Escape from Windows Pro/Business

This blog will explain why an existing Windows Business device isn’t automatically upgraded to Windows Enterprise after assigning the MS365 E5 license when the device is enrolled with Autopilot! It will also show you some other useful information you could use to troubleshoot other Windows subscription licensing issues.

EDIT: 01/06/2022: Added the NCE issue and the HAADJ fix! The fix I mentioned for the first issue in part 4 doesn’t solve that NCE issue!

1. Windows versions and MS365 licenses

Before I discuss the issue further, we need to understand some important differences between the fantastic Microsoft 365 Business Premium license and the Microsoft 365 E5 License.

Do you know why I used the word “fantastic” in combination with the MS365 Business Premium License? That license is the best value for money as it includes almost everything you will need, even Microsoft Defender for Business! Isn’t that wonderful?

Introducing Microsoft Defender for Business

*Microsoft 365 Business Premium

When your user has a Microsoft 365 Business premium license assigned and he/she is enrolling a new device with Autopilot the Windows 10 Pro version would be automatically converted to a Windows Business version

As I mentioned earlier and also by looking at the picture above, Windows 10 Pro is the bare minimum when you want to enroll a device into Azure Ad and Intune

https://call4cloud.nl/2021/08/last-pid-txt-standing-0x8018022/

*Microsoft 365 E5

When your user has a Microsoft 365 E5 license assigned and enrolls a new device with Autopilot, your Windows 10 Pro version will be transformed into a nice Windows Enterprise version.

2. The Problem

So, if we are enrolling a new device, the only thing we should need is a valid, activated Windows Pro license, and we are good to go. Suppose the device’s OriginalProductKey has never been activated before upgrading to Enterprise. In that case, you may need to run this PowerShell online to make sure the build-in product key is activated before upgrading to Enterprise.

$(Get-WmiObject SoftwareLicensingService).OA3xOriginalProductKey | foreach{ if ( $null -ne $_ ) { Write-Host "Installing"$_;changepk.exe /Productkey $_ } else { Write-Host "No key present" } }

After enrolling the device we would end up with a device with Windows Business installed on it. Of course, only if we have assigned the Microsoft 365 Business Premium license

But what happens when we decide to change the Microsoft 365 Business license to a Microsoft 365 E5 license after some weeks? We needed to change it because we suddenly needed to push down some enterprise settings with the use of Intune. But these settings were only available for Windows 10 Enterprise builds.

So, we need Enterprise for some Personalization. To do so, we gave the user a nice MS365 E5 license.

Normally, when logging in with your Entra ID Account, you would expect the device to be converted to Enterprise. So we rebooted the device multiple times to be sure. But even after rebooting it multiple times, nothing changed; the device was still Windows 10 Business instead of Windows 10 Enterprise.

So what’s wrong and how to fix it!

3. Troubleshooting Client-Licensing Level 100

The first thing we did after checking if the device was still Azure Ad Joined with the use of dsregcmd /status, was to check if the Windows Pro license was activated. As told before a Pro license is a hard requirement. So we opened a nice new CMD and entered this command: slmgr /dlv

After a few seconds, we got the licensing information screen. As shown below, it was indeed correctly licensed.

Okay that’s odd because looking at Microsoft their own docs, normally when an Azure Ad user logs in it would trigger a silent edition upgrade with”no reboot required”

Let’s move on, shall we? Of course, we double-checked if the user was indeed licensed for Microsoft 365 E5, and what to do next as we rebooted the device several times. We tried almost everything but reinstalling the device so it could convert to Windows Enterprise was a no-go. At that point, we remembered that a while ago, we did the same for another user, so we decided to check out the device he was working on.

So after opening a remote background session and entering this nice command

systeminfo | findstr /B /C:”OS Name” /B /C:”OS Version”

We immediately noticed the Windows version was already Windows Enterprise

That’s odd because we didn’t do anything special to convert that device to Windows 10 Enterprise.

So we decided to open Google, and maybe we could find something useful… After spending some time on Google we stumbled upon this MS-Docs

Policy CSP – Accounts – Windows Client Management | Microsoft Docs

It’s telling us if the Microsoft Account Sign-in Assistant service (Wlidsvc) is disabled the subscription activation will NOT work because the MSA ticket for license authentication cannot be generated! Okay… sounds fair, so we opened services.msc to check it out even when I am pretty sure we are not disabling services by default!

As shown above, the service was running as it should, so that service wasn’t the issue. What’s next?

4. The One-liner aka the FIX

After spending some more time on google, we found out a couple of things.

*The first one mentioned the “rearm” period of 90 grace days when the Windows Activation would expire and wants to be activated.

*The second one mentioned there could be a delay of up to four days before the cache expires, and your Windows version would be upgraded, as shown below.

*The Third one mentioned the fact that devices that have been upgraded will attempt to renew licenses about every 30 days.

We read all of those articles multiple times, and our conclusion was to just have patience! At some point, Windows will contact the Microsoft Activation Service and convert your Windows 10 Business to Enterprise.

How will we fix this if we don’t want to wait? We need to find a CMD command on the problem device to force it to re-check the subscription licenses. After spending yet again some more time on this issue, this is the command you need to use to fix it!

rundll32 clipc.dll,ClipCleanUpState

It looks like this command does exactly what we need! It refreshes the license subscription and will convert your device to Windows 10 Enterprise! Let’s test it out and do some troubleshooting!

Please note: There could also be other issues in play that could cause your Windows device to NOT upgrade to Enterprise. One of them would probably be the MFA Conditional Access which requires a compliant device before you could access the Microsoft Store. Feel free to read it!

Subscription activation Issues and the Windows Store API (call4cloud.nl)

5. What does it do?

Now that we know which command we should fix, let’s take a better look at “ClipC.dll,” aka Client Licensing Platform Client, which is mentioned in that command. Looking at that name reminded me somehow of “Clippy” but I guess Clippy has nothing to do with licensing…

If you are not sure which functions the DLL has you could use the DLL export viewer from Nirsoft. Open the tool and select the ClipC.dll. As shown below, next to the ClipCleanupState it contains also a lot of other functions.

Also good to know is that ClipC.dll has a corresponding service ClipSVC

They both have the word “licensing/license” in it.. so I guess they have something to do with licensing. Just to be sure the command I showed you is going to work, we made sure the ClipSVC service is stopped

As shown above, it was already stopped.. but I always want to be sure I don’t mess up! Okay Okay, let’s see what happens when we are entering ClipCleanUpState command. Of course, please make sure you use an elevated command prompt!

Not a lot, you would think, right? But let’s open the event log and see what’s happening in the Client-Licensing Event log. Now we have discovered this nice command and what it stands for, we can continue Troubleshooting, but this time, we are going into the rabbit hole a little bit deeper

6. Troubleshooting Client-Licensing Level 200

So, the Client-Licensing event log is the place to start investigating what happened when we performed that Rundll32 command.

After first entering the command, we noticed event 104 mentioning “the ClipSVC was restarted while there is a pending rearm reboot required.” So there is a pending rearm, and a reboot is required? And that word “rearm?” I guess I heard that one before!

So, we rebooted the device. At first, I was under the impression it would update Windows Pro to Enterprise immediately but looking at the activation status told us something else. It was converted back to Pro and mentioned, “the Business subscription is not valid”

So we opened the event log yet again to find out if something else was going wrong.

As shown above, that doesn’t look good. A lot of nice red errors, that could be good right? But looking at the error I showed you earlier (mentioning the subscription is not valid), these errors could have something to do with that. So we decided to reboot the device a second time.

But this time, we noticed something very nice when looking at the Activation screen. As shown below, Windows Pro has been converted to Windows Enterprise and successfully activated!

Please note: We also created a test environment to reproduce the issue manually. After running that rundll32 command, only one reboot was necessary within this test environment.

So we again opened the event log to find out if this upgrade is also noted. As shown below “Lease successfully installed”

I was intrigued if I could find out some more information about Microsoft.Windows.Pro.Addon_8wekyb3d8bbwe and we did. When you need to do some troubleshooting the Client-Licensing event log is a perfect place to start but there is also another CMD command you could use to get yourself all the diagnostics. You can do so by entering this command: licensingdiag -cab c:\test\test.cab

This command will output all the diagnostics to a nice cab file. I guess it could use some other functionality of the ClipC.dll we noticed earlier like ClipGatherDiagnostics.

It also does somehow remind me of the mdmdiagnosticstool I showed you in the blog about troubleshooting TPM errors

Troubleshooting TPM AIK Attestation 0x81039001 errors (call4cloud.nl)

We can gather the diagnostics by using licensingdiag -cab outputfile

But let’s take a look inside this “licensing diag cab” file. In this cab file, you will find a lot of useful stuff. Of course, the Client-licensing event log is in it but also some other logs like the ClipActivationReport. Let’s open that one to check out what’s inside.

This Activation Report, It is mentioning a nice registry key: HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions, let’s check it out, shall we?

As shown above, this registry key only shows us the “ProductOptions”.. Mmm not that useful but I am not done yet. I already showed you some information about the Client Licensing Platform Client, let’s do the same for ClipSVC.

7. What the hell is ClipSVC?

As always, the Event log is very important and knowing how you could output some more diagnostic files is great but I am missing something. As I wanted to know how it works, I started reading more about ClipC.dll and ClipSVC. Short story short:

In the good old days, Windows product activation was handled by SPP (Software Protection Platform) but nowadays the Windows 10 Product activation is controlled by the Client License Service (ClipSVC)

ClipSVC uses tokens that are stored inside the C:\ProgramData\Microsoft\Windows\ClipSVC\ folder

When upgrading a license Microsoft needs to make sure the License is valid, so after successfully passing the genuine validation check, the ClipSVC will record the hardware ID. I guess that’s why I noticed these kinds of device license logs in the Client-Licensing event log! As this ClipSVC will also monitor any hardware changes which could change the hardware id in the device License.

An example is when the hardware id is still intolerance with the device license:

And two examples are when the device license is successfully updated with a different device id and applied the device license successfully

8. Other Possible useful information!

After noticing ClipSVC uses the token.dat file, I was curious about what would happen when we upgrade another user in our test setup from MS 365 business premium to enterprise but this time we are going to remove the token in C:\ProgramData\Microsoft\Windows\ClipSVC\ folder

After removing the tokens.dat file we rebooted the device because as we have learned by now when fixing licensing you will need to reboot. But you can guess what happened… nothing… so let’s take a look at what else was found on the world wide web mentioning fixing licensing and activation issues.

I also found some sites mentioning you could also delete this folder C:\Windows\System32\spp\store\2.0 . Looking at it, it looks more like removing the tokens.dat file in this folder could help when you are dealing with licensing issues with Microsoft Store Apps. But who cares, let’s remove it!

But just like with the other tokens.dat file… nothing changed, the device was still Windows 10 Business.

After spending some more time on the internet, I also came across these nice Tasks in the task scheduler Microsoft\Windows\Subscription.

*EnableLicenseAcquisition and *LicenseAcquisition

Looking at the Next run time date and the “cliprenew.exe” it was going to launch, let’s fire it up manually!

We immediately opened the event log to see what was happening… It looks like it doesn’t do anything?

We also rebooted the device, but after the reboot, it was still running Windows 10 Business, so manually triggering the scheduled task did nothing.

Conclusion

We came across this issue by accident as we needed this device to be Windows 10 Enterprise. Hopefully, this blog will help some people when they are in the same situation.

DO NOT try to enter the KMS Product key!

USE:

net stop clipsvc
rundll32 clipc.dll,ClipCleanUpState
net start clipsvc

Reboot your device twice—once to convert it back to Pro and once to convert it to Enterprise!

I also wrote some other blogs about Licensing issues, feel free to check them!

Windows Licensing Series – Call4Cloud