How to discover Office and Windows KMS hosts through DNS and remove unauthorized instances
This article was written by Eric Ellis, Senior Support Escalation Engineer.
When you troubleshoot KMS configuration and activation issues, you may find unexpected Windows or Office KMS hosts in their environment. This article describes how to discover Office and Windows KMS hosts through DNS, and how to remove unauthorized KMS hosts.
Note
The following steps are similar in Office KMS 2010, 2013, 2016, and 2019.
Discover Office and Windows KMS hosts through DNS
By default, Windows and Office clients discover KMS hosts through DNS and a related _vlmcs SRV record. To determine whether a KMS client can locate a KMS host or whether unwanted KMS hosts exist on the network, run a command similar to the following:
nslookup -type=srv _vlmcs._tcp >%temp%\kms.txt
Review the kms.txt file, and it should contain one or more entries similar to the following:
_vlmcs._tcp.contoso.com SRV service location:
priority = 0
weight = 0
port = 1688
svr hostname = kms-server.contoso.com |
Running this nslookup command frequently reveals _vlmcs SRV entries that are tied to unauthorized Windows or Office KMS hosts.
Remove unauthorized Windows KMS hosts
In many cases, Windows KMS hosts may be unintentionally set up by users who mistakenly entered a KMS host product key, instead of a Windows client product key. To resolve this issue, follow these steps on the computer(s) in question, replace the KMS product key and convert it to a KMS or MAK client:
Open an elevated command prompt.
Run
cscript slmgr.vbs /ipk xxxxx-xxxxx-xxxxx-xxxxx-xxxxx, where xxxxx-xxxxx-xxxxx-xxxxx-xxxxx is Windows product key (there should be 25 numbers).To prevent instability in the license service, restart the system or the Software Protection Service. To restart the Software Protection Service, run the following commands:
net stop sppsvc net start sppsvcRun the following command to display the license information for the installed and active Windows edition:
cscript slmgr.vbs /dliIn DNS Manager, locate the appropriate forward lookup zone, and then delete the _vlmcs SRV records that exist for each computer which is not to serve as a Windows KMS host.
For more information, see the following articles:
Remove unauthorized Office KMS hosts
It's not common to create an Office KMS host unintentionally, because setting up an Office KMS requires a specific product key and the installation of the Microsoft Office 2010 KMS Host License Pack.
To determine whether a computer has the Office 2010 KMS Host License Pack installed and has an active Office KMS host, run the following command:
cscript slmgr.vbs /dlv bfe7a195-4f8f-4f0b-a622-cf13c7d16864
The output of a computer which has the Office 2010 KMS Host License Pack installed resembles the following. In the following example, key items are Partial Product Key: XXXXX and License Status: Licensed. These items indicate that the Office 2010 KMS host key is successfully installed and activated. To pull all the products installed, including all Office KMS host installations, run the following command:
cscript slmgr.vbs /dlv All >C:\<path>\KMSInfo.txt
In this command, <path> equals where you want to write the output. In this file, search for Office and find all the instances for the Office KMS host installations. If you only want to pull specific Office KMS information, replace the Activation ID that is mentioned earlier in the command (bfe7a195-4f8f-4f0b-a622-cf13c7d16864) with the Activation ID for Office 2013, 2016, or 2019. An example of the output resembles the following:
Name: Microsoft Office 2010, KMSHost edition
Description: Microsoft Office 2010 KMS, VOLUME_KMS channel
Activation ID: bfe7a195-4f8f-4f0b-a622-cf13c7d16864
Application ID: 59a52881-a989-479d-xxxx-xxxxxxxxxx
Extended PID:
Installation ID:
Processor Certificate URL: https://go.microsoft.com/fwlink/p/?LinkID=88342
Machine Certificate URL: https://go.microsoft.com/fwlink/p/?LinkID=88343
Use License URL: https://go.microsoft.com/fwlink/p/?LinkID=88345
Product Key Certificate URL: https://go.microsoft.com/fwlink/p/?LinkID=88344
Partial Product Key: XXXXX
License Status: Licensed
Remaining Windows rearm count: 1
Trusted time:
Key Management Service is enabled on this computer
Current count: 0
Listening on Port: 1688
DNS publishing enabled
KMS priority: Normal
Then, follow these steps to remove an Office KMS host in your environment:
Open an elevated command prompt.
Run the following command to uninstall Office KMS host product key:
cscript slmgr.vbs /upk bfe7a195-4f8f-4f0b-a622-cf13c7d16864Warning
If the command is run without the Office activation ID (bfe7a195-4f8f-4f0b-a622-cf13c7d16864), all installed product keys are uninstalled, including those for Windows.
Run the following command again to check the status of the Office KMS host:
cscript slmgr.vbs /dlv bfe7a195-4f8f-4f0b-a622-cf13c7d16864If the Office KMS host product key is removed, the output resembles the following. The key items are This license is not in use and License Status: Unlicensed.
Name: Microsoft Office 2010, KMSHost edition Description: Microsoft Office 2010 KMS, VOLUME_KMS channel Activation ID: bfe7a195-4f8f-4f0b-a622-cf13c7d16864 Application ID: 59a52881-a989-479d-xxxx-xxxxxxxxxx Extended PID: Installation ID: Processor Certificate URL: https://go.microsoft.com/fwlink/?LinkID=88342 Machine Certificate URL: https://go.microsoft.com/fwlink/?LinkID=88343 Use License URL: https://go.microsoft.com/fwlink/?LinkID=88345 Product Key Certificate URL: https://go.microsoft.com/fwlink/?LinkID=88344 This license is not in use. License Status: Unlicensed Remaining Windows rearm count: 1 Trusted time:In DNS Manager, locate the appropriate forward lookup zone, and then delete the _vlmcs SRV records that exist for each computer which is not to serve as an Office KMS host.
For more information, see the following articles: