: On a legitimate network, client machines automatically reconnect to the organization’s KMS host every seven days to reset this 180-day clock. Anatomy of an Unauthorized Activator