Answered by:
OGA false alert on Office 2003

Question
-
For some time now, client PCs in the company I work for (I am the IT admin) get the familiar "this copy of Office is not genuine" message box when an Office app is started. The company has purchased a volume license but it appears that the VLK we have been given has been blacklisted. I have contacted Microsoft support before but have received no response.
This has been going on for some time and staff is increasingly frustrated by these false alerts. It needs to be fixed ASAP.
Many thanks,
Greg
Dump of the MGA tool:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Status: Genuine
Validation Code: 0
Cached Validation Code: N/A
Windows Product Key: *****-*****-2MDY9-F6J9M-K42BQ
Windows Product Key Hash: jY+nlE0RT38EEXpeUqSdQPABSQc=
Windows Product ID: 76487-OEM-2211906-00101
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 5.1.2600.2.00010100.3.0.pro
ID: {04F01177-E9EA-4628-A0EE-BCFB5A043119}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.40.0
Signed By: Microsoft
Product Name: N/A
Architecture: N/A
Build lab: N/A
TTS Error: N/A
Validation Diagnostic: 025D1FF3-230-1
Resolution Status: N/AVista WgaER Data-->
ThreatID(s): N/A
Version: N/AWindows XP Notifications Data-->
Cached Result: 0
File Exists: Yes
Version: 1.9.40.0
WgaTray.exe Signed By: Microsoft
WgaLogon.dll Signed By: MicrosoftOGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002OGA Data-->
Office Status: 114 Blocked VLK 2
Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-175-80070002_B4D0AA8B-604-645_025D1FF3-230-1Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: AllowedFile Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{04F01177-E9EA-4628-A0EE-BCFB5A043119}</UGUID><Version>1.9.0027.0</Version><OS>5.1.2600.2.00010100.3.0.pro</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-K42BQ</PKey><PID>76487-OEM-2211906-00101</PID><PIDType>2</PIDType><SID>S-1-5-21-3498620614-502830929-1480936212</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Compaq dx2420 Microtower</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>5.18</Version><SMBIOSVersion major="2" minor="5"/><Date>20090220000000.000000+000</Date><SLPBIOS>Compaq,Hewlett,Hewlett,Compaq</SLPBIOS></BIOS><HWID>4A9B30F70184E078</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>1</iJoin><SBID><stat>2</stat><msppid></msppid><name>Hewlett-Packard Company</name><model>HP Compaq dx2420 Microtower</model></SBID><OEM/><GANotification><File Name="WgaTray.exe" Version="1.9.40.0"/><File Name="WgaLogon.dll" Version="1.9.40.0"/></GANotification></MachineData><Software><Office><Result>114</Result><Products><Product GUID="{90110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>114</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>59D1605114E3500</Val><Hash>vfZmaSmFPIYrLWTcZSZErUQg+Fo=</Hash><Pid>73931-640-0000106-57990</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="114"/><App Id="16" Version="11" Result="114"/><App Id="18" Version="11" Result="114"/><App Id="19" Version="11" Result="114"/><App Id="1A" Version="11" Result="114"/><App Id="1B" Version="11" Result="114"/><App Id="44" Version="11" Result="114"/></Applications></Office></Software></GenuineResults>Licensing Data-->
N/AWindows Activation Technologies-->
N/AHWID Data-->
N/AOEM Activation 1.0 Data-->
BIOS string matches: yes
Marker string from BIOS: 10071:Compaq Computer Corporation|1005E:Compaq Computer Corporation|1005E:Compaq Computer Corporation|1005E:Hewlett-Packard Company
Marker string from OEMBIOS.DAT: Compaq,Hewlett,Hewlett,CompaqOEM Activation 2.0 Data-->
N/AWednesday, April 28, 2010 4:09 PM
Answers
-
Hello qwertum,
The Office Genuine Advantage Notifications Utility is distributed as an important (but not critical secruity) update (KB949810) by Windows Update.
Depending upon the permissions levels given to the users in your organization, and the methods your organization uses to deploy Windows Updates, some of your computers may have the KB949810 update installed and some may not. If the update is not installed, the only ways a user would be notified that the installation of Office on the computer is nongenuine would be if (a) they were to visit www.microsoft.com/genuine and click on the Validate Office button, or (b) they were to visit the Office downloads site and choose to download some nice-to-have Office add-on that was "gated" by OGA---IOW the installation of Office would have to be validated before the nice-to-have item could be downloaded. At one time gated content included many popular Office templates, but I think as time has gone by, there are fewer and fewer of the nice-to-haves are OGA-gated. If the update is installed, then your users would indeed be seeing periodic notifications about nongenuine software.
The particular computer which generated the mgadiag report you posted should not be showing Notifications about nongenuine software upon startup of Office, but only because the OGA Notifier utility does not seem to be installed on the computer. The part of the report below would spcecify the file versions of the OGA Notifier if it were installed:
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002The sample below (taken from someone else's post) is an example of what that section would look like if the OGA Notifier were installed:
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: 2.0.48.0
OGAExec.exe Signed By: Microsoft
OGAAddin.dll Signed By: MicrosoftNevertheless, the installation of Office on this computer is nongenuine. Here is a snippet of the report:
OGA Data-->
Office Status: 114 Blocked VLK 2
Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-175-80070002_B4D0AA8B-604-645_025D1FF3-230-1The data above shows that the installation of Office is a Volume Licensing edition, and that it was installed with a widely pirated and now blocked Volume Licensing Key. The status of 114 Blocked VLK 2 is special status assigned to installations of Office done with one of two particular VLKs. These keys are the keys that Microsoft issed to itself for the internal use of its own staff and employees--they keys were stolen and widely posted on the internet, so they have been subsequently Blocked from further use. The 114 Blocked VLK 2 key for Office Professional 2003 ends in 3HFDY. You can use a keyfinder utility (such as the Magical Jellybean Keyfinder, Belarc Advisor, etc) to extract the key and that is the one you will find on this computer.
I would suggest visiting http://www.microsoft.com/licensing/ and clicking on the link on the right side to contact a Microsoft VL specialist. They should be able to determine if your organization does indeed have a current and valid Volume Licensing Agreement with Microsoft. If you do, then the task at hand would be doing whatever remediation is needed to uninstall nonlicensed product and install licensed product. If no valid license is in place, they can help you get licensed.
Buy Office 2007 Now, Get Office 2010 Free http://office2010.microsoft.com/en-us/tech-guarantee/microsoft-office-2010-technology-guarantee-FX101825695.aspx?CTT=97- Marked as answer by Darin Smith MS Wednesday, May 5, 2010 7:40 PM
Wednesday, April 28, 2010 7:20 PM