How to check Genuine Windows Licensing and Activation

ionbasa · September 2, 2015

How to check Genuine Windows Licensing and Activation:

Note: This is a WIP. More content to come, especially for Win8.0+

About:

This is meant to be used as a guide on how to determine the status of Windows Licensing and Activation of a particular OS. It also serves to inform the community of how to possibly spot Windows Activations which are non-genuine, tampered with, or pirated.
Ideally, this information is to be used in troubleshooting Windows activation issues during Installs or Upgrades. This should also let you check if Windows has an tampered activation (such as from buying a second hand PC off of eBay, or a pawn shop).

Preface:

Why run a utility to check licensing?

Because people lie, or don't know what they're talking about. The Genuine-ness of a system can indicate a lot about the system and user - such as whether they are likely to download things from dodgy website which can result in rootkits/viruses/malware. It can also shine some light as to whether the user has been conned by someone (such as with second hand machines off eBay).

Some considerations to ponder:

If a system has an OEM sticker on it, and is from firm ABC, then it *should* have firm ABC's OEM_SLP Key in place unless the user has replaced it with the COA Key.
If a totally different Key is in place, then something is wrong, eg: HP machine with Acer SLP Key.
If the version on the COA sticker doesn't match the installed version, but the Key is an OEM_SLP Key, then something is wrong, eg: COA key for Home Premium (core) but Professional SLP Key is installed.
If the Key is a 'valid' Volume license Key - Maybe the machine at one point belonged to an organization or is part of a larger domain, eg: Work computer provided by Company or Academic Institution.
If the report shows the presence of a Loader (a program to bypass Windows Activation) - then you got a peg leg on your hands (pirate).

General Background Information

The sections covers some background information about Product IDs, Channel IDs, OEM Keys, etc.

The Product ID tells us which channel the key came from, eg: Technet, VL, Retail, MSDN. The second group of characters in the ID is known as the Channel ID (CID) - and certain CID codes belong exclusively to such accounts. In Windows 7 there are no more than 20.
SEE: https://social.microsoft.com/Forums/en-US/a2444f34-0aff-4f29-a8ac-67e28b0c0285/blocked-product-keys?forum=genuinewindows7

This is the Key found on the COA.
ALL OEM_SLP Keys are blocked from activation online if used the first time on a machine, but normally give rise to a different error code (0xC0040003).
You always have to phone in whenever using a OEM_SLP key to activate for the 1st time.

Section 'B' -MGADiag Specific

MGADiag:

The Microsoft Genuine Advantage Diagnostic Tool provides detailed information about the Microsoft Genuine Advantage components and settings currently on your system. It will allow you to diagnose and automatically resolve problems regarding your Genuine Windows.
It is officially supported on XP/Vista/7. It partially works with Windows 8.0+

Download links:

http://go.microsoft.com/fwlink/?linkid=52012
http://go.microsoft.com/fwlink/?linkid=56062
These are the ONLY links that are kept current.

The 0xc004c4a2 error ALWAYS indicates a Blocked Key

The Invalid License Key' entry in the Validation Code line of an MGADiag report has a particular means that such a Key is not one which has been issued by Microsoft, and does not appear in their database. Primarily found in Volume License situations, it means that the Key has been generated by a 3rd party tool.

Spotting a stolen key:

Here is a sample of a partial MGADiag using a publicly blocked Lenovo Key after it publicly leaked before Windows 7 RTM:

Note the Cached Online Validation Code "0xc004c4a2" which specifically means 'Blocked Key'. If you ever see that code in that position it means that the Key is blocked from activation and validation, and that consequently the installation is non-genuine.

Here is another sample report:

Again - it's blocked, but this time it's a Retail Key; except that it isn't a normal Retail Key - it's one from an MSDN subscription account, which cannot legally be sold retail. It's been blocked by reason of Abuse - too many activations on too many different computers in too short a time.

Credits:

Sysnative: http://www.sysnative.com/

John Carrona (Microsft MVP): http://www.carrona.org/

My friends at PChelpforum/ Sevenforums/Eightforums/Tenforums: http://www.designermedia.com/

Todo:

Add Channel lists

Add Windows 8.0+ information

Tidy up formatting.

Diagnostic Report (1.9.0027.0):-----------------------------------------Windows Validation Data-->Validation Code: 50Cached Online Validation Code: 0xc004c4a2Windows Product Key: *****-*****-YG69F-9M66D-PMJBMWindows Product Key Hash: /kehptF9HHVxM5d8dUnqgcfndXw=Windows Product ID: 00426-OEM-8992662-00497Windows Product ID Type: 2Windows License Type: OEM SLPWindows OS version: 6.1.7600.2.00010100.0.0.001

Diagnostic Report (1.9.0027.0):-----------------------------------------Windows Validation Data-->Validation Code: 50Cached Online Validation Code: 0xc004c4a2Windows Product Key: *****-*****-88G42-3JM44-2GXYVWindows Product Key Hash: TbrwHqt/yNRYNPi8RHSsGDbY4jQ=Windows Product ID: 00426-068-6958617-86244Windows Product ID Type: 5Windows License Type: RetailWindows OS version: 6.1.7601.2.00010100.1.0.001