How to Manage Multiple Products on Seperate KMS Servers

Question

I'm planning on building a KMS server to manage volume licenses for Office 2013 products (Visio and Project). I am in an enterprise leveraging an existing KMS server to activate and license Win7 and Outlook 2010 but we don't have any administrative
capabilities on the server itself. We own the volume licenses for 2013 but do not have access to the 2010 licenses, which are owned by our enterprise HQ.
Is there a way to make my 2013 products license from my new KMS server but ensure that Windows 7 and Outlook 2010 still activate from the enterprise server?
I would prefer to leverage Site GPO's assigned to security groups but from what I've read so far, KMS and Group Policy aren't capable of that level of integration. Any help would be appreciated.

Answer 1

if you don't publish your KMS into DNS, how will your clients find it?
Your clients need to find the HQ KMS, so they can activate and renew their Windows and Office2010 client tokens. your subset of clients, need to find your local KMS, so they can activate and renew their Office2013 client token.
Without both KMShosts published into DNS, one of them will be undiscoverable.
With your clients statically configured for a specific KMShost, only part of your client requirements will be met.
To be honest, I've never explored the possibility of statically configuring a client for more than a single KMShost. It may be possible, or, it may be explicitly not possible (could even be stated in the docs).
It's my understanding that you can exploit the publishing and discovery behaviour to meet your goals (publish both KMShosts into DNS), and, use fwall or IPsec etc to refuse subnets connection into your KMShost.
KMS Isolation guide:
http://technet.microsoft.com/en-us/library/cc723923(TechNet.10).aspx
But, what I would do, is to have the HQ KMShost uplifted to service your Office2013 KMSclients.
That means you don't have to fiddle about, setting up a KMS, nor maintaining it and it's necessary minimum threshold client_count etc.
Remember - if a VL product is installed, you need an entitlement/license. KMS activation is irrelevant for licensing entitlement purposes. i.e. a KMSclient installation, if unactivated, still requires entitlement/license to exist and be assigned to that
device.
I know that people figure that if rogue cowboys plonk a copy of VL on a PC and the KMShost activates it, "that's bad".
Actually, it's irrelevant.
Once the product is installed, you have to be licensed.
If the cowboys/rogues don't get that or don't agree with it - tough.
I also recognise that it's rarely this cut and dried in organisations (it sure is hard to get audit/compliance across in my org), but, those dudes have to take responsibility for their actions.
It's our job to make sure they are properly informed..
/I don't work for MS. I am a grumpy old sod :/
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)