mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-16 10:53:43 +00:00
Merge branch 'master' into patch-4
This commit is contained in:
Doug Eby
GitHub
@ -167,6 +167,8 @@
|
||||
href: update/waas-manage-updates-wufb.md
|
||||
- name: Configure Windows Update for Business
|
||||
href: update/waas-configure-wufb.md
|
||||
- name: Use Windows Update for Business and WSUS
|
||||
href: update/wufb-wsus.md
|
||||
- name: Windows Update for Business deployment service
|
||||
href: update/deployment-service-overview.md
|
||||
items:
|
||||
|
||||
@ -257,6 +257,5 @@ When you have completed all the steps in this section to prepare for deployment,
|
||||
**Sample files**
|
||||
|
||||
The following sample files are also available to help automate some MDT deployment tasks. This guide does not use these files, but they are made available here so you can see how some tasks can be automated with Windows PowerShell.
|
||||
- [Gather.ps1](/samples/browse/?redirectedfrom=TechNet-Gallery). This sample Windows PowerShell script performs the MDT Gather process in a simulated MDT environment. This allows you to test the MDT gather process and check to see if it is working correctly without performing a full Windows deployment.
|
||||
- [Set-OUPermissions.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619362). This sample Windows PowerShell script creates a domain account and then configures OU permissions to allow the account to join machines to the domain in the specified OU.
|
||||
- [MDTSample.zip](https://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT.
|
||||
|
||||
@ -38,9 +38,6 @@ If you have access to Microsoft BitLocker Administration and Monitoring (MBAM),
|
||||
> [!NOTE]
|
||||
> Backing up TPM to Active Directory was supported only on Windows 10 version 1507 and 1511.
|
||||
|
||||
>[!NOTE]
|
||||
>Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery key and TPM owner information in Active Directory. For more information about these features, see [Backing Up BitLocker and TPM Recovery Information to AD DS](/previous-versions/windows/it-pro/windows-7/dd875529(v=ws.10)). If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker.
|
||||
|
||||
For the purposes of this topic, we will use DC01, a domain controller that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, see [Deploy Windows 10 with the Microsoft Deployment Toolkit](./prepare-for-windows-deployment-with-mdt.md).
|
||||
|
||||
## Configure Active Directory for BitLocker
|
||||
@ -170,4 +167,4 @@ In the following task sequence, we added five actions:
|
||||
[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)<br>
|
||||
[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md)<br>
|
||||
[Use web services in MDT](use-web-services-in-mdt.md)<br>
|
||||
[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md)
|
||||
[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md)
|
||||
|
||||
@ -12,7 +12,7 @@ ms.author: greglin
|
||||
ms.date: 02/13/2018
|
||||
manager: dougeby
|
||||
ms.audience: itpro
|
||||
ms.localizationpriority: medium
|
||||
ms.localizationpriority: high
|
||||
ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.collection: highpri
|
||||
|
||||
@ -3,7 +3,7 @@ title: Windows 10 Pro in S mode
|
||||
description: Overview of Windows 10 Pro/Enterprise in S mode. What is S mode for Enterprise customers?
|
||||
keywords: Windows 10 S, S mode, Windows S mode, Windows 10 S mode, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Enterprise in S mode, Windows 10 Pro/Enterprise in S mode
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.localizationpriority: high
|
||||
ms.prod: w10
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
@ -58,4 +58,4 @@ The [MSIX Packaging Tool](/windows/application-management/msix-app-packaging-too
|
||||
- [Consumer applications for S mode](https://www.microsoft.com/windows/s-mode)
|
||||
- [S mode devices](https://www.microsoft.com/en-us/windows/view-all-devices)
|
||||
- [Windows Defender Application Control deployment guide](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide)
|
||||
- [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp)
|
||||
- [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp)
|
||||
|
||||
BIN
windows/deployment/update/media/specify-update-type-sources.png
Normal file
BIN
windows/deployment/update/media/specify-update-type-sources.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 221 KiB |
@ -6,7 +6,7 @@ ms.mktglfcycl: manage
|
||||
audience: itpro
|
||||
itproauthor: jaimeo
|
||||
author: jaimeo
|
||||
ms.localizationpriority: medium
|
||||
ms.localizationpriority: high
|
||||
ms.author: jaimeo
|
||||
manager: dougeby
|
||||
ms.collection:
|
||||
|
||||
78
windows/deployment/update/wufb-wsus.md
Normal file
78
windows/deployment/update/wufb-wsus.md
Normal file
@ -0,0 +1,78 @@
|
||||
---
|
||||
title: Use Windows Update for Business (WUfB) and Windows Server Update Services (WSUS) together
|
||||
description: Learn how to use Windows Update for Business and WSUS together using the new scan source policy.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: arcarley
|
||||
ms.localizationpriority: medium
|
||||
audience: itpro
|
||||
ms.author: arcarley
|
||||
ms.collection:
|
||||
- m365initiative-coredeploy
|
||||
- highpri
|
||||
manager: dougeby
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Use Windows Update for Business and WSUS together
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
The Windows update scan source policy enables you to choose what types of updates to get from either [WSUS](waas-manage-updates-wsus.md) or Windows Update for Business (WUfB) service.
|
||||
|
||||
We added the scan source policy starting with the [September 1, 2021—KB5005101 (OS Builds 19041.1202, 19042.1202, and 19043.1202) Preview](https://support.microsoft.com/help/5005101) update and it applies to Window 10, version 2004 and above and Windows 11. This policy changes the way devices determine whether to scan against a local WSUS server or Windows Update service.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The policy **Do not allow update deferral policies to cause scans against Windows Update**, also known as Dual Scan, is no longer supported on Windows 11 and on Windows 10 it is replaced by the new Windows scan source policy and is not recommended for use. If you configure both on Windows 10, you will not get updates from Windows Update.
|
||||
|
||||
## About the scan source policy
|
||||
|
||||
The specify scan source policy enables you to specify whether your device gets the following Windows update types form WSUS **or** from Windows Update:
|
||||
|
||||
- Feature updates
|
||||
- Windows quality updates
|
||||
- Driver and firmware updates
|
||||
- Updates for other Microsoft products
|
||||
|
||||
We recommend using this policy on your transition from fully on-premises managed environment to a cloud supported one. Whether you move only drivers to the cloud today or drivers and quality updates and then later move your other workloads, taking a step-by-step approach might ease the transition.
|
||||
|
||||
## Default scan behavior
|
||||
|
||||
To help you better understand the scan source policy, see the default scan behavior below and how we can change it:
|
||||
|
||||
- If no policies are configured: All of your updates will come from Windows Update.
|
||||
- If you configure only the WSUS server policy:
|
||||
|
||||
- On Windows 10: All of your updates will come from WSUS.
|
||||
- On Windows 11: All of your updates will still come from Windows Update unless you configure the specify scan source policy.
|
||||
|
||||
- If you configure a WSUS server and deferral policies: All of your updates will come from Windows Update unless you specify the scan source policy.
|
||||
- If you configure a WSUS server and the scan source policy: All of your updates will come from the source chosen in the scan source policy.
|
||||
|
||||
> [!TIP]
|
||||
> The only two relevant policies for where your updates come from are the specify scan source policy and whether or not you have configured a WSUS server. This should simplify the configuration options.
|
||||
|
||||
## Configure the scan sources
|
||||
|
||||
The policy can be configured using the following two methods:
|
||||
|
||||
1. Group Policy: Specify source service for specific classes of Windows Updates
|
||||
|
||||
- Path: Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Server Update Service\
|
||||
|
||||
:::image type="content" source="media/specify-update-type-sources.png" alt-text="Screenshot of the Group Policy for specifiying sources for update types":::
|
||||
|
||||
2. Configuration Service Provider (CSP) Policies: **SetPolicyDrivenUpdateSourceFor<Update Type>**:
|
||||
|
||||
> [!NOTE]
|
||||
> You should configure **all** of these policies if you are using CSPs.
|
||||
|
||||
- [Update/SetPolicyDrivenUpdateSourceForDriverUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourcefordriver)
|
||||
- [Update/SetPolicyDrivenUpdateSourceForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourceforfeature)
|
||||
- [Update/SetPolicyDrivenUpdateSourceForOtherUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourceforother)
|
||||
- [Update/SetPolicyDrivenUpdateSourceForQualityUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourceforquality)
|
||||
@ -45,7 +45,7 @@ See the following general troubleshooting procedures associated with a result co
|
||||
| :--- | :--- | :--- |
|
||||
| 0xC1900101 - 0x20004 | Uninstall antivirus applications.<br>Remove all unused SATA devices. <br>Remove all unused devices and drivers. <br>Update drivers and BIOS. | Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation. <br>This is generally caused by out-of-date drivers. |
|
||||
| 0xC1900101 - 0x2000c | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.<br> Contact your hardware vendor to obtain updated device drivers.<br> Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. | Windows Setup encountered an unspecified error during Wim apply in the WinPE phase.<br> This is generally caused by out-of-date drivers |
|
||||
| 0xC1900101 - 0x20017 | Ensure that all that drivers are updated.<br>Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers.<br>For more information, see [Windows Vista, Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows 10 setup log file locations](/troubleshoot/windows-client/deployment/windows-setup-log-file-locations).<br>Update or uninstall the problem drivers. | A driver has caused an illegal operation.<br>Windows was not able to migrate the driver, resulting in a rollback of the operating system.<br>This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. |
|
||||
| 0xC1900101 - 0x20017 | Ensure that all that drivers are updated.<br>Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers.<br>For more information, see [Windows Vista, Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows 10 setup log file locations](/troubleshoot/windows-client/deployment/windows-setup-log-file-locations).<br>Update or uninstall the problem drivers. | A driver has caused an illegal operation.<br>Windows was not able to migrate the driver, resulting in a rollback of the operating system.<br>This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software.<br>This can also be caused by a hardware failure. |
|
||||
| 0xC1900101 - 0x30018 | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.<br>Contact your hardware vendor to obtain updated device drivers.<br>Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. | A device driver has stopped responding to setup.exe during the upgrade process. |
|
||||
| 0xC1900101 - 0x3000D | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.<br>Update or uninstall the display driver. | Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation.<br>This can occur due to a problem with a display driver. |
|
||||
| 0xC1900101 - 0x4000D | Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors.<br>Review the rollback log and determine the stop code.<br>The rollback log is located in the <strong>$Windows.~BT\Sources\Rollback</strong> folder. An example analysis is shown below. This example is not representative of all cases:<br> <br>Info SP Crash 0x0000007E detected<br>Info SP Module name :<br>Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005<br>Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A<br>Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728<br>Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40<br>Info SP Cannot recover the system.<br>Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows.<br> <br>Typically, there is a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:<br> <br>1. Make sure you have enough disk space.<br>2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.<br>3. Try changing video adapters.<br>4. Check with your hardware vendor for any BIOS updates.<br>5. Disable BIOS memory options such as caching or shadowing. | A rollback occurred due to a driver configuration issue.<br>Installation failed during the second boot phase while attempting the MIGRATE_DATA operation.<br>This can occur because of incompatible drivers. |
|
||||
@ -93,7 +93,7 @@ See the following general troubleshooting procedures associated with a result co
|
||||
| Error Codes | Cause | Mitigation |
|
||||
| --- | --- | --- |
|
||||
|0x80070003- 0x20007|This is a failure during SafeOS phase driver installation.|[Verify device drivers](/windows-hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](log-files.md#analyze-log-files) to determine the problem driver.|
|
||||
|0x8007025D - 0x2000C|This error occurs if the ISO file's metadata is corrupt.|Re-download the ISO/Media and re-attempt the upgrade<p>Alternatively, re-create installation media the [Media Creation Tool](https://www.microsoft.com/software-download/windows10).|
|
||||
|0x8007025D - 0x2000C|This error occurs if the ISO file's metadata is corrupt or if there is an issue with the storage medium, such as a RAM module containing bad blocks during the installation of Windows.|Re-download the ISO/Media and re-attempt the upgrade<p>Alternatively, re-create installation media the [Media Creation Tool](https://www.microsoft.com/software-download/windows10).|
|
||||
|0x80070490 - 0x20007|An incompatible device driver is present.|[Verify device drivers](/windows-hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](log-files.md#analyze-log-files) to determine the problem driver.|
|
||||
|0xC1900101 - 0x2000c|An unspecified error occurred in the SafeOS phase during WIM apply. This can be caused by an outdated driver or disk corruption.|Run checkdisk to repair the file system. For more information, see the [quick fixes](quick-fixes.md) section in this guide.<br>Update drivers on the computer, and select "Download and install updates (recommended)" during the upgrade process. Disconnect devices other than the mouse, keyboard and display.|
|
||||
|0xC1900200 - 0x20008|The computer doesn’t meet the minimum requirements to download or upgrade to Windows 10.|See [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) and verify the computer meets minimum requirements.<p>Review logs for [compatibility information](/archive/blogs/askcore/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues).|
|
||||
|
||||
@ -153,4 +153,4 @@ To create custom RDP settings for Azure:
|
||||
|
||||
[Windows 10/11 Subscription Activation](windows-10-subscription-activation.md)
|
||||
<BR>[Recommended settings for VDI desktops](/windows-server/remote/remote-desktop-services/rds-vdi-recommendations)
|
||||
<BR>[Licensing the Windows Desktop for VDI Environments](https://download.microsoft.com/download/1/1/4/114A45DD-A1F7-4910-81FD-6CAF401077D0/Microsoft%20VDI%20and%20VDA%20FAQ%20v3%200.pdf)
|
||||
<BR>[Licensing the Windows Desktop for VDI Environments](https://download.microsoft.com/download/9/8/d/98d6a56c-4d79-40f4-8462-da3ecba2dc2c/licensing_windows_desktop_os_for_virtual_machines.pdf)
|
||||
|
||||
@ -1,142 +1,147 @@
|
||||
---
|
||||
title: Activate using Active Directory-based activation (Windows 10)
|
||||
description: Learn how active directory-based activation is implemented as a role service that relies on AD DS to store activation objects.
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af
|
||||
manager: dougeby
|
||||
ms.author: greglin
|
||||
keywords: vamt, volume activation, activation, windows activation
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: activation
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/27/2017
|
||||
ms.topic: article
|
||||
ms.collection: highpri
|
||||
---
|
||||
|
||||
# Activate using Active Directory-based activation
|
||||
|
||||
> Applies to
|
||||
>
|
||||
>- Windows 10
|
||||
>- Windows 8.1
|
||||
>- Windows 8
|
||||
>- Windows Server 2012 R2
|
||||
>- Windows Server 2012
|
||||
>- Windows Server 2016
|
||||
>- Windows Server 2019
|
||||
>- Office 2013*
|
||||
>- Office 2016*
|
||||
>- Office 2019*
|
||||
|
||||
**Looking for retail activation?**
|
||||
|
||||
- [Get Help Activating Microsoft Windows 7 or Windows 8.1](https://support.microsoft.com/help/15083/windows-activate-windows-7-or-8-1)
|
||||
- [Get Help Activating Microsoft Windows 10](https://support.microsoft.com/help/12440/windows-10-activate)
|
||||
|
||||
Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. Active Directory-based activation requires that the forest schema be updated using *adprep.exe* on a supported server OS, but after the schema is updated, older domain controllers can still activate clients.
|
||||
|
||||
Any domain-joined computers running a supported operating system with a Generic Volume License Key (GVLK) will be activated automatically and transparently. They will stay activated as long as they remain members of the domain and maintain periodic contact with a domain controller. Activation takes place after the Licensing service starts. When this service starts, the computer contacts AD DS automatically, receives the activation object, and is activated without user intervention.
|
||||
|
||||
To allow computers with GVLKs to activate themselves, use the Volume Activation Tools console or the [Volume Activation Management Tool (VAMT)](volume-activation-management-tool.md) in earlier versions of Windows Server to create an object in the AD DS forest. You create this activation object by submitting a KMS host key to Microsoft, as shown in Figure 10.
|
||||
|
||||
The process proceeds as follows:
|
||||
|
||||
1. Perform one of the following tasks:
|
||||
- Install the Volume Activation Services server role on a domain controller and add a KMS host key by using the Volume Activation Tools Wizard.
|
||||
- Extend the domain to the Windows Server 2012 R2 or higher schema level, and add a KMS host key by using the VAMT.
|
||||
|
||||
2. Microsoft verifies the KMS host key, and an activation object is created.
|
||||
|
||||
3. Client computers are activated by receiving the activation object from a domain controller during startup.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
**Figure 10**. The Active Directory-based activation flow
|
||||
|
||||
For environments in which all computers are running an operating system listed under *Applies to*, and they are joined to a domain, Active Directory-based activation is the best option for activating all client computers and servers, and you may be able to remove any KMS hosts from your environment.
|
||||
|
||||
If an environment will continue to contain earlier volume licensing operating systems and applications or if you have workgroup computers outside the domain, you need to maintain a KMS host to maintain activation status for earlier volume licensing editions of Windows and Office.
|
||||
|
||||
Clients that are activated with Active Directory-based activation will maintain their activated state for up to 180 days since the last contact with the domain, but they will periodically attempt to reactivate before then and at the end of the 180 day period. By default, this reactivation event occurs every seven days.
|
||||
|
||||
When a reactivation event occurs, the client queries AD DS for the activation object. Client computers examine the activation object and compare it to the local edition as defined by the GVLK. If the object and GVLK match, reactivation occurs. If the AD DS object cannot be retrieved, client computers use KMS activation. If the computer is removed from the domain, and the computer or the Software Protection service is restarted, the operating system will change the status from activated to not activated, and the computer will try to activate with KMS.
|
||||
|
||||
## Step-by-step configuration: Active Directory-based activation
|
||||
|
||||
> [!NOTE]
|
||||
> You must be a member of the local Administrators group on all computers mentioned in these steps. You also need to be a member of the Enterprise Administrators group, because setting up Active Directory-based activation changes forest-wide settings.
|
||||
|
||||
**To configure Active Directory-based activation on Windows Server 2012 R2 or higher, complete the following steps:**
|
||||
|
||||
1. Use an account with Domain Administrator and Enterprise Administrator credentials to sign in to a domain controller.
|
||||
|
||||
2. Launch Server Manager.
|
||||
|
||||
3. Add the Volume Activation Services role, as shown in Figure 11.
|
||||
|
||||
|
||||
|
||||
**Figure 11**. Adding the Volume Activation Services role
|
||||
|
||||
4. Click the link to launch the Volume Activation Tools (Figure 12).
|
||||
|
||||
|
||||
|
||||
**Figure 12**. Launching the Volume Activation Tools
|
||||
|
||||
5. Select the **Active Directory-Based Activation** option (Figure 13).
|
||||
|
||||
|
||||
|
||||
**Figure 13**. Selecting Active Directory-Based Activation
|
||||
|
||||
6. Enter your KMS host key and (optionally) a display name (Figure 14).
|
||||
|
||||
|
||||
|
||||
**Figure 14**. Entering your KMS host key
|
||||
|
||||
7. Activate your KMS host key by phone or online (Figure 15).
|
||||
|
||||
|
||||
|
||||
**Figure 15**. Choosing how to activate your product
|
||||
|
||||
> [!NOTE]
|
||||
> To activate a KMS Host Key (CSVLK) for Microsoft Office, you need to install the version-specific Office Volume License Pack on the server where the Volume Activation Server Role is installed.
|
||||
>
|
||||
>
|
||||
> - [Office 2013 VL pack](https://www.microsoft.com/download/details.aspx?id=35584)
|
||||
>
|
||||
> - [Office 2016 VL pack](https://www.microsoft.com/download/details.aspx?id=49164)
|
||||
>
|
||||
> - [Office 2019 VL pack](https://www.microsoft.com/download/details.aspx?id=57342)
|
||||
|
||||
8. After activating the key, click **Commit**, and then click **Close**.
|
||||
|
||||
## Verifying the configuration of Active Directory-based activation
|
||||
|
||||
To verify your Active Directory-based activation configuration, complete the following steps:
|
||||
|
||||
1. After you configure Active Directory-based activation, start a computer that is running an edition of Windows that is configured by volume licensing.
|
||||
2. If the computer has been previously configured with a MAK key, replace the MAK key with the GVLK by running the **slmgr.vbs /ipk** command and specifying the GLVK as the new product key.
|
||||
3. If the computer is not joined to your domain, join it to the domain.
|
||||
4. Sign in to the computer.
|
||||
5. Open Windows Explorer, right-click **Computer**, and then click **Properties**.
|
||||
6. Scroll down to the **Windows activation** section, and verify that this client has been activated.
|
||||
|
||||
> [!NOTE]
|
||||
> If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmgr.vbs /dlv** command also indicates whether KMS has been used.
|
||||
>
|
||||
> To manage individual activations or apply multiple (mass) activations, please consider using the [VAMT](./volume-activation-management-tool.md).
|
||||
|
||||
|
||||
## See also
|
||||
|
||||
- [Volume Activation for Windows 10](volume-activation-windows-10.md)
|
||||
---
|
||||
title: Activate using Active Directory-based activation (Windows 10)
|
||||
description: Learn how active directory-based activation is implemented as a role service that relies on AD DS to store activation objects.
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af
|
||||
manager: dougeby
|
||||
ms.author: greglin
|
||||
keywords: vamt, volume activation, activation, windows activation
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: activation
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 01/13/2022
|
||||
ms.topic: article
|
||||
ms.collection: highpri
|
||||
---
|
||||
|
||||
# Activate using Active Directory-based activation
|
||||
|
||||
**Applies to**
|
||||
|
||||
Windows 11
|
||||
Windows 10
|
||||
Windows 8.1
|
||||
Windows 8
|
||||
Windows Server 2012 R2
|
||||
Windows Server 2012
|
||||
Windows Server 2016
|
||||
Windows Server 2019
|
||||
Office 2021*
|
||||
Office 2019*
|
||||
Office 2016*
|
||||
Office 2013*
|
||||
|
||||
**Looking for retail activation?**
|
||||
|
||||
- [Get Help Activating Microsoft Windows 7 or Windows 8.1](https://support.microsoft.com/help/15083/windows-activate-windows-7-or-8-1)
|
||||
- [Get Help Activating Microsoft Windows 10](https://support.microsoft.com/help/12440/windows-10-activate)
|
||||
|
||||
Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. Active Directory-based activation requires that the forest schema be updated using *adprep.exe* on a supported server OS, but after the schema is updated, older domain controllers can still activate clients.
|
||||
|
||||
Any domain-joined computers running a supported operating system with a Generic Volume License Key (GVLK) will be activated automatically and transparently. They will stay activated as long as they remain members of the domain and maintain periodic contact with a domain controller. Activation takes place after the Licensing service starts. When this service starts, the computer contacts AD DS automatically, receives the activation object, and is activated without user intervention.
|
||||
|
||||
To allow computers with GVLKs to activate themselves, use the Volume Activation Tools console or the [Volume Activation Management Tool (VAMT)](volume-activation-management-tool.md) in earlier versions of Windows Server to create an object in the AD DS forest. You create this activation object by submitting a KMS host key to Microsoft, as shown in Figure 10.
|
||||
|
||||
The process proceeds as follows:
|
||||
|
||||
1. Perform one of the following tasks:
|
||||
- Install the Volume Activation Services server role on a domain controller and add a KMS host key by using the Volume Activation Tools Wizard.
|
||||
- Extend the domain to the Windows Server 2012 R2 or higher schema level, and add a KMS host key by using the VAMT.
|
||||
|
||||
2. Microsoft verifies the KMS host key, and an activation object is created.
|
||||
|
||||
3. Client computers are activated by receiving the activation object from a domain controller during startup.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
**Figure 10**. The Active Directory-based activation flow
|
||||
|
||||
For environments in which all computers are running an operating system listed under *Applies to*, and they are joined to a domain, Active Directory-based activation is the best option for activating all client computers and servers, and you may be able to remove any KMS hosts from your environment.
|
||||
|
||||
If an environment will continue to contain earlier volume licensing operating systems and applications or if you have workgroup computers outside the domain, you need to maintain a KMS host to maintain activation status for earlier volume licensing editions of Windows and Office.
|
||||
|
||||
Clients that are activated with Active Directory-based activation will maintain their activated state for up to 180 days since the last contact with the domain, but they will periodically attempt to reactivate before then and at the end of the 180 day period. By default, this reactivation event occurs every seven days.
|
||||
|
||||
When a reactivation event occurs, the client queries AD DS for the activation object. Client computers examine the activation object and compare it to the local edition as defined by the GVLK. If the object and GVLK match, reactivation occurs. If the AD DS object cannot be retrieved, client computers use KMS activation. If the computer is removed from the domain, and the computer or the Software Protection service is restarted, the operating system will change the status from activated to not activated, and the computer will try to activate with KMS.
|
||||
|
||||
## Step-by-step configuration: Active Directory-based activation
|
||||
|
||||
> [!NOTE]
|
||||
> You must be a member of the local Administrators group on all computers mentioned in these steps. You also need to be a member of the Enterprise Administrators group, because setting up Active Directory-based activation changes forest-wide settings.
|
||||
|
||||
**To configure Active Directory-based activation on Windows Server 2012 R2 or higher, complete the following steps:**
|
||||
|
||||
1. Use an account with Domain Administrator and Enterprise Administrator credentials to sign in to a domain controller.
|
||||
|
||||
2. Launch Server Manager.
|
||||
|
||||
3. Add the Volume Activation Services role, as shown in Figure 11.
|
||||
|
||||
|
||||
|
||||
**Figure 11**. Adding the Volume Activation Services role
|
||||
|
||||
4. Click the link to launch the Volume Activation Tools (Figure 12).
|
||||
|
||||
|
||||
|
||||
**Figure 12**. Launching the Volume Activation Tools
|
||||
|
||||
5. Select the **Active Directory-Based Activation** option (Figure 13).
|
||||
|
||||
|
||||
|
||||
**Figure 13**. Selecting Active Directory-Based Activation
|
||||
|
||||
6. Enter your KMS host key and (optionally) a display name (Figure 14).
|
||||
|
||||
|
||||
|
||||
**Figure 14**. Entering your KMS host key
|
||||
|
||||
7. Activate your KMS host key by phone or online (Figure 15).
|
||||
|
||||
|
||||
|
||||
**Figure 15**. Choosing how to activate your product
|
||||
|
||||
> [!NOTE]
|
||||
> To activate a KMS Host Key (CSVLK) for Microsoft Office, you need to install the version-specific Office Volume License Pack on the server where the Volume Activation Server Role is installed. For more details, see [Activate volume licensed versions of Office by using Active Directory](/deployoffice/vlactivation/activate-office-by-using-active-directory).
|
||||
|
||||
>
|
||||
>
|
||||
> - [Office 2013 VL pack](https://www.microsoft.com/download/details.aspx?id=35584)
|
||||
>
|
||||
> - [Office 2016 VL pack](https://www.microsoft.com/download/details.aspx?id=49164)
|
||||
>
|
||||
> - [Office 2019 VL pack](https://www.microsoft.com/download/details.aspx?id=57342)
|
||||
>
|
||||
> - [Office LTSC 2021 VL pack](https://www.microsoft.com/download/details.aspx?id=103446)
|
||||
|
||||
8. After activating the key, click **Commit**, and then click **Close**.
|
||||
|
||||
## Verifying the configuration of Active Directory-based activation
|
||||
|
||||
To verify your Active Directory-based activation configuration, complete the following steps:
|
||||
|
||||
1. After you configure Active Directory-based activation, start a computer that is running an edition of Windows that is configured by volume licensing.
|
||||
2. If the computer has been previously configured with a MAK key, replace the MAK key with the GVLK by running the **slmgr.vbs /ipk** command and specifying the GLVK as the new product key.
|
||||
3. If the computer is not joined to your domain, join it to the domain.
|
||||
4. Sign in to the computer.
|
||||
5. Open Windows Explorer, right-click **Computer**, and then click **Properties**.
|
||||
6. Scroll down to the **Windows activation** section, and verify that this client has been activated.
|
||||
|
||||
> [!NOTE]
|
||||
> If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmgr.vbs /dlv** command also indicates whether KMS has been used.
|
||||
>
|
||||
> To manage individual activations or apply multiple (mass) activations, please consider using the [VAMT](./volume-activation-management-tool.md).
|
||||
|
||||
|
||||
## See also
|
||||
|
||||
- [Volume Activation for Windows 10](volume-activation-windows-10.md)
|
||||
|
||||
@ -162,7 +162,7 @@ After you download this file, the name will be extremely long (ex: 19042.508.200
|
||||
The **Get-NetAdaper** cmdlet is used to automatically find the network adapter that's most likely to be the one you use to connect to the internet. You should test this command first by running the following at an elevated Windows PowerShell prompt:
|
||||
|
||||
```powershell
|
||||
(Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name
|
||||
(Get-NetAdapter | Where-Object {$_.Status -eq "Up" -and !$_.Virtual}).Name
|
||||
```
|
||||
|
||||
The output of this command should be the name of the network interface you use to connect to the internet. Verify that this is the correct interface name. If it isn't the correct interface name, you'll need to edit the first command below to use your network interface name.
|
||||
@ -178,10 +178,10 @@ All VM data will be created under the current path in your PowerShell prompt. Co
|
||||
>
|
||||
>- If you previously enabled Hyper-V and your internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."
|
||||
>- If you have never created an external VM switch before, then just run the commands below.
|
||||
>- If you're not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a currently list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that's used to connect to the internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch).
|
||||
>- If you're not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a current list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that's used to connect to the internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch).
|
||||
|
||||
```powershell
|
||||
New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name
|
||||
New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter | Where-Object {$_.Status -eq "Up" -and !$_.Virtual}).Name
|
||||
New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal
|
||||
Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot
|
||||
Start-VM -VMName WindowsAutopilot
|
||||
@ -238,7 +238,6 @@ PS C:\autopilot>
|
||||
|
||||
Make sure that the VM booted from the installation ISO, select **Next**, select **Install now**, and then complete the Windows installation process. See the following examples:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -251,7 +250,6 @@ Make sure that the VM booted from the installation ISO, select **Next**, select
|
||||
|
||||
|
||||
|
||||
|
||||
After the VM restarts, during OOBE, it's fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This offers the fastest way to the desktop. For example:
|
||||
|
||||
|
||||
@ -279,12 +277,12 @@ Follow these steps to run the PowerShell script:
|
||||
1. **On the client VM**: Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same whether you're using a VM or a physical device:
|
||||
|
||||
```powershell
|
||||
md c:\HWID
|
||||
Set-Location c:\HWID
|
||||
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force
|
||||
New-Item -Type Directory -Path "C:\HWID"
|
||||
Set-Location C:\HWID
|
||||
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
|
||||
Install-Script -Name Get-WindowsAutopilotInfo -Force
|
||||
$env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
|
||||
Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv
|
||||
Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv
|
||||
```
|
||||
|
||||
1. When you're prompted to install the NuGet package, choose **Yes**.
|
||||
@ -349,7 +347,7 @@ Follow these steps to run the PowerShell script:
|
||||
With the hardware ID captured in a file, prepare your Virtual Machine for Windows Autopilot deployment by resetting it back to OOBE.
|
||||
|
||||
On the Virtual Machine, go to **Settings > Update & Security > Recovery** and select **Get started** under **Reset this PC**.
|
||||
Select **Remove everything** and **Just remove my files**. If you're asked **How would you like to reinstall Windows**, select Local reinstall. Finally, select **Reset**.
|
||||
Select **Remove everything**, then, on **How would you like to reinstall Windows**, select **Local reinstall**. Finally, select **Reset**.
|
||||
|
||||
|
||||
|
||||
@ -616,7 +614,7 @@ To use the device (or VM) for other purposes after completion of this lab, you n
|
||||
|
||||
### Delete (deregister) Autopilot device
|
||||
|
||||
You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure AD), log into the MEM admin center, then go to **Intune > Devices > All Devices**. Select the device you want to delete, then select the **Delete** button along the top menu.
|
||||
You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure AD), log into the MEM admin center, then go to **Intune > Devices > All Devices**. Select the device you want to delete, then select the **Delete** button along the top menu.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
Reference in New Issue
Block a user