cscript c:\windows\system32\slmgr.vbs /ipk <KMS client setup key>
cscript c:\windows\system32\slmgr.vbs /ato

For example, for Windows Server 2016 Datacenter, you would run:

cscript c:\windows\system32\slmgr.vbs /ipk CB7KF-BWN84-R7R2Y-793K2-8XDDG

This step is not necessary for VMs created from the Windows Server 2016 gallery image, as the gallery image has the appropriate KMS client setup key already configured.

For activation issues involving Windows Server 2016 VMs failing to activate despite having the KMS client setup key configured, or for activation issues with Azure VMs using other versions of Windows, please review the remaining steps below.

Windows VMs should be configured with the KMS client setup key for the version of Windows being used, and have connectivity to port 1688 at kms.core.windows.net in order to activate successfully.

If you are using site-to-site VPN with forced tunneling, please see Use Azure custom routes to enable KMS activation with forced tunneling.

If you are using ExpressRoute with a default route published, please see Azure VM may fail to activate over ExpressRoute.

If your Azure VM experiences Windows activation failures, please try the following steps to resolve the issue. An example of an error message you may see is:

Error(s):  Activating Windows(R), ServerDatacenter edition
 Error: 0xC004F074 The Software Licensing Service reported that the computer could not be activated. No Key Management Service (KMS) could be contacted. Please see the Application Event Log for additional information.

Note that when the grace period has expired and Windows is still not activated, Windows Server 2008 R2 and later versions of Windows will show additional notifications about activating, the desktop wallpaper remains black, and Windows Update will install security and critical updates only, but not optional updates. See also the Notifications section at the bottom of the Licensing Conditions TechNet page.

Steps to Troubleshoot Activation

  1. Download and extract the Psping tool to a local folder in the VM that is failing to activate.http://technet.microsoft.com/en-us/sysinternals/jj729731.aspxTo download the file, first go to Server Manager, Configure this local server, select IE Enhanced Security Configuration, and select Off under Administrators.
  2. Go to Start, search on Windows PowerShell, right-click Windows PowerShell and select Run as administrator.
  3. Make sure the VM is configured to use the Azure KMS server by running the following command. This is set at VM creation, so running this command is just a troubleshooting step to make sure the proper configuration is set.iex “$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /skms kms.core.windows.net:1688”The command should return:Key Management Service machine name set to kms.core.windows.net:1688 successfully.
  4. Verify with Psping that you have connectivity to the KMS server. Switch into the folder where you extracted the Pstools.zip download, then run:.\psping.exe kms.core.windows.net:1688In the second-to-last line of the output, make sure you see:Sent = 4, Received = 4, Lost = 0 (0% loss)If Lost is greater than 0, the VM does not have connectivity to the KMS server. In that case, if the VM is in a virtual network and has a custom DNS server specified, you must make sure that DNS server is able to resolve kms.core.windows.net. Or, change the DNS server to one that does resolve kms.core.windows.net. Note that if you remove all DNS servers from a virtual network, VMs will then use Azure’s internal DNS service, which is able to resolve kms.core.windows.net.Aside from DNS issues, verify the guest firewall has not been configured in such a way that would block activation attempts.
  5. After verifying successful connectivity to kms.core.windows.net, run the following command from that elevated PowerShell prompt. This command attempts activation multiple times in a row.1..12 | % { iex “$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /ato” ; start-sleep 5 }Successful activation will return:Activating Windows(R), ServerDatacenter edition (12345678-1234-1234-1234-12345678) …
    Product activated successfully.
  6. If activation still failed, and the VM is running Windows Server 2012 R2 Datacenter, Standard, or Essentials, try the command below for the specific SKU. You can verify the OS version by going to Start, searching on Msinfo32, double-clicking Msinfo32.exe, and looking at the OS Name in the right pane.For Windows Server 2012 R2 Datacenter, run the following from the elevated PowerShell prompt:iex “$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /ipk W3GGN-FT8W3-Y4M27-J84CP-Q3VJ9”For Windows Server 2012 R2 Standard, run the following from the elevated PowerShell prompt:iex “$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /ipk D2N9P-3P6X9-2R39C-7RTCD-MDVJX”For Windows Server 2012 R2 Essentials, run the following from the elevated PowerShell prompt:

    iex “$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /ipk KNC87-3J2TX-XB4WP-VCPJV-M4FWM”

    After entering the specific command above for the SKU of Windows Server 2012 R2 the VM is using, try activating again:

    iex “$env:windir\system32\cscript.exe $env:windir\system32\slmgr.vbs /ato”

  7. At this point if you are still unable to activate the VM, check the Application event log for events from source Microsoft-Windows-Security-SPP to help understand why activation is failing.

If you are still unable to activate after attempting the above steps, let us know in the comments or contact Azure support.

Comments (18)

  1. Dave Bermingham says:

    Craig, went through these steps and activation still failed. I verified connectivity to kms.core.windows.net as described, however the activation still failed. This is a very vanilla lab environment that uses the default DNS server provided by my Virtual Network. I have tried provisioning 4 different VMs between today and yesterday and activation has failed each time. My vNet is in US East 2 and I'm using "a699494373c04fc0bc8f2bb1389d6106__Windows-Server-2012-R2-201412.01-en.us-127GB.vhd" as my image on a Large instance. Any ideas?

    PS C:toolsPSTools> .psping.exe kms.core.windows.net:1688

    TCP connect to 157.55.195.251:1688:

    5 iterations (warmup 1) connecting test:

    Connecting to 157.55.195.251:1688 (warmup): 28.85ms

    Connecting to 157.55.195.251:1688: 29.05ms

    Connecting to 157.55.195.251:1688: 29.67ms

    Connecting to 157.55.195.251:1688: 29.31ms

    Connecting to 157.55.195.251:1688: 28.90ms

    TCP connect statistics for 157.55.195.251:1688:

     Sent = 4, Received = 4, Lost = 0 (0% loss),

     Minimum = 28.90ms, Maximum = 29.67ms, Average = 29.24ms

    PS C:toolsPSTools> 1..12 | % { iex "$env:windirsystem32cscript.exe $env:windirsystem32slmgr.vbs /ato" ; start-sleep 5 }

    Microsoft (R) Windows Script Host Version 5.8

    Copyright (C) Microsoft Corporation. All rights reserved.

    Activating Windows(R), ServerDatacenter edition (00091344-1ea4-4f37-b789-01750ba6988c) …

    Error: 0xC004F074 The Software Licensing Service reported that the computer could not be activated. No Key Management Service (KMS) could be contacted. Please see the Ap

    plication Event Log for additional information.

  2. Craig Landis says:

    HI Dave,

    With a vanilla environment, it doesn't sound like you have ExpressRoute configured, but if you do, make sure you have public peering enabled if you are advertising a default route. I've updated the blog post with that information.

    Otherwise, since the VMs are 2012 R2 Datacenter, you can run these commands to use the AVMA key:

    iex "$env:windirsystem32cscript.exe $env:windirsystem32slmgr.vbs /ipk Y4TGP-NPTV9-HTC2H-7MGQ3-DV4TW"

    iex "$env:windirsystem32cscript.exe $env:windirsystem32slmgr.vbs /ato"

    Or to run them from elevated CMD instead of PowerShell:

    %windir%system32cscript.exe %windir%system32slmgr.vbs /ipk "Y4TGP-NPTV9-HTC2H-7MGQ3-DV4TW"

    %windir%system32cscript.exe %windir%system32slmgr.vbs /ato

    Also, the step to loop the activation attempt multiple times has worked for many customers when a single manual activation attempt, and Windows own automatic attempts every 2 hours – did not work. So make sure you have tried that. We continue to investigate the issue internally, since activation should be automatic and should not require a manual attempt, let alone multiple manual attempts.

    1..12 | % { iex "$env:windirsystem32cscript.exe $env:windirsystem32slmgr.vbs /ato" ; start-sleep 5 }

    Thanks,

    Craig

  3. Dave Bermingham says:

    I did let that other script run 12 times as specified, but it failed each time. I did it a few times on multiple VMs, vNets, Cloud Services and Geographies and they all had the same issue.

    Fortunately, the AVMA key worked as you described and I can move forward with confidence that I won't have to redo this work. Thanks for taking the time to answer.

  4. Craig Landis says:

    HI Dave,

    We did make a change just yesterday to address this issue of unexpected activation failures, so I suspect if you had retried the normal method today (slmgr.vbs /ato), it would have worked.

    Sorry for the frustrating experience, but glad you got it working and hope you have a good holiday.

    Thanks,

    Craig

  5. Nathan Manning says:

    I too am having the same problem with my VM.  However, msinfo reports that the OS is Windows Server 2012 Datacenter, but NOT R2.  Could that be why the product key above isn't working like it did for Dave?

    Nathan

  6. Nathan Manning says:

    When I tried to use the specific product key in the command above I got an error that I translated using slui.exe 0x2a 0xC004E016

    Which said "Product Key is Invalid".

  7. Brian Rota says:

    Is there a number to call for support for azure?

    This is crazy to be having this issues and no way to call into support.

  8. Dan Bergeron says:

    Step 6 speaks to Windows Server 2012 R2.  What are the steps for 2012 R1 as I am running into that issue on R1?

    Also to Brian Rota's point why do you need to pay for support to spin up a server?

  9. Nathan Manning says:

    What we apparently need is the Azure key to vanilla Windows Server 2012 datacenter. So how about it support team?

  10. Dan Bergeron says:

    MS confirmed KMS issues going on.  No work around at this time.  I have suggested they add the KMS Server to their Services Dashboard given everything looks green and yet they have issues going on at least a week.

  11. GS says:

    Why KMS keys listed on this page for Datacenter R2 (technet.microsoft.com/…/jj612867.aspx) are not working while the one specified in scripts (Y4TGP-NPTV9-HTC2H-7MGQ3-DV4TW) works. Is it MAK key? Also what is the reason for that weird long command lines? VBS file is located already system32 and does not require any additional configuration on command line.

    They key worked for me though without any additional mumbo jumbo in previous steps

  12. Marcelo Saied says:

    for

    Windows Server 2012 Datacenter use in CMD

    %windir%system32cscript.exe %windir%system32slmgr.vbs /ipk "48HP8-DN98B-MYWDG-T2DCC-8W83P"

  13. Nathan Manning says:

    Found that key already on TechNet and used it. Still getting Key Server not located.

  14. Craig Landis says:

    To be clear, expected behavior for Azure VMs regardless of Windows version is that they will automatically activate and do not require a product key be manually entered.

    The product key method, which has been suggested only as a troubleshooting step due to the current issue with KMS activation, only works for 2012 R2. It does not work for 2012 or 2008 R2. That is because it is using the Automation Virtual Machine Activation (AVMA) feature that is 2012 R2-only.

    The PowerShell command was suggested as an easy way to retry activation quickly multiple times, which we have seen work for the current issue that is being investigated. But it is no different than running cscript.exe %windir%system32slmgr.vbs /ato several times in a row.

    We apologize for the delay in getting this issue fully resolved so that all Windows versions automatically activate.

    Azure technical support options are detailed on the following page:

    azure.microsoft.com/…/options

  15. Tracey Nguyen says:

    Hello, I signed up with Azure Portal and provided my credit card info. After half an hour, i got an email saying that the system refused my application. Please help me with this. What do i need to do to open an Aruze account of Microsoft ? Thanks ( TraceyN2015@hotmail.com )

  16. Craig Landis says:

    Hi Tracy,

    This page outlines the Azure support options.

    azure.microsoft.com/…/options

    Thanks,

    Craig

  17. James says:

    MSDN Windows 10 Enterprise RTM gallery images won't activate. Any help is appreciated. Was unable to use the support portal since I don't have the information that it is asking for to link to MSDN.

  18. M Mack says:

    If you just created a new Windows 2012 R2 Azure VM and you are bugged by the fact that it says " Windows is not activated" – then just activate with the Datacenter Key used in this post : "W3GGN-FT8W3-Y4M27-J84CP-Q3VJ9". Issue resolved! If you are using "forced Tunneling" including the use of express routes – then clearly there are more ongoing issues as stated above.

Skip to main content