Product documentation
Citrix Provisioning
Current Release 2407 2402 LTSR 2311 2308 2305 2303 2212 2209 2206 2203 LTSR 1912 LTSR 7.15
View PDF

Configuring a vDisk for Microsoft volume licensing

April 19, 2021
Contributed by: 
C

A vDisk can be configured for Microsoft Key Management Service (KMS) or Multiple Activation Key (MAK) volume licensing when the Imaging Wizard is run. If it was not configured when the Imaging Wizard was run, it can still be configure from the Console:

Note

The MCLI and SoapServer command-line interfaces can also be used to configure Microsoft volume licensing.

  1. Select the vDisk in the Console, then right-click and select File Properties. The vDisk File Properties dialog appears.
  2. Click the Microsoft Volume Licensing tab, then select the MAK or KMS licensing method.
  3. Click OK.

Configuring Microsoft KMS Volume Licensing

This section describes use of the Key Management Server (KMS) license keys with Provisioning Services.

Provisioning Services support for KMS licensing requires that the SOAP Server user account represents a domain user with the right to perform volume maintenance. This user is typically found in Local\Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment. By default, a member of the local administrators group would have this right.

KMS volume licensing utilizes a centralized activation server that runs in the datacenter. It serves as a local activation point (opposed to having each system activate with Microsoft over the internet).

Note

When preparing or updating a KMS configured vDisk that is copied or cloned, it is important to complete the final KMS configuration task. This task is to change the vDisk mode from Private Image Mode to Shared Image Mode, before copying or cloning the vDisk to other Provisioning Servers. Also, both the .pvp and .vhdx file must be copied to retain the properties and KMS configuration of the original vDisk.

The tasks involved in configuring a vDisk image to use KMS volume licensing and managing that vDisk in a Provisioning Services farm include:

If KMS licensing was not configured on the vDisk when the Imaging Wizard was run, it can alternatively be configured using the Console user interface. Refer to the Microsoft Volume Licensing tab, or the MCLI and PowerShell command-line interfaces. Refer to the MCLI or PowerShell Programmers Guide for details.

Preparing the new base vDisk image for KMS volume licensing

After a vDisk is created using the Imaging Wizard, it must be reset to a non-activated state using the rearm command. For additional information about this command, see Configuring KMS Licensing for Windows and Office.

It is important to perform this operation on a system booted from the vDisk in Private Image Mode. This process ensures that the master target device hard disk’s rearm count is not reduced.

Note

Microsoft limits the number of times you can run rearm on an installed OS image. Reinstall the operating system if the number of allowed rearm attempts is exceeded.

  1. Boot the target device from the vDisk in Private Image Mode to rearm. Note: OSPPPREARM.EXE must be run from an elevated command prompt.
  2. A message prompts you to reboot the system, DO NOT REBOOT. Instead shut down the Target device.
  3. If the KMS option was not selected when the vDisk image was created, click on the Microsoft Volume Licensing tab and set the licensing option to KMS.
  4. Set the vDisk mode to Standard Image mode.
  5. Stream the vDisk to one or more target devices.

Maintaining or upgrading a vDisk image that uses KMS volume licensing

To maintain or upgrade a vDisk image that is configured to use KMS volume licensing:

  1. Set the vDisk mode to Private Image mode.
  2. Stream the vDisk to a target device.
  3. Apply the OS/application service pack/update, then shut down the target device.
  4. Set the vDisk mode back to Shared Image mode.
  5. Stream the vDisk to the target device in Shared Image mode. Note: If Office 2010 is installed as a vDisk update, or after vDisk has gone through base disk preparation once, repeat base disk preparation:
    1. In the Console, right-click on the vDisk, then select the File Properties menu option. The vDisk File Properties dialog appears.
    2. Click on the Microsoft Volume Licensing tab, then change the licensing option from KMS to None.
    3. On the Mode tab, set the vDisk access mode to Private Image mode.
    4. PXE boot to the vDisk in Private Image mode to rearm. Note: OSPPPREARM.EXE must be run from an elevated command prompt.
    5. A message prompts you to reboot the system, DO NOT REBOOT. Instead shut down the Target device.
    6. In the Console, right-click on the vDisk, then select the File Properties menu option. The vDisk Properties dialog appears.
    7. Click on the Microsoft Volume Licensing tab, then change the license option from None to KMS.
    8. On the Mode tab, set the vDisk access mode to Shared Image mode.
    9. Stream the vDisk to the target devices.

Configuring Microsoft MAK Volume Licensing

This section describes the use of Multiple Activation Keys (MAK). A MAK corresponds to some purchased OS licenses. The MAK is entered during the installation of the OS on each system, which activates the OS and decrements the count of purchased licenses centrally with Microsoft. Alternatively, a process of ‘proxy activation’ is done using the Volume Activation Management Toolkit (VAMT). This allows activation of systems that do not have network access to the internet. Provisioning Services applies this proxy activation mechanism for Standard Image mode vDisks that have MAK licensing mode selected when the vDisk is created.

The Volume Activation Management Tool (VAMT) version 3.1 must be installed and configured on all Provisioning Servers within a farm. This tool is available from the Microsoft Windows Assessment and Deployment Kit (Windows ADK). For more information, see Install VAMT.

Upon first execution of the VAMT, a VAMT database is created. This database caches all device activations and allows for Provisioning Services to reactivate.

Volume Activation Management Tool 3.1 requires:

  • PowerShell 3.0 – the OS is earlier than Windows Server 2012 or Windows 8
  • SQL 2012 express or newer

Provisioning Service MAK activation requires configuration for three types of users.

  • Volume Activation Management Tool/Provisioning Services installation user — This user is a local administrator on the Provisioning Services server system and has the rights on SQL 2012 or newer (VAMT 3.1 requirement) to create a database for VAMT to use.
  • MAK user — This is the user set in the site’s properties. This user handles the MAK activation on both server and client side. This user is a local administrator on both the Provisioning Services server and the master client. This user requires full access to the VAMT database.
  • Provisioning Services soap/stream services user — the stream process handles the reactivation when the target device restarts. This user requires read access to the VAMT database.

Provisioning Servers use PowerShell to interface with the VAMT. These manual configuration steps are required one time per server.

  1. Install PowerShell 3.0.
  2. Install VAMT 3.1 on every Provisioning Services server system using a Volume Activation Management Tool/Provisioning Services installation user.
  3. Configure a VAMT database as prompted during the initial run of VAMT 3.1. Make this database accessible to all Provisioning Services servers used to stream VAMT activated Provisioning Services target devices.
  4. If the user who created the VAMT database is not the soap/stream services user, copy the VAMT configuration file C:\Users\<VAMT installation user (dB creator)>\AppData\Roaming\Microsoft\VAMT\VAMT.config to C:\Users\<Provisioning Services soap/stream services user>\AppData\Roaming\Microsoft\VAMT\VAMT.config.
  5. Set the Provisioning Services server security configuration to use PowerShell to interface with VAMT.
    1. Set-ExecutionPolicy -Scope \ (the Provisioning Services services user) to unrestricted – see Set-ExecutionPolicy for more information.
    2. WinRM quickconfig.
    3. Enable-WSManCredSSP -Role Client -DelegateComputer <this server’s fqdn> -Force
    4. Enable-WSManCredSSP -Role Server –Force.
  6. Configure the Windows firewall on the client for VAMT 3.1 – see Configure Client Computers for more information. Citrix Provisioning target devices cannot be activated or reactivated if the firewall is not configured for VAMT.

Common activation errors

Error: Failed to create PSSession — Reason: MAK user is not a local administrator on the Provisioning Services server.

Error: Index was out of range. Must be non-negative and less than the size of the collection. Parameters name: Index. — Reason: MAK user does not have full access (read\write) permission to the VAMT database.

Setting the vDisk’s licensing mode for MAK

A vDisk can be configured to use Microsoft Multiple Activation Key (MAK) licensing when running the Imaging Wizard. Refer to Imaging Wizard. If MAK licensing was not configured when the Imaging Wizard was run, set the vDisk’s licensing mode property using the Console, MCLI, or PowerShell user interface. The licensing mode should be set before attempting to activate target devices.

Note

For information on using the command-line interfaces, refer to the MCLI or PowerShell Programmers Guide.

Entering MAK user credentials

Before target devices that use MAK-enabled vDisks can be activated, MAK user credentials must be entered for a site.

The user must have administrator rights on all target devices that use MAK-enabled vDisks, and on all Provisioning Servers that stream the vDisks to target devices.

To enter credentials:

  1. Right-click on the site where the target devices exist, then select the Properties menu option.
  2. On the MAK tab, enter the user and password information in the appropriate text boxes, then click OK.

Activating target devices that use MAK-enabled vDisks

After a vDisk is configured for MAK volume licensing and user credentials have been entered, each booted target device assigned to the vDisk needs to be activated with a MAK.

Note: After all licenses for a given MAK have been used, a new key will be required to allow more target devices that share this vDisk image to be activated.

To activate target devices that use MAK volume licensing from the Console:

  1. Boot all target devices that are to be activated.

  2. In the Console, right-click on the collection or view of the individual device that includes those target devices that require MAK license activation. Select the Manage MAK Activations… menu option. The Manage MAK Activations dialog appears.

  3. In the Multiple activation key text box, enter the MAK to be used to activate the target devices.

  4. The number of booted target devices that require activation, display on the dialog. From the list of booted devices, check the box next to each target device that should be activated.

  5. Click OK to activate licensing for all selected target devices (do not close the dialog until the activation process is completed. The process can be stopped by clicking the Cancel button. Closing the dialog before the activation process completes stops the process and results in some target devices not being activated). The Status column indicates if a target device is being activated (Activating) or the activation failed (Failed). If all target devices were activated successfully, click OK to close the dialog. After the activation process completes, if one or more target devices were not selected to be activated, or if devices were not activated successfully, the dialog displays listing any unactivated devices. After resolving any issues, repeat this step to activate the remaining target devices.

Note

The Manage MAK Activations… option does not display after all currently booted target devices have been successfully activated.

Maintaining MAK activations

Typically, devices and their assigned vDisk activations are preserved automatically. When a different target device is assigned a MAK activated vDisk, it removes any saved existing MAK reactivation information. If the vDisk is reassigned in the future, the target device fails to reactivate. To prevent the loss of MAK activation, do not unassign the activated disk from the target device.

To change a target device’s vDisk, without losing the MAK activation, select one of the following methods:

  1. Assign more vDisks to the target device, without removing any, then set the default booting vDisk accordingly.
  2. Assign more vDisks to the target device and temporarily disable the MAK activated vDisk.

To update a MAK activated vDisk, the AutoUpdate feature must be used so that the MAK activation information, required for shared device reactivation, is maintained.

More MAK considerations:

  • Use of manual vDisk updates (unassigning one vDisk and reassigning another vDisk) results in the loss of the required MAK activation information and requires a new activation, which would consume another license.
  • Use of AutoUpdate to deploy a new vDisk, from a different OS install than the previous vDisk, results in mismatched MAK activation information. In this case, a new activation must be performed from the command line interface, as only unactivated target devices can be activated from the Provisioning Services console.
Configuring a vDisk for Microsoft volume licensing
April 19, 2021
Contributed by: 
C
April 19, 2021
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.