Everything you always wanted to know about Windows Product Activation

Last week I explained why Microsoft’s changes to Windows Product Activation (WPA), which take effect today, are no big deal for most Windows users.

Sadly, the FUD about this issue is spreading through the Internet without much regard for the underlying facts. In addition to Betanews and Slashdot, the story has been picked up by eWeek, CNET News.com, eHomeUpgrade, Microsoft Monitor, WinInsider, InfoWorld, and countless others. The general consensus is that “customers who find themselves reinstalling Windows XP should be ready for a headache,” as CNET put it. Fortunately, that conventional wisdom is wrong.

Trying to make sense of the ins and outs of Windows licensing can be difficult even for someone who makes a living as a Windows expert, so it’s understandable that a reporter trying to write a 200–word story on a tight deadline would get confused. WPA is a complex technology. By the time you finish this article, you’ll understand it a lot better.

For starters, not every copy of Windows requires activation. WPA requirements vary depending on the type of license associated with a copy of Windows. Microsoft sells Windows licenses through three separate programs:

Full Packaged Product (FPP, more commonly referred to as Retail) – These are available in shrink-wrapped boxes, as full licenses (no previous version of Windows required) and as upgrade packages, which typically sell at a discount and require you to provide media from a previous Windows version as part of the previous installation. After installing a retail product, you must go through Windows Product Activation. For most installations, this takes place automatically over the Internet. To learn more about WPA, read Microsoft’s official documentation (pay special attention to the changes in Windows XP Service Pack 1), Alex Nichol’s excellent WPA FAQ, and the now somewhat outdated but still interesting Inside Windows Product Activation, which was prepared around the time Windows XP was first released in 2001. None of the changes announced last week have any effect on you if you use a retail copy of Windows XP.

Volume Licensing (VL) programs – Businesses, government agencies, charitable organizations, and academic institutions are eligible to purchase upgrades to Windows in bulk through one of several licensing programs, the terms of which vary depending on the size of the organization. (The original license must be purchased individually or with a new computer; that license is then enrolled in the Volume Licensing program.) According to this page, “Microsoft understands the unique deployment requirements of businesses that need to acquire licenses in volume and provides product that does not require activation to those customers… Customers can qualify for Microsoft’s Open Licensing program by purchasing as few as five licenses.” Knowledge Base article 299840 provides more technical details: “Activation is not required when you use Volume License media (VL versions of Windows XP) in conjunction with the VL product keys.” (More information is available in the Microsoft Volume Licensing FAQ and on the Volume Licensing Home Page.)

Microsoft made some changes to VL keys with Windows XP Service Pack 1, specifically: blocking two volume license keys that had escaped into the wild and were widely used for pirated copies; and allowing IT staff to encrypt and time-limit the key used on CDs made for unattended installation. None of the changes announced last week have any effect on you if you use a VL version of Windows XP.

OEM/System Builder –  According to the Microsoft Volume Licensing FAQ, “There are two different types of OEM licensing vehicles, one for ‘named’ or ‘Multi-National’ OEMs, and one for system builders. Both types of OEMs may build and distribute computer systems with Microsoft software preinstalled.” That first category is more commonly referred to as Royalty OEMs. If you purchase a PC with Windows XP pre-installed, the changes announced last week may affect you.

OK, it’s that last category where the changes come in. So let’s break it down.

OEM System Builder

The System Builder category includes anyone who buys individual copies of Windows XP to install on new computers. You can go to just about any online software retailer and buy your own OEM copy of Windows XP. (It must be purchased with a “non-peripheral computer hardware component,” for the license to be valid. Qualifying products include memory, internal drives, mice, keyboards, and power supplies/cords.) [Update: The requirement to buy a piece of qualifying hardware is no longer attached to sales of OEM Windows copies. See A welcome change in Microsoft licensing terms for details.] This type of OEM license includes a CD, a Certificate of Authenticity, and a product key, and it requires activation. If you reinstall Windows using an OEM copy sold in this type of packaging, you have to reactivate it. You can activate the initial installation or a reinstallation over the Internet. None of the changes announced last week have any effect on you if you use a single-copy OEM version of Windows XP.

What if you want to build your own white-box PCs and sell them? In that case, you need to buy a package of Windows licenses from an authorized distributor and then use the OEM Preinstallation Kit (OPK) to install Windows. You can customize the installation with extra drivers and applications, and you can even add your own Start menu items and Internet Explorer Favorites. You can build image files for each different type of PC you sell, but for each individual PC you have to include a custom “answer file” that includes a unique value for the ProductKey entry. According to the OPK documentation, “The Product Key that you use to activate the installation must match the number on the Certificate of Authenticity (COA) sticker that accompanies the retail product or that is physically attached to the computer case…”

When your customers turn on the PC for the first time, they go through the Out of Box Experience and accept the license agreement. They don’t have to enter the product key (you already did that) and you can even activate Windows XP for them over the Internet. You are required to provide them with the Windows CD, product key, and Certificate of Authenticity. If they reinstall Windows, they need to use the OEM CD and the key you provided. They can then reactivate Windows over the Internet. None of the changes announced last week have any effect on you if you use an OEM version of Windows XP sold through the System Builder program.

Royalty OEM

Now let’s say you’re in the same league as Michael Dell. You lucky dog – you own one of the 20 largest manufacturers of Windows-based computers in the world. In short, you’re a Royalty OEM. The OPK does a good job of explaining the differences between System Builders,

Royalty OEMs receive a ‘golden master’ copy of Windows from Microsoft. The royalty OEM may customize Windows as described in the OPK, their license agreement, or a signed addendum… These OEMs obtain all customized media, end-user manuals, and bulk quantities of COA stickers from MS authorized replicators.

Royalty OEMs may provide recovery media for each computer, and that media must be protected so that it can be used only on that particular computer. Both printed books and any recovery media display the OEM name and branding.

System-locked preinstallation (SLP) is an anti-piracy technology that helps prevent the copying of legitimately licensed operating system software onto non-licensed systems. SLP is available only to royalty OEMs.

Aha! Now we’re getting somewhere. On a computer put together by a Royalty OEM, the preinstalled copy of Windows (including the recovery CD) contains configuration files that look for specific information in the system BIOS. If they find that information, no activation is required. Royalty OEMs have to provide a Certificate of Authenticity to each customer along with a unique product key (usually printed on a sticker on the side of the PC), but that key isn’t used to activate Windows initially. When you get a new computer from Dell or Gateway or Compaq or any other big PC vendor that uses SLP, no activation is required when you first run Windows, and no activation is required when you reinstall Windows – as long as you start your computer using the SLP CD on the same computer (or one with the same motherboard/BIOS combination).

But what happens to the product key printed on the side of my Dell (or Gateway or Compaq or Toshiba, etc.) computer? Under normal circumstances, it goes completely unused. And there’s the problem. If I’m interested in activating a copy of Windows without paying for it, I can walk into Best Buy, find a display of desktop PCs, and copy down the product keys from the sticker on the side of each one. I can then try using those keys to activate my OEM copy of Windows over the Internet. And until today, that would have worked. But no longer. Now, if I try the same trick, I’ll be unable to activate without calling in. If I’m willing to lie and say that I bought an HP computer but changed the motherboard or flashed the BIOS, I might be able to get away with it. But it’s an extra hoop.

I did some quick searches and have determined that PCs sold by Dell, Gateway, Toshiba, and Compaq all use SLP. Based on the language I quoted earlier from the OPK, I strongly suspect that all PCs sold in the past two years by all of the 20 leading Royalty OEMs also use SLP.

And that means that this change is going to have no effect on legitimate owners of OEM computers who want to reinstall their copy of Windows. As long as they use the CD that came with their PC, installation should be automatic and activation should not be required. The only circumstances under which activation would be required, as I noted in my original post, are if you use the CD on a different computer than the one it was sold with, or if you changed the motherboard or BIOS to one that didn’t match the SLP files.

As I said in my previous post, anyone who tries to turn this change into a major issue simply doesn’t understand how the technology works.