Windows Activation failure

Problem description

Windows activation fails when all the Internet traffic goes through Acreto.

This article describes how to resolve the KMS activation problem you might experience when you force all the traffic to go through Acreto.


You enable forced tunneling on Azure virtual network subnets to direct all Internet-bound traffic back to your on-premises network. In this scenario, the Azure virtual machines (VMs) that run Windows fail to activate Windows.


The Azure Windows VMs need to connect to the Azure KMS server for Windows activation. The activation requires that the activation request come from an Azure public IP address. The activation fails in the forced tunneling scenario because the activation request comes from Acreto instead of from an Azure public IP address.


Use the Azure custom route to route activation traffic to the Azure KMS server to resolve this problem.

The IP address of the KMS server for the Azure Global cloud is Its DNS name is If you use other Azure platforms such as Azure Germany, you must use the IP address of the corresponding KMS server. For more information, see the following table:

Platform KMS DNS IP
Azure Global
Azure Germany
Azure US Government
Azure China 21Vianet

How to

Update the route table of the Subnet where Windows VM was created :

  1. Login to Azure portal

  2. Goto you Virtual network whose subnet’s route table needs to be modified.

  3. In the virtual network menu bar, choose Subnets.

  4. Select the subnet for which the route table needs to be updated.

  5. In the Route table, add the following route :

    • Route name -
    • Address prefix -
    • Next Hop - Internet

    Windows Activation Windows Activation

    Windows Activation Windows Activation

  6. Select Save.


With the custom route, the Window activation traffic goes directly to the Azure KMS server, and the process will be successfully completed.

Windows Activation Windows Activation


Microsoft article: Windows Activation troubleshooting