Windows Server Licensing & CALs — Core Packs, KMS/MAK Activation, Compliance
Windows Server 2016+ uses core-based server licensing (minimum 16 cores per server, sold in 2-packs). Client Access Licences (Device or User CALs) are required for every user or device accessing the server. Miscounts, KMS failures, or edition confusion generate compliance risk and activation errors.
Indicators
- slmgr /dli reports 'Notification' or 'Out-of-tolerance' state
- KMS activation error 0xC004F074 — Key Management Service could not be contacted
- Windows Server activation nag watermark on desktop
- Audit finding: insufficient CALs for current user/device count
- Essentials server accessed by more than 25 users or joined to a foreign domain
Likely causes
- KMS host not configured or SRV record _vlmcs._tcp missing in DNS
- KMS client count below 5-server minimum threshold for server activation
- MAK key activation limit reached — key used on too many installs
- Device CAL vs User CAL mismatch — wrong type purchased for access pattern
- Core pack count insufficient — server has more than 16 physical cores and not enough packs licensed
- Windows Server Essentials installed where Standard or Datacenter is required
Diagnostic steps
-
Check activation status: slmgr /dli (summary) or slmgr /dlv (verbose — shows licence type, remaining grace, partial product key)
-
Test KMS connectivity: nslookup _vlmcs._tcp.<yourdomain> to verify SRV record exists; then Test-NetConnection <KMS-host> -Port 1688
-
On the KMS host: slmgr /dlv — check 'Current count' (must be ≥5 for server, ≥25 for Windows client) and 'Cumulative requests received'
-
For MAK: slmgr /ato forces online activation; if limit reached, call Microsoft Volume Licensing support to reset key via telephone activation
-
Count cores: Get-WmiObject Win32_Processor | Measure-Object NumberOfCores -Sum — multiply by socket count; minimum licensed = 16 cores per server
-
Audit CAL compliance with VAMT (Volume Activation Management Tool): import VAMT database, run product key discovery, cross-reference against purchased CAL count
Resolution path
- Confirm activation state and error code with slmgr /dlv
- Fix KMS DNS SRV record or point client to correct KMS host: slmgr /skms <host>:1688
- Reactivate with slmgr /ato after resolving KMS connectivity
- For MAK over-activation: telephone activation with Microsoft
- Purchase additional core packs or CALs if compliance gap identified
Prevention
- Document core count and CAL count at every server purchase and user onboarding
- Set KMS host via GPO (Computer Config > Admin Templates > Windows Components > Windows Update > Specify intranet Microsoft update service location) for automatic discovery
- Review licence compliance annually against VLSC purchase records
- For Essentials: enforce the 25-user limit and single-server constraint at design time
Tools
- slmgr.vbs (slmgr /dli, /dlv, /ato, /rearm)
- VAMT — Volume Activation Management Tool
- nslookup / Test-NetConnection (KMS connectivity)
- Microsoft VLSC — Volume Licensing Service Centre
- Get-WmiObject Win32_Processor (core count)