KMS Idle Time Monitor

Microsoft.KMS.Product.IdleMinutes.Monitor (UnitMonitor)

The purpose of this rule is to alert system administrators to a possible KMS or network outage.
This rule monitors the end-to-end operation of KMS activation.
A notification event is created by KMS if no activation or renewal requests were logged by KMS (activity event 12290) in the specified time interval.
In addition to new activations, periodic renewal requests are expected to occur (default is 7 days).
Whether or not this alert is serious depends on the number of machines in the KMS environment, how many are actually connected, and the configured renewal interval.

Knowledge Base article:

Summary

The purpose of this rule is to alert system administrators to a possible KMS or network outage. This rule monitors the end-to-end operation of KMS activation. A notification event is created by KMS if no activation or renewal requests were logged by KMS (activity event 12290) in the specified time interval. In addition to new activations, periodic renewal requests are expected to occur (default is 7 days). Whether or not this alert is serious depends on the number of machines in the KMS environment, how many are actually connected, and the configured renewal interval.

Causes

Any failure or incorrect configuration of the KMS service, other Windows components, firewall, hardware, network or routers can trigger the Idle Minutes Alert. This alert can also result from normal behavior, since it is possible that not enough machines attempted to activate or renew during the specified time interval.

Resolutions

The first step is to determine whether there really is a problem. Start with a known good KMS client and run (with elevated privileges) the script slmgr.vbs -ato . If the activation/renewal fails, it will report an error code. You can direct the client to connect to a specific KMS machine by using the slmgr.vbs -skms option. The request event (12288) and response event (12289) in the Windows Application event log may provide additional information, including the identity of failing KMS machines. If there has been a failure, check the following:

Software Licensing service (slsvc) is running.

Other KMS machine behavior is normal.

KMS firewall port is open (default is TCP 1688).

Attempt to connect to KMS using telnet to the KMS port(you won’t be able to do anything other than connect)

Use a network monitor (e.g. netmon) to capture and trace network problems.

There is one Idle Minutes Monitor that is used to monitor for activity. It may be desirable to adjust the time threshold, depending on expected KMS activity.

Additional

There are 3 Missing Activation Requests rules that collectively span a 24-hour period. It may be desirable to disable one or more of these and/or to adjust the time intervals, depending on expected KMS activity.

Element properties:

TargetMicrosoft.KMS.Product
Parent MonitorSystem.Health.PerformanceState
CategoryPerformanceHealth
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.KMS.Product.IdleMinutes.MonitorType
RemotableFalse
AccessibilityPublic
Alert Message
KMS Idle Minutes Monitor Alert
Key Management Service (KMS) inactivity exceeded threshold.
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.KMS.Product.IdleMinutes.Monitor" Accessibility="Public" Enabled="true" Target="Microsoft.KMS.Product" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="false" Priority="Normal" TypeID="Microsoft.KMS.Product.IdleMinutes.MonitorType" ConfirmDelivery="false">
<Category>PerformanceHealth</Category>
<AlertSettings AlertMessage="Microsoft.KMS.Product.IdleMinutes.Monitor.AlertMessage">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Warning</AlertSeverity>
</AlertSettings>
<OperationalStates>
<OperationalState ID="UnderThreshold" MonitorTypeStateID="LessThanEqualThreshold" HealthState="Success"/>
<OperationalState ID="OverThreshold" MonitorTypeStateID="GreaterThanThreshold" HealthState="Warning"/>
</OperationalStates>
<Configuration>
<IntervalSeconds>14400</IntervalSeconds>
<IdleMinutes>$Target/Property[Type="Microsoft.KMS.Product"]/IdleMinutes$</IdleMinutes>
<IdleMinutesThreshold>720</IdleMinutesThreshold>
</Configuration>
</UnitMonitor>