Moving a KMS Host From Windows Server 2012 to 2022

Overview

Right after we upgraded a client's internal PKI, the KMS host was next: it was still on Windows Server 2012, which reached end of support in October 2023. Here are the facts about KMS worth having in your head, and the steps I used to move it.

How KMS works

Key Management Service activates volume-licensed Windows and Office on your own network. Clients find the KMS host through DNS and activate against it. The host itself is activated once with Microsoft, using a KMS host key — formally a Customer Specific Volume License Key (CSVLK) — from the volume licensing product keys in the Microsoft 365 admin center.

The host doesn't need a dedicated server. A host on Windows Server activates both servers and clients; a host on a Windows client OS activates clients only.

The numbers that matter

• Activation threshold: clients activate once the host has counted 25 or more machines; servers and volume editions of Office need 5.
• Count window: the host counts unique machines that contacted it in the last 30 days, and keeps the 50 most recent.
• Validity: activations last 180 days, and clients try to renew every 7 days. A short gap between old and new host won't cause outages.
• Scale: one host serves any number of clients, and one host key activates up to six hosts.
• Network: TCP 1688, published in DNS as the _VLMCS._tcp SRV record.

Check your host key covers your newest clients

A KMS host can only activate the Windows versions its host key covers, and an older host may need updates as well. A Windows Server 2025 host key, for example, covers Windows Server 2025 back to 2008, plus Windows 11 and 10. Check Microsoft's KMS activation planning table against your newest clients before you move, and fully patch the new host.

Step 1 — Retire the old host

On the 2012 host, remove the KMS host key and turn the machine back into an ordinary KMS client:

slmgr /upk
slmgr /ipk <KMS client setup key>

Microsoft publishes the client setup key for each Windows version.

Then delete the old host's SRV record: in DNS Manager, open your domain's _tcp folder and remove the _VLMCS record that points at the old server.

Step 2 — Stand up the new host

On the 2022 server, install the host key and activate it with Microsoft:

cscript C:\Windows\System32\slmgr.vbs /ipk <KMS host key>
cscript C:\Windows\System32\slmgr.vbs /ato

When activation completes, restart the Software Protection service.

Step 3 — Verify

• DNS: a new _VLMCS._tcp record points at the new host.
• Count: on the new host, slmgr /dli shows the current count. It should climb as clients renew.
• Event log: the Key Management Service log (under Applications and Services Logs) records event 12290 for each client activation request, with the computer name and time.

nslookup -type=srv _vlmcs._tcp.<your domain>
slmgr /dli