Microsoft Digital License Hell

tl;dr Don’t buy a digital Windows license, but good luck getting a “classic” product key. Never ask for “support” or “activation” when speaking to Microsoft’s automated phone attendant.

Salty language is used in the story below, to make for a more entertaining read. Never curse at tech support, no matter how frustrated you get (and if you’re dealing with Microsoft, you will get frustrated). This is also not a journalistic account of what happened, but is reasonably accurate.

I’m not a Windows user, if I can possibly help it. However, as macOS became more and more of a dumpster fire, I switched my photography workstation over to Windows. The MacBook Pro I was using at the time was “good enough”, however the machine lacked a TPM, so I had to go with Windows 10. Again, not a problem, because I don’t really see Windows 11 as an improvement.

As hard as I tried, I could not find an easy way to buy a retail Windows 10/11 Pro license with a product key. The only option direct from Microsoft was a “digital license”. This felt like a bad idea, but for $199 USD plus taxes, gave me a full Windows license. At least with a full retail license, you can transfer it to new hardware.

Fast-forward a few years, and Windows 10 was effectively killed off by Microsoft. The once high-end MacBook Pro was showing its age, and I found a good deal on a mini-PC with Windows 11 preloaded, so I moved my photography software over to the new machine.

However, I had this Windows license on an aging piece of hardware. Since I paid full price for it, I wanted to move it to a virtual machine. I do occasionally use Windows for a few things (other than photography), so I wanted to go ahead and spin up a Windows 11 virtual machine in Proxmox, transfer the license, and have it around for when I need it.

Everything online said to “reset” the previous Windows installation. That would release the license and prep it for transfer. I verified I could still log into the Microsoft account I used to purchase the license, and could see it in my purchase history. I put the old machine online and reset the PC.

I’ve done plenty of Windows 11 installs in Proxmox, so that part was straightforward. Grab the latest ISO from Microsoft, install Windows, and install the virtio drivers from Red Hat. So far, so good, but you can probably guess what happened next.

Windows 11 would not activate. I signed in with my Microsoft account, and ran the “activation troubleshooter”. It would say there’s some sort of problem, but had a link to click if I “had changed my hardware recently”. Seems reasonable, so I’ll click that. More spinning, followed by vague error messages. (“We can’t find any devices linked to your Microsoft account…”). What do you mean? I can see both the new device AND license in my Microsoft account.

I tried this a few times, did some searches online, and couldn’t change the outcome. Also, somewhere in the process, Windows switched to signing in with my Microsoft account. Not what I want, but hopefully it would let me switch back to a local account once activated.

Fun fact, you can’t even log in with a Microsoft account if your machine isn’t connected to the Internet. ‘Cuz everyone is always online, right?

So, let’s try the support options. This was a disaster. Microsoft’s online support and help is useless. Many pages gave me HTTP 500 errors. It was all very circular and useless (spoiler: this is a pattern). Their support articles would say just to do the same things I had done at least a handful of times by this point.

At one time, you used to be able to call Microsoft when you had activation issues.

Microsoft doesn’t want you to call them, but if you do some searching, you can find a toll-free number for them: 800-642-7676. This is where the kafka-esque nightmare begins.

When you call their toll-free number, you’re greeted with a speech recognition IVR. As with all these “AI powered” IVRs, they want you to describe your problem. Stupidly, I mentioned “activation”.

Don’t do that. As soon as you mention “activation” it tells you to go online for support and then hangs up on you.

According to this article, Microsoft has killed off their phone activation service: https://www.neowin.net/news/report-microsoft-quietly-kills-official-way-to-activate-windows-1110-without-internet/

Okay, well, not my first rodeo. Call number two: I asked for help with a purchase. After you confirm that you in fact want to speak to a human, you get one. Magic.

I explained my problem to the human, who pretty quickly said, “oh, you need technical support”. Okay, great, let’s do that. I get transferred to support. The line was silent for quite some time, probably 15 — 20 minutes. Then some music came on. Great, getting close to technical support, right? Nope. After a few minutes of music, the call just dropped.

True to the theme, let’s start over. Call the 800 number, ask for help with a purchase, explain the issue to another sales person, get transferred to technical support. This time, a tier 1 tech did answer the phone.

After explaining the issue, the tier 1 tech wanted to use Quick Assist to get into my machine. That made me a little twitchy… how many support scams start with Quick Assist? But I called Microsoft directly, with a phone number I found on multiple websites (including their own), plus the virtual machine is on an isolated network and has nothing on it. Okay, fine, lets Quick Assist.

The tier 1 tech tried everything I had already tried. They opened up my Microsoft account in Edge and could see the purchase in my history. They tried a few more things like using slmgr, trying to activate with generic volume license keys, and signing in and out of my Microsoft account. No luck. I did have a fair amount of trouble explaining that this was a virtual machine, I’m not sure the tech knew what this was. Lots of questions about my new hardware. “Was the new machine another Apple product?” No, it’s a virtual machine running on a Linux hypervisor called Proxmox.

After about an hour, the tier 1 tech gave up and said they could escalate to tier 2. Okay, great, let’s do that. Hold for a bit, then tier 1 hands off to tier 2.

I explain everything again, but tier 2 understands what a virtual machine is. The new tech repeats pretty much everything tier 1 did. Then proceeds to download the Windows Media Creation tool to download a new Windows ISO to the desktop. They mounted the ISO, and began to re-install Windows from within Windows. Seems odd and useless, it’s a brand new install, but okay. Also, I think every tech ran the sfc tool, which I have never actually seen resolve anything (but does look like they’re doing something and kills time).

The Windows installer error-ed out saying that my CPU wasn’t supported. I chose a generic QEMU x86-64-v2-AES CPU in Proxmox, because I know I’ll be swapping out my hypervisor soon, and I didn’t want Windows to freak out when the CPU changes. It let me install with this CPU type from the original ISO, so I’m not sure why it suddenly complained.

Not a problem, I would just change to the QEMU x86-64-v3 CPU and try again. No luck. Okay, QEMU x86-64-v4… oops, my CPU doesn’t support some instructions, so that won’t work. Fine, I’ll concede and switch to “host” and kick that can down the road, that strategy has worked out well for me so far, right?

Switching the CPU to host made setup.exe happy, so Windows proceeds to reinstall itself, pretty slowly. The re-installation is nearly complete when the phone call drops after 2.5 hours. Damnit! I have no case number, no call back number, just the tech’s name and a quick assist code. The installation finishes and reboots.

Disturbingly, sometimes the Quick Assist session persists across reboots/logouts… but no such luck. I tried re-entering the last session code… maybe I can reconnect and ask the tech to call me back? Nope, Quick Assist just spins and spins. Okay, I need a break anyway.

I go do some things.

I have an epiphany. Maybe sales will just give me a store credit for my purchase, and I can just “buy” a new license. Sounds like an easy hack, right?

Call number 4. I speak to sales, who immediately shoots down my store credit hack. The purchase is “too old”, or something. I explain I was already escalated to tier 2, but all I have is a name for the tech. Nope, that won’t help either. Back to tier 1 you go!

I speak to a new tier 1 tech. At this point, I’ve spent over three hours on the phone with Microsoft. I explain that I’m a bit frustrated and was already escalated to tier 2. My pleas fall on deaf ears. So I have to start over and re-explain everything. Again, tier 1 doesn’t understand what a virtual machine is. They asked odd questions, like could I provide proof of purchase for my new machine. Uh, no, I can’t provide proof of purchase for my custom-built Proxmox server. Tier 1 does all the same troubleshooting steps, again. This time, they went into the registry and tweaked some things like the edition of Windows.

After nearly an hour, unsurprisingly, nothing worked. I would have to be escalated to tier 2. However, now they are not available. We argue a bit about when they can call me… and settle on 9AM local time the next day. I asked if they had my phone number, since they have never asked for it or provided a case number. “Are the last four digits of your number 1234?” Yes. Okay, they have caller ID that passes through. Great.

A few hours later, I get an email. They’re sorry, but won’t have anyone available to call me at 9AM tomorrow. But they can have someone call me between 1PM and 3PM two days later. Okay, great.

About 2 PM the day before they are supposed to call, I get a call which comes up on my phone as “Microsoft”. Again, I think about tech support scams, but answer anyway. I explained that I was supposed to be called tomorrow and wasn’t really ready for this call right now. They asked if I was still experiencing the issue (fuck yes) and said someone would call me tomorrow during the scheduled time. Okay, great.

Except, no one called.

The next day, I decided to start this all over again. Having an escalation and maybe even a case ID in the subject line of an email. I called back the caller ID from two days ago, hoping I could get directly into support. Nope, same IVR as the 800 number. So I asked for support.

NEVER ASK FOR SUPPORT on the Microsoft IVR. It immediately says to go to the web and hangs up on you. Worse, once you do this, they record your caller ID and block further calls from both phone numbers I have at this point. Fun!

No matter, I have other phone numbers. So I call from a new caller ID and go through sales again. I started the call on speakerphone on my VoIP handset, but once I got transferred to tier 1 support, I switched to my handset. I don’t really like speakerphone. Unfortunately, I didn’t have the handset cord plugged in and they couldn’t hear me. While I fiddled with that, I got an incoming call from Microsoft (again, they have caller ID!). I got the handset plugged in and re-explained my issue… again… I already had a tier 2 escalation and no one called me during my “appointment”. This time, I was told the only way I could get support was to reply to the aforementioned email and request a call back. I was skeptical, but that was all the tech would do for me at this point.

So I replied to the email, explained that no one called me, and tier 1 support said to reply to this email and request a call from tier 2. I sent the email and expected never to hear from Microsoft again.

But to my surprise, a little while later, I got a call from Microsoft.

Once again, I have to re-explain everything. I guess Microsoft doesn’t take notes. This time, the tech kept trying to tell me what I was trying to do is impossible. You can’t transfer a digital license. But I kept pushing back. I paid FULL RETAIL PRICE and everything I’ve ever read about this license says you CAN transfer it. That’s the point, otherwise, you could buy an OEM license at a deep discount (and possibly from a shady source). OEM licenses will not transfer. This is what you get when you buy a PC at a store. Since I was not placated by the suggestion I would have to just spend another $199 USD on a new license, the tech said he would try a few things.

They did try a few different things. Eventually downloading a script from https://get.activated.win/.

At first, I thought this was some Microsoft proprietary script, but it turns out to be a PowerShell script hosted by “massgrave.net”. Neat! Not the first time I saw a tech basically “Google” for things like product keys and scripts. I guess they can’t solve the problems they create for themselves and their customers. The tech also seemed to look at the unique device ID for the installation, and I think said they were “doing something with that”.

It also seems like every Microsoft tech asks a bizarre question during each call. This time, I was quizzed about my email address. “Who owns your email? Is it GoDaddy?” No, I run my own email server. I had to explain that a few times. Yes, people still do this.

Somehow, the magic third party script worked. I’m not sure if the tech did anything on the backend or not (I suspect not). But Windows started to report it was activated with a digital license.

After about 30 minutes, this was “good enough” for me. I said I would take an immediate backup of the virtual machine and hope this is resolved.

I noticed the backup was huge. Almost the entire size of the volume I created in Proxmox. I had other things to do, so I’d circle back later.

Later eventually came.

Once again, I was back into Microsoft Account land for the Windows login. I had the virtual machine detached from the network. That’s when I discovered you can’t even log into Windows if it can’t connect back to Microsoft. Fine. You can have Internet access long enough for me to switch back to a local account.

I do that, but I’m immediately told that I can’t switch to a local account. I have Bitlocker turned on (when the fuck did that happen) and my recovery keys have been uploaded to my Microsoft Account (when the fuck did I authorize that?). Hilariously, the error message basically said I was on my own for figuring out how to turn off Bitlocker, but that I should also back up my recovery keys (again, no guidance on how to do that). Fortunately, I know how to do that. So, I use manage-bde to grab the recovery key and back that up. Then I decrypt the drive. Now I can switch to a local account.

With decryption off, I deleted some things (like windows.iso a tech left sitting on the desktop). I use the Windows drive clean up tools to delete a bunch of crap (previous installs, Windows update backups, etc.). I remove basically every app that Windows will allow (which is certainly not all of them). Then I use sdelete from sysinternals to zero out the free space. Take a backup in Proxmox, and now it’s down to a more “reasonable” 13 GB.

Success?!?

This whole episode required 11 calls to Microsoft totaling over 5 hours on the phone, plus the time I spent troubleshooting myself. All in all, I spent at least 10 hours to get Windows 11 Pro installed and activated with a “digital license”.

There were some surprises:

• Being blacklisted by caller ID by asking for support

• Microsoft techs using third party tools and volume license keys

• Bitlocker being turned on and my recovery key being escrow-ed into my Microsoft Account

I was not surprised at how hostile Microsoft is towards their paying customers. I was not surprised that the whole “digital activation” was a fucking disaster. I told myself so, years ago, but could not find an alternative. Short of setting up a business account with a third party, I’m not sure if it’s possible to get a “classic” product key anymore.

In theory, my problem is solved, but I’m skeptical that Windows won’t de-activate itself at some time in the future. It also got activated while the host CPU flags were set in Proxmox, so it may be tied to my physical CPU. My Proxmox server is getting a bit old, so it will need to be replaced. So I’m not sure if I’ll have to go through all this again when that happens. I could try switching back to the QEMU x86-64-v2-AES CPU profile, but that might just piss off Windows and cause it to de-activate. So, I guess yet another can is kicked down the road.