Port 1688: Microsoft KMS — The Port That Keeps Windows Alive

What This Port Is

Port 1688 sits in the registered port range (1024–49151), the territory IANA sets aside for services that have applied for a slot. IANA has not formally assigned port 1688 to any service. No RFC governs it. No official standard designates it.

And yet, if you work in enterprise IT, you know exactly what port 1688 is.

Microsoft chose port 1688 for its Key Management Service (KMS), and that informal choice has calcified into de facto standard. Millions of Windows machines in organizations worldwide connect to this port, silently, every seven days, to renew their right to exist.

Microsoft KMS: The Problem It Solves

Before KMS, volume licensing was a logistics nightmare. An organization buying 10,000 Windows licenses needed to activate each one individually, often requiring Internet access per machine or lengthy phone calls to Microsoft. That doesn't scale.

Microsoft introduced KMS with Windows Vista and Windows Server 2008 to solve this. The idea: designate one internal server as the "KMS host," activate it once with Microsoft, and let every other machine in your organization activate against that server instead of against Microsoft directly.

The KMS host listens on TCP port 1688.

How It Works

When a KMS client (any volume-licensed copy of Windows, Office, or Windows Server) needs to activate or renew:

1. Discovery: The client looks for a DNS SRV record called _VLMCS._tcp in the local domain. This record points to the KMS host.
2. Connection: The client opens a TCP connection to port 1688 on the KMS host.
3. Request: The client sends a single activation request packet using anonymous RPC.
4. Response: The KMS host checks its activation count. If enough machines have registered (the threshold is 25 clients for Windows, 5 for Office), it sends back a confirmation.
5. Done: The session closes. The whole exchange takes milliseconds.

The activation isn't permanent. A KMS-activated machine must renew every 180 days, with renewal attempts every 7 days. If a machine can't reach port 1688 for 180 days, it enters a 30-day grace period, then reduced functionality mode. The port is the lifeline.

The Security Angle

Because port 1688 traffic uses anonymous RPC and is not encrypted by default, it should only be reachable from internal networks. Exposing a KMS host to the Internet is asking for abuse — there have been widespread piracy tools that impersonate KMS hosts to activate unlicensed Windows installations.¹

If you're auditing a network and see unexpected traffic on port 1688 to an unusual host, that warrants investigation.

What's Actually Listening on Port 1688

To check what's using port 1688 on a local machine:

Windows:

netstat -ano | findstr :1688

Then look up the PID in Task Manager. On a KMS host, you'll see sppsvc.exe — the Software Protection Platform service.

Linux/macOS:

sudo ss -tlnp | grep 1688
# or
sudo lsof -i :1688

Unassigned Doesn't Mean Unknown

The gap between "IANA unassigned" and "universally used" is a recurring feature of the port system, not a bug. IANA assigns ports by application, and many vendors simply pick a number and ship before formalizing anything. Port 1688 is one of the most prominent examples: an entirely informal choice that became so ubiquitous that enterprise firewalls have named rules for it.

If you manage Windows infrastructure, port 1688 (TCP, inbound to your KMS host, from internal subnets) needs to be open. That's not a recommendation — it's a requirement.