Call4Cloud | MMP-C | Autopilot | Device Preparation

Escape from Windows Pro/Business

Patch My Pc | install & update thousands of apps

This blog will explain why an existing Windows Business device isn’t automatically upgraded to Windows Enterprise after assigning the MS365 E5 license when the device is enrolled with Autopilot! It will also show you some other useful information you could use to troubleshoot other Windows subscription licensing issues.

EDIT: 01/06/2022: Added the NCE issue and the HAADJ fix! The fix I mentioned for the first issue in part 4 doesn’t solve that NCE issue!

1. Windows versions and MS365 licenses

Before I discuss the issue further, we need to understand some important differences between the fantastic Microsoft 365 Business Premium license and the Microsoft 365 E5 License.

Do you know why I used the word “fantastic” in combination with the MS365 Business Premium License? That license is the best value for money as it includes almost everything you will need, even Microsoft Defender for Business! Isn’t that wonderful?

Introducing Microsoft Defender for Business

*Microsoft 365 Business Premium

When your user has a Microsoft 365 Business premium license assigned and he/she is enrolling a new device with Autopilot the Windows 10 Pro version would be automatically converted to a Windows Business version

Afbeelding met tekst  Automatisch gegenereerde beschrijving

As I mentioned earlier and also by looking at the picture above, Windows 10 Pro is the bare minimum when you want to enroll a device into Azure Ad and Intune

https://call4cloud.nl/2021/08/last-pid-txt-standing-0x8018022/

*Microsoft 365 E5

When your user has a Microsoft 365 E5 license assigned and enrolls a new device with Autopilot, your Windows 10 Pro version will be transformed into a nice Windows Enterprise version.

2. The Problem

So, if we are enrolling a new device, the only thing we should need is a valid, activated Windows Pro license, and we are good to go. Suppose the device’s OriginalProductKey has never been activated before upgrading to Enterprise. In that case, you may need to run this PowerShell online to make sure the build-in product key is activated before upgrading to Enterprise.

$(Get-WmiObject SoftwareLicensingService).OA3xOriginalProductKey | foreach{ if ( $null -ne $_ ) { Write-Host "Installing"$_;changepk.exe /Productkey $_ } else { Write-Host "No key present" } }

After enrolling the device we would end up with a device with Windows Business installed on it. Of course, only if we have assigned the Microsoft 365 Business Premium license

Afbeelding met tekst  Automatisch gegenereerde beschrijving

But what happens when we decide to change the Microsoft 365 Business license to a Microsoft 365 E5 license after some weeks? We needed to change it because we suddenly needed to push down some enterprise settings with the use of Intune. But these settings were only available for Windows 10 Enterprise builds.

So, we need Enterprise for some Personalization. To do so, we gave the user a nice MS365 E5 license.

Afbeelding met tafel  Automatisch gegenereerde beschrijving

Normally, when logging in with your Entra ID Account, you would expect the device to be converted to Enterprise. So we rebooted the device multiple times to be sure. But even after rebooting it multiple times, nothing changed; the device was still Windows 10 Business instead of Windows 10 Enterprise.

So what’s wrong and how to fix it!

3. Troubleshooting Client-Licensing Level 100

The first thing we did after checking if the device was still Azure Ad Joined with the use of dsregcmd /status, was to check if the Windows Pro license was activated. As told before a Pro license is a hard requirement. So we opened a nice new CMD and entered this command: slmgr /dlv

Afbeelding met tekst  Automatisch gegenereerde beschrijving

After a few seconds, we got the licensing information screen. As shown below, it was indeed correctly licensed.

Okay that’s odd because looking at Microsoft their own docs, normally when an Azure Ad user logs in it would trigger a silent edition upgrade with”no reboot required”

Afbeelding met tekst  Automatisch gegenereerde beschrijving

Let’s move on, shall we? Of course, we double-checked if the user was indeed licensed for Microsoft 365 E5, and what to do next as we rebooted the device several times. We tried almost everything but reinstalling the device so it could convert to Windows Enterprise was a no-go. At that point, we remembered that a while ago, we did the same for another user, so we decided to check out the device he was working on.

So after opening a remote background session and entering this nice command

systeminfo | findstr /B /C:”OS Name” /B /C:”OS Version”

We immediately noticed the Windows version was already Windows Enterprise

That’s odd because we didn’t do anything special to convert that device to Windows 10 Enterprise.

So we decided to open Google, and maybe we could find something useful… After spending some time on Google we stumbled upon this MS-Docs

Policy CSP – Accounts – Windows Client Management | Microsoft Docs

It’s telling us if the Microsoft Account Sign-in Assistant service (Wlidsvc) is disabled the subscription activation will NOT work because the MSA ticket for license authentication cannot be generated! Okay… sounds fair, so we opened services.msc to check it out even when I am pretty sure we are not disabling services by default!

As shown above, the service was running as it should, so that service wasn’t the issue. What’s next?

4. The One-liner aka the FIX

After spending some more time on google, we found out a couple of things.

*The first one mentioned the “rearm” period of 90 grace days when the Windows Activation would expire and wants to be activated.

*The second one mentioned there could be a delay of up to four days before the cache expires, and your Windows version would be upgraded, as shown below.

*The Third one mentioned the fact that devices that have been upgraded will attempt to renew licenses about every 30 days.

devices that have been upgraded will attempt to renew licenses about every 30 days

We read all of those articles multiple times, and our conclusion was to just have patience! At some point, Windows will contact the Microsoft Activation Service and convert your Windows 10 Business to Enterprise.

How will we fix this if we don’t want to wait? We need to find a CMD command on the problem device to force it to re-check the subscription licenses. After spending yet again some more time on this issue, this is the command you need to use to fix it!

rundll32 clipc.dll,ClipCleanUpState

It looks like this command does exactly what we need! It refreshes the license subscription and will convert your device to Windows 10 Enterprise! Let’s test it out and do some troubleshooting!

Please note: There could also be other issues in play that could cause your Windows device to NOT upgrade to Enterprise. One of them would probably be the MFA Conditional Access which requires a compliant device before you could access the Microsoft Store. Feel free to read it!

Subscription activation Issues and the Windows Store API (call4cloud.nl)

5. What does it do?

Now that we know which command we should fix, let’s take a better look at “ClipC.dll,” aka Client Licensing Platform Client, which is mentioned in that command. Looking at that name reminded me somehow of “Clippy” but I guess Clippy has nothing to do with licensing…

Clippy komt terug om je te helpen - Webwereld

If you are not sure which functions the DLL has you could use the DLL export viewer from Nirsoft. Open the tool and select the ClipC.dll. As shown below, next to the ClipCleanupState it contains also a lot of other functions.

export of clipc.dll showing the clipcleanupstate function

Also good to know is that ClipC.dll has a corresponding service ClipSVC

Afbeelding met tekst  Automatisch gegenereerde beschrijving

They both have the word “licensing/license” in it.. so I guess they have something to do with licensing. Just to be sure the command I showed you is going to work, we made sure the ClipSVC service is stopped

Afbeelding met tekst  Automatisch gegenereerde beschrijving

As shown above, it was already stopped.. but I always want to be sure I don’t mess up! Okay Okay, let’s see what happens when we are entering ClipCleanUpState command. Of course, please make sure you use an elevated command prompt!

Afbeelding met tekst  Automatisch gegenereerde beschrijving

Not a lot, you would think, right? But let’s open the event log and see what’s happening in the Client-Licensing Event log. Now we have discovered this nice command and what it stands for, we can continue Troubleshooting, but this time, we are going into the rabbit hole a little bit deeper

6. Troubleshooting Client-Licensing Level 200

So, the Client-Licensing event log is the place to start investigating what happened when we performed that Rundll32 command.

After first entering the command, we noticed event 104 mentioning “the ClipSVC was restarted while there is a pending rearm reboot required.” So there is a pending rearm, and a reboot is required? And that word “rearm?” I guess I heard that one before!

Client-Licensing event log showing all the event that corrospond with the subscription activation licensing

So, we rebooted the device. At first, I was under the impression it would update Windows Pro to Enterprise immediately but looking at the activation status told us something else. It was converted back to Pro and mentioned, “the Business subscription is not valid”

Afbeelding met tekst  Automatisch gegenereerde beschrijving

So we opened the event log yet again to find out if something else was going wrong.

As shown above, that doesn’t look good. A lot of nice red errors, that could be good right? But looking at the error I showed you earlier (mentioning the subscription is not valid), these errors could have something to do with that. So we decided to reboot the device a second time.

But this time, we noticed something very nice when looking at the Activation screen. As shown below, Windows Pro has been converted to Windows Enterprise and successfully activated!

windows is now activated

Please note: We also created a test environment to reproduce the issue manually. After running that rundll32 command, only one reboot was necessary within this test environment.

So we again opened the event log to find out if this upgrade is also noted. As shown below “Lease successfully installed”

Afbeelding met tekst  Automatisch gegenereerde beschrijving

I was intrigued if I could find out some more information about Microsoft.Windows.Pro.Addon_8wekyb3d8bbwe and we did. When you need to do some troubleshooting the Client-Licensing event log is a perfect place to start but there is also another CMD command you could use to get yourself all the diagnostics. You can do so by entering this command: licensingdiag -cab c:\test\test.cab

This command will output all the diagnostics to a nice cab file. I guess it could use some other functionality of the ClipC.dll we noticed earlier like ClipGatherDiagnostics.

Clipc.dll showing the clipgatherdiagnostics command

It also does somehow remind me of the mdmdiagnosticstool I showed you in the blog about troubleshooting TPM errors

Troubleshooting TPM AIK Attestation 0x81039001 errors (call4cloud.nl)

We can gather the diagnostics by using licensingdiag -cab outputfile

creating a licensing diagnostic cab file by using the command licensingdiag -cab

But let’s take a look inside this “licensing diag cab” file. In this cab file, you will find a lot of useful stuff. Of course, the Client-licensing event log is in it but also some other logs like the ClipActivationReport. Let’s open that one to check out what’s inside.

when running the licensediagnostics we will get a folder with athe clipactivastionreport.xml in it

This Activation Report, It is mentioning a nice registry key: HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions, let’s check it out, shall we?

Afbeelding met tekst  Automatisch gegenereerde beschrijving

As shown above, this registry key only shows us the “ProductOptions”.. Mmm not that useful but I am not done yet. I already showed you some information about the Client Licensing Platform Client, let’s do the same for ClipSVC.

7. What the hell is ClipSVC?

As always, the Event log is very important and knowing how you could output some more diagnostic files is great but I am missing something. As I wanted to know how it works, I started reading more about ClipC.dll and ClipSVC. Short story short:

In the good old days, Windows product activation was handled by SPP (Software Protection Platform) but nowadays the Windows 10 Product activation is controlled by the Client License Service (ClipSVC)

ClipSVC uses tokens that are stored inside the C:\ProgramData\Microsoft\Windows\ClipSVC\ folder

When upgrading a license Microsoft needs to make sure the License is valid, so after successfully passing the genuine validation check, the ClipSVC will record the hardware ID. I guess that’s why I noticed these kinds of device license logs in the Client-Licensing event log! As this ClipSVC will also monitor any hardware changes which could change the hardware id in the device License.

An example is when the hardware id is still intolerance with the device license:

Afbeelding met tekst  Automatisch gegenereerde beschrijving

And two examples are when the device license is successfully updated with a different device id and applied the device license successfully

Afbeelding met tekst  Automatisch gegenereerde beschrijving
Afbeelding met tekst  Automatisch gegenereerde beschrijving

8. Other Possible useful information!

After noticing ClipSVC uses the token.dat file, I was curious about what would happen when we upgrade another user in our test setup from MS 365 business premium to enterprise but this time we are going to remove the token in C:\ProgramData\Microsoft\Windows\ClipSVC\ folder

Afbeelding met tekst  Automatisch gegenereerde beschrijving

After removing the tokens.dat file we rebooted the device because as we have learned by now when fixing licensing you will need to reboot. But you can guess what happened… nothing… so let’s take a look at what else was found on the world wide web mentioning fixing licensing and activation issues.

I also found some sites mentioning you could also delete this folder C:\Windows\System32\spp\store\2.0 . Looking at it, it looks more like removing the tokens.dat file in this folder could help when you are dealing with licensing issues with Microsoft Store Apps. But who cares, let’s remove it!

Afbeelding met tekst  Automatisch gegenereerde beschrijving

But just like with the other tokens.dat file… nothing changed, the device was still Windows 10 Business.

Afbeelding met tekst  Automatisch gegenereerde beschrijving

After spending some more time on the internet, I also came across these nice Tasks in the task scheduler Microsoft\Windows\Subscription.

*EnableLicenseAcquisition and *LicenseAcquisition

*EnableLicenseAcquisition and *LicenseAcquisition scheduled tasks that will handle the subscription activaiton

Looking at the Next run time date and the “cliprenew.exe” it was going to launch, let’s fire it up manually!

these licensing tasks will use cliprenew.exe to renew the license

We immediately opened the event log to see what was happening… It looks like it doesn’t do anything?

We also rebooted the device, but after the reboot, it was still running Windows 10 Business, so manually triggering the scheduled task did nothing.

Afbeelding met tekst  Automatisch gegenereerde beschrijving

Conclusion

We came across this issue by accident as we needed this device to be Windows 10 Enterprise. Hopefully, this blog will help some people when they are in the same situation.

DO NOT try to enter the KMS Product key!

USE:

net stop clipsvc
rundll32 clipc.dll,ClipCleanUpState
net start clipsvc

Reboot your device twice—once to convert it back to Pro and once to convert it to Enterprise!

I also wrote some other blogs about Licensing issues, feel free to check them!

Windows Licensing Series – Call4Cloud

Fix You GIFs | Tenor

24 thoughts on “Escape from Windows Pro/Business

  1. Great blog. We’ve been struggling with this problem for quite a while now and I think you might have steered us in the right direction. About time some took the bull by horns. Microsoft support has been useless and a waste of time so far.

    Thank you!

  2. Hi Rudy,

    We found out that since we switched to New Commerce Experience and the grace period of 90 days has expired, after changing licenses, the machines no longer upgrade to Enterprise with the result that direct access no longer works and we have an angry customer. Do you have any idea to speed up the process?

    Thanks in advance.

    Mark

    1. Hi… what happens when running that command rundll32 clipc.dll,ClipCleanUpState and rebooting the device?

      1. So that’s the issue, it seems that the old MSP licenses have expired, but are still assigned and we can’t remove them, the Windows license also seems to be hanging on the old license. rundll32 clipc.dll,ClipCleanUpState does not force an Enterprise upgrade. Nothing has changed about the entire configuration at 2 customers and the common denominator is switching licensing models. One customer collapsed last week and now we have another customer with exactly the same issue. Since last week there is a call at MS, but unfortunately still no response.

        1. Hi… THe old windows 10 pro license (that was expired) is it still activated? what happens when putting in a new windows 10 pro license key?
          I really need to have some logs to determine what could be causing it…

          1. Hi, nope even when replacing the pro-key the device wont upgrade. I have the log cab-file if you want… How can I share it with you?

          2. Hi… of course… you could send it o my info@call4cloud.nl address (so it wont get blocked :P)

          3. Hi, sorry to resurrect an old thread but did you ever manage to figure this out? We have a client with a similar issue who were also moved to the New Commerce Experience recently. The only difference is that the problem is affecting new devices. Running the commands in this blog post has sadly had no effect and Microsoft Support have been equally useless so far.

            Thanks,
            Joe

          4. Hehe… was just about going to update the blog
            This should temporary fix it

            cscript.exe C:\Windows\System32\slmgr.vbs -ipk NPPR9-FWDCX-D2C8J-H872K-2YT43

            It will put in a generic KMS enterprise key for the time being… after entering it.. the device will become enterprise again.. In the meantime MS needs to fix the issues… as it is a issue with the NCE licensing in the backend (as it looks like)

  3. I’ve spent a long time looking for a fix for an issue like this. Eventually thanks to following your blogs in this series I’ve found out the issue was due to the fact that my Intune PC was linked with 2 tenants (my own company’s tenant and the tenant of a customer, because I didn’t remove the checkmark in the box next to “Allow my organization to manage my device” when logging on to the customer’s tenant in some O365 application (cfr: https://4sysops.com/archives/windows-1011-azure-adintune-enterprise-subscription-is-not-valid/)

  4. This was a GREAT article
    However, there is NEW information – as of about 8 months ago.
    If you’re using Azure MFA, Microsoft requires you to exclude the windows store.
    We just went through this whole thing. Here’s a reddit article from a year ago where people went over all this.
    Micorosft’s article on how to implement cloud licensing needs to be updated to include this information – I have an open ticket with MS on this, I’m going to ask if they will update it. You referenced that doc here in your article – that’s the doc that needs updating.
    https://www.reddit.com/r/Intune/comments/ppbfqg/which_cloud_app_must_bypass_mfa_to_be_able_to/

    1. True but i guess you missed the other blog i wrote about this (thought i mentioned it also in this blog) when writing that blog that mfa exclusion wasnt mentioned (i talked with ms about this :p)

      https://call4cloud.nl/2022/05/night-at-the-windows-store-api-service-secret-of-the-subscription-activation/

  5. Thank you, and I got my windows 10 enterprise and Microsoft 365 from the Microsoft partner store keyingo.com, it is working perfectly

  6. Nice blog!

    Was actually having this issue but in a different way (just from pro to enterprise) and your post helped me understand and to dig further as to why was that happening :3

    Thanks from Ibiza, Spain,

    Enrico

  7. I’m having this same issue. My question is, doesn’t this issue kind of mess up deploying devices with Autopilot? I mean, if I have certain policies and settings configured that depend upon Enterprise licensing and my W10/W11 pro devices aren’t automatically stepping up, the some of those policies and settings are going to initially be consider “not applicable” or perhaps even error out. What would the best way be to handle this?

    1. I have this exact same question. The manual method did work to upgrade the pc to Enterprise from Pro, but how are we supposed to tackle this on mass AutoPilot scale?

  8. Also, instead of rebooting twice you can run the following to grab the original OEM license:

    $GetDigitalLicence = (Get-WmiObject -query ‘select * from SoftwareLicensingService’).OA3xOriginalProductKey
    cscript c:\windows\system32\slmgr.vbs -ipk $GetDigitalLicence

    And then do as you suggest above:

    net stop clipsvc
    rundll32 clipc.dll,ClipCleanUpState
    net start clipsvc

    Then reboot once and you should be good to go. Doing it this way prevents the need for multiple reboots.

    1. Yep combining them would make the second reboot unnecessary… Guess I still need to add that part to the blog… but when first writing it and fixing it… it didn’t combine those 2 parts (as I mention both of them in the blog 🙂 )

  9. Don’t you need to be an admin to perform the above? Are you saying all this can be delivered as a remediation script without needing to shadow and remote onto 1000+ machines via remote control tool and run that command manually. Let me guess no one has tried this via a remediation script and if they have does it work (Does anything work nowadays with Microsoft)? I’d get 100% success abandoning PolicyCSP for settings management (and the greedy MS requiring Enterprise licenses) and do EVERYTHING via registry Key injection and file injection using a 3rd party product like Ivanti desktop now. Local GPEDIT.MSC hasn’t Gone has it. Intune is not ready and i don’t know when it will be ready. What does ready mean? Sell a product that is better than before or at the minimum the same level of DaaS management layer as before. WMI Doesn’t exist, remote computer management…Doesn’t exist the list of removed features is endless to cause x2 higher cost of ownership at X4 times the price!

    $GetDigitalLicence = (Get-WmiObject -query ‘select * from SoftwareLicensingService’).OA3xOriginalProductKey
    cscript c:\windows\system32\slmgr.vbs -ipk $GetDigitalLicence

    net stop clipsvc
    rundll32 clipc.dll,ClipCleanUpState
    net start clipsvc

  10. Hi, in our company we solved it by putting admin users and restarting.
    After restarting windows it activates with Enterprise.
    Obviously afterwards we remove the user as administrator.
    I just have to find out why we have to do this and we have to understand why it doesn’t do it on all PCs (I think)

  11. Hi Rudy,

    We are experiencing the same thing with Windows 11.
    Not sure whether it’s because of Windows 11. The rearm seems always there, no matter how many reboots I did.

    1. Did you also read the blog i wrote about the subscription activation issues when you have the latest windows updates installed?

Leave a Reply

Your email address will not be published. Required fields are marked *

57  +    =  58

Proudly powered by WordPress | Theme: Wanderz Blog by Crimson Themes.