Let’s learn how to install and activate VAMT (Volume Activation Management Tool). Also, understand how to automatically activate Windows 7 devices for extended security updates (ESU).
Microsoft announced the end of Windows 7 on January 14, 2020. It provided us the option to either migrate to Windows 10 or buy, purchase and install Extend Security Update(ESU) for Windows 7. Every environment has a different point and process of deploying and servicing Windows.
I know this blog is a bit late, but for many, it will be required to extend the support for the second year as all of us have not migrated to Windows 10, so I thought to post it.
Many organizations have already implemented it, but I see, there are not many posts on how to use Volume Activation Management Tool(VAMT) for activating it and issues which are faced.
Introduction – VAMT Activate Windows 7 ESU keys
There are two types of activation: one for the machines connected to the Internet, ‘Online Activation,’ and the other is ‘Proxy activation'(some environments have their devices behind a firewall and have no internet).
In this post, I assume that you already have the new key to install; we will cover the technical part of using VAMT to activate that new key. For more details on buying Extended Security Updates visit Microsoft Volume Licensing.
ESU Key activation Prerequisites – VAMT Activate Windows 7 ESU keys
- Install the SSU listed below (or a later SSU) and the ESU licensing preparation package: Windows 7 SP1 and Windows Server 2008 R2 SP1
- Windows Server 2008 SP2:
Note: Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine.
Introduction to VAMT and its Prerequisites
Introduction to VAMT
The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage Windows and Microsoft Office and select additional Microsoft product volume and retail-activation processes.
VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). The below diagram illustrates three common environments. For better understanding, check Introduction to VAMT.
Important: VAMT is designed to manage volume activation for Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 (or later), and Microsoft Office 2010 (or above). VAMT is only available in an EN-US (x86) package.
VAMT Requirements
Product Key Requirements
Product Key Types:
- Multiple Activation Key (MAK)
- Key Management Service (KMS) host key (CSVLK)
- KMS client setup keys (GVLK)
System Requirements
- 1 GHz x86 or x64 processor
- 1 GB RAM for x86 or 2 GB RAM for x64
- 16 GB available hard disk space for x86 or 20 GB for x64
- Display 1024×768 or higher resolution monitor
- Network Connectivity to remote computers via Windows Management Instrumentation (TCP/IP) and Microsoft Activation Web Service on the Internet via HTTPS
- Operating System – Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, or later. If installing on Windows Server 2008 R2, you must also install .NET Framework 3.5.
Installing and Configuring VAMT – VAMT Activate Windows 7 ESU keys
VAMT can be installed as a part of the Windows Assessment and Deployment Kit (ADK) for Windows 10. VAMT requires local administrator privileges on all managed computers to deposit confirmation IDs (CIDs), get the client products license status, and install product keys.
Installing VAMT
- Download ADK for windows 10 VAMT 3.1 which comes with windows automated deployment toolkit Windows 10 ADK Setup
- Run the ADK Setup
If required, run the .NET framework 4.5 installations.
Accept the agreement and Install
Select Volume activation management tool and SQL express, click on install and wait for a successful installation.
If you want, you can install SQL Server Express individually ex- for Windows 10 machines, you can install SQL express 2017, and for Windows 7 machines, you can install SQL express 2014.
Configuring VAMT for the first-time use
Once installed, open it, and it will prompt you to specify database details; click on create new Database and provide the name of the Database as VAMT. It will make the Database and connect to VAMT.
For Remote SQL servers, use the full FQDN like servername.domain.com. Once Launched, it will show as below
Adding and Activating Product Keys
Adding Product Key
Once VAMT is launched, right-click on the Product key and select add product key; a window will open. Enter your Product Key and click on ‘ADD KEY(S).’
You can now see your product key is added.
Activating Product Key
After adding the Product key, you need to discover the product, install the product key, and then activate it using VAMT.
Select your domain, enter your computer name and click on search.
This will discover the machine into VAMT.
Tip – If you want to discover more than one machine in VAMT, then use Machine1, Machine2, and Machine3…. And click on search.
Right-click on the machine and select Update License Status using current or alternate credentials.
This will collect the product information and give you the status, as in my case, I have already installed the MAK key, so it is showing as Licensed and Genuine.
In your case, the new key has not been installed, so you can right-click on the machine and select ‘Install Product Key’; this will give you options on how you want to install the product key. Since we have imported the MAK key, it will show the option below.
Once successfully installed, you will get the following prompt
Once the key is installed, you can close the windows, and it will show you below the screen, but the new key will be ‘Unlicensed’ (as in my case, it already indicates licensed).
Right-click on the machine row, which shows unlicensed, and click on ‘Activate.’
If machines are connected to the Internet, you can select ‘Online Activation .’ For devices not having an Internet connection, choose ‘Proxy activation.’
For Proxy activation machine on which VAMT is installed should be connected to the Internet.
Once you click on Activate, the below screen will appear, showing success.
If you select ‘Proxy Activation’ below window will appear, use ‘Acquire Confirmation ID, apply to selected machine(s) and activate,’ it will activate the product.
On how to install and configure the KMS key follow the article Install a KMS Client.
Firewall Configurations for machines behind the firewall
WMI firewall ports need to use VAMT activation on those machines if machines are behind the firewall.
For machines on an Isolated network, VAMT needs to be installed on a local device in the same network for activation to work.
You can follow the article to know the firewall Requirements Configure Windows Firewall to allow VAMT.
Only a limited set of TCP/IP ports is allowed through a hardware firewall in certain scenarios. Administrators must ensure that WMI (which relies on RPC over TCP/IP) is permitted through these types of firewalls. By default, the WMI port is a dynamically allocated random port above 1024. The following Microsoft knowledge article discusses how administrators can limit the range of dynamically allocated ports.
Ports Requirement: VAMT Activate Windows 7 ESU keys
- TCP Ports 135 and 445 Inbound – This is needed for Windows Management Instrumentation (WMI)
- TCP 1024 – 2000 Inbound – Dynamic Ports for Windows Management Instrumentation (WMI).
- TCP 49152 – TCP 65535 – Dynamic Range RPC.
Known Issues VAMT Activate Windows 7 ESU keys
One of the most common issues which you will face while adding the product key is ‘the product key is Invalid’
To fix this, you need to
- Download the VAMT Files. The download includes the following files:
- pkconfig_win7.xrm-ms
- pkconfig_vista.xrm-ms
- Copy the two downloaded files to C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\VAMT3\pkconfig, replacing the older versions of the files.
- Close VAMT, and then restart it.
For other known issues, follow the Known article Issues.
References
- https://techcommunity.microsoft.com/t5/windows-it-pro-blog/obtaining-extended-security-updates-for-eligible-windows-devices/ba-p/1167091
- https://www.microsoft.com/en-us/download/details.aspx?id=100304
- https://docs.microsoft.com/en-us/windows/deployment/volume-activation/volume-activation-management-tool
- https://www.anoopcnair.com/windows-7-extended-security-update-step-by-step/
Wrong RPC portspann should be 49152-65535, not 41952. You have a typo there.
Thank you for the note. We will fix this.
How can I make a group of devices in vamt?
Can you use the Proxy activation with a KMS server in a different domain provided firewall ports are open? We have 2 domains, with a DMZ in the middle, I want to install VAMT on the DMZ server [ports will be opened between it and the 2 domains] and use activate the KMS Client keys from Domain 2, against the KMS Server in Domain 1.