0xC004F041 and 0xC004F039: Your KMS Host Is Not Activated or Enabled

Fix it now

Both codes come from the client and both point at the server. Microsoft publishes 0xC004F041 as the Key Management Service not being activated, and 0xC004F039 as the Key Management Service not being enabled. Nothing on the client needs changing.

slmgr /dlv
sc query sppsvc
netstat -ano | findstr :1688

1. Read two lines of the slmgr /dlv output: the description should name a KMS host key, and Licence Status should read Licensed. Anything else is your answer.
2. If a host key is installed but the host is not licensed, activate it: slmgr /ato. With no internet route, activate by phone instead – search for SLUI 04 from Start.
3. If no host key is installed, add the Volume Activation Services role and run the Volume Activation Tools wizard: Install-WindowsFeature -Name VolumeActivation -IncludeManagementTools, then vmw.exe.
4. Open the port: Set-NetFirewallRule -Name SPPSVC-In-TCP -Profile Domain,Private -Enabled True.
5. Go back to a client and run slmgr /ato.

Do not install a KMS host key on a client. Clients take a generic volume licence key; a host key on a client is one of the documented ways a host key gets used up.

If the client activates, you are done. If not, the next section separates the two codes, which have different causes and different fixes.

Why it happens

KMS is a chain with two links. A host holds a KMS host key, activates that key once against Microsoft, and from then on issues activations to clients on your network. A client holds a generic volume licence key, which is not an entitlement so much as an instruction to go and borrow one. Break the first link and the second cannot exist, which is why both of these codes appear on clients and are fixed on the server.

Microsoft publishes 0xC004F041 as “The Software Protection Service determined that the Key Management Server (KMS) isn’t activated. KMS needs to be activated”, and its resolution is a single line: activate the KMS host using online or telephone activation. That is unusually direct for an activation code. It means a host key is present and its own activation never completed.

0xC004F039 is published differently. Its text is that the computer could not be activated because the Key Management Service is not enabled, and Microsoft’s resolution is to troubleshoot the network connection between host and client and confirm no firewall is blocking TCP 1688. So the two codes are not two shades of the same thing: one is about the host’s licence state, the other about whether the client reached a working service at all.

Event ID 12290 is the fastest way to tell which you have. It is written on the host, in the Key Management Service log, once for each client that contacts it, and it carries the client’s CMID and the minimum count needed. Entries arriving from your failing clients mean they reached the host and were refused. No entries at all mean they never got there, and the fault is in front of the host rather than inside it. 0xC004E005 turns up in these conversations too, and Microsoft publishes no meaning for it.

Full reference

Which machine to look at, and what it should say

Standing a host up the documented way

1. On a supported Windows Server, add the Volume Activation Services role. In PowerShell: Install-WindowsFeature -Name VolumeActivation -IncludeManagementTools.
2. Enable the firewall rule: Set-NetFirewallRule -Name SPPSVC-In-TCP -Profile Domain,Private -Enabled True.
3. Run the Volume Activation Tools wizard: vmw.exe.
4. Choose Key Management Service, enter your KMS host key, and activate it online or by telephone.
5. Commit the configuration and close the wizard, then confirm with slmgr /dlv that the host reads Licensed.

The wizard route matters because it configures the role as well as installing the key. Installing the key with slmgr /ipk alone works, but it leaves you doing by hand the parts the wizard does for you, and it is the route most likely to end with a host that is licensed and still not answering.

Which log to read on which machine

A 12288 on the client with no 12289 after it means the request left and nothing came back. That is a network or host problem, not a licensing one, and no amount of work on the client will move it.

What a KMS host can and cannot activate

• A KMS host running Windows Server can activate both server and client operating systems. A KMS host running a Windows client edition can activate only client operating systems.
• A host may be physical or virtual. Microsoft states that you can run a KMS host on any physical or virtual system running a supported Windows Server or Windows client operating system.
• The host needs the host key that covers the products you are activating. A client reaching a host that cannot serve its product gets 0xC004F042, which is a different article.
• Clients need a count on the host before it will answer: 25 or higher for client editions, 5 or greater for servers and volume Office. Below that, the host is healthy and still refuses.

Before you conclude the host key is the problem

Two checks separate a genuine key problem from an infrastructure one, and both take seconds. First, does the host activate itself? A host that reads Licensed has a working key, whatever the clients are reporting. Second, do 12290 entries appear on the host when a client tries? If they do, the client is reaching a working service and being refused for a reason the host will name; if they do not, nothing about the key is in question yet.

It is worth being clear about what this code does not mean. It is not a shortfall of client licences, it is not a count problem, and it is not something a client-side registry edit reaches. The client is reporting, accurately, what the server told it.

Every code this article covers

Confirm the fix worked

1. On the host, slmgr /dlv names a KMS host key and Licence Status reads Licensed.
2. netstat -ano | findstr :1688 on the host returns a LISTENING line.
3. Test-NetConnection <host> -Port 1688 from a client subnet returns True.
4. On a client, slmgr /ato completes and slmgr /dlv reads Licensed.
5. A new Event ID 12290 appears in the host’s Key Management Service log for that client.

Questions people ask about this