Every Enterprise PC in an organisation activates one of two ways, and confusing them causes real outages — laptops that deactivate off-site, keys that run out of activations. KMS and MAK are both legitimate volume activation. They are built for opposite shapes of organisation. Here is the plain-English difference.
Volume licensing gives an organisation two activation engines. KMS keeps activation inside your own network: one internal host, activated once by Microsoft, then vouches for your PCs. MAK skips the middleman: each PC activates directly with Microsoft using a key that carries a fixed count of activations. Same licences, different plumbing — and the choice follows from one question: do your PCs regularly touch your network?
👆 The whole comparison in one panel. The GVLK row matters most — it is the key people mistake for a free licence, and it only works because the KMS host behind it is real.
With KMS, the organisation runs a KMS host — a service on one of its servers, activated with Microsoft once using a special host key from the volume agreement. Every PC carries the KMS client setup key for its edition (the published GVLK — public because it contains no rights, only directions). PCs find the host through DNS, activate against it, and renew every 180 days by touching the network again; between renewals they try to check in automatically. The catch is scale: a KMS host only starts activating Windows PCs after it has heard from at least 25 of them, so KMS is a fleet tool by design. A PC that never returns to the network — or its VPN — eventually falls out of activation, which is KMS working as intended.
MAK is the direct route. The volume agreement issues a Multiple Activation Key with a set number of activations on it. Each PC takes that key, contacts Microsoft's own servers once — online, or by phone/proxy tooling for isolated machines — and stays activated permanently, with no renewal and no need to ever see the office network. Every install consumes one activation from the count, visible in the organisation's licence portal. That permanence is exactly why MAK suits remote workers, tiny sites, and machines that live off-network — and why the key itself is a secret worth guarding, unlike the public GVLK.
Domain-joined fleets have a third option that borrows KMS's shape: Active Directory-Based Activation stores the activation object in the domain itself, and a domain-joined PC activates when it joins and stays activated while it remains a member. If your organisation already lives in Active Directory — and most KMS candidates do — ask your licensing admin which of the three your agreement is running before you troubleshoot a single PC against the wrong system.
The decision makes itself once you look at the machines. Desktops and office laptops that dock, VPN or visit regularly: KMS (or Active Directory activation) — no key counts to babysit, activation heals itself on contact. Field laptops, executives who never come in, one-PC branch sites, lab machines off the network: MAK — activate once with Microsoft and never think about it again. Very small organisations: MAK by default, because 25 PCs is a real threshold and KMS below it simply never switches on. Mixed fleets run mixed systems — that is normal, and your volume agreement supports both at once.
Watch the edition change in the video — then this page's activation map will tell you exactly how that PC stays activated afterwards.
▶️ Watch Full VideoKMS activates your PCs against a server your own organisation runs, and renews every 180 days; MAK activates each PC once, directly with Microsoft, using a key with a fixed number of activations, and never needs renewal.
Microsoft designed KMS for fleets: a KMS host begins activating Windows client PCs only after 25 of them have requested activation. Below that threshold the host stays idle, which is why small organisations and remote machines are normally activated with MAK instead.
The KMS client setup key (GVLK) is published by Microsoft and contains no licence at all — it only tells a PC to find its organisation's KMS host. The licence lives in the organisation's volume agreement behind that host. Sharing a GVLK shares nothing; sharing a MAK key, by contrast, shares real, counted activation rights and should never be done.