Now that you have an overview of the Office 2010 KMS activation and MAK activation, I can address the question of whether KMS or MAK is the better option to activate Office 2010. Most of the arguments also apply for Windows Vista and Windows 7 activation.

Microsoft recommendations

You need at least 5 Office 2010 installations if you want to activate Office 2010 with KMS; however, Microsoft recommends using MAK activation if your network has fewer than 25 computers. If you have more than 50 Office 2010 machines, Microsoft recommends going for KMS.

Management

The biggest advantage of KMS is that the Office clients don’t have to be configured. Once your KMS host is running and activated, you usually won’t be bothered again with activation issues. By contrast, MAK requires that you ensure activation whenever you install Office 2010. However, you can also automate the MAK deployment process.

Limited number of MAK activations

Another downside of MAK activation is that whenever you have to reinstall a machine, the number of possible installations with the corresponding MAK key is reduced by one. Some organizations deploy new OS images when major updates are required, such as Windows service packs, or when a user has messed up his desktop. In such an environment KMS is probably the better option.

180 days

The biggest downside of KMS is that Office clients have to be activated again after 180 days. Thus, you always have to ensure that your KMS infrastructure is working properly. The main advantage of MAK is that once a machine is activated, it will stay activated as long as you don’t make major changes to the computer.

In the field computers

Using KMS to activate Office 2010 on the laptop computers of business travelers is at best problematic because the computer might not be able to reach the KMS host when the 180 days are over; Office 2010 will then start complaining. Since the user can continue working with Office, this might or might not be a big deal, depending on who is using the computer.

Working with MAK and KMS activation

Since there are situations where KMS activation is problematic, many organizations end up working with MAK and KMS. The downside of this option is that you have to deal with two different activation methods, which increases the complexity of your infrastructure. Because MAK activation is the more flexible option, it might make sense in some environments not to use KMS activation.

By now you have probably realized that there is no clear answer to the question of whether KMS or MAK  is the better to activate Office 2010. I certainly didn’t cover all possible scenarios here. Thus, before making a decision, you have to evaluate your own environment. Bottom line: If you have a big network where new machines are added frequently, KMS is usually the better option. In a small static network, MAK is often the preferable solution.

• Access Services in SharePoint Server 2010 (0)
• Office 365 review – Part 8: SharePoint Online and conclusion (0)
• Office 365 review – Part 7: Lync Online (0)
• Office 365 review – Part 6: Exchange Online Hybrid, Archiving and IRM (2)
• Office 365 review – Part 5: Migrating to Exchange Online (0)

In the last post of this series, I discussed Office 2010 KMS activation. Today, I will have a look at the second option that Microsoft provides for volume activation—the Office 2010 MAK activation. Like in my previous post, I will only list the most important facts you have to know.

Office 2010 MAK activation key facts

• MAK stands for Multiple Activation Key. This doesn’t stop people from saying “MAK key.”
• A MAK key can be used to activate multiple Office 2010 installations, contrary to an ordinary product key that can only be used to activate one installation. The number of possible activations depends on the number of Office licenses you have purchased.
• Unlike with KMS activation, every machine has to be activated only once. You have to activate Office 2010 again only when significant hardware changes (for instance, the hard drive) occur.
• You can get MAK keys at the Volume Licensing Service Center.
• The MAK key has to be deployed to the Office 2010 installation. There are five ways to do this— two before you deploy Office 2010 and three after installation. Before Office 2010 deployment: Office Customization Tool (OCT): OCT is part of the Office 2010 setup program and can be started with setup.exe /admin. During the procedure you can enter the product key (MAK). Config.xml file: If you deploy Office 2010 through a network installation, you can use config.xml to specify the MAK key. After Office 2010 deployment: Volume Activation Management Tool (VAMT) 2.0: VAMT is a free Microsoft tool that allows you to deploy MAK keys (among other things). Backstage view: The Backstage view is the new menu in Office 2010 that you can access by clicking “File” in an Office application. You can find product activation under “Help.” ospp.vbs script: The ospp.vbs script can be found in the Office 2010 installation folder (%installdir%\Program Files\Microsoft Office\Office14). The script can be used to configure Office 2010.
• There are two different ways to activate Office 2010 with VAMT: MAK independent activation and MAK proxy activation. With MAK independent activation, each computer will contact Microsoft’s activation service, whereas with MAK proxy activation only the computer where VAMT is installed needs access to the Internet. You can choose the activation method in the VAMT user interface.
• Additional reading: Configure and deploy volume activation of Office 2010 Plan for volume activation of Office 2010

• Access Services in SharePoint Server 2010 (0)
• Office 365 review – Part 8: SharePoint Online and conclusion (0)
• Office 365 review – Part 7: Lync Online (0)
• Office 365 review – Part 6: Exchange Online Hybrid, Archiving and IRM (2)
• Office 365 review – Part 5: Migrating to Exchange Online (0)

Many admins who still haven’t upgraded to Vista or Windows 7 will first have to deal with volume activation when they deploy Office 2010. Microsoft’s documentation about Office 2010 volume activation is quite comprehensive. Today, I will summarize the key facts about Office 2010 KMS activation. In my next post, I will cover MAK activation, and in the last post of this series I will compare Office 2010 KMS and MAK activation.

Office 2010 KMS activation key facts

• KMS, which stands for Key Management Service Host, is software for Windows that works as a proxy for Windows Vista, Windows 7, and Office 2010 activation.
• Office 2010 volume editions are delivered with the KMS client, which doesn’t have to be installed. KMS clients will find the KMS host automatically through DNS.
• When an end user starts Office 2010 (no admin privileges required), the KMS client will contact the KMS host, which will then activate Office 2010 automatically. This means you don’t have to enter a product key on the client side.
• Windows 7 (volume editions) and Windows Server 2008 R2 are delivered with the KMS host that can activate Office 2010.
• The KMS host for Windows Vista and Windows Server 2008 can’t be used for Office 2010 activation.
• Make sure that a DNS server that supports SRV records is available and that you have sufficient privileges. More information about KMS DNS configuration can be found here.
• KMS 1.1 can be downloaded and installed on Windows Server 2003 SP1 or later: 32-bit or 64-bit. After you install KMS 1.1, you have to update to KMS 1.2. You need at least Windows Server 2003 SP2 for that.
• For all Windows editions, you will need the KMS host license files for Office 2010, which are included in the Office 2010 KMS Host License Pack.
• Make sure your firewall allows outbound connections for the server where the KMS host runs. The KMS host will contact Microsoft’s activation service.
• You also need the Office 2010 KMS host product key, which you can get at the Volume Licensing Service Center if you purchased Office 2010 licenses. You will also need the Office 2010 activation ID “bfe7a195-4f8f-4f0b-a622-cf13c7d16864.”
• The KMS host has to be activated with these commands: slmgr.vbs /ipk <Office 2010 KMS host key> slmgr.vbs /ato <Office 2010 activation ID>
• You will need at least 5 Office 2010 installations before client activation starts (not 25, as for Windows Vista and Windows 7).
• After installation, Office 2010 will work normally without activation for a grace period of 25 days. After this, users will see notification dialogs whenever they start an Office application. After the 30^th day, the title bar will turn red, reminding you that activation has failed. There is no Reduced Functionality Mode like with the retail editions of Office 2010. Thus users can still continue with their work.
• You can rearm Office 2010 5 times to extend this grace period to 180 days.
• Every KMS-activated Office 2010 has to renew its activation after 180 days.
• To verify which Office 2010 clients have been activated, you can use Microsoft’s free Volume Activation Management Tool (VAMT).
• Additional reading: Configure and deploy volume activation of Office 2010 Plan for volume activation of Office 2010

In my next post, I will cover Office 2010 MAK activation.

• Access Services in SharePoint Server 2010 (0)
• Office 365 review – Part 8: SharePoint Online and conclusion (0)
• Office 365 review – Part 7: Lync Online (0)
• Office 365 review – Part 6: Exchange Online Hybrid, Archiving and IRM (2)
• Office 365 review – Part 5: Migrating to Exchange Online (0)

This article explains how you can rearm Office 2010 and for what you need this feature.

Office 2010 is certainly the best Office suite out there. However, compared to Office 2007 it has one major drawback: Like Vista and Windows 7, Office 2010 has to be activated. However, Office 2010 behaves a little different than Windows if it is not activated. Rearming Office 2010, that is resetting the grace period, works similar as rearming Windows.

Office 2010 Reduced Functionality Mode

Retail versions of Office 2010 will only run in Reduced Functionality Mode (RFM) after the grace period of 30 days has been exceeded. In RFM Office, documents can only be viewed but not modified.

Volume editions of Office 2010 don’t have an RFM. However, Office will start nagging users with messages after 25 days. You can just imagine how many helpdesk calls it will provoke if you don’t ensure that Office 2010 has been activated during this grace period.

Activating Office 2010

You can use the latest version of the Key Management Host (KMS) or activate Office 2010 with VAMT. Either way shouldn’t be doable within 25 days after the installation.

However, it might be difficult to activate Office 2010 during the grace period if you deploy a pre-installed Office with an OS image. The grace period begins immediately after you installed Office 2010 on your master PC. If you have to perform other configurations before you create the master image, then it is quite possible that 25 days is too short. You also have to take into account that it might take some time until Office finds a KMS host or until you activate it manually.

This is where Office 2010 rearm comes in. This features allows you reset the grace timer to 30 days grace. If you rearm Office right before you create the OS master image, you can be sure that you have the full 25 days before users will bothered with Office activation notifications or before the retail edition goes into Reduced Functionality Mode after 30 days.

How to rearm Office 2010

You will find some complicated instructions on the Web of how to rearm Office 2010. Most of these articles were written before Office 2010 was released. There are also third party tools that allow you to rearm Office 2010. However, I recommend following Microsoft’s instructions. This topic is too sensitive to rely on third party tools.

To rearm Office 2010, you only have to run ospprearm.exe in %installdir%\%Program Files%\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform from an elevated command prompt. "%Program Files%" has to be replaced with %Program Files (x86)% if you installed Office 2010 32-bit on Windows 64-bit.

Rearm Office 2010 – ospprearm.exe

Since you can rearm up to 5 times, you can run Office 2010 for 180 days (30 days + 5 x 30 days) without activating it, if you rearm it every time after the 30 days grace period has been reached.

Another effect of rearming Office 2010 is that the client machine ID (CMID) is reset. The KMS host uses the CMID to identify unique clients. This allows the KMS host to count Office 2010 correctly.

Rearming Office 2010 Trial

Office 2010 rearm could also be useful if you installed Office 2010 Trial. The Office 2010 Professional Plus Trial comes with a special activation code that will allow you to test Office 2010 for 60 days. There are reports on the web indicating that you can also rearm the trial version of Office 2010. Office 2010 Trial indeed comes with ospprearm.exe. However I doubt that rearming will work after you used the trial activation code because rearming makes only sense with an Office installation that hasn’t been activated.

Office 2010 Activation Wizard

You can run Office 2010 Trial without activating it but every time you launch the Office 2010 Activation Wizard will pop up. If you cancel this dialog, you can continue using the Office application. I suppose this will only work for 30 days. If you have experience with rearming Office 2010 Trial, please let me know.

• Access Services in SharePoint Server 2010 (0)
• Office 365 review – Part 8: SharePoint Online and conclusion (0)
• Office 365 review – Part 7: Lync Online (0)
• Office 365 review – Part 6: Exchange Online Hybrid, Archiving and IRM (2)
• Office 365 review – Part 5: Migrating to Exchange Online (0)

Product key groups

Product Keys for KMS and MAK are associated with a so-called product key groups which are arranged in a hierarchy (see diagram). A product key of a certain group can activate the operating systems that belong to this group as well as lower key groups. There are four product key groups: Vista VL: Windows Vista (the lowest group), Server Group A: Windows Web Server 2008, Server Group B: Windows Server 2008 Standard and Enterprise, Server Group C: Datacenter and Itanium-based systems.

KMS 1.1 (Key Management Services)

To activate Server 2008 via KMS, you have to install version 1.1. If you already have KMS 1.0 installed, you can update it by launching the WindowsServer2003-KB948003-x86-ENU.exe which is part of the KMS 1.1 download. Note that KMS is platform and language-dependent. If you want to activate Server 2008 machines, KMS has to run on a server. You won’t be able to activate Server 2008 if your KMS is installed on a Vista box.

Determining your KMS version

After the update, it is difficult to figure out which KMS is actually running. “Add and Remove Programs” in the Control Panel doesn’t display the version and the KMS command slmgr doesn’t display it either. However, the help screens are different for KMS 1.0 (left) and KMS 1.1 (right). KMS 1.1 has more options. Check out the screenshots to see the differences.

KMS activation thresholds

KMS only starts activating its Vista clients if at least 25 physical Vista machines are in the network environment. A Server 2008 installation can be activated if at least 5 servers contacted the KMS. KMS can activate virtual Windows installations, but they don’t count for the threshold.

VAMT 1.1 (Volume Activation Management Tool)

VAMT 1.1 has also been released recently. Like KMS 1.1, its main enhancement is the support for Windows Server 2008. I have reviewed VAMT 1.0 a while back. I played a little with VAMT 1.1 and didn’t find significant differences. You can use VAMT to get an overview of the licensing status of your Vista and Server 2008 machines and you can also use it to deploy MAK keys.

License states

Basically, there are five license states for Windows Server 2008 and Vista SP1:

• Licensed: After activation
• Initial Grace: After the installation of the OS
• Out-of-Tolerance Grace: Hardware changes make re-activation necessary
• Non-Genuine Grace: If genuine activation failed when you try to download software from Microsoft.
• Unlicensed: When any of the grace periods (30 days) expires, the system will enter a notifications-based mode of operation.

One of the improvements of Service Pack 1 for Vista is that it abolishes Reduced Functionality Mode (RFM). So Vista SP1 and Windows Server 2008 will just enter a mode where the desktop background turns black and where notifications in the lower right corner over the system tray tell you that your copy of Windows isn’t genuine.

The fact that Microsoft gave up on RFM is certainly a step into the right direction. However, I am still unhappy with the current situation. My main complaint is that KMS is a much too simple tool for such an important task. I want a central licensing tool that logs all activation attempts, displays all machines with their last known license states, allows me to push activation for clients who had problems and so on. And, of course, I want a GUI for KMS.

VAMT is nice for deploying MAKs, but it is more or less useless if you want to get an overview of the license status of your whole network. VAMT is only able to scan the network to gather the license states of your Windows machines. Computers that are not online during the scanning process won’t be included.

I want to be able to get the exact licensing status of my whole network with just a mouse click. If Microsoft imposes extra work on us because they want to sell more licenses, they should at least give us the tools to manage licensing without hassle.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Reduced Functionality Mode will be removed in Vista SP1 (2)

When I started playing with Vista RC, I couldn’t believe my eyes when one of my test machines entered RFM. This computer had a private IP and had no router configured which made it impossible to activate Vista via Internet since one isn’t even allowed to change the IP settings of a machine in RFM. There seem to be workarounds, but they were all too time consuming for my taste. This incident made it clear to me that we will have to invest a lot of extra time just dealing with Vista activation.

I think RFM is a nightmare for any sys admin. Just imagine all your Windows machines entering into RFM over night because something went wrong with Vista activation. So in my view this is the most important new feature of Service Pack 1. However, this doesn’t mean that Vista activation becomes easier for us to handle.

The fundamental difference between Windows XP and Vista still stands. Most admins didn’t have to worry at all about Windows activation until Vista drew its first breath. So before you can deploy Vista, you have to spend a considerable amount of time learning about Vista’s activation methods. It also remains to be seen how intrusive this recurring notice is that non-genuine Vista installations will present to users.

I suppose this also means that Windows Server 2008 will be delivered without RFM. This might be even more important. I don’t have to tell you what it means if some of your servers go into RFM just because you forgot to activate them.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

Considering how many (genuine) Windows systems are out there, this doesn’t seem to be so much. However, 12,000 paying customers ran into problems even though Microsoft promised them that WGA will give them a “genuine advantage”.

System failures always happen. No IT system has a 100% up time. What is annoying about WGA is that Microsoft tells their customers it is only to their advantage. This is comparable to the new activation rules for Vista and Windows Server 2008. They unquestionably cause extra costs for Windows customers. But Microsoft keeps telling us that it is only for our best interest. I never understood why should higher revenues for Microsoft benefit me.

This incident is just another example that shows that any kind of anti-piracy technology only brings disadvantage to the customer. Microsoft knows that, and we know it, too. It is this obvious insincerity that displeases me.

Update: The WGA Blog has now an explanation of the incident.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

I am quite surprised that 22% don’t know how they will activate Vista. I mean after all those detailed articles I wrote about Vista activation, you should have made up your mind by now. I suppose, this is due to the fact that many are still not considering deploying Vista. There is certainly no reason to hurry. XP is doing just fine in most environments. However, sooner or later you’ll have to make the move. I can’t repeat it often enough: Even if you don’t intend to deploy Vista in your network in the near future, try to learn about its new features now. The changes for system administrators are huge. The same applies to Windows Server 2008.

It is no surprise that the majority of you use KMS to activate Vista. After all that is the method that Microsoft recommends for organizations with more than 25 computers. 27% voted for this option which seems to be a bit low to me. I assume this number will increase in the future. In the last weeks, I began to notice that KMS was gaining ground in this poll. I think, those 10% who will use MAK and KMS can be added to the KMS group. Most of them probably use MAK for laptops only. Therefore, KMS is the main activation method here.

23% of you are in the lucky position to leave the Vista activation to your hardware vendor. Buying new hardware with an installed and activated operating system certainly has its charm. Just connect the power plug and the network, and you’re done. This strategy worked fine in the past because it always took Microsoft about five years to release a new OS version. Usually, you also need new hardware after this time period. So it makes sense to just buy new PCs with the latest Windows version installed. However, I think that Microsoft will reduce the time cycles between new Windows releases in the future. If Windows 7 will indeed be released in 2010, you might run into problems with this strategy. Upgrading an OEM edition is usually more expensive than a regular license.

17% are going to work with MAK only. I suppose that many of this group can’t use KMS because they have less than 25 computers. You may know that KMS can only be used if more than 25 Vista machines are connected to it. Maybe some of you just don’t like the idea that KMS is contacting Microsoft every 180 days to reactivate itself.

When I started this poll I wasn’t sure which activation method we will use. We have about 600 desktops, so KMS would be the option that Microsoft recommends for us. However, I’m one of the people who don’t like the fact that computers which have been activated already have to reaffirm their activation again and again. So I had a great sympathy for the MAK option right from the beginning.

But then I recognized an analogy to another decision I had to make many years ago. In a way, KMS works like DHCP. Instead of IP addresses a KMS server issues licenses. When we first introduced DHCP (actually it was BootP at that time) I was skeptical about this technology. What will happen if the DHCP server isn’t available for some reason? Well, today I can’t imagine anymore running a network without DHCP. Just connect the PC to the network and don’t care about the IP configuration anymore. It is exactly like this with KMS. Just deploy Vista without bothering about its activation. Of course, this analogy only applies if KMS proves to be as robust as DHCP. So we decided to give KMS a chance.

Note: There is a poll embedded within this post, please visit the site to participate in this post's poll.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

• MAK vs. KMS: advantages and disadvantages of activating Vista using MAKs
• MAK vs. KMS: pros and cons of activating Vista using KMS

Note: There is a poll embedded within this post, please visit the site to participate in this post's poll.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

Organizations having no firewall or are sharing their network with others might not want to expose their KMS. We also have this problem since we have public areas where students can use our computers. Anyone can just connect its own laptop to our network thereby activating his or her Vista machine. If you offer Wi-Fi access points for guests, you might have a similar problem.

To protect KMS with IPsec, you don’t have to deploy any additional software. To configure your Vista clients you can use Group Policy. Thus, you can use IPsec authorization only for members of an Active Directory domain. The Group Policy settings define the IPsec policy used by the KMS clients and the KMS host. They also specify the corresponding rules for the Windows Vista Firewall.

Note that these settings will only affect KMS clients trying to communicate with the KMS host. Other machines in your network, like domain controllers or other servers don’t have to use IPsec to connect to your KMS server. It is also possible to exempt configurable IP ranges from IPsec authentication. These machines don’t have to be part of an Active Directory domain.

It is interesting to note that Microsoft’s documentation assumes that the KMS host is installed on a Vista machine or Longhorn server. This is a bit strange since there is no release date for Longhorn yet, and using a Vista workstation to run such an important service for a large network is even stranger in my view. However, there is an appendix discussing the extra steps necessary for running the KMS host on Windows Server 2003.

The whole documentation has about 30 pages. You should be prepared to spend some time with this. I, personally, have a lot of respect for IPsec. Every time I am confronted with IPsec, it usually turns out that I needed more time to get it working than I originally planned.

So the question for me is, is it really worth the effort? First of all, if a student really “misuses” our KMS, he or she has to come back every 180 days. Otherwise, Vista will go into Reduced Functionality Mode (RFM) after the grace period expires.

Second, what could be the advantage for my organization if we protect our KMS in such a complicated way? I doubt Microsoft would take any measures against us as long as our KMS is not publicly available on the Internet.

Third, wouldn’t it much easier if KMS offers an option that would allow only Windows domain members to use it for Vista activation? If Microsoft wants us to activate our desktop computers, they should at least give us easy-to-use management tools. KMS doesn’t even have a GUI! So maybe we should just wait until Microsoft offers appropriate tools instead of messing around with IPsec. What do you think?

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

MAK Pros

• Less than 25 Vista computers: In this case you have no other choice anyway, since you can’t use KMS.
• Onetime, non-expiring activation: In my view, this is the most important advantage of MAK activation. Once you activated your Vista machines, you don’t have to care anymore about product keys. You don’t have to watch out for your KMS host and your Vista clients don’t have to contact Microsoft, anymore. And, most important of all, there is a lower risk of your desktop computers becoming useless because activation failed on your KMS host.
• Your network doesn’t have internet access: If your computers are in a high security network without any connection to the outside world then MAK activation is the best choice.
• MAK is the more comprehensive solution: MAK activation works no matter how your IT infrastructure is organized. You can use it on your in the field computers, in branches, in high security networks etc. Thus, if you only want to deal with one Vista activation solution then MAK is probably the better choice.
• Similarities to Windows XP Volume License Keys (VLKs): If you are already familiar with volume licensing under XP, you don’t have to change your deployment strategy much since MAKs are managed like VLKs. There is, however, one important difference: You have to activate your Vista machines after you deployed the MAK key.

MAK Cons

• MAK activation needs extra care during the deployment process: Every time you deploy a new Vista machine, you have to take care of its activation afterwards. You can deploy the MAK with the Vista image, but you’ll always need an extra step for activating your Vista machines. KMS is easier to handle here. Once your KMS infrastructure stands, you don’t have to think about activation during the deployment process.
• Every MAK allows only a limited number of activations: This number is dependent on the number of licenses you purchased. If you increase the number of Vista clients, you have to increase your possible MAK activations, too. But this is not the only problem. It is quite probable that you will need more MAK activations than the licenses at hand. For instance, if you have to reinstall a machine, you have to activate it again which decreases the number of times you can use this MAK. The same applies to test installations. If you used up all your possible activations, you’ll have to contact Microsoft again. It will, then, depend on their goodwill if they allow you activations that are more than the number of purchased licenses. With KMS, you won’t have this problem since the KMS host can activate an infinite number of Vista clients. As far as I know, this number is not transmitted to Microsoft.

Please, let me know if I missed any argument.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

Deploying MAKs with VAMT isn’t the only option you have. In my post about MAK activation, I outlined all possible options. The advantage of using VAMT for this purpose is that the product key installation and the activation of the Vista machines can be done in one step. If you specify the MAK on the reference machine for your master image, for example, you’ll have to take care about the activation in an extra step after you deployed the Vista image.

The only requirement is, however, that you can access all your clients from the computer where you installed VAMT. It is also recommended that your Vista machines belong to a Windows domain or workgroup. Otherwise, you’ll have to add the IP addresses of all your clients manually. If you want to deploy the MAK in a Windows workgroup, a registry key has to be added on all Vista machines to enable remote administration action under UAC (User Account Control).

If you work with Active Directory, deploying the MAK with VAMT is quite simple. After you added all Vista machines, you right click on a container or on selected computers and choose MAK Independent Activation or MAK Proxy Activation. Which option you should use depends on the way your Vista clients are connected to the Internet. If your firewall doesn’t allow your workstations to connect to Microsoft using DCOM RPC traffic, you can work with MAK Proxy Activation.

This way, the MAK Proxy, i.e. VAMT, installs the MAK on the Vista computer, obtains the Installation ID (IID), submits the IID to Microsoft on behalf of the client, and receives the Confirmation ID (CID), which is then used to activate Vista. With MAK Independent activation, VAMT installs the product key on the Vista computers which will then directly contact Microsoft to activate.

During my tests both options worked reliably, however, I only tried it on a couple of machines. There was only one thing which was a bit strange. I uninstalled a product key with slmgr.vbs –upk command on a Vista computer. After refreshing the computer status VAMT correctly recognized that this machine is in non-genuine state. However, as key type it displayed now “SKU not supported“. SKU stands for “Soft Keeping Unit” and is a unique code which allows Microsoft to keep track of its products. So VAMT somehow classified this machine as a non-volume edition. Consequently, I wasn’t able anymore to deploy a MAK to this computer.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

Microsoft recommends using KMS in environments with more than 25 computers. When I first read about KMS, I also thought that it is the best option for us. However, I am not so sure about this, anymore. Actually, at the moment, it is fifty-fifty.

KMS Pros

• No client configuration necessary: All you have to do is to install KMS. Your Vista machines will find the KMS automatically using DNS. So, any time, you install a new Vista machine, you don’t even need to worry about having it activated.
• Vista computers don’t need special internet access: Since KMS activates the Vista machines; they don’t need any kind of internet access. Essentially, this means that you don’t have to change the firewall configuration for your clients. You only have to make sure that your KMS host can connect to Microsoft’s volume licensing servers.

KMS Cons

• Vista clients have to renew their activation every 180 days: By default, each KMS activated Vista computer will contact the KMS every 7 days. They have to confirm their activation at least every 180 days (plus grace period.) This means that you always have to keep an eye on your KMS, DNS, your Vista clients, etc. to see if everything is still working, properly. If technical problems come up, then you’ll have to spend extra time fixing them.
• The KMS host has to renew its activation every 180 days: In my view, this is the biggest disadvantage of KMS. If there are problems with your KMS key, activation might fail. We already had such an incident. So, this is not just theory. In such case, you will be dependent on Microsoft. I, personally, feel very uncomfortable with this idea.
• KMS is difficult to implement with decentralized infrastructure: If your organization has multiple branches, you have to make sure that those Vista clients can connect to your KMS host, for example, by VPN. Depending on your network infrastructure this might cause extra work. You could also install a KMS host in every branch which also means more work. It is possible to use a Vista machine as KMS host in smaller branches. But then you have to make sure that this computer is always available.
• In the field computers: If your company has many employees working in the field using laptops, then KMS might not be the best activation method. You probably will use MAK to activate these machines. Of course, you can combine KMS and MAK. You could use KMS for the Vista computers in your corporate network and MAK for the rest. However, you then have to deal with two different activation methods which means that you need the corresponding know-how and infrastructure for both technologies.
• KMS needs dynamic DNS with SRV record support: If you don’t use Active Directory, you might not have your own DNS server and use the one of your ISP, instead. Your ISP probably will not allow you to modify their DNS records. That means having to mess with the registry on your Vista clients to tell them where they can find the local KMS.
• It is difficult to test KMS: Before using such an important new technology, I always want to try it, to see if it is reliable and to get some experiences, also. This is difficult with KMS since you can’t test it in a virtual environment and you need at least 25 different Vista clients before KMS will activate them.

Please, let me know if I missed arguments for or against KMS. The question of using KMS or MAK certainly depends on the features of MAK activation, also. I’ll write about it soon.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

It was not just enough to uninstall the KMS keys on the Vista clients where we erroneously used them to activate Vista. So, we contacted Microsoft KMS Service Center, hoping that they would increase the number of allowed KMS installations for us. A Microsoft representative, then, asked us how many KMS installation we would need. One of my colleagues asked for 10 further KMS activations. They immediately replied that it would take 1-3 weeks.

After a month, we finally got the confirmation that our request has been completed. It is interesting to note that such a relatively simple task takes so long to accomplish. Obviously, those guys responsible for KMS support are quite busy at the moment. I suppose, it won’t be much faster if you want to increase the number of allowed MAK activations. So, keep in mind that you have to contact Microsoft in time if you need more MAK or KMS activations.

I don’t know if they really gave us 10 further KMS licenses since you can’t see at Microsoft licensing how many KMS hosts you have activated already. This is only possible for MAKs. At least, they didn’t complain about our request.

So, finally I was able to activate our KMS host on a Windows server. I’ll probably report about our experiences as soon as we have more than 25 Vista clients.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

Alex Kochis explains the purpose of Skiprearm in detail. Anytime you run sysprep, Vista is “rearmed” automatically, i.e. the grace period is reset. This way you’ll get the full 30 days grace period after you deployed the image, even though the image was created a long time before.

Since one can only rearm Vista three times, you’ll run into problems if you run sysprep too often during your tests. That’s where Skiprearm comes in. If you set this registry key to 1 before you run sysprep, then Vista won’t be rearmed, which will preserve you the option to run rearm three times after the image has been deployed.

The question now is, how could Skiprearm help in extending the grace period indefinitely? If Alex Kochis is right, then Skiprearm won’t change the fact that you can rearm Vista only three times. Setting Skipream to 1 just means that Vista is not rearmed automatically when you start sysprep, and nothing else. It does not change the fact that you can rearm Vista only three times. This, at least, is the intended purpose of Skiprearm.

So how can we explain the results of Brian Livingston’s tests? One possible explanation is that his assertion is simply wrong. Maybe someone activated his test machines and he didn’t know about it. The other explanation is that the implementation of Skiprearm contains a bug which indeed causes the effect Brian Livingston observed.

The problem is that you can’t easily test this since you have to wait for three months. One thing is for sure, though. Skiprearm is of no use on a machine which is already in Reduced Functionality Mode (RFM). I tried this yesterday. Neither slmgr –rearm nor did Skiprearm have any effect on my Vista PC whose grace period has already expired.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

One only has to change the SkipReam registry subkey to 1. You can find this key here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurentVersion\SL

Then, you run slmgr –rearm on a command prompt with administrator privileges before the grace period is over. This will give you another grace period of one month. According to Livingston, this can be done for an indefinite number of times if SKipRearm is set to 1. In his tests he was able to rearm Vista 12 times. He writes, however, that it didn’t work with a full version of the Home Premium edition.

Note that it is not a dirty hacker trick. Microsoft recommends this in a Technet paper if you have to run sysprep more than three times. I don’t know, why one should run sysprep more than three times, but this can be very useful if you have problems activating Vista. SkipRearm is a documented parameter which can be used during an unattended setup. Here is an example how to use it in unattend.xml.

This is very strange, if it is really true. Why is Microsoft imposing this hassle on us if the bad guys can use Vista without activation, anyway? This Computerworld article contains kind of a reaction from Microsoft. David Lazar, the director of the Genuine Windows program says:

It is important to note that these hacks are, at best, temporary. Microsoft has systems in place to detect and block piracy.

Well, I guess this won’t be the last time we’ll hear about such “hacks”.

Update: Microsoft denies that the Skiprearm hack works.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

The installation of VAMT is very easy. All you have to do is to run the MSI. The good news is that contrary to KMS, VAMT has an easy-to-use graphical user interface. At first, I tried the MAK management features. This function tells you how many remaining activations a MAK key still has. VAMT retrieves this information from Microsoft Volume Licensing. However, you have to add your MAKs first manually.

VAMT offers three ways of collecting Vista machines in your network: by IP address, thru search in Active Directory and thru search in a Workgroup. With the first option, you have to specify IP addresses, manually. VAMT will group them in a container. I followed the manual line by line, but in my test VAMT always failed to collect the status of my test computers with the error code 0×80070005.

After a while, I figured out that UAC (User Account Control) is the reason. According to the manual, a registry key (LocalAccountTokenFilterPolicy) must be created to enable remote administrative actions under UAC. In my view, it is very strange that one has to mess with the registry on all client machines to work with VAMT if you are not using Active Directory. However, in my test adding the registry key didn’t solve the UAC problem. It is only after I disabled UAC altogether, that VAMT was able to collect the activation status.

I, then, installed VAMT on a member server of a Windows domain. In theory, VAMT should gather the computer names from Active Directory. This way, you don’t have to add all your clients, manually. But whenever I added client computers using the AD option, I got an error message with the error code 0x8007003A. I, then, installed VAMT on a domain controller. The error message was the same there.

VAMT has a funny feature which allows you to look up the error codes. I wonder why the error message doesn’t simply deliver the explanation for the error code. Anyway, this error code look up didn’t work either. The error code tool displayed another error message: Access denied. Maybe, Microsoft should offer yet another tool which looks up the error messages of the error code look up function?

I couldn’t believe that Microsoft delivered such an important tool with so many bugs. So I gave VAMT another chance. In the tests, described above, I always used virtual machines under VMware Workstation. This time, I installed VAMT on a physical Windows Server 2003 SP1, et voilà, it was able to gather all Vista machines in our Windows domain thru Active Directory. I also was able to collect the licensing information without disabling UAC on the Vista clients.

At least, I had my first sense of achievement. VAMT listed only the Vistas machines in our domain, i.e. all other Windows versions were excluded. You can group computers in containers. For this, you have to specify a string as filter for the computer name. VAMT will then only retrieve those computers from AD which contain this string. This, certainly, is a very strange way to group computers. Why isn’t VAMT able to list AD containers?

After collecting all Vista machines, VAMT will retrieve their licensing status by connecting to them thru WMI (Windows Management Instrumentation). You can do this for each computer individually or for a computer group. If you have Vista’s firewall enabled, you have to allow WMI inbound connections. You can do this manually by enabling the corresponding exception in the Control Panel Firewall configuration tool or by using Group Policy.

The retrieval process is relatively slow. If a computer isn’t online, then VAMT will wait for several seconds. Since VAMT contacts all computers of the selected group simultaneously this might not be a big problem, though.

VAMT displays information like the key type, license status, grace expiration date, installation ID and pending conformation ID. However, it collects many more information which is stored in an XML file for further processing.

VAMT groups computers automatically according to their licensing status. This helps you to find computers which were not yet activated. VAMT knows seven states: Initial-out-of-box (OOB), Grace (newly installed Vista machines, not yet activated), Licensed (activated by KMS or MAK), Non-Genuine Grace (validation failed), Out of Tolerance (computers with too many hardware changes or KMS clients that have not renewed their activation in 180 days), Unlicensed (computers in Reduced Functionality Mode (RFM)), Non-Volume Computers (Vista machines not supporting volume activation).

All in all, VAMT worked reliably on my physical server. I don’t know why it didn’t work on my virtual test server, though. It is certainly possible that I made a mistake or perhaps there is something wrong in my testing environment. It is also possible that VAMT simply doesn’t work in virtual environments or maybe it is still buggy. Please, let me know if you were more successful in using VAMT under VMware.

VAMT is certainly a very useful tool. This is especially true for the features which help you activate Vista machines in your network. I’ll write about them soon in another post.

Please, also check out the Related section below for other articles in my series about Vista activation.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

I have no doubt about it that sooner or later some smart hackers will find better ways. I’ve seen so many copy protections in the last 25 years. If there is a big interest in a software product, then it is always only a matter of time until someone cracks the copy prevention. Usually, copy protection doesn’t make sense to a software company for economic reasons since they only end up annoying their paying customers while not really effectively stopping others from cracking or going around it.

Usually, it is much easier to crack the protection than you think. The Register mentions an interesting method which is much smarter than using brute-force. Just take a digital camera, go to the next computer store and take a picture of the activation code on the back of the Vista box. Is it really that easy? I guess it is. I hope you won’t be one of the poor guys who buys such a box afterwards.

Now, what does this mean for your MAK or your KMS Key? In my organization, there are many students who had access to our product keys because they sometimes have to install Windows. We probably can’t work like this anymore in the future. These student workers come and go and we can’t be 100 percent sure that no one will steal our keys, sells it or publishes it on the Web.

We’ve had trouble already with our KMS key. I would like to install a KMS to get more experience with it, but we are not able anymore to activate our KMS. Microsoft still has to fix the problem.

This shows that you should be careful handling your activation key. How will you secure your keys? Who will be able to access the keys? Do we need new company guidelines for Microsoft product key handling, now? Will you have a disaster recovery plan if all your desktops become useless because they got deactivated?

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Well-known Windows basher Randall C. Kennedy unmasked – Don’t always take “objective” reports as real (13)

MAK purpose

• You can use the MAK to activate as many Vista machines as you have licensed.
• The MAK key can only be used for volume editions of Vista.
• Usually, every organization gets one MAK from Microsoft.

Ways to deploy the MAK

• Use autounattend.xml for installation with DVD or unattend.xml for network share installations or imageunattend.xml for WDS installations.
• If you use ImageX to clone Vista, you can specify the MAK on your reference computer before imaging.
• You can also specify the MAK after the installation manually via Control Panel, using slmgr.vbs in a logon script (slmgr.vbs -ipk <MAK>), or with the VAMT (Volume Activation Management tool). (I’ll have a closer look at the latter. soon.)

Ways to activate Vista using MAK

• By phone. If you your network doesn’t have an internet connection you have no other choice.
• By using a direct internet connection to Microsoft. You can do that manually using the Control Panel or by using the command slmgr.vbs –ato in a script
• Work with MAK Independent Activation using VAMT. (More about this soon,)
• By using a MAK Proxy Activation. The Vista machines will connect to your MAK proxy which will contact Microsoft’s activation server over the internet on their behalf. You also need VAMT for this.

Have you already decided whether to use MAK or KMS? If so, please let me know about your choice and your reasons. I am thinking of writing another post regarding the advantages and disadvantages of using MAK or KMS.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Windows Server 2008 and Vista SP1 licensing essentials – KMS 1.1 – VAMT 1.1 (4)

The explanation of this incident is a good example of how easily you can run into problems with Microsoft’s new activation guidelines. When we first received the Vista DVDs, we only got one key, the KMS Key. At that time nobody knew what “KMS” means. Since it was the only key we got, we all thought it is just the key to activate Vista. Well, you really can use the KMS key to activate Vista. So, some of our admins used this key for their test installations.

I think it is quite strange that you can use the same key to activate a workstation and as a backend application. Anyway, Microsoft will now increase the number of allowed KMS hosts for our organization. But this will take one to three weeks!

This gives you an idea what happens if there is any kind of “misuse” of your activation keys. In our case, we accidently misused the KMS key because we didn’t get the right instructions. I am sure; there are many similar cases where one can run innocently into problems.

Let’s say someone steals your KMS key and publishes it on the internet. Microsoft will disable this key, which will result in an activation failure of your KMS host. Your Vista clients won’t be able to activate anymore. After 180 days your activated machines will get deactivated. There is a 30 day grace period before they go into Reduced Functionally Mode (RFM). You can prolong the grace period three times which gives you another 120 days.

Thus, there should be plenty of time to fix the problem. However, the question is, when will you realize that you have a problem at all? In the case described above, we realized the problem too late. We didn’t deploy Vista yet, so it is not a big problem. But it confirmed my worries about this new risks Microsoft imposed on us with Windows Vista Volume Activation 2.0. It doesn’t happen often with new versions, but version 2.0 is definitely a change to the worse.

Please check out the Related section below for other articles in this series about Vista activation.

• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• Office 2010 activation – How to rearm Office 2010 (12)
• Well-known Windows basher Randall C. Kennedy unmasked – Don’t always take “objective” reports as real (13)