Volume activation guide for Windows Embedded 8 and Windows Embedded 8.1

9/16/2013

Microsoft

September 2013

Summary

Describes the volume activation options available for Windows Embedded 8 and Windows Embedded 8.1 devices including:

• Active Directory-Based Activation
• Key Management Services (KMS) Activation
• Multiple Activation Key (MAK) Activation

Applies To

• Windows Embedded 8 Standard (Standard 8)
• Windows Embedded 8 Pro
• Windows Embedded 8 Industry Professional (Industry 8 Professional)
• Windows Embedded 8 Industry Enterprise (Industry 8 Enterprise)
• Windows Embedded 8.1 Industry Pro
• Windows Embedded 8.1 Industry Enterprise

Introduction

Microsoft Volume Licensing solutions provide the most flexible and cost-effective way to give your organization access to the latest Microsoft technologies. Whether you want to upgrade your device to the latest embedded operating system, gain access to exclusive offerings—such as Windows Embedded 8 Industry Enterprise (Industry 8 Enterprise) edition with enterprise features like AppLocker and DirectAccess—or use a specific Windows Embedded 8 edition with greater flexibility, there is a Volume Licensing option that is right for your organization.

Volume Activation Services enables you to automate and simplify the issuance and management of Microsoft software volume licenses across the enterprise. Windows Embedded 8 extends the benefits of Windows 8 to industry devices through a set of capabilities specifically designed for embedded systems.

Product activation is required for all editions of Windows 8. The purpose of this guide is to provide an overview of volume activation options for Standard 8 products. The guide describes the differences between volume activation in Windows 8 Client and Standard 8 products. Standard 8 is the product family name that applies to the current Standard 8 wave of products, which are:

• Windows Embedded 8 Standard (Standard 8)
• Windows Embedded 8 Pro
• Windows Embedded 8 Industry Professional (Industry 8 Professional)
• Windows Embedded 8 Industry Enterprise (Industry 8 Enterprise)
• Windows Embedded 8.1 Industry Pro
• Windows Embedded 8.1 Industry Enterprise

System Requirements for Volume Activation Services

Validating the licenses and activating tens, hundreds, or thousands of devices in multiple locations is an important network administration task. By doing so, you verify that operating systems and applications are genuine, have not been compromised, and will be supported. See Managing Activation Using the Volume Activation Management Tool (VAMT) for more information on how to accomplish these tasks.

Volume activation services can be installed and used on any device running, Windows 7, Windows 8, Windows Server 2012 or Windows Server 2008 R2.

Overview on Volume Licensing and Activation

Before you configure and use volume activation technologies, it may be helpful to understand how volume activation works.

Volume activation is the authentication process that ensures your software copy is genuine. Activation is part of deployment and a core piece of the planning stage for Windows client and server operating systems and applications.

Activation is designed to be relatively transparent to users. However, Windows Embedded 8 devices must be activated immediately upon installation. Failure to activate the operating systems will prevent users from completing customization and a visible watermark will be displayed on the device’s screen.

Where Licenses Are Obtained

• Retail: Microsoft software products that are acquired through a retail store are individually licensed and come with one unique product key (printed on the product packaging), which the user enters during product installation. The device uses this product key to complete activation after the software installation is complete. This final activation step can be accomplished online or by telephone.
• Original Equipment Manufacturer (OEM): Most OEMs sell systems that include a standard build of Widows and other software. OEM activation is performed one of several methods, depending on the OEM and their agreement with Microsoft. This process occurs before the device is sent to the customer so that the software is already activated and no additional actions are required by the user. OEM activation remains valid as long as the customer uses the OEM-provided image on the device. If the customer wants to create customized images, they can used the image provided by the OEM as the basis for creating custom images.
• Volume Licensing: A volume license is a product key that allows an organization to activate a specific number of clients to use a particular piece of software. Microsoft Volume Licensing offers customized programs that are tailored to the size and purchasing preference of a variety of organizations. To become a volume license customer, the organization must enter into a volume license agreement with Microsoft.

Activation Options

There are three volume activation scenarios to active systems.

Active Directory-Based Activation

Active Directory-Based Activation simplifies the process of activating clients that are running Windows Embedded 8, Windows Embedded 8.1 or Windows Server 2012. Active Directory-Based Activation can be run on any device that is joined to the domain and can be configured on any domain controller that runs Windows Server 2012.

During Active Directory-Based Activation, any Windows Embedded 8, Windows Embedded 8.1 or Windows Server 2012 computers connected to the domain will activate automatically and transparently during computer setup. These clients stay activated as long as they remain members of the domain and maintain periodic contact with a domain controller.

This is the preferred method of activation for Windows Embedded 8, Windows Embedded 8.1 devices connected to the network because it provides better uptime due to Active Directory redundancy. Essentially, the Active Directory infrastructure is now the Key Management Services host, so you get all the benefits of Active Directory replication and redundancy.

Key Management Service (KMS)

KMS enables organizations to activate systems within their network, eliminating the need for individual devices to connect to Microsoft for product activation.

If you have a network where multiple versions of Windows client and server operating systems are deployed, you will probably want to use KMS to activate them. KMS can be installed by using the Server Manager on any device running Windows Server 2012. It can also be installed from the command line and used on devices running earlier versions of Windows Server. See Server Manager for more information.

This is the preferred method of activation for Windows Embedded 8, Windows Embedded 8.1 devices if the device is connected on a regular basis to the network where KMS is hosted.

Multiple Activation Key (MAK)

Not all of an organization's devices are conveniently located on the organization's network. Devices may be laptops that are in the possession of employees who travel frequently, they may be located in branch offices that do not have good connectivity to the host network, or they may be part of extremely secure networks that are disconnected from the main network. You can use a MAK to activate these clients.

This is the preferred method of activation for Windows Embedded 8, Windows Embedded 8.1 devices that are on an isolated network or never connected to the KMS-hosted network. This means you now have to manage activation counts.

KMS allows organizations to activate computers within customer environments through an internally hosted service. MAK activates computers on a one-time basis by using the hosted activation services provided by Microsoft. Customers can use either or both key types to activate devices in their environments.

How Volume Activation Works

Before configuring and using volume activation technologies, it may be helpful to understand how volume activation works.

Active Directory-Based Activation

Active Directory-Based Activation can be installed from any device that is joined to the domain, and can be configured on any domain controller that runs Windows Server 2012. In addition, it requires the Windows Server 2012 Active Directory Domain Services (AD DS) schema extension. See Active Directory Domain Services (AD DS) Overview for more information.

Activation objects themselves are not editable. However, an administrator with proper permissions can use advanced AD DS tools to view each activation object and to configure security Access Control Lists (ACLs) for the activation objects to restrict access as needed. Administrators can delete activation objects, if necessary. On a local client, a user can use the command line to perform these functions if they have Write access to the activation object.

In an environment that is using Active Directory-Based Activation, the volume activation process is as follows:

1. A user with Enterprise Administrator permissions installs the Active Directory-Based Activation role service on a domain controller, including the KMS host key, and then activates the KMS host key with the activation services that are hosted by Microsoft

   Note

   This installation can be completed from any device where the Volume Activation Tools Console is installed. See Managing Activation Using the Volume Activation Management Tool (VAMT) for more information.

2. When a domain-joined device running Windows Server 2012, Windows 8 or Windows 8.1 with a Generic Volume License Key (GVLK) starts, the licensing service on the client automatically queries the domain controller for licensing information.

3. If a valid activation object is found, activation proceeds silently without user intervention. The same renewal guidelines apply to Active Directory-Based Activation as to KMS activation.

Key Management Service (KMS) Activation

KMS enables organizations to activate systems within their network, eliminating the need for individual devices to connect to Microsoft for product activation.

In an environment that is using a KMS host, the volume activation process is as follows:

1. KMS is installed on a server.
2. The KMS host key is installed on the KMS host and then activated by contacting the hosted activation services at Microsoft.
3. After the KMS is enabled, it registers an SRV record in Domain Name System (DNS) each time KMS is stated or once per day.
4. A KMS client device discovers the KMS host from a configured registry entry or through the KMS SRV record in DNS. See Understanding KMS for more information on KMS.
5. The client sends a Remote Procedure Call (RPC) request to the KMS host on 1688/TCP (the default setting). This request includes an encrypted client device ID. If the device has never been activated and there is no response from the KMS host, the client sends a new request after two hours. If the device has been activated, the client sends a new reactivation request after seven days.
6. The KMS host adds the client device ID to a table and returns the activation count to the client.
7. The client evaluates the activation count against the license policy and activates if the activation threshold is met.

Multiple Activation Key (MAK) Activation

A MAK is a volume license key that is used for one-time activation with activation services that are hosted by Microsoft. MAK is most often used when devices are located off site or are a part of a secure network that is not connected to the main network. There are two ways to use MAK to activate devices:

1. MAK independent activation – Each device must independently connect and be activated by Microsoft over the internet or by telephone.
2. MAK proxy activation – A device that is acting as a MAK proxy gathers activation information from multiple devices on the network and then sends a centralized activation request to Microsoft on their behalf. MAK proxy activation is configured by using the Volume Activation Management Tool (VAMT). See Managing Activation Using the Volume Activation Management Tool (VAMT) for more information.

Volume Activation Options Available for Windows Embedded 8 Products

The internal activation mechanism of both the Windows Embedded 8 and Windows Embedded 8.1 products is the same as those in Windows 8 Client. Existing documentation should be used as guidance when working with both the Windows Embedded 8 and Windows Embedded 8.1 products for planning and deploying a volume activation infrastructure. See the end of this document for links to those documents.

The following table shows the activation options available for each of the Windows Embedded 8 and Windows Embedded 8.1 products.

Windows 2012 Technologies

A number of technologies are available in Windows Server 2012 to simplify the task of configuring the distribution and management of an organization's volume software licenses. These technologies include:

• Volume Activation Services Server Role – Volume Activation Services is a server role in Windows Server 2012 that enables you to automate and simplify the issuance and management of Microsoft software volume licenses for a variety of scenarios and environments. With Volume Activation Services, you can install and configure KMS and enable Active Directory-Based Activation.
• Volume Activation Tools Console – The Volume Activation Tools snap-in is installed with KMS and Active Directory-Based Activation. You can use the Volume Activation Tools console to install, activate and manage one or more volume activation license keys in AD DS or on a KMS host.
• Volume Activation Management Tool (VAMT) – VAMT is a free, downloadable Microsoft Management Console (MMC) snap-in that is included in the Windows Assessment and Deployment Kit (ADK) that enables network administrators and other IT professionals to automate and centrally manage the Windows and Microsoft Office volume and retail activation process. VAMT can manage volume activation by using MAKs or the KMS.
  VAMT 3.0 includes all the major functionality of the previously released versions of VAMT and it also includes an improved interface, data storage in a Microsoft SQL Server database for greater scalability and speed, new reporting options, the ability to use Windows PowerShell cmdlets and new context-sensitive Help. In addition, VAMT 3.0 supports Active Directory-Based Activation in addition to KMS and MAK activation.

Differences Between Volume Activation on Windows Embedded 8 and Windows Embedded 8.1 Products and Windows 8 and Windows 8.1 Client Products

Windows Embedded 8 and Windows Embedded 8.1 products use the same volume activation mechanisms as Windows 8 and Windows 8.1 Client-based products. The volume activation differences between Windows Embedded 8 and Windows Embedded 8.1 products and Windows 8 and Windows 8.1 Client products are:

• Not all volume activation options are available on every Windows Embedded product.
  Windows Embedded 8 Standard (Standard 8) and Windows Embedded 8 Pro only support a subset of the volume activation mechanisms.
• Windows Embedded 8 Standard (Standard 8) has dormant enterprise features.
  Unlike the Windows 8 Client, which provides different sets of media—one for Pro and one for Enterprise—the media for Standard 8 includes the enterprise bits in a dormant state along with the Pro features. The result is that, in order to enable the enterprise features in Standard 8, the user must enter a MAK add-on key on top of the operating system key that the embedded OEM entered while manufacturing the device. In other words, enabling enterprise features on Standard 8 is a two-key process rather than a one-key process as compared to Windows 8 Client Enterprise.
• Standard 8 Sideloading features are not enabled when the device is domain joined.
  Unlike Windows 8 Client, which allows sideloading when a device is joined to a domain, Standard 8 requires a MAK add-on key to be entered so that sideloading features are enabled on the device. The same MAK add-on key also enables Enterprise features on the device.
• Windows Embedded 8 Industry Enterprise (Industry 8 Enterprise) already has the GVLK key preinstalled for KMS and Active Directory-Based Activation
  Out-of-the-box is_isentext has the GVLK key installed in the image. No additional installation of a key is required to enable the device to activate using an existing KMS or Active Directory-Based Activation infrastructure.
  Windows Embedded 8 Industry Professional (Industry 8 Professional) does not have a key preinstalled. As a result, a Industry 8 Professional device requires the administrator to enter a valid GVLK key for KMS or Active Directory-Based Activation.

Sideloading Features

Enabling Enterprise and Sideloading Features on Windows Embedded 8 Standard Devices

Enterprise and sideloading features are enabled by entering a MAK add-on key on the Standard 8 device. Refer to the Embedded Sideloading Guide for additional details. You can also see Add and Remove Apps for more information.

To activate a sideloading product key

1. Open a command prompt with administrator privileges and type the following to add the sideloading product key, replacing <sideloading product key> with your sideloading key.

   Slmgr /ipk <sideloading product key>
   

2. Activate the sideloading product key by typing the following at the command prompt. Note that the activation GUID entered in this step is not the same as the sideloading product key and must be entered exactly as shown here. All Standard 8 devices use the same activation GUID.

   Slmgr /ato 4B01CD02-8A33-4887-9F32-F3146AD7FE45
   

Enabling sideloading on Windows Embedded 8 Industry Devices

Refer to the Embedded Sideloading Guide for additional details. You can also see Planning to Deploy Windows 8 Apps in Configuration Manager for more information.

Conclusion

Microsoft Volume Licensing solutions and Windows Embedded 8 and Windows Embedded 8.1 provide the most flexible and cost-effective way to give your organization access to the latest Microsoft technologies. Volume Activation Services enables you to automate and simplify the issuance and management of Microsoft software volume licenses across the enterprise.

Windows Embedded 8 and Windows Embedded 8.1 extend the benefits of Windows 8 and Windows 8.1 to industry devices through a set of capabilities specifically designed for embedded systems. Enterprises can gain lasting competitive advantage with intuitive Windows 8-style apps, powerful connectivity and enhanced management and security capabilities, all with seamless Microsoft enterprise management tools integration.

Additional Information

References and Resources

Except for the differences called out in this guide, the existing online Volume Activation documentation applies to the Windows Embedded 8 and Windows Embedded 8.1 products. The internal activation mechanisms of these products are the same as those in Windows 8 and Windows 8.1 Client. The existing documentation can and should be used as guidance when working with Windows Embedded 8 and Windows Embedded 8.1 products for planning and deploying a volume activation infrastructure.

If you have an existing Windows Server 2008 R2 infrastructure, the Volume Activation Planning Guide and the Volume Activation Deployment Guide are good sources of information to add volume activation to your infrastructure.

If you want to utilize the new volume activation methods such as Active Directory-Based Activation, which are available with Windows Server 2012, the Plan for Volume Activation is a good resource.

General Product Activation and Key Information is available online an provides information on how to get keys.

The Volume Licensing site is also a good resource for general information.

Active Directory Domain Services (AD DS) Overview