Troubleshooting Windows Activation on a Portal-Deployed Server

This article helps you confirm why a Windows Server that you deployed from the portal template is not showing as activated, and how to fix it. Windows servers deployed from a portal template are preconfigured to activate against the DataBank activation server. When activation fails, the cause is almost always that the server cannot reach that activation server over the network.

Before you begin If you are not using a DataBank-managed IP space, you need to provide your public IP addresses for your Windows server so we can whitelist them on our KMS server. Open a support ticket with those addresses. Activation will not succeed until they are added.

Activation server reference Host: kms.platformdb.services Port: 21688 (this is not the Microsoft default of 1688, and it is the most common setting to get wrong)

All commands below are run in PowerShell as Administrator on the Windows server.

---

Step 1: Test the network connection to the activation server

Start here. If the network path is blocked, nothing else will fix activation.

Test-NetConnection -ComputerName kms.platformdb.services -Port 21688 -InformationLevel Detailed

Read the result as follows.

If TcpTestSucceeded is True, the path is open. Continue to Step 2.

If TcpTestSucceeded is False and the name resolves to an address, something is blocking outbound TCP port 21688. Check the Windows firewall on the server and any firewall or security group rules on your network, and allow outbound TCP 21688 to kms.platformdb.services. If you are not using a DataBank-managed IP space, also confirm that you have sent us your public IP addresses as described above.

If TcpTestSucceeded is False and the name does not resolve, the server cannot reach a working DNS server. Check the DNS settings on the server and test with Resolve-DnsName kms.platformdb.services.

Step 2: Check the current license status

Get-CimInstance SoftwareLicensingProduct `
    -Filter "Name LIKE 'Windows%' AND PartialProductKey IS NOT NULL" |
    Select-Object Name, Description, LicenseStatus, LicenseStatusReason,
                  KeyManagementServiceMachine, KeyManagementServicePort

Example of a server that has not activated:

Name                       : Windows Server 2022 Datacenter
Description                : Windows(R) Operating System, VOLUME_KMSCLIENT channel
LicenseStatus              : 5
LicenseStatusReason        : -1073418396
KeyManagementServiceMachine: kms.platformdb.services
KeyManagementServicePort   : 21688

The LicenseStatus value tells you where the server stands.

LicenseStatus	Meaning
1	Licensed. Activation is valid and no action is needed.
5	Not activated or in a grace period. Continue below.
6	Extended grace period. Continue below.

If LicenseStatus is already 1, the server has activated and you are done.

Step 3: Get the specific failure code

Get-CimInstance SoftwareLicensingProduct `
    -Filter "Name LIKE 'Windows%' AND PartialProductKey IS NOT NULL" |
    ForEach-Object { '0x{0:X8}' -f $_.LicenseStatusReason }

Code	Meaning
0xC004F056	Cannot contact the activation server. This is a connectivity issue.
0xC004F074	Activation server unavailable. Same root cause as above.
0x00000000	No error. Activation succeeded or has not been attempted yet.

Step 4: Confirm the activation server settings are intact

A sysprep, a Group Policy, or a manual change can overwrite the preconfigured settings.

Get-CimInstance SoftwareLicensingProduct `
    -Filter "PartialProductKey IS NOT NULL" |
    Select-Object KeyManagementServiceMachine, KeyManagementServicePort

The expected result is kms.platformdb.services with port 21688. If the port shows 0 or 1688, or the host is blank or different, reset it.

cscript //nologo C:\Windows\System32\slmgr.vbs /skms kms.platformdb.services:21688

Step 5: Force an activation attempt

Once Step 1 shows the connection is open, run:

cscript //nologo C:\Windows\System32\slmgr.vbs /ato

A successful run ends with Product activated successfully.

A failed run looks like this:

Error: 0xC004F074 The Software Licensing Service reported that the computer could not be activated. No Key Management Service (KMS) could be contacted.

Step 6: Verify

Get-CimInstance SoftwareLicensingProduct `
    -Filter "Name LIKE 'Windows%' AND PartialProductKey IS NOT NULL" |
    Select-Object LicenseStatus, LicenseStatusReason

You should see LicenseStatus of 1 and LicenseStatusReason of 0.

---

Common problems

Symptom	Likely cause	Fix
TcpTestSucceeded : False, name resolves	Port 21688 is blocked, or your public IP is not whitelisted	Allow outbound TCP 21688. Send us your public IP addresses if not on DataBank-managed IP space.
TcpTestSucceeded : False, name does not resolve	The server cannot reach a DNS server	Check DNS settings and run Resolve-DnsName kms.platformdb.services.
KeyManagementServicePort is 0 or 1688	Port was never set or was reset	Run the /skms command in Step 4.
/ato returns 0xC004F074 even though the TCP test passes	Your public IP is not yet whitelisted, or the activation server needs a support-side adjustment	Open a support ticket.
Previously activated, now LicenseStatus 5	The server was offline or could not reach the activation server for more than 180 days	Run /ato again and check connectivity if it fails.

Still not activated

If the connection test passes, the settings are correct, and /ato still fails, open a support ticket and include the following.

First, the server name and the public IP address it uses to reach the internet. Second, the output of this command:

Get-CimInstance SoftwareLicensingProduct `
    -Filter "Name LIKE 'Windows%' AND PartialProductKey IS NOT NULL" |
    Select-Object Name, Description, LicenseStatus, LicenseStatusReason,
                  KeyManagementServiceMachine, KeyManagementServicePort |
    Format-List

Third, the full output of cscript //nologo C:\Windows\System32\slmgr.vbs /ato.

Good to know

An unactivated server retries automatically about every 120 minutes, so you do not need to keep running /ato by hand. Once activated, the server renews about every 7 days, and activation stays valid for 180 days as long as the server can reach the activation server within that window.