Microsoft explains the Windows 7 KMS activation issue

[German]On January 8, 2019, some administrators in enterprise environments observed KMS activation errors on Windows 7 clients. Windows 7 was reported as 'not genuine' (error code 0xC004F200). Now Microsoft has provided some explanation.

I've covered the issue within my blog post Update KB971033/KB4480960/KB4480970 bricks Windows 7 Genuine (0xc004f200). The publishing, Microsoft blamed KB4480960/KB4480970 to brick Windows 7 KMS activation. At that time the following was known:

• The KMS activation issue occurs only on Windows 7 clients, where the activation update KB971033 (dated 4/19/2018) was installed.
• This update was never scheduled for KMS activation environment – and Microsoft later posted a KB article, recommending not to install this update in volume licenced KMS environments.
• The update could only be downloaded by Admins from the Microsoft Download Center and need to be installed manuelly on Windows 7 clients. No automatic update was prevented.

To sum it up: Installing update KB971033 wasn't recommended nor necessary in KMS environments. The sole purpose was to detect validation errors and activation exploits in Windows 7 clients. According to Microsoft KB article, the update also detects possible manipulating attempts with important Windows 7 system files.

Unfortunately, the KB4480960 and KB4480970 updates for Windows 7 were released on January 8, 2019. This seemed to result in a coincidence, and Microsoft had also provided short notes in the linked KB articles. In the meantime, however, the corresponding text has been revised. We can't blame those update for the KMS activation issue. 

Microsoft explains the issue

On January 10, 2019 Microsoft published the article Activation failures and "not genuine" notifications around January 8, 2019, on volume-licensed Windows 7 KMS clients with more insights. Microsoft confirms that the KMS activation problems only occurred if the activation update KB971033 (from 4/19/2018) was installed on the following clients with volume license activation:

• Windows 7 Professional
• Windows 7 Professional N
• Windows 7 Professional E
• Windows 7 Enterprise
• Windows 7 Enterprise N
• Windows 7 Enterprise E

n this scenario it could happen that the Windows 7 clients reported the error dialog Windows Activation Windows is not genuine with the error code 0xC004F200.

At the same time, affected Windows 7 clients fell into non-activated mode, i.e. the desktop showed a black background and the watermark was displayed in the lower right corner with the message that Windows is not genuine. 

The command slmgr /dlv returned the error 0xC004F200. A new activation attempt with the command slmgr /ato failed because Microsoft reported an invalid Windows 7 copy. As far as everything is known. New to the Microsoft article is the hint to the root cause:

A recent update to the Microsoft Activation and Validation unintentionally caused a "not genuine" error on volume-licensed Windows 7 clients that had KB971033 installed. The change was introduced at 10:00:00 UTC on January 8, 2019, and was reverted at 4:30:00 UTC on January 9, 2019.

Within the KB article Microsoft recommends strongly to uninstall KB971033 on Windows 7 clients using Key Management Service (KMS) or Multiple Activation Key (MAK) volume activation. The kb article contains hints how administrators can check on the clients if KB971033 is installed (e.g. with wmic qfe where HotFixID="KB971033") and how to uninstall it (e.g. with wusa /uninstall /kb:971033). After uninstalling update KB971033 on the affected Windows 7 clients, the activation must be performed again. To do this, Microsoft has provided the following command sequence, which must be executed in a command prompt with administrative privileges.

net stop sppuinotify
sc config sppuinotify start= disabled
net stop sppsvc
del %windir%\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 /ah
del %windir%\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 /ah
del %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
del %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\cache\cache.dat
net start sppsvc
cscript c:\windows\system32\slmgr.vbs /ipk [KMS Client-Key]
cscript c:\windows\system32\slmgr.vbs /ato
sc config sppuinotify start= demand

It's imho recommended to insert the above commands into a .bat file and to run it via Run as administrator. It is important that the placeholder [KMS Client-Key] is replaced by the client-specific key. Microsoft specifies the KMS Client Setup keys for each edition of Windows 7 in this document. If in doubt, please refer to the Microsoft KB article for details.

Similar articles:
Microsoft Office Patchday (January 2, 2019)
Office 2010 Updates for January 2019 has been pulled
Microsoft Security Update Summary (January 8, 2019)
Patchday: Updates for Windows 7/8.1/Server Jan. 8, 2019
Patchday Windows 10-Updates (January 8, 2019)
Patchday Microsoft Office Updates (January 8, 2019)
Update KB971033/KB4480960/KB4480970 bricks Windows 7 Genuine (0xc004f200)
Network issues with updates KB4480970 and KB4480960