How to remove a KMS Server from your infrastructure

We had some rogue KMS server hosts in our infrastructure. My guess is someone inadvertently installed the wrong key.

We can easily look up KMS hosts as they are published to DNS.

from a command prompt run:

Run this for all your subdomain’s fqdn to list all servers. A sample output would be this:

As you see, we have 2 KMS host entries, one seems valid, the other looks like someone attempted to activate his PC the wrong way and ended up publishing KMS service records in DNS.

  • Login/RDP/PSEXEC to the affected host (John-Desktop) and uninstall KMS product key. To do this, run this from an elevated command prompt:

  • Install the default KMS client key, found here:

  • Activate the computer as a client using the command below. In our case it would go to the KMS01.constoso.com host

  • Now you should stop this record from being published in DNS. You guessed it, just because you uninstalled the KMS host key and put in the client Key doesn’t mean he stopped advertising KMS in DNS. If you are running Windows 2008 R2, slmgr.vbs has  a switch which does this for you:

  • Stop and Start the Software Licensing Service:

  • Remove the _vlmcs KMS service record for John-Desktop from the contoso.com _tcp node. You can do this via dnsmgmt.msc console
No Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Active Directory
Preseed Files for DFS Replication using Robocopy

Use Robocopy to Preseed Files for DFS Replication I’ll write this here first, since it’s important: The folder in which you are robo-copying (ex c:\test) must not exist on the destination server (ex. f:\test). If you create the folder manually on the destination server, the file-hashes will not match and DFSr will …

Active Directory
Reset Users Password Expiration Date

1.In Active directory users and computers, make sure advanced features is enabled 2.Navigate to the user account, there should be an Attribute Editor tab 3.Scroll to the pwdLastSet field. Modify it by entering 0 (zero) in the value field. Click OK. This sets the value to (Never) as in the …

Active Directory
Reset AD Users Password Expiration Date

1.In Active directory users and computers, make sure advanced features is enabled 2.Navigate to the user account, there should be an Attribute Editor tab 3.Scroll to the pwdLastSet field. Modify it by entering 0 (zero) in the value field. Click OK. This sets the value to (Never) as in the …