Posted January 19, 201213 yr Greetings, I work in desktop support for a community college. This summer we began changing our activation scheme from MAK to KMS as we cycle out computers. We thought everything went fine until a few weeks ago when some users started reporting their copies of windows were not genuine. The first few reports we thought were a fluke, but it now appears that most of the computers we deployed this summer are affected. When a computer has this issue we are able to reactivate the computer either via the gui or slmgr.vbs /ato without issue. It looks like our KMS server is functioning properly but our clients are not renewing their licenses. Running slmgr.vbs /dlv confirms this showing a Volume activation expiration of 0 minutes. I can verify that the clients have connectivity to the kms server by running slmgr.vbs /ato and receiving a valid license. All of our client computers are Windows 7 Enterprise SP1. When we initially decided to switch to KMS I set up a pilot group of 25 users. KMS is functioning properly on these computers. A renewal request is sent by these computers every 7 days, a valid response is received from the server, and no issues have been reported in 8 months. As I looked over the logs on the effected clients I noticed something strange, they are completely devoid of 12288 and 12289 activation request and response events. It seems that the clients are never requesting renewals from the kms server. If I run slmgr.vbs /ato a request is immediately sent and a successful response is immediately received, the license renews, and everything appears to work fine. But when the renewal interval passes a renewal request is never sent and the license is never renewed. Running slmgr.vbs /dlv shows the renewal interval at 10080 minutes. There is activity in the event logs from the Security-SPP service. It is waking up around the renewal time, performing a licensing status check, rescheduling its task for the next interval, and going back to sleep. The clients both those which work and those which don’t were created from ghost images. They had been sysprepped with /generalize and all have unique CMIDs. Since this issue first became apparent I did an install from disk of a windows 7 client, it functions properly and sends renewal requests to the KMS. I have also built a test from the ghost image used this summer, it activates from the kms but does not send renewal requests. The following is the output from slmgr.vbs from several computers. We change the activation and renewal intervals to 60 minutes for trouble shooting. I also attached the events generated by Security-SPP. Both from when the renewal time comes up and when slmgr.vbs /ato is run. Functioning computer from pilot group: Software licensing service version: 6.1.7601.17514 Name: Windows® 7, Enterprise edition Description: Windows Operating System - Windows® 7, VOLUME_KMSCLIENT channel Activation ID: ae2ee509-1b34-41c0-acb7-6d4650168915 Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f Extended PID: 00392-00170-918-500000-03-1033-7601.0000-0742011 Installation ID: 011244986693800136570170522132085766058201662535178622 Partial Product Key: HVTHH License Status: Licensed Volume activation expiration: 259200 minute(s) (180 day(s)) Remaining Windows rearm count: 1 Trusted time: 1/19/2012 4:01:02 PM Key Management Service client information Client Machine ID (CMID): 8708597b-49e8-4957-98e7-9662cdd06bfd KMS machine name from DNS: kms.*****.edu:1688 KMS machine extended PID: 55041-00168-313-132325-03-1033-7600.0000-0172012 Activation interval: 60 minutes Renewal interval: 60 minutes KMS host caching is enabled Functioning computer built from PC: Software licensing service version: 6.1.7601.17514 Name: Windows® 7, Enterprise edition Description: Windows Operating System - Windows® 7, VOLUME_KMSCLIENT channel Activation ID: ae2ee509-1b34-41c0-acb7-6d4650168915 Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f Extended PID: 00392-00170-918-500000-03-1033-7601.0000-2912011 Installation ID: 006936798272824896672381555236527746199915851534723813 Partial Product Key: HVTHH License Status: Licensed Volume activation expiration: 259200 minute(s) (180 day(s)) Remaining Windows rearm count: 1 Trusted time: 1/19/2012 4:05:39 PM Key Management Service client information Client Machine ID (CMID): 672b2348-44b0-41c9-9126-6aaf28392d36 KMS machine name from DNS: kms.*****.edu:1688 KMS machine extended PID: 55041-00168-313-132325-03-1033-7600.0000-0172012 Activation interval: 60 minutes Renewal interval: 60 minutes KMS host caching is enabled Non-functioning client: Software licensing service version: 6.1.7601.17514 Name: Windows® 7, Enterprise edition Description: Windows Operating System - Windows® 7, VOLUME_KMSCLIENT channel Activation ID: ae2ee509-1b34-41c0-acb7-6d4650168915 Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f Extended PID: 00392-00170-918-500000-03-1033-7600.0000-0522011 Installation ID: 007066005935825266048863484554411700601482254035114306 Partial Product Key: HVTHH License Status: Licensed Volume activation expiration: 259140 minute(s) (179 day(s)) Remaining Windows rearm count: 1 Trusted time: 1/19/2012 4:08:43 PM Key Management Service client information Client Machine ID (CMID): 5e055c48-535f-4fdc-9695-30f37716da04 KMS machine name from DNS: kms.*****.edu:1688 KMS machine extended PID: 55041-00168-313-132325-03-1033-7600.0000-0172012 Activation interval: 60 minutes Renewal interval: 60 minutes KMS host caching is enabled Event logs from non-functioning client: Information 1/19/2012 2:25:56 PM Security-SPP 1003 None Information 1/19/2012 2:25:56 PM Security-SPP 902 None Information 1/19/2012 2:25:56 PM Security-SPP 900 None Information 1/19/2012 2:25:56 PM Security-SPP 1066 None Information 1/19/2012 2:30:58 PM Security-SPP 1003 None Information 1/19/2012 2:35:58 PM Security-SPP 903 None Information 1/19/2012 2:35:58 PM Security-SPP 16384 None Details: Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:25:56 PM Event ID: 1003 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )] 7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:25:56 PM Event ID: 902 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The Software Protection service has started. 6.1.7601.17514 Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:25:56 PM Event ID: 900 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The Software Protection service is starting. Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:25:56 PM Event ID: 1066 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: Initialization status for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:30:58 PM Event ID: 1003 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259140)(?)(?)(?)])(1 )(2 )] 7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:35:58 PM Event ID: 903 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The Software Protection service has stopped. Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:35:58 PM Event ID: 16384 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: Successfully scheduled Software Protection service for re-start at 2012-01-19T20:29:58Z. Reason: GVLK. Event Log from non-functioning client when slmgr.vbs /ato was sent. Information 1/19/2012 2:45:26 PM Security-SPP 900 None Information 1/19/2012 2:45:27 PM Security-SPP 902 None Information 1/19/2012 2:45:27 PM Security-SPP 1003 None Information 1/19/2012 2:45:27 PM Security-SPP 1066 None Information 1/19/2012 2:45:28 PM Security-SPP 12288 None Information 1/19/2012 2:45:30 PM Security-SPP 1003 None Information 1/19/2012 2:45:30 PM Security-SPP 1003 None Information 1/19/2012 2:45:30 PM Security-SPP 12289 None Information 1/19/2012 2:45:30 PM Security-SPP 1033 None Information 1/19/2012 2:50:31 PM Security-SPP 903 None Information 1/19/2012 2:50:31 PM Security-SPP 16384 None Details: Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:45:26 PM Event ID: 900 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The Software Protection service is starting. Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:45:27 PM Event ID: 902 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The Software Protection service has started. 6.1.7601.17514 Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:45:27 PM Event ID: 1003 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259140)(?)(?)(?)])(1 )(2 )] 7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:45:27 PM Event ID: 1066 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: Initialization status for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:45:28 PM Event ID: 12288 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The client has sent an activation request to the key management service machine. Info: 0x00000000, 0x00000000, kms.*****.edu:1688, 5e055c48-535f-4fdc-9695-30f37716da04, 2012/01/19 19:45, 0, 1, 259140, ae2ee509-1b34-41c0-acb7-6d4650168915, 25 Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:45:30 PM Event ID: 1003 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: 358fb95b-0090-44fb-883a-75734e060c30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 4f00134f-b514-4626-a74b-a8ec7c8dfe92, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 8dffd6e4-0497-4c35-b7d7-e47cf464cf30, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 5: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 0 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )] 7: b793ff2d-9d80-407c-b521-85111c51028c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:45:30 PM Event ID: 1003 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status= 1: ae2ee509-1b34-41c0-acb7-6d4650168915, 1, 1 [(0 [0x00000000, 1, 0], [( 2 0xC004F005)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )] Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:45:30 PM Event ID: 12289 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The client has processed an activation response from the key management service machine. Info: 0x00000000, 0x00000000, 1, 0, 50, 60, 60, 2012/01/19 19:45 Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:45:30 PM Event ID: 1033 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: These policies are being excluded since they are only defined with override-only attribute. Policy Names=(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Shell-InBoxGames-FreeCell-EnableGame) (Shell-InBoxGames-Hearts-EnableGame) (Shell-InBoxGames-Minesweeper-EnableGame) (Shell-InBoxGames-PurblePlace-EnableGame) (Shell-InBoxGames-Shanghai-EnableGame) (Shell-InBoxGames-Solitaire-EnableGame) (Shell-InBoxGames-SpiderSolitaire-EnableGame) (Shell-MultiplayerInboxGames-Backgammon-EnableGame) (Shell-MultiplayerInboxGames-Checkers-EnableGame) (Shell-MultiplayerInboxGames-Spades-EnableGame) (Shell-PremiumInBoxGames-Chess-EnableGame) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) App Id=55c92734-d682-4d71-983e-d6ec3f16059f Sku Id=ae2ee509-1b34-41c0-acb7-6d4650168915 Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:50:31 PM Event ID: 903 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: The Software Protection service has stopped. Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 1/19/2012 2:50:31 PM Event ID: 16384 Task Category: None Level: Information Keywords: Classic User: N/A Computer: at23563.*****.edu Description: Successfully scheduled Software Protection service for re-start at 2012-01-19T20:44:30Z. Reason: GVLK. Continue reading...
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.