Volume license key

In software licensing, a volume license key (VLK) denotes the product key used when installing software licensed in bulk, which allows a single product key to be used for multiple installations.

This form of licensing typically applies for business, government and educational institutions, with prices for volume licensing varying depending on the type, quantity and applicable subscription-term. For example, Microsoft software available through volume-licensing programs includes Windows Vista, Windows 7 Enterprise, Windows 8 Enterprise, Windows Server 2008, Microsoft Office 2007 and many others.^[1]

Use of volume license keys

Volume licenses are not always transferable; however, some types of Microsoft volume-license can be transferred provided a formal transfer-process is completed which enables Microsoft to register the new owner. A very small number of software vendors specialize in brokering such transfers in order to allow the selling of volume licenses and keys. The most notable of these, Discount-Licensing, pioneered the sale of Microsoft volume licenses in this way.^[2]

MAK & KMS

Starting with Windows Vista, Microsoft replaced VLKs with Multiple Activation Keys (MAK) or with Key Management Server (KMS) keys. Hosts activated via a KMS have to report back to that key server once every 180 days.^[3][4]

KMS and ACPI_SLIC requirements

Microsoft's licensing for volume license products requires that volume licensing be an additional cost or license, applied over the top of an existing qualifying Microsoft product license. Windows license data is stored in the computer's BIOS in an area referred to as the "ACPI_SLIC", so that KMS can detect the use of previous Microsoft products even with the storage device removed or erased.^[5]

KMS licensing of a client device will be refused if licensing entries for a prior qualifying Windows license either do not exist or are corrupted in the ACPI_SLIC table. KMS client refusal can also occur if a properly qualifying Windows license was previously installed but the motherboard manufacturer did not correctly enable ACPI_SLIC in the BIOS.

In the event that the KMS server rejects the client device due to problems with the ACPI_SLIC data, the only way available to apply a volume license key is with the MAK product key.^[6] Problems with ACPI_SLIC can be diagnosed with the Microsoft MGADiag tool.

Unauthorized use

Microsoft has blocked several volume license keys that have been abused in service packs, starting with Windows XP Service Pack 1. Microsoft even developed a new key verification engine for Windows XP Service Pack 2 that could detect illicit keys, even those that had never been used before. Several security consultants have condemned the move by Microsoft, saying that leaving a large install base unpatched from various security holes is irresponsible because this unpatched install base can be leveraged in large scale Internet attacks, such as Trojan horses used to send spam e-mail. Others have come to Microsoft's defense, arguing that Microsoft should not have to provide support for illegal users. After much public outcry, Microsoft elected to disable the new key verification engine. Service Pack 2 only checks for the same small list of commonly used keys as Service Pack 1. Users of existing installations of Windows XP can also change their product key by following instructions from Microsoft.^[7]

Notable keys

A volume license key that was commonly used to bypass product activation in early versions of Microsoft's Windows XP operating system was FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8.^[8] This key was part of the first warez release of the final version of Windows XP by a group called devils0wn, 35 days before the official retail release on 28 August 2001.^[9] The key is now obsolete, as it has been blacklisted by Microsoft since August 2004, and affected computers will display a WGA notification.^[10] It was made famous partly because it featured in a popular image circulated on the Internet before the retail launch of Windows XP. In the image, the key is written on a CD-R containing the leaked operating system and held in front of a digital Microsoft sign counting down the days until the release of Windows XP.^[11]

Users using these keys will receive an error message when they install the latest service pack, and such users are told to obtain a legitimate license and change their product key.^[12]

Unauthorized KMS licensing

Any client machine with the correct KMS client setup keys can authenticate against any KMS server. KMS client keys are well known and documented publicly by Microsoft.^[13] KMS servers require a minimum of 25 clients to properly activate, but also stop counting additional licenses beyond 50, and automatically accept any client key once reaching the 25 client threshold.

Businesses operating KMS servers are required to properly shield the KMS server behind firewalls so that it cannot be reached from the Internet, and be used to authorize illegal use of KMS client keys by the general public. Public exposure of a KMS server can result in Microsoft revoking the server key, thereby disabling all attaching clients.

External KMS server access is desirable for devices on long-term leave away from the corporate network, as KMS client activation will expire after six months of not being able to contact a KMS server. For this situation, a business can make it accessible through an encrypted VPN tunnel known only to the devices outside the corporate network.

Additionally, there is an unofficial KMS server emulator that will activate Windows or Office even if the software was not licensed or paid for, regardless of whether or not there are 25 or more computers on the network, and regardless of whether or not a previous version of Windows was installed. There is also a program that will send KMS requests to a legitimate KMS server, in order to fool the server into thinking that there are 25 or more computers on the network. Microsoft considers both of these exploits to be a violation of the Terms and Conditions.

References

External links

• Microsoft's website on VLK