Small Rant: Windows Activation

TLDR: Offline activation via https://aka.ms/aoh requires a captcha, MS account login and 2FA once per client, with \~80 to go. Any tips on speeding this up?

I'm just kinda curious about the opinion of other Sysadmins that have to work with Windows clients.

I work as a sysadmin at the factory of a fairly large company, where we mainly use Windows for our production floor clients. To extend the amount of support we get for each client, we have a standardized image, which gets updated every few years for a new release of IoT Enterprise LTSB / LTSC.

To get an image of what I am doing right now: (spoilering this part as it isn't too important to my rant)

So, since our clients aren't connected to the internet, they cannot connect to Windows servers for activation. As such, I have to use slmgr.exe and SLUI 4 to activate the clients (formerly using the hotline, nowadays just the website https://aka.ms/aoh).

This activation requires you to put in a long string of numbers that the UI will show you into a field on the website and to reach that website you must always 1. Solve a Captcha and 2. Log into your Microsoft account, always forcing 2FA confirmation. And it doesn't remember your Microsoft Account, ever. You always have to log in again, from the start, solving the captcha. There is no button to activate another client once you finish activating the one you're currently working on, you need to re-load the link and start again. And again. And again. I've already optimized my current workflow as well as I can, using a python script to generate the QR codes I need for given commands so that I can avoid dealing with typing in the same commands over and over. But every time, I have to spend around 2-5 minutes dealing with the online Microsoft activation process.

Btw, if your connection is lost, you connect to a different AP or such, somehow the website doesn't require reauthentication. I don't know how exactly the process here works, but I can log into a tab for the site in one browser, open another in an incognito tab, open the next in a third browser, etc. And it'll usually last all day, so if I logged in and didn't use the session 'til the evening, it won't require reauthentication. My guess is that the endpoint / API request in the background actually works without authentication, and the whole login process is just a security circus akin to the TSA, and that if I knew a bit better about how web development works, I could probably just find out how the API request to Microsoft servers work to skip authentication. But I don't wanna risk getting in legal trouble just because I am not following the officially mandated license activation procedure.

Does anyone have some advice for me on how to save some time doing this? I got around 80 clients left to go and am pretty tired of the whole process.

Can you not use an internally hosted activation server? Typically you’d set that up on a server (or workstation even), activate it once, then point your clients to it. Heck I think clients will even just broadcast out to their local subnet to see if there’s an activation service available. Then the clients just check in occasionally to confirm the license is still active.

We cannot, I've actually brought this up before with management. Apparently they used to use one before I was hired. As some corporate devices are used in some of our VLANs though, and they have to connect to the activation servers that central IT runs, I was told that our CISO and our contact at central IT have decided to forbid running an activation server locally in our production VLANs. This was what they decided on back then, because our standard process requires only aquiring manufacturer pre-activated clients, so an activation server would usually not be necessary, and in the few cases where it is necessary they decided that it would be alright to have someone from 1st level (or I guess an admin like me, as it turned out in the end) activate the devices by hand.

Are these domain joined? If so load the update keys into AD and be done with it.

Maybe it's worth having this conversation again because it sounds like there is a difference of understanding here. They're saying no local activation server is required because it's only needed for occasional use. You're saying there is so much occasional use that you need a better solution for activation. Maybe talking this through again with Central IT to make sure everybody understands what's going on here would be helpful.

Yeah, but our AD is a Sub-OU in our global, central-IT managed AD. Not sure if we even have that much control over our Sub-OU. I'll make sure to ask our domain owner tomorrow, though. Thanks for the idea!

Have you looked at VAMT? But if a KMS server is out of the question, this might not be an option either

VAMT would (as far as I know) require a KMS + MAKs. So, I'm guessing that'll be out of the question, but I'll bring it up tomorrow in the team daily.

Well, if you have an always on pc, then install the activation service on that pc? Anything domain joined isn’t going to broadcast for its activation server, and given how central IT is acting, I’d expect you have your own vlan (though you should confirm). You’re not registering it into dns, so nothing outside your vlan will even know it exists…

Just wait until you hit the arbitrary maximum number of activations for that key and have to get in touch with Microsoft to extend it.

AD activation is the best way, it is designed for splitting down availability into OUs and whatnot.

I used to do a lot of offline activation, which was doable. 10 years ago it was fine but it went downhill from there. Fortunately I only have to do such activations twice a year nowadays :)

Lose your job speedrun any%