Update KB971033/KB4480960/KB4480970 bricks Windows 7 Genuine (0xc004f200)

[German]New day, new problem: Microsoft probably released the old update KB971033 again the night before. As it looks, Windows 7 is no longer activated after installing the update and is reported as not genuine. Addendum: It's related to Windows 7 January 7, 2019 Update KB4480960 (security-only) or KB4480970 (Monthly Rollup).

I just stumbled across the topic at askwoody.com, where it hit enterprise clients with Windows 7.

Update KB971033 for Windows 7

The description for update KB971033 was last updated on April 17, 2018 and deals with the topic Windows Activation Technologies for Windows 7. There is a new activation update there to ensure that Windows 7 can be activated.

Update re-released, breaks on clients

Woody Leonhard wrote that night that Microsoft has re-released the KB971033 update for unknown reasons. Since then, admins have complained about Windows 7 clients that are no longer activated. On reddit there is this thread which describes the drama..

PSA: Windows 7 Genuine Advantage – KB971033. Make sure you don't have it!

Woke up this morning to find a few thousand Windows 7 VDI machines reporting that Windows 7 wasn't genuine. After much troubleshooting we found that KB971033 (should not have been installed in a KMS environment in the first place) was installed on these machines. Until today having this KB installed hasn't been an issue, it appears a change to how Microsoft's activation servers respond to a standard KMS key being sent to them may be to blame.

Removing the update, deleting the KMS cache and activation data from the PC's and re-activating against KMS resolved the issue.

The thread starter found suddenly a few thousand Windows 7 VDI machines that reported that Windows 7 was not genuine. After many tests, he found that KB971033 (which should not have been installed at all in a KMS environment) was installed on these machines and causes this issue. 

The thread starter writes that installing this KB has not been a problem so far. It seems that a change in the response of Microsoft's activation servers to a default KMS key sent to them could be to blame. Removing the update, deleting the KMS cache and activation data from the PCs, and reactivating against KMS fixed the problem. A user has posted the following fix script:

wusa /uninstall /kb:971033 /quiet
net stop sppsvc /y
del %windir%\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 /ah
del %windir%\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 /ah
del %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
del %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\cache\cache.dat
net start sppsvc
cscript %windir%\system32\slmgr.vbs /ipk 33PXH-7Y6KF-2VJC9-XBBR8-HVTHH
cscript %windir%\system32\slmgr.vbs /ato

Another reddit.com tread addresses the same issue. Somebody affected? Addendum: Microsoft has confirmed the error in KB articles 4480960 (security only) and 4480970 (Monthly Rollup) for Windows 7 and is investigating it.