Activate Windows with the firmware embedded product key

Windows devices that are Active Directory joined (or Hybrid Azure Active Directory joined), might be activated by using an on-premises KMS server, which has been (and still is) perfectly fine. But when you migrate these devices to Azure AD only joined devices, these devices might not have direct access to the on-premises environment anymore.

You could end up with devices, which still try to activate Windows after a factory reset by reaching out to a KMS server that is not reachable. An option is to activate Windows with the firmware embedded product key, which is available on most (business) laptops.

If you’re using a subscription activation Windows license (Windows E3/ E5 license), subscription activation should automatically pull the firmware embedded activation key and activate the underlying pro license. But this only happens automatically during the Out of the Box Experience.

The solution

With a small PowerShell script, we can easily query the device for its ‘baked-in’ product key and use that key to active Windows, so the device doesn’t have to reach out to a KMS server anymore for activation.

I’ve created the below script to get the job done. As I wanted to deploy the script as a win32 app with Microsoft Intune, I also created a small detection script.

With this command, we can retrieve information regarding the Windows license, including the Original Product Key:

Get-CimInstance -query 'select * from SoftwareLicensingService'

slmgr.vbs is used to install and activate the key.

I’ll use the below command to check if the ProductKeyChannel is changed to OEM:DM, in the detection script, but also to write it to the transcript.

Get-WmiObject SoftwareLicensingProduct -Filter "ApplicationID = '55c92734-d682-4d71-983e-d6ec3f16059f' and LicenseStatus = '1'"

This is the complete activation script:

# --------------------------------------------------------------------------------------------- # 
# Author(s)    : Peter Klapwijk - www.InTheCloud247.com      					                #
# Version      : 1.0                                                                            #
#                                                                                               #
# Description  : Script retrieves the firmware-embedded product key and activates Windows       #
#                with this key														            #
#                														                        #
# Changes      : v1.0 Initial version	                                                        #
#                														                        #
# --------------------------------------------------------------------------------------------- #

# Start Transcript
$Transcript = "C:\programdata\Microsoft\IntuneManagementExtension\Logs$($(Split-Path $PSCommandPath -Leaf).ToLower().Replace(".ps1",".log"))"
Start-Transcript -Path $Transcript | Out-Null

#Get firmware-embedded product key
try {
    $EmbeddedKey=(Get-CimInstance -query 'select * from SoftwareLicensingService').OA3xOriginalProductKey
    write-host "Firmware-embedded product key is "$EmbeddedKey""
} catch {
    write-host "ERROR: Failed to retrieve firmware-embedded product key"
    Exit 1
}

#Install embedded key
try {
    cscript.exe "$env:SystemRoot\System32\slmgr.vbs" /ipk "$EmbeddedKey"
    write-host "Installed license key"
} catch {
    write-host "ERROR: Changing license key failed"
    Exit 2
}

#Active embedded key
try {
    cscript.exe "$env:SystemRoot\System32\slmgr.vbs" /ato
    write-host "Windows activated"
} catch {
    write-host "ERROR: Windows could not be activated."
    Exit 3
}

#Check Product Key Channel
$getreg=Get-WmiObject SoftwareLicensingProduct -Filter "ApplicationID = '55c92734-d682-4d71-983e-d6ec3f16059f' and LicenseStatus = '1'"
$ProductKeyChannel=$getreg.ProductKeyChannel

    if ($getreg.ProductKeyChannel -eq "OEM:DM") {
        write-host "Windows activated, ProductKeyChannel = "$ProductKeyChannel""
		Exit 0
    } else {
		write-host "ERROR: Windows could not be activated. "$ProductKeyChannel""
		Exit 4
    }

Stop-Transcript

The detection script checks if the embedded key is used (OEM:DM) or a retail key is used, which in my case is also fine.

That is done by the same command as used in the activate script to check the ProductKeyChannel.

The detection script:

# --------------------------------------------------------------------------------------------- # 
# Author(s)    : Peter Klapwijk - www.InTheCloud247.com      					                #
# Version      : 1.0                                                                            #
#                                                                                               #
# Description  : Detection script to be used with Microsoft Intune, determines if the current   #
#                Product Key Channel is OEM or Retail								            #
#                														                        #
# Changes      : v1.0 Initial version	                                                        #
#                														                        #
# --------------------------------------------------------------------------------------------- #

$getreg=Get-WmiObject SoftwareLicensingProduct -Filter "ApplicationID = '55c92734-d682-4d71-983e-d6ec3f16059f' and LicenseStatus = '1'"
$ProductKeyChannel=$getreg.ProductKeyChannel

    if ($getreg.ProductKeyChannel -eq "OEM:DM" -or $getreg.ProductKeyChannel -eq "Retail") {
        write-host "Correct ProductKeyChannel found = "$ProductKeyChannel""
		Exit 0
    } else {
		write-host "ERROR: Wrong ProductKeyChannel found =  "$ProductKeyChannel""
		Exit 4
    }

The most recent version of the script is also found on my GitHub.

The script is provided as-is. I’m not a scripting guru, so make your changes if needed.