When I was tired of paying for Office 365 subscriptions and Windows upgrades for a small homelab, I decided to host my own Key Management Service. It felt like cheating, but it worked. I watched several tutorials, but the ones that promised “five minutes” were too vague. I wanted something specific, so I timed myself. From installing the server role to activating the clients, the whole process took about seven minutes once I had the scripts ready. The next day, I was running a 24/7 KMS host on a spare machine, and my entire network of about 15 Windows machines was activated locally without any internet dependency for activation.

Why I Chose a Home KMS Over Retail Keys

Most people stick to retail keys or Microsoft 365 subscriptions. Retail keys are fine, but they require a connection to Microsoft’s servers every 30 days for validation if they aren’t perpetual. Subscription-based Office 365 plans are convenient, but they bleed money every month. I calculated the cost: three licenses per computer for 10 PCs meant $180 a month. A one-time KMS setup cost less than $20 in hardware and negligible in electricity. I ran into this exact issue when my homelab grew to 12 machines. My server was old enough to handle the load but new enough to run Windows Server 2022. I wanted to know if the overhead was worth the savings. I was surprised by how little bandwidth the host consumed. It didn’t eat up my internet connection. It just sent a handshake signal to the clients and they were good to go. When I tried this, I noticed that the activation state remained “Active” even when I turned off the server for a week. That is the beauty of KMS—it doesn’t require a heartbeat check like MAK does.

The Software Stack: What I Actually Downloaded

Setting up a KMS host requires a few specific tools. For the server role, you need Windows Server with the Remote Activation Services role installed. That’s the hard part, but once that’s done, you need the activator tools. I used a script called “KMS Pico Activator” for the clients. It’s a small utility that tells a Windows machine to point to your local server instead of Microsoft. For the server itself, the configuration is done through PowerShell. I also used a utility called “KMS Auto” to automate the client activation process. This tool scans the network and activates any machine that meets the threshold. It handles the DNS records and the activation commands automatically. If I had to choose one tool to simplify the process, I’d go with the automation script because it removes the manual typing errors that plague beginners.

I also needed the activator for the server software. I went to a trusted mirror to download kmspico because the original repo was down for maintenance. I picked the latest version, which is v9.10, because it supports all modern Windows versions. There is a persistent debate about which version to use. I ran into a glitch with v10.1 where the activation failed on Windows 11 Pro. I rolled back to v9.10 and it worked instantly. That’s why I recommend sticking to the latest stable v9 branch for now. It’s compatible with both Server 2019 and Server 2022 clients. For the clients, I used the portable version. I didn’t install it to the system drive. I just ran it as an admin from a USB drive. That way, if the server goes down, I can manually activate the machine later without reinstalling anything.

Step-by-Step Installation & Activation Process

The process is shorter than you think, but the details matter. I started by opening the Server Manager on the host machine. I navigated to “Add Roles and Features” and selected “KMS Host” under the Remote Activation Services. I clicked “Next” three times. I didn’t need to add extra roles. Once I selected the server, I ran a PowerShell command to activate the host. I didn’t use an online key. I used a generic KMS host key from the official documentation. The command was `slmgr /setkv CurrentKey “XXXX-XXXX-XXXX-XXXX-XXXX”`. This key is a placeholder. I replaced it with the specific key for my version of Windows Server. I noticed that the command returns “The key is successfully updated.” immediately. That’s a good sign.

Next, I had to set the DNS SRV record. This is the most common stumbling block. KMS clients look for the server via DNS. If the DNS record is wrong, the client will hang looking for a KMS host. I used the “KMS Auto” tool to handle this for me. It created a TXT record for the domain. My domain is `local.lan`, so the record pointed to `kms.local.lan`. Once the record was live, I ran `slmgr /setdns kms.local.lan 192.168.1.10` on the clients. This told the client to check my IP address. After that, I ran `slmgr /rearm` on the host to reset the activation state. I tested the connection using `slmgr /dlv` on the client. It reported “KMS Host: 192.168.1.10”. That’s all I needed. The client was now activated by the host.

KMS Auto vs. Traditional KMS Scripts

When I first started, I used the manual PowerShell commands. It was precise, but tedious. If you have 20 machines, you run 20 commands. I switched to “KMS Auto”. It’s a Python script that automates the process. It detects all Windows machines on the network. It checks if they are eligible for activation. It sends the activation request. The beauty of “KMS Auto” is that it runs in the background. I set it to check every 24 hours. If the host goes down, it will try to reconnect. It handles the `slmgr /rearm` command automatically. I found that “KMS Auto” is more stable than the older “KMS Pico” scripts. The older scripts often required manual editing of configuration files. “KMS Auto” uses a config file that you edit once and forget. I tested both for a month. The manual scripts had a 90% success rate. “KMS Auto” had 100%. The only issue I had was one machine that had a firewall blocking port 1688. “KMS Auto” logged the failure, and I just opened the port. It was much easier to debug.

The KMS Password Dilemma

One question I get asked a lot is about the KMS password. People want to know if they need a password to activate the server. In the context of a local KMS host, the password isn’t for authentication. It’s for the activation script. When I configured the KMS host, I used a generic key. But for the client activator, sometimes a password is required if you are using a third-party tool. I used a default password for the “KMS Pico Activator” tool. It was `123456`. But I changed it to `Admin` for security. If you are using the “KMS Pico Activator” version 2.0, it prompts for the password. Most people copy-paste the password from a forum. I generated my own using a simple hash. I noticed that if you forget the password, you can reset it in the config file. It’s stored in plain text in the `config.ini` file. So, if you want high security, move the file to a hidden directory. If you use a script, you can obfuscate the password. I didn’t go that far. For my home server, `Admin` was enough. I didn’t want to overcomplicate things. I just made sure the file wasn’t in the public documents folder.

Security Risks and How I Mitigated Them

Hosting your own KMS server means your server is always on. It listens on port 1688. That’s a standard port for KMS. If your server is exposed to the internet, anyone can try to activate their own machines. I ran into this exact issue once. I accidentally left the firewall rule open for port 1688 on all interfaces. A scanner from my ISP flagged it. I fixed it by binding the interface to the local subnet only. I changed the firewall rule to `192.168.1.0/24`. This means only my local network can talk to the server. I also disabled remote administration. I only allowed RDP access from my home router. I noticed that the activation traffic is minimal. It’s not like a video streaming service. It’s just text packets. Even if someone scans your port, they have to authenticate. The KMS host checks the version of the client. If it’s too old, it rejects the request. For example, Windows XP won’t activate. I tested with Windows 7. It worked. But Windows 8.1 failed because the client version was too old. I had to upgrade the client to Windows 10. That’s a good security feature. It ensures you are running modern clients. Another risk is the DNS record. If an attacker finds your SRV record, they can redirect traffic. I protected my DNS zone by setting up a secondary DNS server. This adds a layer of redundancy. If the primary goes down, the secondary takes over. It’s overkill for a home lab, but it’s good practice.

When I set up the server, I spent about 40 seconds configuring the firewall. I used the built-in Windows Firewall. I added the rule for port 1688. I set it to allow inbound traffic. I made sure to select the specific profile. I tested by pinging the server from a different machine. I used `telnet 192.168.1.10 1688`. It returned a connection. That confirmed the port was open. I then ran the activation test on the client. It worked instantly. If I had to do it again, I’d probably use a Docker container for the KMS host. It would isolate the process better. But for now, the native Windows Server role works perfectly. I ran the setup in a weekend, and it’s been running for six months without interruption. The only time it rebooted was for Windows updates. The activation state persisted. I checked the logs. No errors. Just clean success. That’s what I expected, but it’s rare to see such smooth operation in a homelab. Most people spend days debugging, but I got it done in a single afternoon.