Activation failures and "not genuine" notifications around January 8, 2019, on volume-licensed Windows 7 KMS clients

Applies to: Windows 7 ProfessionalWindows 7 Enterprise

Summary

This article applies to volume-licensed Windows 7 devices that use Key Management Service (KMS) activation and have the KB 971033 update installed. Some users may receive the Windows Activation or "Windows is not genuine" notifications starting at or after 10:00 UTC, January 8, 2019.

On January 9, 2019, we reverted a change that was made to Microsoft Activation and Validation servers. For devices that continue to report activation and “not genuine” notifications, you should remove KB 971033 by following the steps in the "Resolution" section.

Windows editions that support volume-licensing activation include the following:

• Windows 7 Professional
• Windows 7 Professional N
• Windows 7 Professional E
• Windows 7 Enterprise
• Windows 7 Enterprise N
• Windows 7 Enterprise E

For Windows editions that experience activation and “not genuine” errors that are not caused by the Microsoft Activation and Validation server change around January 8, 2019, we recommend that you follow standard activation troubleshooting.

Symptoms

1. You receive a Windows is not genuine error message after you log on.
    

   Screenshot	Text description
   	Dialog Title: Windows Activation Windows is not genuine Your computer might be running a counterfeit copy of Windows Get genuine now Ask me later 0xC004F200

    
2. A This copy of windows is not genuine watermark appears on the Windows desktop on a black background.
    

   Screenshot	Textual description
   	"This copy of Windows is not genuine" watermark appears in the bottom-right corner of the Windows desktop on a black background.

    

3. The slmgr /dlv output reports error 0xC004F200.

   Screenshot

   Textual description

   Note Select fields cleared to remove PII. Name: Windows(R) 7, Enterprise edition Description: Windows Operating System - Windows(R) 7, VOLUME_KMSCLIENT channel Activation ID: ae2ee509-1b34-41c0-acb7-6d4650168915 Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f Extended PID: <removed> Installation ID: <removed> Partial Product Key: HVTHH License Status: Notification Notification Reason: 0xC004F200 (non-genuine). Remaining Windows rearm count: 2 Trusted time: <removed> Please use slmgr.vbs /ato to activate and update KMS client information in order to update values.

    
4. Activations that are made by using the slmgr /ato command fails and return the following message: "Windows is running within the non-genuine notification period. Run ‘slui.exe’ to go online and validate Windows."
    

   Screenshot	Textual description
   	Activating Windows(R) 7, Enterprise edition (ae2ee509-1b34-41c0-acb7-6d4650168915) … Error: Windows is running within the non-genuine notification period. Run ‘slui.exe’ to go online and validate Windows.

    
5. The following events are logged in the event log.
    

   Event log	Event source	Event ID	Description
   Application	Microsoft-Windows-Security-SPP	8209	Genuine state set to non-genuine (0x00000000) for application Id 55c92734-d682-4d71-983e-d6ec3f16059f
   Application	Microsoft-Windows-Security-SPP	8208	Acquisition of genuine ticket failed (hr=0xC004C4A2) for template Id 66c92734-d682-4d71-983e-d6ec3f16059f
   Application	Windows Activation Technologies	13	Genuine validation result: hrOffline = 0x00000000, hrOnline =0xC004C4A2
   Application	Microsoft-Windows-Security-SPP	8196	License Activation Scheduler (sppuinotify.dll) was not able to automatically activate. Error code:  0xC004F200:

Cause

A recent update to the Microsoft Activation and Validation unintentionally caused a "not genuine" error on volume-licensed Windows 7 clients that had KB 971033 installed. The change was introduced at 10:00:00 UTC on January 8, 2019, and was reverted at 4:30:00 UTC on January 9, 2019.

Note This timing coincides with the release of the “1B” January 2019 updates (KB 4480960 and KB 4480970) that were released on Tuesday, January 8, 2019. These events are not related.

Windows 7 devices that have KB 971033 installed but did not experience this issue between the time of the change (10:00:00 UTC, January 8, 2019) and the time of the reversion of that change (4:30:00 UTC, January 9, 2019) should not experience the issue that is described in this article.

KB 971033 ("Description of the update for Windows Activation Technologies”) contains the following text:

"Note For an Enterprise customer who uses Key Management Service (KMS) or Multiple Activation Key (MAK) volume activation, we generally recommend to NOT install this update in their reference image or already deployed computers. This update is targeted at consumer installs of Windows using RETAIL activation."

We strongly recommend that you uninstall KB 971033 from all volume-licensed Windows 7-based devices. This includes devices that are not currently affected by the issue that is mentioned in the "Symptoms" section.

net stop sppuinotify
sc config sppuinotify start= disabled
net stop sppsvc
del %windir%\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 /ah
del %windir%\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 /ah
del %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
del %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\cache\cache.dat
net start sppsvc
cscript c:\windows\system32\slmgr.vbs /ipk <edition-specific KMS client key>
cscript c:\windows\system32\slmgr.vbs /ato
sc config sppuinotify start= demand