Edit

Share via

OEM Activation

  • Article
  • Applies to:
    ✅ Windows 11, ✅ Windows 10

As a device maker, you can install and use the Windows IoT Enterprise operating system to develop and test prototype customer systems. Any images installed without a product key or using the default manufacturing key won't function for more than 30 days after the first boot of an image on a prototype system.

Activation is the process of registering Windows IoT Enterprise with Microsoft to ensure the product is genuine and reduce piracy to ensure customers receive the product quality that they expect from a Windows-based operating system.

Important

Windows IoT Enterprise devices produced by OEMs must be enabled for activation before leaving the factory.

Windows IoT Enterprise provides three options for enabling activation, including:

Activation Model Description
PKEA Product Key Entry Activation
Requires a unique 5 by 5 product key to be applied to each device produced.
ePKEA Embedded Product Key Entry Activation
ePKEA is designed exclusively for OEMs building specialized devices base on Windows IoT Enterprise. A single ePKEA product key comes with the ability to activate a predetermined number of devices. Each successful activation via internet connection or by telephone decrements the available activation count associated with the OEMs ePKEA. Request a new ePKEA before fully depleting the available activations associated with your current ePKEA to prevent activation failures.
OA 3.0 OEM Activation 3.0 (OA3)
The OA 3.0 system enables OEMs to develop an internal inventory management system to manage the ordering and receiving of Windows product keys and the creation and reporting process for the Computer Build Report. You must include an edition specific Default Product Key in each golden image of Windows IoT Enterprise. The default product key can't activate Windows, but rather instructs Windows to search for an OA 3.0 product key that stored in the device’s firmware.

This article focuses on using ePKEA to enable activation for Windows IoT Enterprise based devices. For more information about OA 3.0, see OEM Activation 3.0 system.

Managing your ePKEA Product Keys

Important

An ePKEA product key should be handled confidentially to prevent piracy from depleting your available activation count resulting in your customers being unable to activate the devices they purchased from you.

You should also monitor the remaining activation count monitored to ensure that the consumed activations match the number of devices produced.

Protect your Product Key

Remove your ePKEA from the registry to prevent disclosure attack where malicious code extracts your product key from the image. If a bad operator can extract the product key from your devices it could be used to enable activation on their own devices, draining the available activations associated with your ePKEA.

You should run SLMGR.vbs /cpky before finalizing your image to remove the product key from the registry to avoid your ePKEA from a disclosure attack and ensure that your ePKEA activation allotment isn't depleted.

Slmgr.vbs /cpky

For more information, see Slmgr.vbs Options.

Monitor activations remaining for ePKEA product keys

ePKEA product keys are similar to MAK product keys that the Volume Activation Management Tool (VAMT) was designed to support, therefore it also works with ePKEA product keys. You can use the Volume Activation Management Tool (VAMT) to monitor the number of activations remaining for your ePKEA keys. Just add your ePKEA keys to VAMT and select Product key data online to retrieve the number of remaining activations for the ePKEA.

For more information, see Using VAMT to Manage Product Keys.

Manufacturing Process

You should be familiar with the Windows desktop manufacturing process before you can enable activation. There are several different methods to deploy and customize your Windows IoT Enterprise image. After selecting your manufacturing process, you can incorporate a compatible approach to enable activation using your ePKEA based product key.

For more information, see Windows Manufacturing Overview.

Enable Activation

You can install your production ePKEA product key using any of the following four methods:

If you choose to create your image using the interactive setup experience, you can supply your production ePKEA, the default manufacturing key or skip the product key entry step, however only your production ePKEA enables activation. The following table explains each scenario.

When prompted for Product Key Result
Enter your production ePKEA Production image is fully enabled for activation
Enter the 'default manufacturing key' Your device isn't enabled for activation and you must install your production ePKEA during Audit Mode.
Skip the product key entry screen You must select either Windows IoT Enterprise or Windows IoT Enterprise LTSC to proceed. Your device isn't enabled for activation when setup is complete and you must install your production ePKEA during Audit Mode.

For more information on interactive setup, see Boot and install Windows.

Activate your device

A Windows IoT Enterprise device that is enabled for activation is fully operational without an internet connection. Being fully operational without an internet connection is useful for devices deployed in disconnected environments. Activation is deferred until the device is connected to a network that can access the Microsoft Activation Servers. If the device believes it can get to the Microsoft Activation Servers, Windows IoT Enterprise automatically attempts to activate resulting in either a successful activation or a failed activation. Windows IoT Enterprise can't return to a deferred activation state once activation is attempted. You can activate your production ePKEA product key using any of the following three methods:

Windows IoT Enterprise attempts to activate automatically if you have an internet connection. You can confirm your activation status in Settings or using the Windows Software Licensing Management Tool (SLMGR.VBS).

  • Settings

    To view your activation status in Settings, select Start > Settings > System > Activation.

    If your device shows that it isn't activated, you can trigger an activation attempt by selecting Activate Windows now.

  • Windows Software Licensing Management Tool (SLMGR.VBS)

    Using the keyboard on your device press Windows + R and type one of the following commands into the "Run" dialog.

    Information Level Command
    Abbreviated slmgr.vbs /dli
    Verbose slmgr.vbs /dlv

    Note: If you prefer, these commands can also be run from a PowerShell command prompt.

    A result of License Status:Licensed indicates the device is activated If your device shows that it isn't activated, you can also trigger an activation attempt using slmgr.vbs /ato.

    For more information, see Slmgr.vbs Options.

Frequently asked questions

  • How do I acquire a ePKEA that I can use for my devices?

    Answer: You need to have a valid Client License Agreement (CLA) in place with Microsoft and then you would fill out and submit the Special Key Request form. To acquire an ePKEA product key, contact your Windows IoT Distributor, or your Microsoft Account Manager.

  • Are there any logs where can I tell that my device has attempted to activate?

    Answer: In the System Event Viewer, look for a 118 event in the Client Licensing Event Log. The 118 event indicates that the device could access the Microsoft Activation Servers. This would cause the device to come out of Deferred activation and attempted to activate.

  • How do I ensure that activation occurs at a specific time?

    Answer: Configure Windows to attempt to activate on the next reboot by adding SLMGR.vbs /ato to the RunOnce registry key using the following PowerShell command.

    Reg add HkLm\Software\microsoft\Windows\CurrentVersion\RunOnce /v autoactivate /t REG_SZ /d “C:\windows\system32\slmgr.vbs /ato”

  • How do I check my activation status?

    Answer: You can check your activation status using Settings or the Software Licensing Management Tool.

    • To check your activation status using Settings, using your keyboard, press Windows + R, then type slui.exe into the Run dialog and press Enter.
    • To check your activation status using the Software Licensing Management Tool, using your keyboard, press Windows + R, then type slmgr.vbs /dlv into the Run dialog and press Enter.

  • What causes a device to require reactivation?

    Answer: Anytime a hardware change is made to an active device, the device is classified as either in-tolerance or out-of-tolerance. A minor change such as adding memory or changing the hard drive would typically be considered in-tolerance and not require reactivation. Major hardware changes, such as changing the motherboard, can cause a device to be considered out-of-tolerance, which sets the device back to a not activated state. A large number of small hardware changes made at the same time can also push the device into an out-of-tolerance state.

  • Why does my device show Activate Windows in the lower right corner of the display?

    Answer: When a device requires reactivation, a watermark is displayed in the lower-right corner of each attached display indicating that the device isn't activated. As a result you can't change the Windows personalization settings, such as desktop background or the lock screen background until the device is reactivated.

  • How do I confirm the product key used to enable activation?

    Answer: You can retrieve the last five digits of the product key used to enable activation using the following PowerShell command.

    slmgr.vbs /dli

    The last five digits of the product key used to enable activation can be found after the Partial Product Key: value in the output.

  • How does the use of Unified Write Filer (UWF) impact activation?

    Answer: Windows activates as expected. However, if Unified Write Filter (UWF) is enabled when Windows is activated, restarting the device resets the activation state and you must reactivate the device. Although the device doesn't stay activated, UWF is doing exactly what is it supposed to do. You must activate Windows before enabling UWF, or suspend UWF before attempting to activate in order for the activation state to be retained.

  • I'm having problems with my ePKEA who can I contact for help?

    Answer: To get help with the PKEA, contact your Windows IoT Distributor, or your Microsoft Account Manager.

  • I have more questions on activation, deploying the ePKEA or using VAMT who can I reach out to for help?

    Answer: To get more help with Activation contact your Windows IoT Distributor, or your Microsoft Account Manager.

Related content