KMS allows you to do the authorization/activation of Windows in-house, and allows you to get stats about what is going on. However, running this on a full blown Windows installation could be too expensive, overkill.

This article explains the steps to get KMS working in your domain, using a Windows 2008 R2 server in Server Core mode, virtualized. Yes, it is possible to run a KMS in a VM, unlike a few years ago when the EULA explicitly stated you were not allowed to.

Another good reason to go with Windows 2008 R2 is that it supports being a KMS for Windows 7 as well as 2008 servers. If you had a Windows 7 KMS, not only could you not run it in core mode but it would only be able to authorize workstations. And Windows 2008 first release is simply not supported.

Create a Virtual Machine

This VM can be in a Hyper-V environment or a VMware environment.

As we will be running Core, the requirements are lower. I suggest starting with:

• 1 vCPU
• 512MB of RAM
• 10GB of Hard drive (single drive)
• Low resource shares relative to your other VMs

Install Windows Server

Select your Windows 2008 R2 ISO from your data stores. Obviously, this article is not about that, I assume people interested in KMS know how to install Windows.

Select the core mode.

 

Windows is up – now what?

Log into the server’s console through VMware or hyper-v (well this guide mostly works for physical servers too – I just find it’s a waste of metal !). You will be greeted by the minimal UI of Core.

Configure the networking

Run the sconfig command. Chose option 8.

Select your NIC (normally number 0 if you only have one).

Configure it with a static IP , and make sure you configure the DNS settings properly for your domain.

KMS relies on DNS a lot so having a static IP will save you trouble in the future. Alternately depending on your setup, how you manage VLANs and IPs etc, have a reservation for it. ipconfig /all will show you the MAC address of the card, as on the standard Windows install.

Once you’re done configuring the network, go back to the main menu of sconfig.

Configure your Windows Update Settings

Set it to obtain updates from Microsoft for now. Later on you will surely manage this by GPO so it does not really matter. Back to the main menu, chose option 6 to download the updates that are required right now. (As core has no Internet explorer or Windows update UI that’s the way of getting them manually).

Configure date and time (option 9)

Configure the hostname (option 2)

I recommend rebooting after you changed it and before you join the domain – if the computer account is pre-staged in AD it will use the old name instead of the pre-staged one if you don’t.

Join the domain (option 1)

You can also use the typical netdom commands if you want to join it and force a specific OU.

Reboot

Add a local administrator

Once the server reboots, on the domain, log in with your local admin account. Run sconfig, and use option 3 (or use net localgroup – faster!) and add a domain account to your local admins, so you can login with an AD account and manage the server. While you are there, you may want to change the local admin password (the ctrl-alt-del screen does have that option).

Remote management

Once the server is fully patched up, and your local admin account is secured and you can now login using a domain account, consider enabling remote management. Option 4 in sconfig allows you to enable remote powershell, remote MMC, WinRM, etc. An interesting thing you can do once this is open is open the event log remotely easily, which may be useful. Be aware that KMS is very low maintenance and that keeping everything locked down may prove more secure, but be sure your operational teams will have a way to get into the server, either through the virtualized console, powershell, or RDP (enabled in the sconfig main menu – with two options, one to allow only secure RDP clients like Vista and Win 7 or one to allow any clients, useful if you still use XP workstation).

Enable KMS

Enabling KMS is very simple. The only thing you will need is your “KMS Key”, which can be found on the Microsoft licensing website.

Run this command:

slmgr.vbs /ipk KmsKey

You should then see a small window pop up and confirm the product has been activated.

Now, we should activate our server, while we’re at it.

slmgr.vbs /ato

There we go. KMS is enabled, the server is activated. What else needs to be done?

Well first of all, clients rely on DNS to locate the KMS. So if you do not have dynamic updates enabled, start by disabling the automated registration by running:

slmgr.vbs /cdns

The command to enable automatic updates (default but try it if you run into issues or change your mind) is :

slmgr.vbs /sdns

After running these, make sure to restart sppsvc by using net stop and net start or by using the services MMC, if you enabled remote MMC.

If using manual DNS, create an entry with the following settings:

Verify the DNS entry

Manual or automated, let’s check if it worked.

nslookup -type=srv _vlmcs._tcp.<your DNS domain>

If this command returns the SRV record pointing to your KMS server on port 1688, it means clients will now find the KMS.

Open the firewall

As you noticed while creating or verifying the SRV record, the KMS, by default, is listening on port 1688. This can be changed with the slmgr.vbs command. However, no matter what port you do, you will need to open it up in the firewall. You can use netsh…

netsh firewall set portopening tcp 1688 KMS enable

However, the beauty of Server core is that you should never have to connect to it. For this, I highly recommend that you apply your standard Windows 2008 security baseline GPOs, and create a KMS Specific one. In this GPO, you should ensure that the KMS service is set to automated, and that this TCP port is opened.

You can then apply further hardening to the machine, and configure Windows updates by GPO as well. As server core is not a service that is very visible to the users, this server could easily be patched and rebooted at almost any time, but you can patch it like any server that you use. Less patches will be required, as Server core does not include a lot of software that comes with the full install.

Troubleshooting

Read the slmgr.vbs documentation for more information. slmgr.vbs /dli will show you some information, and there will be an Event Log created just for KMS where you can get useful information about activations. If you have any issues, remember to check the DNS record from the workstation you’re trying to activate, as well as test connectivity to port 1688.

The error you receive on a workstation may seem cryptic but most of them have a good explanation, so Google them ! Remember you need at least 25 workstation licenses or 5 server licenses to use KMS, and have fun !

You opened the Remote Administration exception, you can ping it, you can browse shares, file and print sharing is enabled, yet it still fails?

There is one thing I have not seen documented in the SCOM installation/deployment guides: The agent actually adds an exception for itself when it runs, so if you block local exceptions (What’s the point of having a GPO for the firewall config on your serves if you don’t?) , it will fail.

Add this to your Firewall policy, as a program exception:
%SystemRoot%\422C3AB1-32E0-4411-BF66-A84FEEFCC8E2\MOMAgentInstaller.exe

Be sure to open it for the proper IPs only for added security. Then try to push it again..

Good luck!

It can happen on new setups, or on existing ones if things in particular break. It is a very common problem, and being the lucky guy I am, I obviously had this issue except none of the fixes discussed on forums worked.

Here’s a link to the thread I opened on technet… which includes a detailed description of the problem:

http://social.technet.microsoft.com/Forums/en-US/operationsmanagergeneral/thread/0d76679f-a6ae-4b41-bae8-5477d905a160

Here’s a rundown of what to check. However, this document doesn’t explain how to do every Windows or AD operation, but if you need more info on a specific step, believe me, there’s a lot of information out there on how to proceed with them..

Bottom line:

1 – Is your SCOM running with Local System or domain service accounts?

Let’s use setspn to check some…SPNs ! setspn -L domain\account

If Local system: Make sure the computer has SPNs registered for: Itself (HOST), the health service (MSOMHsvc) as well as the SDK (MSOMSdkSvc). It needs one SPN with the netbios name only, and one with the FQDN. So that means six SPNs, not counting potential SQL SPNs if you are running SQL on the same box.

If domain accounts: Make sure the computer has the SPNs registered for itself and the health service, for a total of 4 SPNs. Make sure the SDK account has the SDK SPNs registered to itself. If it has not, you have two choices: register it manually using setspn, or give the account access to update its own SPNs. To do this, use adsiedit, browse to the service account, and in the advanced permissions, grant Write ServicePrincipalName to “SELF”. Next time you start the services, the SPNs will get registered, and there’s no chance you’ll make a typo.

2 – Is your SQL service running with Local System or domain service accounts?

Proceed with the same checks as above. We’re looking for SPNs on either the computer account if local or the service account if on the domain. You should find two MSSQLSvc SPNs. One with just the FQDN, and the other one with the port number of the SQL instance. The same steps as above apply, if you want to give the service account the rights to register its own SPN.

3 – Is your clock in sync? Stupid question but hey, it screws up kerberos… check the date too !

4 – Is the SDK account (if it’s a domain account) owner of the SQL OperationsManager database?

If not, this could be a problem if the account used originally to create it is now disabled or deleted. Change it.

5 – Double check for duplicate SPNs.

It is possible that old accounts contain bad MSSQLSvc, MSOMSdkSvc or MSOMHSvc SPNs. I suggest using your favorite AD tools to search. (adfind by joeware, ldifde, ldp.exe can all do the trick). If you identify any duplicate SPNs, delete the bad ones.

6 – Try this in SQL, as a sysadmin.

execute as login = ‘domain\sqlserviceaccount’

The results should be simply OK. Then, try any other domain account.  If you get this error, you still have an impersonation problem:

An exception occurred while enqueueing a message in the target queue. Error: 15404, State: 19. Could not obtain information about Windows NT group/user 'DOMAIN\scom01opsmgr', error code 0x5.

Add your SQL and SDK service accounts to the Windows Authorization Access domain group. This is what finally fixed it for me !

Trying to enable EFS on a specific OU, while it’s disable at the top of the structure or domain?
Recovery certificates from two different GPOs mixing up instead of being replaced?

Overall EFS GPOs looking like they aren’t merging properly?

Well, it’s not because EFS GPOs are supposed to behave like black magic. Turns out there’s a bug, Microsoft’s aware of it, but doesn’t think it would be a good idea to FIX IT on Windows XP and 2003.

Thankfully, all it means is you need to edit your GPOs from a Vista, 2008 or Windows 7 machine.

KB : EFS may not be enabled expectedly after you disable a policy and this policy turn off the EFS feature

Opening my EFS GPOs in Windows 7, switching the Allow/Don’t allow and applying the ‘change’ fixed my GPOs. A few minutes later, and stuff was behaving like it should’ve been… Can I have those wasted hours of my life back, Mr. Ballmer?

Sharepoint.

Mappoint.

Performancepoint (what the hell!).

Makes about as much sense as commercials with Seinfeld and Bill Gates.

I was expecting a new card with a note on it or something, but it is just a typical certificate, with the note Charter at the top. Plus it doesn’t even appear on the transcript. Kind of lame.

Oh well, I guess I can put it on my resume.. like anyone would put MCTS certifications on their resume.

Why did I get FIVE certifications by getting my MCITP: Enterprise Admin? Are people craving instant gratification so much that Microsoft had to make you feel like you accomplished something every time you spent 130$ and 2 hours to pass an exam?

That MCITP itself is already easier than it should be, the individual certifications are a joke. Putting “TS: Windows Server 2008 Applications Infrastructure, Configuring” on my resume feels as stupid as writing “MCP” on it. OK, so I know how to install IIS and Sharepoint Services, and I know what a “Terminal Server” is. Now what ?

Well, if I was like some people I know I could put this in my signature!

/rant