Office activation fails with error 0xC004F074: solution

Error 0xC004F074 means: no KMS server reachable

Error 0xC004F074 is an activation fault that the Software Licensing Service returns when Office could not reach a Key Management Service (KMS). KMS is an activation server that many organisations run on their own network to activate Office and Windows in bulk, without each PC talking to Microsoft individually. If the client cannot find or trust that server, activation stops with this code.

The message is tied to volume licences: Office 2016, 2019, 2021, and the LTSC releases that are rolled out through a corporate agreement. You rarely see it on a home PC with Microsoft 365 or a retail version, because those activate over the internet with a Microsoft account or product key. The code therefore seldom points to a broken key and almost always to a connection, time, or name-resolution problem between the client and the KMS host.

It's helpful to know that KMS activation is renewed periodically: a KMS client renews its activation roughly every 180 days. If the error appears on a machine that previously worked, there's likely nothing wrong with the key, the periodic renewal simply failed because the host was temporarily unreachable. That explains why Office was fine for months and then suddenly asks for activation.

These causes are almost always behind the error

Four causes explain the vast majority of cases. Run through them in your mind before you start, as they determine which step you take first.

• Time difference: the PC's system clock differs by more than four hours from the KMS host. The host then refuses activation because the timestamps don't match.
• DNS cannot find the KMS host: KMS clients search for the server automatically via an SRV record (_vlmcs._tcp) in DNS. If that record is missing or fails, the host cannot be found.
• Port 1688 blocked: a firewall or antivirus blocking outgoing traffic to the KMS host on the default port.
• KMS host itself unavailable: the server is off, or hasn't yet counted enough unique clients to allow activation (KMS has a minimum threshold).

You can resolve the first three causes yourself on the client side. The fourth requires action from the KMS host administrator. Always start with the time, because it's the most common and quickest cause to check. If that doesn't work, continue with DNS and the firewall before contacting the administrator.

A fifth, less frequently mentioned cause is a laptop that switches networks. A device that activated without issues at the office may no longer reach the internal KMS host at home or on a public network. The activation then suddenly seems broken even though nothing about the installation has changed. In such a case, the solution is simply to reconnect to the corporate network, not to tinker with settings.

First, sync the system time

Because a time difference is the most common trigger, start there. Open Settings > Time & language > Date & time and turn on both "Set time automatically" and "Set time zone automatically". Then click Sync now. Also check the time zone: a PC with the correct clock but the wrong zone can still fall outside the four-hour margin and cause activation to fail.

If syncing via Settings doesn't work, force it through an elevated command prompt:

net stop w32time
net start w32time
w32tm /resync

The w32tm /resync command retrieves the time again from the configured time server. In a domain, the PC synchronises with the domain controller; on a standalone machine with an internet time server such as time.windows.com. Afterwards, verify that the date, time, and time zone are correct and try activating Office again. The error is often already gone at this point because the host now trusts the client.

Pay attention to the CMOS battery on an older desktop. A dead motherboard battery resets the clock to a date far in the past every time the machine restarts, causing the time difference to return and activation to keep failing. If the clock drifts after every restart, replacing that battery is the real fix – not manually adjusting the time.

Flush the DNS cache and check the KMS host

If the client cannot find the KMS server, flushing the DNS cache and checking the SRV record helps. An outdated cache might point to an old or wrong host that has since been replaced. Open the command prompt as administrator.

ipconfig /flushdns
nslookup -type=srv _vlmcs._tcp

The first command clears outdated DNS entries. The second queries the SRV record that points to the KMS host. If you get a server name and port 1688 back, the host is known in DNS and the problem is likely with the time or the firewall. If nothing comes back, you must set the KMS host manually (see the next section) or resolve the DNS problem with your administrator.

Then test whether you can actually reach the host. A ping test says little because ICMP is often blocked, but activation via ospp.vbs gives the last error code in /dstatus, showing whether the connection succeeded or failed. That way you know if the issue is with name resolution or the network path.

Set the KMS host and activate with ospp.vbs

Office contains a script, ospp.vbs, that lets you view the licence status and control activation. Open the command prompt as administrator and navigate to the Office folder. The folder name depends on your version; Office16 covers Office 2016 up to 2021.

cd "C:\Program Files\Microsoft Office\Office16"

cscript ospp.vbs /dstatus              :: show current licence status
cscript ospp.vbs /sethst:kms.bedrijf.nl :: set KMS host manually
cscript ospp.vbs /act                  :: activate

If you use 64-bit Office on 64-bit Windows, the folder is under C:\Program Files. With 32-bit Office on 64-bit Windows, it's under C:\Program Files (x86). /dstatus shows whether the key is registered as a KMS client and the last error code. /sethst points to the correct server when DNS doesn't supply one automatically. If the host is correct, /act succeeds and the status changes to Licensed.

To clear a wrongly configured host, use cscript ospp.vbs /remhst, so the client searches via DNS again automatically. If you don't know the exact KMS host name, ask your administrator; guessing a name only produces a new error code. Microsoft describes the error code and KMS context in the official documentation on error 0xC004F074.

Read the output of /dstatus carefully. The LICENSE STATUS line shows whether Office is activated (Licensed) or not, and the last error code appears at the bottom. If you see 0xC004F074 there again, the client managed to contact the host but activation failed, pointing once more to a time or threshold issue. If you run multiple Office products, use cscript ospp.vbs /dstatusall to see the status of all installed licences at once.

Allow port 1688 in firewall and antivirus

Even with a correct SRV record and matching time, activation fails if network traffic is blocked. KMS communication runs over TCP port 1688 by default. A strict firewall, a VPN policy, or an antivirus with network protection can close that port, so the client knows the host but cannot reach it.

• Allow outbound TCP traffic on port 1688 to the KMS host in Windows Defender Firewall.
• Check whether an external firewall or proxy blocks traffic between client and host.
• Temporarily disable the network protection of an antivirus to test whether it's the culprit, and re-enable it afterwards.

If you work from home but should be on a corporate network, the client cannot reach the internal KMS host because it's usually only visible inside the company network. In that case, first connect to the corporate network or VPN and then activate again.

Check whether you have a volume licence

If you see this error on a home PC, the wrong installation variant or key has probably been used. A retail or Microsoft 365 installation should never require a KMS server. The table makes the distinction clear.

If it turns out you actually have a retail product, remove the KMS installation and reinstall Office from your Microsoft account or with the retail key. A MAK key activates online, so you can enter the key with ospp.vbs and activate directly with Microsoft. If you'd like to know which variant suits you best and how activation works in principle, read what software activation involves and the comparison between Microsoft 365 and Office 2021.

Quick checklist for error 0xC004F074

Work through the steps in order. In most networks, the error is gone after time and DNS recovery.

1. Set system time, date, and time zone to automatic and synchronise.
2. Flush DNS cache with ipconfig /flushdns.
3. Check KMS SRV record with nslookup -type=srv _vlmcs._tcp.
4. Allow port 1688 in firewall and antivirus.
5. Check licence status with cscript ospp.vbs /dstatus.
6. Set KMS host manually if necessary and activate with /sethst and /act.
7. Verify it's a volume licence; otherwise reinstall as retail or Microsoft 365.

If the error persists after all steps, the problem lies with the KMS host itself. Report it to your system administrator with the error code and the outcome of /dstatus, so they can check the server's availability and client count.