This page documents how MAS scripts interface with core Windows licensing subsystems. Components covered:
| Component | Role in MAS |
|---|---|
SoftwareLicensingService / SoftwareLicensingProduct (WMI) | License queries, key installation, activation commands |
sppsvc / SLsvc (Software Protection Platform) | Core licensing service; manages activation state |
ClipSVC / ClipUp.exe | HWID digital license ticket processing |
DISM.exe / DismApi.dll | Windows edition detection and changes |
pkeyhelper.dll / pidgenx.dll | Product key retrieval and channel validation |
wmic.exe / PowerShell WMI | Legacy and modern WMI access paths |
slmgr.vbs | Traditional SPP wrapper (MAS calls WMI directly instead) |
| Registry keys | KMS config, SPP state, identity tokens |
For information about the script architecture and batch/PowerShell integration, see page 5.2. For diagnostic procedures and error handling routines, see page 5.4.
Windows licensing is built on multiple subsystems that work together to validate and maintain activation state. MAS scripts must interact with all of these components to successfully activate Windows and Office products.
Diagram: Windows Licensing Component Architecture
Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd515-522 MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd549-551 MAS/Separate-Files-Version/Troubleshoot.cmd612-951
The Software Protection Platform is the core licensing subsystem in Windows. It manages product keys, license validation, activation state, and grace periods.
Service Name: sppsvc (Windows Vista SP1 and later) or SLsvc (Windows Vista RTM)
Display Name: Software Protection / Software Licensing Service
Executable: sppsvc.exe or SLsvc.exe in System32
Scripts detect which service to use based on Windows build number:
| Windows Version | Build Number | Service Name | Executable |
|---|---|---|---|
| Vista RTM | 6000 | SLsvc | SLsvc.exe |
| Vista SP1+ | 6001-6003 | sppsvc or SLsvc | sppsvc.exe or SLsvc.exe |
| Windows 7+ | 7600+ | sppsvc | sppsvc.exe |
Diagram: SPP Service Detection Logic
Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd876-886 MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd883-886
Scripts interact with SPP primarily through WMI classes rather than direct service calls. This provides a standardized interface across different Windows versions.
Primary WMI Classes:
| Class Name | Purpose | Example Methods/Properties |
|---|---|---|
SoftwareLicensingProduct | Represents individual product licenses | Activate(), InstallProductKey(), PartialProductKey, LicenseStatus |
SoftwareLicensingService | Service-level operations | RefreshLicenseStatus(), InstallProductKey(), ReArmWindows() |
OfficeSoftwareProtectionProduct | Office product licenses (legacy) | Similar to SoftwareLicensingProduct |
OfficeSoftwareProtectionService | Office service operations (legacy) | Similar to SoftwareLicensingService |
WMI Access Methods: Scripts support two methods for WMI access, automatically selected based on availability:
_wmic=1): Traditional command-line tool
wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus_wmic=0): Used when wmic.exe is unavailable (Windows 11 21H2+)
$null=(([WMICLASS]'SoftwareLicensingService').GetInstances()).RefreshLicenseStatus()Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd1141-1148 MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd549-551
SPP stores licensing data in binary token files that the scripts must manage during activation and troubleshooting.
Key Files:
| File | Location | Purpose |
|---|---|---|
tokens.dat | %SystemRoot%\System32\spp\store\ or \spp\store\2.0\ | License activation tokens |
data.dat | %SystemRoot%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\ | Confirmation IDs and HWID data |
cache.dat | Same as data.dat | KMS activation cache |
Various .xrm-ms files | %SystemRoot%\System32\spp\tokens\ | License definition files |
Token Detection Function: Scripts use a PowerShell function to locate tokens.dat across different paths:
:scandat check
Searches in order:
1. %SysPath%\spp\store\2.0\tokens.dat
2. %SysPath%\spp\store\tokens.dat
3. %SystemRoot%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
Sources: MAS/Separate-Files-Version/Troubleshoot.cmd779-785 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd657-661
Scripts monitor and modify SPP registry keys to manage licensing state and configuration.
Primary Registry Locations:
| Key Path | Important Values | Purpose |
|---|---|---|
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform | TokenStore, ServiceSessionId, SkipRearm | Service configuration and state |
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform | NoGenTicket, NoAcquireGT | Privacy/policy settings |
HKLM\SYSTEM\CurrentControlSet\Services\sppsvc | Standard service parameters | Service control |
Key Registry Operations:
Opt-out of KMS AVS validation (builds 9600+):
NoGenTicket = 1 (REG_DWORD)
NoAcquireGT = 1 (REG_DWORD) [build 14393 only]
TokenStore path validation: Scripts verify the TokenStore registry value points to the correct path
Volatile state cleanup: Temporary licensing state keys that must be removed for activation
Sources: MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd981-984 MAS/Separate-Files-Version/Troubleshoot.cmd789-794
ClipSVC is the Windows Store licensing service, critical for HWID (Hardware ID) digital license activation on Windows 10/11.
Service Name: ClipSVC
Display Name: Client License Service
Executable: ClipUp.exe in System32
Required For: Windows 10/11 HWID activation, Windows Store app licensing
Service Dependencies (checked by scripts):
wlidsvc - Microsoft Account Sign-in AssistantKeyIso - CNG Key IsolationLicenseManager - Windows License Manager ServiceDiagram: ClipSVC Activation Flow
Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd618-683 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd706-717
The HWID activation method generates an XML ticket that instructs ClipSVC to create a digital license.
Ticket Generation Process:
:hwiddata ticket function%ProgramData%\Microsoft\Windows\ClipSVC\GenuineTicket\Installation Methods: Scripts use dual installation approach for reliability:
| Method | Command | When Used | Success Check |
|---|---|---|---|
| Service Restart | Restart-Service ClipSVC | Primary method | Ticket XML deleted after processing |
| clipup utility | clipup -v -o | Secondary method | Ticket XML deleted after processing |
If XML file remains after both methods, activation failed.
Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd625-636 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd640-682
Primary File: tokens.dat in %ProgramData%\Microsoft\Windows\ClipSVC\
Purpose: Stores activated digital licenses for Windows Store apps and Windows OS
Troubleshooting Operations:
rundll32 clipc.dll,ClipCleanUpState (clears all licenses)Related Registry Keys:
| Key Path | Purpose |
|---|---|
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState | Volatile protected key, auto-deleted on restart |
HKU\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL | Store ID cache, must be cleared for activation |
Sources: MAS/Separate-Files-Version/Troubleshoot.cmd666-716 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd703-717
WMI provides the primary interface for scripts to interact with licensing services. All product key operations, activation commands, and license queries use WMI.
Service Name: Winmgmt
Repository Location: %SystemRoot%\System32\wbem\repository\
Critical for: All activation methods require functioning WMI
Health Check: Scripts verify WMI by querying Win32_ComputerSystem:
wmic path Win32_ComputerSystem get CreationClassName
or PowerShell equivalent:
Get-WmiObject -Class Win32_ComputerSystem
Diagram: WMI Licensing Operations
Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd1063-1076 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd1019-1044 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd1011-1015
When WMI is corrupted, Troubleshoot.cmd provides comprehensive repair:
Repair Steps:
%SystemRoot%\System32\wbem\repository\winmgmt /salvagerepository and /resetrepositorySafety Checks:
Sources: MAS/Separate-Files-Version/Troubleshoot.cmd1104-1241
Office 2010-2013 and some Office 2016 MSI installations use OSPP, a separate licensing system from SPP.
Service Name: osppsvc
WMI Classes: OfficeSoftwareProtectionProduct, OfficeSoftwareProtectionService
Token File: tokens.dat in %ProgramData%\Microsoft\OfficeSoftwareProtectionPlatform\
Version Detection:
| Build Number | SPP vs OSPP |
|---|---|
| < 9200 | OSPP for Office |
| >= 9200 | SPP for Office (typically) |
Scripts dynamically switch between SPP and OSPP classes:
:oh_setspp
if winbuild GEQ 9200: use SoftwareLicensingProduct/Service
if winbuild LSS 9200: use OfficeSoftwareProtectionProduct/Service
if Office 14.0: force OfficeSoftwareProtectionProduct/Service
Sources: MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd1215-1231 MAS/Separate-Files-Version/Troubleshoot.cmd899-951
Change_Windows_Edition.cmd uses DISM (Deployment Image Servicing and Management) for detecting current and available editions, and for performing edition changes that cannot be done with a simple key install.
Before presenting edition choices, the script queries DISM for the active edition and available upgrade targets:
dism /English /Online /Get-CurrentEdition → sets %osedition%
dism /online /english /Get-TargetEditions → populates %_dtarget% list
If dism.exe fails, the script falls back to querying LicenseFamily from SoftwareLicensingProduct via WMI.
Sources: MAS/Separate-Files-Version/Change_Windows_Edition.cmd386-471
The script selects one of three methods based on the OS build and target edition:
| Method | Condition | Mechanism |
|---|---|---|
SoftwareLicensingService.InstallProductKey() | Windows 10/11, compatible non-Core target | WMI key install via dk_inskey; no reboot needed immediately |
DismApi.dll (:dismapi: embedded PS) | Core-to-non-Core, or build < 17134 target | P/Invoke into DismApi.dll; requires reboot |
CBS XML (:cbsxml: embedded PS) | Builds before 10240 (Windows 7/8/8.1) | Component Based Servicing; requires reboot |
DISM /online /Set-Edition | Windows Server editions | Direct DISM command with product key |
The _dismapi flag in Change_Windows_Edition.cmd is set to 1 when the target edition's token files are not present in %SysPath%\spp\tokens\skus\%targetedition%\ and the target is not in an alternate edition list.
Diagram: Edition Change Method Selection
The DismApi.dll path is invoked by reading the :dismapi: embedded PowerShell block from the script file and executing it with the target edition and key as arguments:
%psc% "$f=[System.IO.File]::ReadAllText('!_batp!') -split ':dismapi\:.*';
. ([scriptblock]::Create($f[1])) %targetedition% %key%"
Log files from each edition change attempt are copied to %desktop%\ChangeEdition_Logs\ as compressed .cab archives for post-mortem analysis.
Sources: MAS/Separate-Files-Version/Change_Windows_Edition.cmd562-684 MAS/Separate-Files-Version/Change_Windows_Edition.cmd688-720 MAS/Separate-Files-Version/Change_Windows_Edition.cmd775-824
These two DLLs from Windows' own Software Protection Platform are used by Change_Windows_Edition.cmd to obtain valid product keys for target editions and to validate key channel (licensing type). Both are accessed via PowerShell P/Invoke using the dk_reflection helper that constructs a dynamic assembly.
pkeyhelper.dll exports two functions used by MAS:
| Function | Signature | Purpose |
|---|---|---|
GetEditionIdFromName | (String editionName, ref int skuId) → int | Converts an edition name string (e.g., "Professional") to a numeric SKU ID |
SkuGetProductKeyForEdition | (int skuId, String channel, ref String keyOut, ref String null) → int | Returns a product key for the given SKU and channel type |
Subroutines:
:ced_targetSKU — calls GetEditionIdFromName to populate %targetSKU%:k_pkey — calls SkuGetProductKeyForEdition for each channel in %keyflow% until a key is returned:ced_windowskey — orchestrates the above two, iterating the %keyflow% channel priority list to find the best keyThe %keyflow% variable defines the channel priority order, which differs between client and server paths:
Client: "Retail OEM:NONSLP OEM:DM Volume:MAK Volume:GVLK PGS:TB Retail:TB:Eval"
Server: "Volume:GVLK Retail Volume:MAK OEM:NONSLP OEM:DM PGS:TB Retail:TB:Eval"
pkeyhelper.dll is only available on Windows 10 build 17134 (1803) and later. On earlier builds, the script falls back to a static key table in :changeeditiondata.
Sources: MAS/Separate-Files-Version/Change_Windows_Edition.cmd1004-1042 MAS/Separate-Files-Version/Change_Windows_Edition.cmd1046-1058
pidgenx.dll exports PidGenX, which validates a product key against pkeyconfig.xrm-ms and returns metadata including the channel string.
Signature (as called via P/Invoke):
PidGenX(String key, String pkeyconfig_path, String locale,
int flags, IntPtr null1, IntPtr null2, IntPtr output_buffer) → int
The output buffer is a 0x04F8-byte structure; the channel name is extracted as a Unicode string at offset 1016 with length 128.
Configuration file: %SysPath%\spp\tokens\pkeyconfig\pkeyconfig.xrm-ms
Subroutine: :k_pkeychannel — calls PidGenX with a candidate key and reads the channel string from the output buffer into %pkeychannel%. This is used to confirm that the key returned by pkeyhelper.dll matches the expected channel (e.g., the loop in :ced_windowskey checks if pkeychannel == expected_channel).
Diagram: Key Retrieval Flow for Edition Change
Sources: MAS/Separate-Files-Version/Change_Windows_Edition.cmd1016-1042
Scripts extensively read and modify registry keys for licensing, configuration, and troubleshooting.
Sources: MAS/Separate-Files-Version/Troubleshoot.cmd789-794 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd703-717 MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd981-984
KMS Server Configuration:
:_taskregserv function sets:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\KeyManagementServiceName
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\KeyManagementServicePort
KMS Cache Clearing:
:_taskclear-cache function deletes:
- KeyManagementServiceName
- KeyManagementServicePort
- KeyManagementServiceMachine
- DisableDnsPublishing
- DisableKeyManagementServiceHostCaching
Permission Fixes: Scripts can repair SPP token folder permissions when corruption is detected:
:fixsppperms PowerShell function:
- Takes ownership of tokens folder
- Grants SYSTEM full control
- Grants Administrators full control
- Grants Users read/execute
KMS AVS Opt-Out (builds 9600+): Sets the following to prevent sending KMS client activation data to Microsoft:
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform
NoGenTicket = 1 (REG_DWORD)
NoAcquireGT = 1 (REG_DWORD) [build 14393 only]
Pending Reboot Detection: Before edition changes, :ced_rebootflag checks:
HKLM\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
If either key exists, the edition change is aborted.
Sources: MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd974-977 MAS/Separate-Files-Version/Troubleshoot.cmd799-814 MAS/Separate-Files-Version/Change_Windows_Edition.cmd985-997
Scripts manage multiple interdependent services for successful activation.
Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd515-522 MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd589-596
Scripts use multiple methods to control services:
Starting Services:
sc start <servicename>
PowerShell: Start-Service <servicename>
Stopping Services:
PowerShell: Stop-Service <servicename> -force
With timeout: Start-Job { Stop-Service ... } | Wait-Job -Timeout 20
Service Restart for Activation:
For ClipSVC: Restart-Service ClipSVC (triggers ticket processing)
For wlidsvc/LicenseManager: Start-Job { Restart-Service ... } | Wait-Job -Timeout 20
Service Health Checks:
sc query <servicename> | find /i "RUNNING"
Error codes: 1060 = not installed, 1053 = timeout, 577/225 = possible malware
Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd641-654 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd707-717 MAS/Separate-Files-Version/Troubleshoot.cmd667-717
Scripts interact with multiple file system locations for licensing data and license files.
Diagram: File System Layout for Licensing
Sources: MAS/Separate-Files-Version/Troubleshoot.cmd779-894 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd618-636
Scripts reinstall system licenses using embedded PowerShell:
License Installation Function (:xrm: section):
InstallLicenseFile($Lsc): Installs single .xrm-ms file via SoftwareLicensingService.InstallLicense()
InstallLicenseArr($Str): Installs semicolon-separated list of files
InstallLicenseDir($Loc): Installs all .xrm-ms files in directory recursively
ReinstallLicenses(): Reinstalls from System32\oem, System32\licensing, System32\spp\tokens
Used during troubleshooting to rebuild corrupted licensing state.
Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd1116-1137 MAS/Separate-Files-Version/Troubleshoot.cmd872-880
Token Deletion: During troubleshooting, scripts must delete tokens to force regeneration:
:scandat delete - Deletes SPP tokens.dat and data.dat
:scandatospp delete - Deletes OSPP tokens.dat
Search locations (in order):
1. System32\spp\store\2.0\
2. System32\spp\store\
3. NetworkService\AppData\...\SoftwareProtectionPlatform\
4. ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\
Token Verification: After deletion and service restart, scripts verify new tokens were created:
:scandat check - Confirms tokens.dat exists and stores path in %token% variable
:scandatospp check - Same for OSPP tokens
Sources: MAS/Separate-Files-Version/Troubleshoot.cmd859-889 MAS/Separate-Files-Version/Troubleshoot.cmd924-941
Understanding the complete flow of how scripts orchestrate component interactions is essential for troubleshooting.
Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd528-870
Sources: MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd516-1060
Sources: MAS/Separate-Files-Version/Troubleshoot.cmd569-1073
Scripts perform extensive validation of component health during pre-flight checks.
| Component | Check Method | Error Detection | Auto-Fix Available |
|---|---|---|---|
| SPP Service | sc query sppsvc | Error codes, timeout | Service restart |
| ClipSVC Service | sc query ClipSVC | Service not running | Service restart |
| WMI | Query Win32_ComputerSystem | Query failure | Repository rebuild |
| SPP Tokens | Check tokens.dat existence | File not found | License reinstall |
| SPP Registry | Query TokenStore value | Incorrect path | Not available |
| Token Permissions | SYSTEM access check | Access denied | :fixsppperms |
| ClipSVC Tokens | Check tokens.dat in ClipSVC | File not found | ClipCleanUpState |
| Service Dependencies | sc query each dependency | Not running | Service start |
Permission Validation: Scripts check SPP token folder permissions and can repair:
:checkperms function checks:
- SYSTEM has full control
- Administrators have full control
- Users have read/execute
If errors found:
- :fixsppperms applies correct ACLs
- Uses takeown and icacls via PowerShell
Sources: MAS/Separate-Files-Version/Troubleshoot.cmd799-814 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd1259-1417
SPP Service (sc start sppsvc) Error Codes:
| Error Code | Meaning | Script Action |
|---|---|---|
| 0 | Success | Continue |
| 1056 | Service already running | Continue |
| 1053 | Timeout | Suggest reboot + Fix WPA Registry |
| 577 | Possible malware/corruption | Show malware detection warning |
| 225 | Possible malware/corruption | Show malware detection warning |
ClipSVC Installation Error Codes:
| Error Code | Meaning | Script Action |
|---|---|---|
| 0 | Ticket installed | Success |
| File remains | Ticket not processed | Check Internet, licensing servers |
| tokens.dat missing | ClipSVC failed | Suggest Fix Licensing |
Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd1152-1169 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd657-673
Scripts use PowerShell extensively to interact with licensing components via .NET reflection and WMI.
P/Invoke for Native APIs:
WMI Class Access:
SPP Trigger Functions:
ClipSVC Status Check:
Sources: MAS/Separate-Files-Version/Activators/HWID_Activation.cmd959-999 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd1080-1094 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd1206-1212
MAS scripts achieve activation by orchestrating multiple Windows subsystems in a carefully sequenced manner. The primary components—SPP, ClipSVC, WMI, registry, and services—must all function correctly and in coordination. Scripts validate each component's health, perform activation operations through WMI, manage token files and registry keys, and provide comprehensive troubleshooting when components fail. Understanding these interactions is essential for diagnosing activation failures and maintaining system licensing health.
Refresh this wiki
This wiki was recently refreshed. Please wait 4 days to refresh again.