Auto-Activating Windows 7

[Duke]

Hi all,

 

This seemed like the best place to post as OS activation is hopefully done as part of or shortly after OS deployment!

 

We have around 800 PCs that we rebuilt with Windows 7 this summer. Our plan was to use an internal KMS server and our KMS key to handle activation. However, quite a few of our machines are still ones that were built from bare-bones chassis with a retail copy of Windows. We found out the hard way that you can't use the KMS key unless the machine has a BIOS flag to say it was shipped with Windows!

 

As such, we've fallen back to using a MAK key, but this only works when you activate the machines manually. For example, the MAK key is built into our image and the PC builds fine. If it's then left alone, it won't activate automatically and will just sit in the out of box grace period. We've had machines running for weeks that should have expired by now, but they say they're still in the grace period. However, if you log on, and click the activate Windows button, it successfully activates in a few seconds.

 

Any idea what might cause this? We have an internal proxy (Smoothwall) and the ISP proxy (SWGfL). As best as I can see, I've set all the 'required' Microsoft activation URLs to be allowed through Smoothwall and to not require authentication. I read somewhere that not all Microsoft processes will pick up proxy settings from Internet Explorer, but if this was the case then why would it work when someone logs on?

 

I've been using the VAMT tool to try to force an activation remotely, and I get the following errors on a machine:

 

License acquisition failure details.

hr=0x80072EE2

Acquisition of Secure Processor Certificate failed.

hr=0x80072EE2

 

Any feedback appreciated!

Chris

[LeightonJames]

Try this as a batch file:

 

cscript //b c:\windows\system32\slmgr.vbs /ipk (type mak key here with hyphens)

cscript //b c:\windows\system32\slmgr.vbs /ato

 

and add it to the run once portion of your installation script.

[Duke]

Cheers, that's definitely worth a try! Just wish I knew why they wouldn't activate automatically!

[morganw]

We found out the hard way that you can't use the KMS key unless the machine has a BIOS flag to say it was shipped with Windows!

 

I'm pretty sure there is no such restriction. Who told you this?

[glen_j]

its true, i had the same issue. it wont activate if there isn't a flag in the bios

You receive an error message when you try to activate Windows Vista or Windows 7 on a computer that was obtained from an OEM

[morganw]

Thanks. What about KMS activation for Windows 7 virtual machines? Surely the hypervisor isn't going to pretend to have been manufactured?

[Duke]

I'm pretty sure there is no such restriction. Who told you this?

 

Microsoft, Google and the KMS server. glen_j's link explains it fairly well.

 

I'd never heard of this at all before this summer, but it affected us pretty badly. It's annoying that there's no way around it, even if you have all your fully legal media and licences to hand. The only solution I saw online was to go back to the bare-bones PC manufacturers and ask them for a BIOS update that includes the 'Windows Installed' flag - there's no guarantee they'd have one or give it to you though. Not sure how you'd go about proving you had a valid copy of Windows anyway, and I didn't fancy doing that many BIOS updates!

 

Not sure about VMs. We don't have many Windows 7 VMs so have activated them all with MAK keys anyway. All our virtual servers use MAK keys too.

 

Cheers,

Chris

[Duke]

Heh, I can't believe there's not more information out there on this one...

 

So, Windows 7 uses 'winhttp' to communicate with Microsoft's servers for activation. winhttp does not pull down proxy settings from IE like pretty much everything else does, so regardless of what settings you've made on your proxy, winhttp isn't going to see or use them.

 

Thankfully, you can set winhttp settings via a command line, so assuming you already have your key in the image (if not then see LeightonJames's post), you need to run something like:

 

netsh winhttp set proxy proxyname:portnumber
cscript //b c:\windows\system32\slmgr.vbs /ato

 

Rather annoying.

Chris

Edited September 21, 2012 by Duke

[LeightonJames]

Glad you got there in the end.