viktor/kms-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

kms-website: anonymous client diagnostics (Send-Diag -> /diag) + FAQ disclosure

Browse source 
Fire-and-forget telemetry so script failures are captured server-side (Loki via
the kms-diag collector). kms-bootstrap.ps1 + setup-kms.ps1 POST a small anonymous
JSON event at each outcome (action, ok/fail, error text + exit codes, EditionID/
build/locale, detected Office products; no hostname/user/keys). 3s timeout,
errors swallowed -- never affects activation. $env:KMS_NO_TELEMETRY=1 opts out;
$env:KMS_DIAG_URL overrides. Version baked at build via Dockerfile sed
(__KMS_VERSION__ -> SCRIPT_VERSION build-arg). FAQ updated to disclose it.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-01 19:46:49 +00:00
parent b51dc9894c
commit 7cfcd73d83
4 changed files with 76 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

20
layouts/index.html
View file

@ -314,10 +314,22 @@ cscript ospp.vbs /dstatus :: verify --LICENSED--</code></pre>
<summary>Will my activation be logged? What about privacy?</summary>
<p>The KMS protocol itself sends your machine's hostname, your client IP (from the TCP
socket), and the product ID being activated. The server records the event in a log so
the operator can see overall traffic. No personal data beyond what the KMS protocol
itself transmits is collected; nothing is shared, sold, or retained beyond the operator's
monitoring. If that bothers you, run your own vlmcsd — it's a single binary, the source
is on <a href="https://github.com/Wind4/vlmcsd" target="_blank" rel="noopener">GitHub</a>.</p>
the operator can see overall traffic. The PowerShell scripts additionally send a small
<strong>anonymous</strong> diagnostics event (see next question) so the operator can spot
and fix script breakage. No personal data beyond what the KMS protocol itself transmits is
collected; nothing is shared, sold, or retained beyond the operator's monitoring. If that
bothers you, run your own vlmcsd — it's a single binary, the source is on
<a href="https://github.com/Wind4/vlmcsd" target="_blank" rel="noopener">GitHub</a>.</p>
</details>
<details>
<summary>Does the script send anything back to the server?</summary>
<p>Yes — a single <strong>anonymous, fire-and-forget</strong> diagnostics event per run, so the
operator can find and fix execution failures. It contains: the script name + version, what ran
(Windows / Office / edition-switch / install) and whether it succeeded, the error text on
failure, your Windows edition / build / locale, and detected Office products. It does
<strong>not</strong> send your hostname, username, or product keys. It can never block or break
activation (3-second timeout, errors swallowed). Opt out entirely by setting
<code>$env:KMS_NO_TELEMETRY=1</code> before running the one-liner.</p>
</details>
<details>
<summary>Is this legal? Can I use it for anything?</summary>