:Resolve Windows activation failure on an ECS instance

Possible causes

A Windows ECS instance activates automatically through a built-in script that contacts a Key Management Service (KMS) server. Activation can fail for the following reasons:

• Software Protection service exceptions

• Network exceptions

• Clock synchronization failure

• Insufficient disk space

• Incorrect activation code

• Corrupted license file

Software Protection service exceptions

Problem description

When you run the slmgr -ato command, the following error message appears.

Run 'slui.exe 0x2a 0x80070002' to display the error text.

Example error message:

Cause

The Software Protection service is not running or is disabled.

Solution

1. Connect to the Windows ECS instance. See Connect to a Windows instance.

2. Open Server Manager, select Tools > Services, and double-click Software Protection.

3. Click Start.

   Note

   If the Software Protection service fails to start or is missing, rebuild it:

   1. Run regedit, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppsvc, right-click it, and select Export to back up the key to C:\sppsvc_bak.reg.

   2. On a working ECS instance with the same OS version, export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppsvc to sppsvc_good.reg.

   3. Copy sppsvc_good.reg to the problematic instance and double-click it. When prompted, click Yes to import. Start the service and retry activation.

   4. If activation fails, double-click C:\sppsvc_bak.reg to restore the original registry key.

Network exceptions

Problem description

The "Windows is not genuine" message appears on the desktop. When you manually activate the system as described in How to use a KMS domain name to activate a Windows instance in a VPC, the following error appears.

0xC004F074 The Software Licensing Service reported that the computer could not be activated. The Key Management Service (KMS) could not be contacted.

Example error message:

Cause

A network issue prevents the instance from reaching the KMS server. Common causes include the system firewall, an IP security policy, or other security software blocking the connection.

Solution

1. Add an entry in the format <IP address of the KMS activation server> kms.cloud.aliyuncs.com to the C:\Windows\System32\drivers\etc\hosts file to ensure the KMS domain name resolves correctly.

   Note

   Run ping kms.cloud.aliyuncs.com to obtain the IP address of the KMS activation server.

2. Check if the system firewall blocks TCP port 1688 for kms.cloud.aliyuncs.com. Delete any inbound or outbound rule that blocks this port.

   To view inbound and outbound rules, see the Add port rules section of Set up a firewall for a Windows instance for remote connection.

3. Check if an IP security policy blocks access to the IP address resolved from kms.cloud.aliyuncs.com. If so, delete the policy.

   To view IP security policies, see the Check whether IP security policies are set section of Troubleshoot general faults when you ping a public IP address from a server.

4. Check if other security software is blocking access to TCP port 1688 for kms.cloud.aliyuncs.com.

5. Run route print to check internal routes. Add any missing routes manually.

6. After completing the troubleshooting steps, run telnet kms.cloud.aliyuncs.com to verify connectivity, then retry activation.

Clock synchronization failure

Problem description

Running slmgr -ato returns an activation failure message.

Cause

The instance clock is out of sync with the KMS server. A significant time drift causes activation to fail.

Solution

Check the system time in the lower-right corner of the desktop. If the time is incorrect, adjust it manually or run the following commands to synchronize the clock, then retry activation.

net start W32Time
w32tm /resync

Insufficient disk space

Problem description

A "Product not found" message appears during activation.

Cause

The system disk is full, leaving insufficient space for activation.

Solution

Free up space on the C drive, then retry activation.

Incorrect activation code

Problem description

Error code C004F015 or 0xC004C003 appears, indicating that the activation server blocked the product key.

Cause

The activation code does not match the OS version, typically due to manual changes during activation.

Solution

1. Find the correct activation code for your OS version in the official Microsoft documentation.

2. Run slmgr /ipk <$Setup_Key> to replace the activation code, then run slmgr -ato to activate the system.

   Note

   <$Setup_Key> is the system activation code.

Corrupted license file

Problem description

Cause

The C:\windows\system32\spp\store\2.0\tokens.dat file or other license files are corrupted.

Solution

Reinstall the license files and reactivate the system.

Stop the sppsvc service: Stop-Service SppSvc.

Rename C:\Windows\System32\spp\store\2.0\tokens.dat.

Reinstall the license files: slmgr /rilc.

Activate the system: slmgr /ato.

Restart the instance. The system activates successfully.