2 .TH VLMCS 1 "February 2015" "Hotbird64" "KMS Activation Manual"
6 vlmcs \- a client for testing and/or charging KMS servers
9 \fBvlmcs\fR [ \fIoptions\fR ] [ \fItarget\fR ] [ \fIoptions\fR ]
11 \fItarget\fR can be one of the following:
14 \fIhostname\fR|\fIipaddress\fR[:\fItcp-port\fR] or to query a specific KMS server (example: vlmcs kms.example.com:1688).
16 \fR.\fIdomain\fR to automatically detect KMS servers via DNS for \fIdomain\fR (example: vlmcs .example.com). Please note the dot before \fIdomain\fR.
18 \fI-\fR (a single dash) to detect KMS servers in your own domain.
21 If you use \fIipaddress\fR:\fIport\fR as the \fItarget\fR, the \fIipaddress\fR must be enclosed in brackets
22 if it contains colons, e.g. [2001:db8:dead:beef::1]:1688. If you use a link-local IPv6 address on Unix systems, you must append a percent sign and the
23 interface identifier of the source interface, for example fe80::dead:beef%eth0.
25 If you omit the \fItarget\fR, 127.0.0.1:1688 will be used except if you use \fB-i6\fR. In this case the default target is [::1]:1688.
28 \fBvlmcs\fR is a program that can be used to test a KMS server that provides activation for
29 several Microsoft products. The KMS server may also be an emulator. It supports
30 KMS protocol versions 4, 5 and 6.
33 generates one or more activation requests for a Microsoft KMS product and sends
34 it to a KMS server. It then analyzes and displays the responses of the KMS server.
37 checks both the DCE-RPC protocol and the activation message for correctness and
38 reports any errors that it finds.
41 can also be used to "charge" a KMS server. A Microsoft KMS server sends correct activation messages only if it detects a certain minimum of clients (25 for Windows client OSses, 5 otherwise) on the network. This is Microsoft's futile attempt to prevent running a KMS server in a home environment.
44 .IP "\fB-h\fR or \fB-?"
54 Show some examples how to use vlmcs correctly.
57 Be verbose. Instead of just displaying the returned ePID and the HwId
58 (protocol v6 only) vlmcsd shows all details of the query and the response.
60 .IP "\fB-l\fR \fIapplication"
61 Request activation for a specific
63 Valid applications can be displayed by using
67 .IR "Windows Vista Business" "."
68 The list of available applications is not complete. You may
70 .BR "-a" ", " "-k" " and " "-s"
71 to specify applications that are not listed with \fB-x\fR. The
73 option is used as a shortcut for the most common applications.
75 .IP "\fB-4\fR, \fB-5\fR and \fB-6"
76 Force version 4, 5 or 6 of the KMS protocol. The default is to select a suitable
77 version according to the
79 selected. Plese note that some products (e.g. Office 2013) may use different protocols with different versions of Windows.
82 Let the client pretend to be a virtual machine. Early versions of Microsoft's
83 KMS server did not increase the client count if the request came from a virtual
84 machine. Newer versions ignore this flag.
87 Use NetBIOS names instead of DNS names. By default vlmcsd generates some random
88 DNS names for each request. If you prefer NetBIOS names, you may use
90 A real Microsoft activation client uses DNS names or NetBIOS depending on the
91 client name configuration. KMS servers treat the workstation name as a comment
92 that affects logging only. Clients will be identified by a GUID that can
93 be specified using \fB-c\fR. \fB-d\fR has no effect if you also specify \fB-w\fR.
95 .IP "\fB-a\fR \fIapplication-guid"
96 Send requests with a specific
97 .IR "application-guid" "."
98 There are currently only three known valid
99 .IR "application-guid" "s:"
102 55c92734-d682-4d71-983e-d6ec3f16059f (Windows)
104 59a52881-a989-479d-af46-f275c6370663 (Office 2010)
106 0ff1ce15-a989-479d-af46-f275c6370663 (Office 2013)
109 A Microsoft KMS server uses these GUIDs to have seperate counters for the
110 already activated clients. A client that does not contact the KMS server
111 within 30 days will be deleted from the database. Emulated KMS servers
112 are always fully charged.
114 .IP "\fB-k\fR \fIkms-guid\fR"
115 Send requests with a specific
117 A Microsoft KMS server uses these GUIDs as a product id to decide whether to
118 grant activation or not. A list of current \fIkms-guid\fRs can be found in
119 kms.c (table KmsIdList). Emulated KMS servers grant activation unconditionally
120 and do not check the \fIkms-guid\fR.
122 .IP "\fB-s\fR \fIactivation-guid\fR"
123 The \fIactivation-guid\fR defines the actual product, e.g. "Windows 8.1 Professional WMC KMSCLIENT edition". A \fIactivation-guid\fR maps 1:1 to a product key.
124 However, neither a Microsoft KMS server nor emulated servers check this id.
125 The \fIactivation-guid\fR is useful in logging to get a specific product description like
126 "Windows 8.1 Professional WMC". A list of current \fIactivation-guid\fRs can be found in
127 kms.c (table ExtendedProductList).
129 .IP "\fB-n\fR \fIrequests"
132 requests to the server. The default is to send at least one request and enough
133 subsequent requests that the server is fully charged afterwards for
134 the \fIapplication\-guid\fR you selected (explicitly with
135 .BR "-a" " or implicitly by using " "-l" ")."
138 Causes to use a new TCP connection for each request if multiple requests
139 are sent with vlmcsd. This is useful when you want to test an emulated KMS
140 server whether it suffers from memory leaks. To test for memory leaks use
142 with a large number of requests (> 100000) and then test twice (with and
145 This option may become neccessary for future versions of Microsoft's KMS
146 server because multiple requests with different
150 are impossible in a real KMS szenario over the same TCP connection.
152 .IP "\fB-c\fR \fIclient-machine-guid\fR"
153 Normally vlmcs generates a random \fIclient-machine-guid\fR for each request. By using this option you can specify a fixed \fIclient-machine-guid\fR
154 This causes a Microsoft KMS not to increment its client count because it
155 receives multiple requests for the same client. Thus do not use
157 if you want to charge a real KMS server.
159 .IP "\fB-o\fR \fIprevious-client-machine-guid\fR"
160 If the \fIclient-machine-guid\fR changes for some reason, the real KMS client stores a \fIprevious-client-machine-guid\fR which is sent
161 to the KMS server. This happens rarely and usually 00000000-0000-0000-0000-000000000000 is used. You can use \fB-o\fR to specify a different
162 \fIprevious-client-machine-guid\fR.
164 .IP "\fB-G\fR \fIfilename\fR"
165 Grabs ePIDs and HWIDs from a KMS server and writes the information to \fIfilename\fR
166 in format suitable to be used as a configuration file (aka ini file) for \fBvlmcsd\fR(8).
167 This is especially useful if you have access to a genuine KMS server and want to use
168 the same data with \fBvlmcsd\fR(8).
170 If \fIfilename\fR does not exist, it will be created.
171 If you specify an existing \fIfilename\fR, it will be updated to use the information
172 received from the remote KMS server and a backup \fIfilename\fR~ will be created.
174 \fB-G\fR cannot be used with \fB-l\fR, \fB-4\fR, \fB-5\fR, \fB-6\fR, \fB-a\fR, \fB-s\fR, \fB-k\fR, \fB-r\fR and \fB-n\fR
176 .IP "\fB-w\fR \fIworkstation-name"
177 Send requests with a specific
178 .IR "workstation-name" "."
179 This disables the random generator for the workstation name. Since it is
180 a comment only, this option does not have much effect.
182 .IP "\fB-r\fR \fIrequired-client-count"
183 Also known as the "N count policy". Tells the KMS server that successful activation requires
184 \fIrequired-client-count\fR clients. The default is the
185 \fIrequired-client-count\fR that the product would need if the request
186 was a real activation. A Microsoft KMS server counts clients
187 up to the double amount what was specified with \fB-r\fR. This option
188 can be used to "overcharge" a Microsoft KMS server.
190 .IP "\fB\-t\ \fIstatus\fR"
191 Reports a specific license status to the KMS server. \fIstatus\fR is a number
192 that can be from 0 to 6. 0=unlicensed, 1=licensed, 2=OOB grace, 3=OOT grace,
193 4=Non-genuinue grace, 5=notification, 6=extended grace. Refer to
194 .URL "http://technet.microsoft.com/en-us/library/ff686879.aspx#_Toc257201371" "TechNet" ""
195 for more information. A Microsoft KMS server collects this information for
198 .IP "\fB-g\fR \fIbinding-expiration\fR"
199 This tells the KMS server how long a client will stay in its current license
200 status. This can be the remaining OOB time (the grace peroid that is granted between installation of a product and when activation is actuall required) or
201 the remaining time when KMS activation must be renewed.
202 \fIbinding-expiration\fR is specified in minutes. A Microsoft KMS server
203 apparantly does not use this information.
205 .IP "\fB-i \fIprotocol-version\fR"
206 Force the use of Internet protocol \fIprotocol-version\fR. Allowed values are 4 (IPv4) and 6 (IPv6). This option is useful only if you specfiy a \fIhostname\fR and not an
207 \fIip-address\fR on the command line.
210 Do not set the RPC_PF_MULTIPLEX flag in the RPC bind request. This can be used to test if the KMS server uses the same setting of this flag in the RPC bind respone. Some KMS
211 emulators don't set this correctly.
213 .IP "\fB-N0\fR and \fB-N1\fR"
214 Disables (\fB-N0\fR) or enables (\fB-N1\fR) the NDR64 transfer syntax in the RPC protocol. Disable NDR64 only in case of problems. If NDR64 is not used, vlmcs cannot detect many RPC protocol errors in KMS emulators. If you want to test whether a KMS emulator fully supports NDR64, you must use the \fB-n\fR option to send at least two requests. This is because Microsoft's client always sends the first request using NDR32 syntax and subsequent requests using NDR64 syntax.
216 .IP "\fB-B0\fR and \fB-B1\fR"
217 Disables (\fB-B0\fR) or enables (\fB-B1\fR) bind time feature negotiation (BTFN) in the RPC protocol. Disable BTFN only in case of problems. If BTFN is not used, vlmcs cannot detect many RPC protocol errors in KMS emulators.
220 Options that do not require an argument can be specified together with a single
221 dash, e.g. vlmcs -6mvT. If you specify an option more than once, the last occurence
225 .IP "\fBvlmcsd.ini\fR(5)"
228 .IP "\fBvlmcs kms.example.com"
229 Request activation for Windows Vista using v4 protocol from kms.example.com.
230 Repeat activation requests until server is charged for all Windows products.
233 Request activation for Windows Vista using v4 protocol from a KMS server that is published via DNS for the current domain.
235 .IP "\fBvlmcs .example.com"
236 Request activation for Windows Vista using v4 protocol from a KMS server that is published via DNS for domain example.com.
238 .IP "\fBvlmcs -6 -l Office2013 -v -n 1"
239 Request exactly one activation for Office2013 using v6 protocol from
240 localhost. Display verbose results.
242 .IP "\fBvlmcs kms.bigcompany.com -G /etc/vlmcsd.ini"
243 Get ePIDs and HWIDs from kms.bigcompany.com and create/update /etc/vlmcsd.ini accordingly.
246 Some platforms (e.g. Solaris) may have a \fBman\fR(7) system that does not handle URLs. URLs may be omitted in the documentation on those platforms. Cygwin, Linux, FreeBSD and Mac OS X are known to work correctly.
252 Thanks to CODYQX4, crony12, deagles, DougQaid, eIcn, mikmik38, nosferati87, qad, Ratiborus, vityan666, ...
255 \fBvlmcsd\fR(7), \fBvlmcsd\fR(8), \fBvlmcsdmulti\fR(1)