Mike Gore - 2020-05-28

Windows Download and Activation

• Microsoft Windows 10 Downloads - use for all installations - the key we apply later ties it to the University activation server
  • https://cs.uwaterloo.ca/twiki/view/CF/Windows10BaseImageCreation#Where%20to%20Get%20Windows%2010

Campus Version of Windows 10 activation

• Can be used on university-owned computers only
• Requires that all clients be connected to the University in order to activate
  • Must also connect at least TWICE a year to stay activated
  • VPN resources for remote users
    • vpn.cs.uwaterloo.ca
    • vpn.uwaterloo.ca
• Summary: all the ISO images we download from IST or Microsoft must be configured to activate via a KMS servers (discovered by DNS lookups)
• The windows client will hopefully find the IST license server and activate - if not follow these notes

VPN resources needed for remote activation off campus

• VPN resources: vpn.uwaterloo.ca or cs.vpn.uwaterloo.ca

Activation

• • You must activate Windows 10 against the campus KMS server using the publicly available KMS server activation KEY
    • The KEY just tells Windows to look for any KMS server willing to activate Windows and is not sensitive
    • To find a list of the published keys (these are publicly available from Microsoft) consult the Microsoft document here
      • https://docs.microsoft.com/en-us/windows-server/get-started/kmsclientkeys
      • Example: Windows 10 Education, the one we use, is: NW6C2-QMPVW-D7KKK-3GKT6-VCFB2

Summary Method

• Activating Windows 10
  1. ) Open an elevated command prompt
     • Search: "command" -> right click on "command prompt" -> Run as Administrator
  2. ) c:\windows\system32\cscript c:\windows\system32\slmgr.vbs /ipk NW6C2-QMPVW-D7KKK-3GKT6-VCFB2
     • Sets Windows to activate against a License Server - this key is published by Microsoft (ie public) and is the same for all license sever activation's everywhere
  3. ) c:\windows\system32\cscript c:\windows\system32\slmgr.vbs /skms officelic.uwaterloo.ca
     • Tells Windows who to talk to
  4. ) c:\windows\system32\cscript c:\windows\system32\slmgr.vbs /ato
     • Activates

Basic Testing

1. ) slmgr.vbs -dli (will display the current activation state - and the last 5 digits of the KEY )
2. ) nslookup -type=srv _vlmcs._tcp (will show you if it knows about the Campus KMS servers )
   • ( This should return three licensing servers from IST - if not try the commands below)

Checking if a client can find any KMS servers

• nslookup -type=srv _vlmcs._tcp

Activation Detail

Key type Terminology

• Note: KEY type controls the activation process - be sure you know WHICH key is in effect - see Testing below
• KMS = Key Managment Server: controls license ( For the University IST runs several of these )
• Notes:
  1. ) To use KMS client MUST be able to connect to a KMS server it lease TWICE A YEAR - otherwise use MAK KEY!
     • KMS lookup via DNS is DEFAULT on ALL Microsoft Windows Educational images - it is NOT hard coded

• • • This process can FAIL if the client can NOT automatically find the IST license servers via DNS lookups * If KMS fails it will ask a license key - this is likely because of not seeing the KMS - see Testing below * All KMS client keys are all PUBLIC since activation status is done on the KMS server NOT on the client * KMS key list: https://docs.microsoft.com/en-us/windows-server/get-started/kmsclientkeys
  1. ) Our Campus Windows 10 Educational public KMS key is: NW6C2-QMPVW-D7KKK-3GKT6-VCFB2
     • Sets Windows to activate against a License Server - this key is published by Microsoft (ie public) and is the same for all license severs everywhere*
     • MAK = Multiple Access Key: controls license ( Used rarely at the university - may be need for some laptop installs only )
       • * MAK keys are PRIVATE for the Campus use only *
       • Link to Key access restricted Windows 10 Educational private MAK key for University of Waterloo )

Manually specifying KMS or MAK key activation (KMS is default):

• KMS is default a computer must be able to connect to KMS twice a year to work otherwise use MAK laptops
  • Open an elevated command prompt
  • For KMS run: slmgr.vbs /ipk NW6C2-QMPVW-D7KKK-3GKT6-VCFB2 ( Windows 10 Educational public KMS key )
    • * Note: You only need this if you have previously specified another KEY type - otherwise it is default
  • For MAK run: slmgr.vbs /ipk Link to Key access restricted Windows 10 Educational private MAK key for University of Waterloo )
    • * Changes to MAK key activation

Testing

1. ) Open an elevated command prompt
2. ) slmgr.vbs -dli (will display the current activation state - and the last 5 digits of the KEY )
3. ) nslookup -type=srv _vlmcs._tcp (will show you if it knows about the Campus KMS servers )
   • ( This should return three licensing servers from IST - if not try the commands below)
   • If the FAILS try MANUALLY specifying the KMS - see next section before manually activating
4. ) Try manually activating: * Open an elevated command prompt
   • run: C:\Windows\System32\cscript c:\windows\system32\slmgr.vbs /ato
     • If this FAILS check the status by running: slmgr.vbs -dli * ( question: Do you have the right key type for the activation you are attempting ??? - check last 5 digits of the KEY )

Manually specifying the KMS server: - If a client does NOT auto-discover

1. ) Open an elevated command prompt
2. ) c:\windows\system32\cscript c:\windows\system32\slmgr.vbs /skms officelic.uwaterloo.ca
   • (or slmgr.vbs -skms officelic.uwaterloo.ca[:1688] where *:1688 *is optional and either / or - work as option character ))
3. ) Repeat testing steps
4. ) If client STILL FAILS to activate
   • in elevated command prompt
     • run: cd \Windows\system32\drivers\etc * run: notepad hosts ( and add the following lines )

                129.97.128.170   licsrv4  #PRE
                129.97.128.166   licsrv5  #PRE
                

       * run command: copy hosts lmhosts * reboot and retest

Windows UPDATES - optional setup with IST servers

• We all should use IST WSUS servers for windows updates
  • - normally when a host is joined to the CS-GENERAL domain this is done automatically but NOT for stand alone machines

• Peter Schepers gave me these notes:

        reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v WUServer /t REG_SZ /d "https://wsus.uwaterloo.ca" /f>NUL
        reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v WUStatusServer /t REG_SZ /d "https://wsus.uwaterloo.ca" /f>NUL
        reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /t REG_DWORD /d 1 /f>NUL
        reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v UseWUServer /t REG_DWORD /d 1 /f>NUL
        reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v RescheduleWaitTime /t REG_DWORD /d 5 /f>NUL
        reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 0 /f>NUL
        reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 4 /f>NUL
        reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallDay /t REG_DWORD /d 0 /f>NUL
        reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallTime /t REG_DWORD /d 1 /f>NUL