How to Find Non-Genuine Windows Installations and Activate Them (2024)

What is a Genuine Microsoft Product?

Shortly after introducing Windows XP in 2001, Microsoft faced unprecedentedlevels of piracy of its operating system. To combat this, they created ananti-infringement system named Windows Genuine Advantage (WGA) which theylaunched in 2006.

At its core, Genuine Advantage further extended the anti-piracy protectionsbeyond entering and validating license keys during setup (a process known asactivation). These extensions included continuous license validity checks thatphoned home to Microsoft and visible consequences if Windows was found not tobe genuine.

Why is There Non-Genuine Microsoft Software On My Devices?

There are many reasons non-genuine software may be installed on your PCs. Inpractice, these are the most common:

Intentional Piracy

End-users who are used to pirating software on their personal devices maybe willing to take the same risk on their work devices, especially insituations where they are forced to use an outdated version of Windows.

This is a worst-case scenario because pirated software is often stronglycorrelated with malware infections which can compromise the integrity of theentire operating system.

In a 2017 IDC study commissioned by Microsoft, IDC found that one inthree unlicensed or pirated copies of PC software caused malwareinfection.¹

Developer Virtual Machines / Test Devices

macOS and Linux are quickly growing in market share among the preferredplatforms for software engineers to use on their work devices. That being said,these developers often need to test cross-platform code on Windowsto ensure compatibility. To do this, developers will use a virtualmachine (VM) that runs Windows which they can boot-up on demand.When a VM isn’t practical—like on Macs running Apple silicon—older Intel Macs that can run Bootcamp may be used for the same purpose.

Developers often download pre-packaged VM images or ISOs from Microsoft thatcontain evaluation versions of Microsoft Windows. These images get the developerup and running, but within a few weeks begin prompting the developer to entera valid license key. Since most developers don’t have the ability to instantlyprocure this software (and they don’t see the value) these ad-hoc installationsquickly expire and are then considered non-genuine by Microsoft.

It’s important to identify these devices. While they aren’t used often, theystill likely have sensitive files on them (like source code being tested andinfrastructure secrets). In the case of VM they may even have the ability toaccess the files or the network available to the host system. These allrepresent potential risk on a device that isn’t being managed as if it isa real asset.

Malware Infections

Unrelated to piracy, poorly engineered malware can cause a previously licensedand genuine version of Windows to suddenly report as non-genuine. This occursbecause the malware, in an effort to compromise the system, corrupts coreservices and important files on the PC that are associated with theGenuine Advantage capability.

This occurs when malware is attempting to hook deeply into the system(ex: a rootkit) so it can undermine the integrity of the built-in security ofWindows and hide an infection from the end-user.

Chasing down non-genuine Windows installations can be the first thread infinding a significant dormant infection, allowing you to correct it, beforeit becomes a serious problem.

Programmatically Locating Non-Genuine Versions of Windows

Microsoft WMI enables you to enumerate the state of Windows License using theSoftwareLicensingProduct table (docs).

SELECT Name, GenuineStatus, LicenseStatus, PartialProductKey FROM SoftwareLicensingProductWHERE PartialProductKey IS NOT NULL AND Name LIKE "Windows%" AND (LicenseStatus != 1 OR GenuineStatus = 1);

You can run this query right from the Windows Terminal using theGet-WMIObject PowerShell cmdlet.

Get-WMIObject -Query 'SELECT Name, GenuineStatus, LicenseStatus, PartialProductKey FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND Name LIKE "Windows%" AND (LicenseStatus != 1 OR GenuineStatus = 1);';

Why Is Non-Genuine Microsoft Software a Problem?

It can be tempting for IT staff to want to avoid turning over the software licensingrock. Once they become aware of it, they now have to solve a tricky andexpensive problem that only serves to benefit Microsoft financially.

While it’s easy to empathize with this viewpoint, looking at the facts,the benefits of having this visibility to you and your organization faroutweigh the perceived (and often unrealized) negative impacts.

As stated above, unlicensed or counterfeit versions of Windows are indicatorsof other potential problems. For example:

• Windows PCs with non-genuine software are much more likelyto be compromised by malware.

• Windows PCs with non-genuine software are more likely to be un-managed orgenerally unknown to the IT Team.

• Windows PCs that are non-genuine may indicate a developer use-case that isn’tbeing accounted for by the organization in any official way.

These insights are extremely valuable and well worth the effort of enumeratingnon-genuine Windows installations.

How Does Kolide’s Detection Work?

Kolide’s endpoint agent is capable of running queries against WMI so you canaggregate Microsoft License informationacross all of your Windows PCs.

This problem cannot be remediated through traditional automation with tools like an MDM. You need to be able to stop devices that fail this check form authenticating to your SaaS apps and then give end-users precise instructions on how to unblock their device.

Kolide's Okta Integration does exactly that. Onece integrated in your sign-in flow, Kolide will automatically associate devices with your users' Okta identities. From there, it can block any device that exhibits this problem and then provide the user, step-by-step instructions on how to fix it. Once fixed, Kolide immediately unblocks their device. Watch a demo to find out more.