[ms office - o365] Random issues with Shared Computer Activation!

[jadzea]

Having the exact same issue, but only with the latest build of Office365.

 

I’ll have to check the build numbers but I’m convinced this is either a bug in Window or Office365. I suspect the latter only because I’ve noticed it happening since I updated our main image with the latest build of Office365 apps.

 

Very frustrating to have this issue, especially as it has worked so well for so long…

[jadzea]

Just out of interest - anyone who is having this issue, what AntiVirus are you running? Sophos??

[kennysarmy]

Just out of interest - anyone who is having this issue, what AntiVirus are you running? Sophos??

 

Sophos here, but not sure it's related, we can re-create the issue with Sophos disabled.

 

If you sign in as a test user with Office licence, open WORD and check it's activated.

 

Then sign as an admin and remove the user's profile manually by deleting C:\users\ & deleting the associated entry in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\ProfileList

 

Log back in as the test user and open WORD - for me it's then unlicenced/ unactivated.

 

 

However, if you remove the local profile by using "systempropertiesadvanced.exe" - then all is well.

 

Be good to see if anyone can replicate the above.

[jadzea]

Out of interest, what is the build number of the Office365 desktop apps you are using?

 

Ours is Version 2201 Build 16.0.14827.20216

 

In a case where the SSO activation fails Office shows something like Microsoft® Word for Microsoft 365 MSO (Version 2201 Build 16.0.14827.20216) 64-bit and the product ID is blank.

[kennysarmy]

This has been suggested by MS as a possible fix.

 

As discussed over the phone, you can configure the licensing token to roam with the user's profile or be located on a shared folder on the network.

 

This can be done by enabling the include the SCLCacheOverride and SCLCacheOverrideDirectory. Since you already have Office apps installed the SCLCacheOverride and SCLCacheOverrideDirectory can be edited in the registry.

 

Navigate to registry path HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration, add a string value of SCLCacheOverride, and set the value to 1. Also, add a string value of SCLCacheOverrideDirectory and set the value to the path of the folder to save the licensing token. To allow each user license token be added in a folder within the licensing folder on the shared path, kindly ensure the file path is added in the below path format example.

 

\\server\users\%username%\token

 

OR

 

\\server\share\%username%

 

I'm struggling the next couple of days for time, but should be able to try this by the end of the week.

[Koldov]

Hi @kennysarmy

 

Not dealing with O365/M365 apps, but having trouble with the opposite as I am trying to get Office 2019 installed... MS just making things complicated as always!

 

Anyway, just noticed this whilst creating a deployment XML on the website: https://config.office.com/

 

 

Seems like it's an option to set-up the token roaming right from the deployment set-up.

 

Anyway, hope you got it sorted!

[jadzea]

This has been suggested by MS as a possible fix.

 

As discussed over the phone, you can configure the licensing token to roam with the user's profile or be located on a shared folder on the network.

 

This can be done by enabling the include the SCLCacheOverride and SCLCacheOverrideDirectory. Since you already have Office apps installed the SCLCacheOverride and SCLCacheOverrideDirectory can be edited in the registry.

 

Navigate to registry path HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration, add a string value of SCLCacheOverride, and set the value to 1. Also, add a string value of SCLCacheOverrideDirectory and set the value to the path of the folder to save the licensing token. To allow each user license token be added in a folder within the licensing folder on the shared path, kindly ensure the file path is added in the below path format example.

 

\\server\users\%username%\token

 

OR

 

\\server\share\%username%

 

I'm struggling the next couple of days for time, but should be able to try this by the end of the week.

 

Did you manage to get to the bottom of this? I'm still having issues with it.

[kennysarmy]

Did you manage to get to the bottom of this? I'm still having issues with it.

 

I've been on a bit of leave and now catching up with LOTS of project related stuff - hoping to find time to look at his issue again next week.

[jadzea]

I'll feed back our results too.

 

We've just rebuilt our image using the latest version of Office365 apps and things look ok so far...

[TwistedHelixis]

Sorry to jump in, just a quick question. One of my schools has pupils logging into the laptops as a year group and they don't use 365. I have been told to get the Open Value Subscription Education version of Office (with a perpetual license), as this supports shared pupil access.

 

Is this correct?

[CHiLL]

Sorry to jump in, just a quick question. One of my schools has pupils logging into the laptops as a year group and they don't use 365. I have been told to get the Open Value Subscription Education version of Office (with a perpetual license), as this supports shared pupil access.

 

Is this correct?

OVS isn't a type of Office, it's a type of licensing model. The school is only entitled to it if they have <1000 users.

 

You'd most likely want to look at the non-Office 365/Microsoft 365 apps, such as Office Professional Plus 2019 or 2021. They are your more traditional deployments of Office, where you're stuck on that version (you still get security updates) until you deploy the next (whereas O/M365 apps are updated monthly with new features).

[kennysarmy]

Did you manage to get to the bottom of this? I'm still having issues with it.

 

Hi,

 

So I created a new folder share - gave everyone modify rights.

 

Added the following keys to a test PC:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration: SCLCacheOverride = 1. And SCLCacheOverrideDirectory = .\\\O365Tokens\%username%\token

 

Rebooted the test PC.

 

Logged in and the licencing tokens are still being created locally in Users\\AppData\Local\Microsoft\Office\16.0\Licensing

 

 

 

Can anyone see what I've done wrong?

[kennysarmy]

I'll feed back our results too.

 

We've just rebuilt our image using the latest version of Office365 apps and things look ok so far...

 

Can you advise the version?

 

We're testing on : Version 2203 (Build 15028.20228 Click-to-Run)

[jadzea]

Can you advise the version?

 

We're testing on : Version 2203 (Build 15028.20228 Click-to-Run)

 

We've had the problems with 16.0.15028.20204 and 16.0.15028.20228

 

If we go back to version to version 16.0.15028.20218 we find that it generally works ok.

 

I'm convinced it is an issue with the AAD broker plugin. We know it is installed on the machines, but I wonder if the later builds have made some changes to this plugin. We get lots of errors in the AAD logs in event viewer, such as error 1098 or error 1097 (The server has not found anything matching the requested URI. server turn an error for auth code request)

 

???

[jadzea]

Ok so I finally got to the bottom of this!

 

We use AB TUTOR and we’d deployed a logging policy on some machines that was set to monitor websites visited. This meant AB TUTOR set up a local proxy service that it routed traffic through to log what was being visited but stopped activation working.

 

As soon as it was removed things started working again!

[kennysarmy]

Ok so I finally got to the bottom of this!

 

We use AB TUTOR and we’d deployed a logging policy on some machines that was set to monitor websites visited. This meant AB TUTOR set up a local proxy service that it routed traffic through to log what was being visited but stopped activation working.

 

As soon as it was removed things started working again!

 

 

We also have ABTUTOR.

 

But, sadly we are seeing the same issue on computers where we have not installed it

 

We do set our on-site Smoothwall box as our proxy, but they've assured me nothing is being blocked WRT Microsoft activation.

 

I've a call lined up with MS tomorrow to look at this further.

[kennysarmy]

Update.

 

We've created a new GPO - called "C - SCLCacheOverrideDirectory"

 

 

 

As a test we applied this to our Library OU.

 

 

When I check the registry remotely the value of the "SCLCacheOverrideDirectory" gets changed to the name of each machine in the library, eg.

 

 

 

In the \\fp4\d$\O365Tokens folder I can now see being created folders for each library computer:

 

 

MS have reported this is expected behaviour.

 

 

As the license token is being provisioned on a device basis. As confirmed with my team there wouldn't be any implications with this.

 

From my hypothesis it would seem each individual license token is added to the same token file which would change or increase the token file information.

 

We can verify this by opening and confirming the license token information before adding another user and confirm the token details changes when another user is activated on that device.

 

If you can run a test to verify the license token information changes / increases with additional user on the device and give us a feedback.

 

 

Once we've run without issue in the Library we will roll out the GPO to the rest of the computers on site.

[jadzea]

Have you tried removing any AB TUTOR logging policies on the computers that have the issue? As soon as we did this it resolved the problem.

 

It seems that AB tutor introduces a let’s say hidden proxy for the purposes of being able to log websites visited etc into the AB tutor log. Removing the policy (or at the very least removing the option in the an tutor monitoring policy for logging websites visited) solved the problem for users who logged on - we had to delete the local profiles for anyone who had been on previously.

 

We use smoothwall too, but in transparent mode so we don’t have any proxy settings set at all - I wonder if it is fundamentally an issue with office365 activation going through a proxy full stop?

[kennysarmy]

Have you tried removing any AB TUTOR logging policies on the computers that have the issue? As soon as we did this it resolved the problem.

 

It seems that AB tutor introduces a let’s say hidden proxy for the purposes of being able to log websites visited etc into the AB tutor log. Removing the policy (or at the very least removing the option in the an tutor monitoring policy for logging websites visited) solved the problem for users who logged on - we had to delete the local profiles for anyone who had been on previously.

 

We use smoothwall too, but in transparent mode so we don’t have any proxy settings set at all - I wonder if it is fundamentally an issue with office365 activation going through a proxy full stop?

 

Issue was occurring on PC's without AB Tutor and also we don't have any logging policies as far as I'm aware...

[kennysarmy]

Still being plagued by this

 

Especially bad if we remove all local profiles using a script we have.

 

Can anyone share their methods for freeing up hard disk space taken by local profiles to see if there is something "off" with our script.

[Warwick_Tech]

Still being plagued by this

 

Especially bad if we remove all local profiles using a script we have.

 

Can anyone share their methods for freeing up hard disk space taken by local profiles to see if there is something "off" with our script.

 

Sorry to Necro an old thread, but we are getting the same errors - So far a logoff and logon fixes it, but these are Controlled assesments so that's not going down well;

 

Interesting theory on the profile cleanup, ours is supposed to clear them on each reboot, we use a couple of different methods;

 

1. Via the standard GPO

2. Via a custom PS script

 

 

$profiles = $null

 

$profiles = Get-WMIObject -class Win32_UserProfile | Where {((!$_.Special) -and ($_.LocalPath -ne "C:\Users\Administrator") -and ($_.LocalPath -ne "C:\Users\UpdatusUser"))}

 

if ($profiles -ne $null) {

$profiles | Remove-WmiObject

}

 

Not sure if it's either/both of these?

 

Did your trick with the 'shared folder' work?

 

----

EDIT

 

When manually removing profiles I use the following, but this isn't set automate anywhere;

 

Get-CimInstance win32_userprofile -verbose | Where {$_.LastUseTime -lt $(Get-Date).Date.AddDays(-14)} | Remove-CimInstance -Verbose

 

This one never worked!

 

#requires -RunAsAdministrator

 

$Filter = '{0}{1}{2}{3}' -f 'Special=False AND Loaded=False AND LastUseTime<=',"'",$(Get-Date).Date.AddDays(-30),"'"

Get-WmiObject -ClassName Win32_UserProfile -Filter $Filter |

Add-Member -MemberType ScriptProperty -Name UserName -Value {

(New-Object System.Security.Principal.SecurityIdentifier($this.Sid)).Translate([system.Security.Principal.NTAccount]).Value } -PassThru |

ForEach-Object {

Write-Output "Deleting $($_.LocalPath)"

$_.Delete()

}

exit

Edited February 26, 2024 by Warwick_Tech

[kennysarmy]

Sorry to Necro an old thread, but we are getting the same errors - So far a logoff and logon fixes it, but these are Controlled assesments so that's not going down well;

 

Interesting theory on the profile cleanup, ours is supposed to clear them on each reboot, we use a couple of different methods;

 

1. Via the standard GPO

2. Via a custom PS script

 

[ATTACH=CONFIG]70963[/ATTACH]

 

 

 

Not sure if it's either/both of these?

 

Did your trick with the 'shared folder' work?

 

----

EDIT

 

When manually removing profiles I use the following, but this isn't set automate anywhere;

 

 

 

This one never worked!

 

Yes, we don't get issues anymore - the trick with redirecting the tokens to a central folder seemed to do the trick!

[kennysarmy]

Yes, we don't get issues anymore - the trick with redirecting the tokens to a central folder seemed to do the trick!

 

Spoke to soon.

 

We're getting quite a few issues this term with staff & students not getting the O365 token

 

 

UNLICENSED PRODUCT Most features are turned off because a shared computer license isn't available

 

 

I had to remove a teacher's local profile to fix the issue this morning.

 

Sometimes a restart fixes it.

 

Sometimes signing out of office and back in fixes it.

 

I can never recreate the issue and show it to Microsoft, it just seems to break randomly and it's very annoying for the users and us

[ozydave]

This is still driving me mad.

 

Cannot seem to find anything that works consistently to clear the error.

Uninstalling office and re-installing don't work.

Deleting local profiles don't work

The trick above moving the tokens, the problems return after a while, so don't work.

I reimage the device again the problem returns after a while.

 

what a pile of poo

[kennysarmy]

This is still driving me mad.

 

Cannot seem to find anything that works consistently to clear the error.

Uninstalling office and re-installing don't work.

Deleting local profiles don't work

The trick above moving the tokens, the problems return after a while, so don't work.

I reimage the device again the problem returns after a while.

 

what a pile of poo

 

Still an issue here - we found this works fairly reliably.

 

Open PPT, log off via account menu option, close PPT, login in via account (twice as first one throws up an error), close PPT, open PPT, slight delay and it works.