Windows 7 activation through a Smoothwall proxy

[Ric_]

I'm having a bit of a nightmare activating Windows 7 through our Smoothie box. The error code received is 0x8004fe33 and, according to Activation fails when you try to activate Windows Vista or Windows Server 2008 over the Internet it is a problem with the proxy connection.

 

I've tried adding an exception for all the sites listed but that doesn't seem to have worked. The logs also don't seem to show the box hitting any of those sites wither. Any ideas?

 

BTW - Since I only need to activate two machines at present I don't want to sort out a KMS server yet. I know I can totally unfilter them but it's beside the point as it should work and it would be handy to have it working anyway.

[tom_newton]

Have you stuck their domains in "do not auth for"? That might help.

[tom_newton]

Ooh, ooh... are you sure activation is using a proxy? does the "proxycfg" command still exist in win7? Sometimes various windows components don't use the proxy as set in IE.

[Ric_]

Have you stuck their domains in "do not auth for"? That might help.

 

dumb-ass me

 

Ooh, ooh... are you sure activation is using a proxy? does the "proxycfg" command still exist in win7? Sometimes various windows components don't use the proxy as set in IE.

 

No it doesn't.

 

... and now I can't test it because the NIC on theat machine seems to have gone West!

[linkazoid]

I never managed to get ours to work either through our smoothie.

 

In the end I activated our 2 test machines on a unfiltered connection.

[Sylv3r]

We couldn't activate our Windows 2008 servers through or smoothwall box but added all the microsoft domains to the do not authenticate setting and it works. How ever it requires microsoft.com so I tend to add / remove this as and when required as I don't want to give a free reign to MSN messenger etc.

[paul_1989]

After some network card problems yesterday that are now resolved, the error code seems to have changed to 0xC004FC03.

 

I tried adding microsoft.com to the smoothwall "Do not require authentication for these domains" section and tried activating again. It then produced the error code 0x80072EFD.

 

Each error seems to point to network problems in that it cannot establish a connection with the server.

 

(Oh, I'm Ric's assistant by the way )

[tom_newton]

Hi Paul! Must be a tough job working for Ric

 

Is there anything interesting in the logs? I'm thinking you might want to check for banned filetypes etc.

 

You would have hoped microsoft would have made this easier eh?

 

I'll have a blocklist daemon look into this, break out the MSDN subs

 

Tom

[mounters]

Have you added the proxy in through netsh?

 

cmd

netsh

winhttp

set proxy ADDRESS:PORT

[paul_1989]

In my application logs im getting 2 errors each time I try to activate.

 

Source: Security-SPP

Event ID: 1008

Acquisition of Secure Processor Certificate failed. hr=0xC004FC03

 

Source: Security-SPP

Event ID: 8200

License acquisition failure details.

hr=0xC004FC03

 

 

 

Just tried adding the proxy through netsh and no joy, still getting error code: 0xC004FC03

[mounters]

In my application logs im getting 2 errors each time I try to activate.

 

Source: Security-SPP

Event ID: 1008

Acquisition of Secure Processor Certificate failed. hr=0xC004FC03

 

Source: Security-SPP

Event ID: 8200

License acquisition failure details.

hr=0xC004FC03

 

 

 

Just tried adding the proxy through netsh and no joy, still getting error code: 0xC004FC03

 

Have you installed any root certificate updates on the box that wont activiate Update for Root Certificates [November 2009] (KB931125)

[nile_c]

Hi guys,

 

In addition to the usual Microsoft domains for "Do not auth", I found you also need the following:

activation.sls.microsoft.com

 

Please let me know whether that works.

 

EDIT: Forgot to add, you need to allow the domain too.

Edited February 23, 2010 by nile_c

[john]

To be weird mine worked 110% perfectly through my smoothwall and that was both 2008 R2 and Windows 7. Sorry to be annoying but someone has to!

[paul_1989]

Haha, thanks John.

 

nile_c, no luck there, we already have those settings in place

 

mounters, as far as I can see everything i sup to date and running fine.

[nile_c]

Strange, could you send me your web filter log whilst a client attempts to activate?

[paul_1989]

Nothing new pops up on the web filter log as I try to activate it, so I'm not sure it would tell you much really >.<

[nile_c]

Well, it tells us that the traffic might not even be hitting your SmoothWall.

 

Do you fancy running a tcpdump for extra fun?

[paul_1989]

I've attached the results when I try to activate. I'm 10.10.0.184

activation.7z

[nile_c]

Thanks paul_1989. Comparing your dump with my own from the other day I've found the problem. The activation process accesses 'go.microsoft.com' first and then gets bounced with a 302 to activation.sls.microsoft.com

 

So, we also need to include go.microsoft.com to the auth exclusions and make sure it is allowed. Hopefully that is the last one :-)

[paul_1989]

I have go.microsoft.com in the auth exclusions but what do you mean by make sure it's allowed?

[nile_c]

Once you setup the auth. exclusion it will treat any access to those domains as "Unuathenticated IPs". Because there is no way to tell who is behind the request once we skip authentication.

 

You will generally have the "Unauthenticated IPs" group blocked from the internet, or using a quite restricted policy. The next step is to create an 'Allow' rule so that unauthenticated clients can get to the excluded domains.

 

Based on this thread, the relevant domains for Win7 activation are:

activation.sls.microsoft.com

go.microsoft.com

 

(In addition to any others already configured for windows/office updates etc.)

[paul_1989]

Thank you! I'm no longer "a victim of software counterfeiting" haha.

Had those 2 in the do not require authentication box all along, but with unauthenticated users disallowed access.

[MartinT]

Thank you for this. I have been puzzling over how to get Windows Activation and Updates to work properly through our Smoothwall/Smoothguardian setup and this technique works perfectly.

[DrCheese]

Ooh, ooh... are you sure activation is using a proxy? does the "proxycfg" command still exist in win7? Sometimes various windows components don't use the proxy as set in IE.

 

You can use this nowadays..

open elevated CMD

netsh

winhttp

import proxy source=ie (will copy ie settings)

 

to remove, it's just

reset proxy (Instead of import proxy)

[machin05]

Have you stuck their domains in "do not auth for"? That might help.

 

Sorry to bump a really old thread, but we are having this same issue with our new Smoothwall but I can't seem to find the "Do not Auth for" settings?

 

Can someone kindly point me in the right direction?

 

Cheers,

Will