Small Rant: Windows Activation

[u/EktoHunter]

TLDR: Offline activation via https://aka.ms/aoh requires a captcha, MS account login and 2FA once per client, with ~80 to go. Any tips on speeding this up?

I'm just kinda curious about the opinion of other Sysadmins that have to work with Windows clients.

I work as a sysadmin at the factory of a fairly large company, where we mainly use Windows for our production floor clients. To extend the amount of support we get for each client, we have a standardized image, which gets updated every few years for a new release of IoT Enterprise LTSB / LTSC.

To get an image of what I am doing right now: (spoilering this part as it isn't too important to my rant) I was tasked with executing our project of updating out-of-date 2016 LTSB clients to 21H2 LTSC, as the new version will allow security updates for us until 2032. Some of our clients are former Windows 7 clients that aren't even officially compatible with Windows 10 according to the manufacturer, but Windows 10 might run on them, so to save money we keep the clients as long as they will run (meaning they will be phased out with Windows 11). We are also jumping from 1607 directly to 21H2, which Microsoft has explicitly advised us is not the official procedure or supported by them. But, updating between each version and needing a license would be a way higher financial impact than how we're currently going about it.

So, since our clients aren't connected to the internet, they cannot connect to Windows servers for activation. As such, I have to use slmgr.exe and SLUI 4 to activate the clients (formerly using the hotline, nowadays just the website https://aka.ms/aoh).

This activation requires you to put in a long string of numbers that the UI will show you into a field on the website and to reach that website you must always 1. Solve a Captcha and 2. Log into your Microsoft account, always forcing 2FA confirmation. And it doesn't remember your Microsoft Account, ever. You always have to log in again, from the start, solving the captcha. There is no button to activate another client once you finish activating the one you're currently working on, you need to re-load the link and start again. And again. And again. I've already optimized my current workflow as well as I can, using a python script to generate the QR codes I need for given commands so that I can avoid dealing with typing in the same commands over and over. But every time, I have to spend around 2-5 minutes dealing with the online Microsoft activation process.

Btw, if your connection is lost, you connect to a different AP or such, somehow the website doesn't require reauthentication. I don't know how exactly the process here works, but I can log into a tab for the site in one browser, open another in an incognito tab, open the next in a third browser, etc. And it'll usually last all day, so if I logged in and didn't use the session 'til the evening, it won't require reauthentication. My guess is that the endpoint / API request in the background actually works without authentication, and the whole login process is just a security circus akin to the TSA, and that if I knew a bit better about how web development works, I could probably just find out how the API request to Microsoft servers work to skip authentication. But I don't wanna risk getting in legal trouble just because I am not following the officially mandated license activation procedure.

Does anyone have some advice for me on how to save some time doing this? I got around 80 clients left to go and am pretty tired of the whole process.

[u/irsyacton]

Can you not use an internally hosted activation server? Typically you’d set that up on a server (or workstation even), activate it once, then point your clients to it. Heck I think clients will even just broadcast out to their local subnet to see if there’s an activation service available. Then the clients just check in occasionally to confirm the license is still active.

[u/EktoHunter → u/irsyacton]

We cannot, I've actually brought this up before with management. Apparently they used to use one before I was hired. As some corporate devices are used in some of our VLANs though, and they have to connect to the activation servers that central IT runs, I was told that our CISO and our contact at central IT have decided to forbid running an activation server locally in our production VLANs. This was what they decided on back then, because our standard process requires only aquiring manufacturer pre-activated clients, so an activation server would usually not be necessary, and in the few cases where it is necessary they decided that it would be alright to have someone from 1st level (or I guess an admin like me, as it turned out in the end) activate the devices by hand.

[u/Shanga_Ubone → u/EktoHunter]

Maybe it's worth having this conversation again because it sounds like there is a difference of understanding here. They're saying no local activation server is required because it's only needed for occasional use. You're saying there is so much occasional use that you need a better solution for activation. Maybe talking this through again with Central IT to make sure everybody understands what's going on here would be helpful.

[u/tsaico → u/Shanga_Ubone]

I will often use the analogy of a bathroom in your house. It is the least used room, there's only a handful of use cases, is generally useless for all the other use cases, and makes life a lot harder if your house doesn't have one. It is a specialized tool, no different than any other tools. Frequency of use doesn't negate its importance or the value it brings to the table.

[u/irsyacton → u/EktoHunter]

Well, if you have an always on pc, then install the activation service on that pc? Anything domain joined isn’t going to broadcast for its activation server, and given how central IT is acting, I’d expect you have your own vlan (though you should confirm). You’re not registering it into dns, so nothing outside your vlan will even know it exists…

[u/Hamburgerundcola → u/irsyacton]

Lose your job speedrun any%

[u/proudcanadianeh]

Are these domain joined? If so load the update keys into AD and be done with it.

[u/EktoHunter → u/proudcanadianeh]

Yeah, but our AD is a Sub-OU in our global, central-IT managed AD. Not sure if we even have that much control over our Sub-OU. I'll make sure to ask our domain owner tomorrow, though. Thanks for the idea!

[u/Tomazim → u/EktoHunter]

AD activation is the best way, it is designed for splitting down availability into OUs and whatnot.

[u/simask234]

Have you looked at VAMT? But if a KMS server is out of the question, this might not be an option either

[u/EktoHunter → u/simask234]

VAMT would (as far as I know) require a KMS + MAKs. So, I'm guessing that'll be out of the question, but I'll bring it up tomorrow in the team daily.

[u/Am0nymou5 → u/EktoHunter]

No, VAMT doesn't need KMS + MAK, it can activate any type of Windows/Office license via proxy activation. You just load up the keys in VAMT, the machine that VAMT is on needs internet access to microsoft.com (proxy works too) and WMI/RPC connectivity to reach to the other PCs - which should be allowed in a standard AD environment.

Once it's all set up, you load the computers/OU you want to activate into VAMT, and VAMT will try and activate them via WMI/RPC. The only issue is that any machines that are offline will not get activated, so you may need to run VAMT multiple times to get those offline devices as well - but this can be automated via PowerShell script and a scheduled task (only thing to bear in mind is that the PowerShell module for VAMT is pretty old, so you need to run the scripts in a 32-bit PowerShell).

[u/hellcat_uk]

Just wait until you hit the arbitrary maximum number of activations for that key and have to get in touch with Microsoft to extend it.

[u/EktoHunter → u/hellcat_uk]

I got the physical stickers that I gotta rub the little gray window off to show the full key for every client. These aren't MAKs.

[u/StaffNo3581]

I used to do a lot of offline activation, which was doable. 10 years ago it was fine but it went downhill from there. Fortunately I only have to do such activations twice a year nowadays :)

[u/zarkay]

Well, if you do have valid licences and a local Server for activation is really not possible for whatever reason I would use the MAS from GitHub once for every client. You will need an active Internet connection only for the duration of the process.

[u/FeleaseRpseineEiles]

I don't understand their banishment from a separate vlan but that sounds fatal

[u/Fun-Consideration86]

"as the new version will allow security updates for us until 2032"

how are you doing security updates if they are offline?

[u/Excellent-Program333]

We have a client with Office 2021 that we have manually do this every time we re image a machine. Online just doesnt work. A bit of a pain, but we know the client soon will have to bite the bullet and pay for the 365 Licenses soon.

[u/Smooth-Zucchini4923]

1 Solve a Captcha and 2. Log into your Microsoft account, always forcing 2FA confirmation. And it doesn't remember your Microsoft Account, ever.

Some forms of 2FA can be automated. For example, you can automatically respond to a TOTP 2FA attempt by keeping the key on your PC. This does degrade the security of the account, however. The 2FA stops being a 2FA, because it is no longer "something you have" but "something you know."

Btw, if your connection is lost, you connect to a different AP or such, somehow the website doesn't require reauthentication. I don't know how exactly the process here works, but I can log into a tab for the site in one browser, open another in an incognito tab, open the next in a third browser, etc. And it'll usually last all day, so if I logged in and didn't use the session 'til the evening, it won't require reauthentication.

I would open your browser dev tools, and check to see if the page requests an endpoint ending in /logout. I imagine the tool is coded to automatically log the user out, but you could probably stop it by stopping it from making that request.

[u/vulcandroid]

We run into this too in manufacturing. Last year they would block your phone number after 10 tries. We burned through every phone in the project teams to get everything activated. They've been changing this system a lot the past few months.

[u/420GB]

We use AD based activation, I've never typed a Windows license key at work.

[u/kernelqzor → u/420GB]

same, once we moved to KMS/ADBA it was like a whole category of pain just disappeared overnight

if you’re stuck with offline boxes though, that hotline / website dance is basically hell on earth, i’d be begging management for some kind of KMS island or at least a one-time “activation week” with temp network access

[u/BlackV]

TLDR: Offline activation via https://aka.ms/aoh requires a captcha, MS account login and 2FA once per client, with ~80 to go. Any tips on speeding this up?

dont do it offline, KMS activation first option, AD activation 2nd option

[u/catwiesel]

i would tell management to give me 20 monkeys for a week.

that is the price of using windows.

make the people who decide suffer.