# Moving a KMS Host From Windows Server 2012 to 2022

> You can move a KMS host from Windows Server 2012 to 2022 without breaking activation if you know the activation thresholds and follow the steps in order.

Canonical: https://mikereams.com/writing/key-management-services-2012-upgrade

Published: May 24, 2023  
Author: Mike Reams (https://mikereams.com/about)  
Topics: [Security](https://mikereams.com/writing/topics/security), [Cyber Security](https://mikereams.com/writing/topics/cyber-security), [Cryptography](https://mikereams.com/writing/topics/cryptography), [Governance, Risk, and Compliance](https://mikereams.com/writing/topics/grc), [Identity and Access Management](https://mikereams.com/writing/topics/iam), [Certificate Authority](https://mikereams.com/writing/topics/certificate-authority)  
Tags: kms, KMS, Security  
Project: [Key Management Services Upgrade](https://mikereams.com/work/key-management-services-upgrade)

![Key Management Services 2012 Upgrade](https://mikereams.com/writing/7f4c3f8d1fea7c769a0f9e4418d4f2f05d6fcd90-850x490.png)

## Overview

Right after we [upgraded a client's internal PKI](https://mikereams.com/writing/pki-infrastructure-upgrade), the KMS host was next: it was still on Windows Server 2012, which reached end of support in October 2023. Here are the facts about KMS worth having in your head, and the steps I used to move it.

## How KMS works

Key Management Service activates volume-licensed Windows and Office on your own network. Clients find the KMS host through DNS and activate against it. The host itself is activated once with Microsoft, using a KMS host key — formally a Customer Specific Volume License Key (CSVLK) — from the [volume licensing product keys](https://learn.microsoft.com/en-us/microsoft-365/commerce/licenses/product-keys-for-vl) in the Microsoft 365 admin center.

The host doesn't need a dedicated server. A host on Windows Server activates both servers and clients; a host on a Windows client OS activates clients only.

## The numbers that matter

- **Activation threshold:** clients activate once the host has counted 25 or more machines; servers and volume editions of Office need 5.
- **Count window:** the host counts unique machines that contacted it in the last 30 days, and keeps the 50 most recent.
- **Validity:** activations last 180 days, and clients try to renew every 7 days. A short gap between old and new host won't cause outages.
- **Scale:** one host serves any number of clients, and one host key activates up to six hosts.
- **Network:** TCP 1688, published in DNS as the _VLMCS._tcp SRV record.

## Check your host key covers your newest clients

A KMS host can only activate the Windows versions its host key covers, and an older host may need updates as well. A Windows Server 2025 host key, for example, covers Windows Server 2025 back to 2008, plus Windows 11 and 10. Check Microsoft's [KMS activation planning](https://learn.microsoft.com/en-us/windows-server/get-started/kms-activation-planning) table against your newest clients before you move, and fully patch the new host.

## Step 1 — Retire the old host

On the 2012 host, remove the KMS host key and turn the machine back into an ordinary KMS client:

```
slmgr /upk
slmgr /ipk <KMS client setup key>
```

Microsoft publishes the [client setup key for each Windows version](https://learn.microsoft.com/en-us/windows-server/get-started/kms-client-activation-keys).

Then delete the old host's SRV record: in DNS Manager, open your domain's **_tcp** folder and remove the **_VLMCS** record that points at the old server.

## Step 2 — Stand up the new host

On the 2022 server, install the host key and activate it with Microsoft:

```
cscript C:\Windows\System32\slmgr.vbs /ipk <KMS host key>
cscript C:\Windows\System32\slmgr.vbs /ato
```

When activation completes, restart the Software Protection service.

## Step 3 — Verify

- **DNS:** a new _VLMCS._tcp record points at the new host.
- **Count:** on the new host, slmgr /dli shows the current count. It should climb as clients renew.
- **Event log:** the Key Management Service log (under Applications and Services Logs) records event 12290 for each client activation request, with the computer name and time.

```
nslookup -type=srv _vlmcs._tcp.<your domain>
slmgr /dli
```