Free windows licenses?

What are KMS licenses?

KMS stands for key management services, this is a service which you can run your own client activation tools for windows licenses. The license on the specified machine asks to validate against the KMS service to check “am i a valid license?”. Which the service reports “yep, your valid until x date”, the machine your using this on gets all the benifits of having a license. This a standard which is created by Microsoft for their licensing setup.

Is this legal?!

We use this only for testing purposes, but the volume licenses keys are given out by Microsoft themselfs. So its kinda a gray area to license your own computer with a volume license and your own KMS server. The renew of each license is each 6 months or so on the test setup.

The setup

I use the 11notes docker setup, modified the docker-compose file a little to make it work for myself. 11notes is a reverse enginered solution based on the KMS service but now it can on linux based systems. After running docker-compose up -d the webui should be available and with that the KMS service is also online.

Getting a license

Login on our test windows VM and we start a administrator powershell session. Lets points the Windows VM to our own KMS service with following command slmgr /skms <IP-docker-node>:1688. We use the following volume license (source) and to add the license we do slmgr /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX

License validation

To validate our license against our KMS service we need to activate the service on our Windows host with slmgr /ato. Sometimes the license will do a little finnicky stuff to validate, but if you check the KMS webui, we can see the following:

<CLIENT ID>
KMS EPID:
<SOME HASH HERE>
	
test
Last IP:<IP HERE>
Last active: 10/27/2025, 6:56:59 PM
	Windows 	Windows 10/11 Professional 	Activated 	1

This means our license is valid and active on the Windows VM. From my understanding the Windows machine keeps polling the KMS service every so often. I haven’t tested it but my best guess is that the license will be deactivated when it couldn’t reach the KMS server in x time.

Conclusion

KMS is a easy way to get testing machines up and running with a license. I can see why larger businesses setup these constructions to get a better grip on the license usage.

There are many ways of activating a Windows machine, I was curious what a random KMS server on the internet could see when you activate against it. Main takeaway is dont activate your windows machine against any unknown or untrusted KMS service on the internet, the people that run that service can see alot of information polling for validation coming from your machine.

• Tags:
• Security
• Feature