How to remediate – Windows OS Not Activated (WMI)

1. Introduction

The Windows OS Not Activated (WMI) vulnerability means a Microsoft Windows installation hasn’t been activated correctly. This is important because unactivated systems will eventually stop functioning as intended, disrupting business operations. It typically affects desktop and server installations of Windows. A lack of activation impacts availability; confidentiality and integrity are not directly affected.

2. Technical Explanation

• Root cause: The Windows licensing subsystem hasn’t successfully validated the operating system license.
• Exploit mechanism: There is no exploit in this case; it’s a configuration issue. A user or administrator simply needs to activate the OS.
• Scope: All versions of Microsoft Windows are potentially affected, including desktop and server editions.

3. Detection and Assessment

You can confirm if a system is unactivated using several methods. Start with a quick check in System Information, then use PowerShell for more detail.

• Quick checks: Open the System window (Win + Pause/Break) or run msinfo32 and look for “OS Activation Status”. If it says “Not Activated”, the system is vulnerable.
• Scanning: There are no specific scanners for this issue; standard OS inventory tools can report activation status.
• Logs and evidence: Event ID 405 in the Application event log indicates activation issues, but may not always be present.

powershell Get-WmiObject -Class Win32_OperatingSystem | Select-Object OSArchitecture, Caption, ProductID, LicenseStatus

4. Solution / Remediation Steps

Fixing this involves activating the Windows operating system using a valid product key or through your organisation’s activation server.

4.1 Preparation

• Ensure you have a valid Windows product key available. Roll back is simple: if activation fails, the OS will continue in its current state.
• Change windows may require approval from IT management depending on your organisation’s policies.

4.2 Implementation

1. Step 1: Open Settings (Win + I).
2. Step 2: Go to Update & Security > Activation.
3. Step 3: Click “Change product key” and enter a valid key, or click “Activate” if you are using KMS/MAK activation.
4. Step 4: Follow the on-screen instructions to complete activation.

4.3 Config or Code Example

Before

powershell Get-WmiObject -Class Win32_OperatingSystem | Select-Object LicenseStatus

After

powershell Get-WmiObject -Class Win32_OperatingSystem | Select-Object LicenseStatus

4.4 Security Practices Relevant to This Vulnerability

While not a direct security issue, good asset management and patch cadence can help prevent this by ensuring systems are properly licensed and configured during deployment.

• Practice 2: A regular patch cadence includes checking activation status as part of routine maintenance.

4.5 Automation (Optional)

# Example PowerShell script to check activation status across multiple machines (requires remote management enabled).
foreach ($computer in @("PC1", "PC2", "PC3")) {
    try {
        $status = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $computer | Select-Object LicenseStatus
        if ($status.LicenseStatus -ne "Licensed") {
            Write-Host "$computer is not activated."
        } else {
            Write-Host "$computer is activated."
        }
    } catch {
        Write-Host "Error connecting to $computer: $($_.Exception.Message)"
    }
}

5. Verification / Validation

Confirm the fix by checking activation status in Settings or using PowerShell. A smoke test should verify core system functionality.

• Post-fix check: Run msinfo32 and confirm “OS Activation Status” shows “Activated”.
• Re-test: Re-run the earlier command Get-WmiObject -Class Win32_OperatingSystem | Select-Object LicenseStatus. The output should show “Licensed”.
• Smoke test: Verify basic functionality like opening a web browser and accessing network resources.
• Monitoring: Monitor Event ID 405 in the Application event log for any new activation failures.

powershell Get-WmiObject -Class Win32_OperatingSystem | Select-Object LicenseStatus

6. Preventive Measures and Monitoring

• Baselines: Include an activation check in your standard Windows build image or GPO settings.
• Asset and patch process: Review the activation status of all Windows systems on a monthly basis.

7. Risks, Side Effects, and Roll Back

The main risk is entering an invalid product key, which will not activate the OS. Service impacts are minimal; the system will simply remain unactivated. Roll back involves reverting to the previous activation state (if any) or re-entering a valid key.

• Risk or side effect 1: Entering an incorrect product key may lock out further attempts for a period of time.
• Risk or side effect 2: Activation server outages can temporarily prevent successful activation.
• Roll back: If activation fails, simply restart the system and try again later, or re-enter the correct product key.

8. References and Resources

• Vendor advisory or bulletin: Microsoft Volume Activation
• NVD or CVE entry: Not applicable, as this is a configuration issue not an exploit.
• Product or platform documentation relevant to the fix: Troubleshoot Windows activation errors