Saving Upgrade Ryan: How KB5040527 fixed the Subscription Activation issue!

Great news! The July Preview KB5040527 update has finally fixed the Windows subscription activation issue that plagued the upgrade from Windows 11 Pro to Enterprise. While we’re all thrilled about this fix, you need more details to understand the complete picture.

1. Introduction

In a recent journey through the world of Windows updates, we encountered a significant roadblock with the April Windows update KB5036980, which disrupted the automatic upgrade from Windows 11 Pro to Enterprise.

Besides disrupting the automatic upgrade from Pro to Enterprise, it also impacted existing devices, causing them to drop back to Pro. When they dropped back to Pro, all the enterprise-based security features stopped working!

This issue was caused by a permissions problem with the registry key MFARequiredInCLIPRenew, which I explained in a previous blog post on Call4Cloud.

https://call4cloud.nl/2024/05/kb5036980-breaks-upgrade-windows11-enterprise

2. Initial MFARequiredInClipRenew Fix

The initial problem was identified when the LicenseAcquisition scheduled task responsible for the subscription activation failed due to permission issues with the registry key MFARequiredInCLIPRenew.

In the blog I mentioned, I shared a temporary fix that involved manually adding this MFARequriedInClipRenew registry key and the proper permissions.

This adjustment allowed the upgrade process to proceed smoothly. For a detailed explanation, refer to our previous blog post.

3. Microsoft’s Partial Solution

In response, Microsoft introduced the handle_access_denied feature in the June update (KB5039212)to address the MFA-required registry key errors. This handle_access_denied feature would handle the access denied error, in a graceful way, as explained in this blog on Patch My PC: KB5040442 | Windows Activation issues | Access Denied (patchmypc.com)

Before we continue on how this handle_access_denied task is doing its job, let me give you a small summary.

Function Workflow

1. Feature Check: The function verifies if the handle_access_denied feature is enabled using __private_IsEnabled.
2. Registry Key Attempts: It uses functions like CreateOrOpenKey and SetValue to handle the registry key.
3. Bypassing Errors: The feature bypasses errors related to creating or accessing the registry key, ensuring the scheduled task proceeds.
4. Scheduled Task: Ultimately, the task responsible for upgrading to Enterprise runs successfully, even if the MFA key isn’t created.

Unfortunately, this handle_access_denied cliprenew feature was initially disabled by default, which meant that users continued to experience the same upgrade issues despite the update.

As I mentioned in the Patch my PC blog, we could enable it using the Vivetool with some adjustments. Once the feature was enabled, Windows would uplift back to Enterprise.

4. The July KB5040527 Preview Update

The turning point came with the July KB5040527 preview update.

When we look closer at the improvements Microsoft added to the list in this article below, we will notice that the subscription issue is now resolved!

July 25, 2024—KB5040527 (OS Builds 22621.3958 and 22631.3958) Preview – Microsoft Support

It appears that in this preview update, Microsoft has enabled the handle_access_denied feature by default.

This change allowed the scheduled task responsible for the upgrade to run without hiccups, enabling devices to transition back to Enterprise as intended.

I guess it’s almost time to start celebrating! At least I did!

5. A Temporary Workaround?

However, this solution feels (in my humble opinion, but who am I?) like a temporary workaround. The underlying feature that required creating the MFA key is still present, but it’s now being bypassed with the Handle_access_denied feature within Cliprenew.exe.

Consequently, the MFA key is still not being created, even with the latest preview July update.

This indicates that while the immediate problem is mitigated, a more permanent solution is likely still in development. Microsoft added the mfarequiredfeature in the cliprenew executable for a reason not to bypass it later on.

I can only assume that we are going to spot the “real fix” to deal with the MFA-required registry permission issue in an upcoming Windows release! Hopefully, it will not give us the same issues it did when they first implemented this MFA requirement in the clip-renew function in April.

6. A Temporary Workaround indeed!

The July preview update contained a feature to handle the access denied error, but in my opinion, that wasn’t the real fix. I guess I was right!

Microsoft only implemented this fix for, uhhh, the July preview update? This is a bit weird; why go through all the hassle of creating this workaround only to ditch it the same week?

Luckily, Microsoft also added a new feature at the exact moment

Microsoft implemented the Changepathregistryformfafeature to the cliprenew.exe. This feature will move the required from the HKLM to the HKCU and by doing so fixing the access denied issue! Want to hear more about this fix? please read the additional blog:

Conclusion

Stay tuned for further updates as we monitor these developments and provide insights into the next steps for achieving a lasting resolution. We will keep you informed as Microsoft works towards a comprehensive fix for this persistent issue.