Several Windows XP Pro OEM systems reported as key "lost or stolen" but they aren't RRS feed

  • Question

  • Hello,


    My company is a managed services provider and value added reseller (OEM). In the last week, five (and counting) systems at one of our customer sites started failing WGA for Windows XP Pro SP2 when using Microsoft Update. A new version of WGA was (forced to be) installed by Windows Update on these systems and that new version is reporting that these systems have a license key that has been reported lost or stolen. I can assure you that these systems have a legitimate license bought from an authorized distributor (ASI) with a COA attached to the systems that matches the key installed on the system, and neither our customer or us (reseller) reported these keys lost or stolen. (I know, you are going to say that all crooks will claim this, but I nor my customer are crooks and I guarantee you that these systems have a genuine version of Windows).


    I have had previous cases (yes, more than one of them) where something similar has happened and in all such cases, Microsoft found that our customer had a legitimate license and reissued them a new COA. Microsoft would never admit that these were a false positive of WGA validation, but IMO that is exactly what it was. (Turns out that somebody who did not have the license traded in that key for a 64-bit upgrade and apparently Microsoft did not sufficiently validate that the person legitimately had the license key. Microsoft invalidated the license key that was upgraded and my innocent customer and I were harmed as a result.) Proving that these systems had a legitimate license turns out to be an awful lot of work on my part (for which our--your and my--customer is not willing to pay because your WGA makes it seem like we as OEMs are crooks) and often takes months and months of elapsed time (all of it with the systems marked as failing WGA and not able to get Windows updates). I am not happy to have to do all that work again. If it (again) turns out that these systems have a legitimate license, is Microsoft going to pay for my time to prove it to you?


    One of the systems that initially failed WGA is now able to run Windows Update just fine and passes WGA validation. So, either I am incorrectly remembering which system originally failed WGA validation or something changed in WGA to realize that this is a legitimate copy of Windows. That makes me even more suspicious that these are false positives. Is there anything that happened in WGA validation in the last week or so that would explain this and these systems might just start passing WGA validation?


    I ran the tool to check the license key and it reported that the key that I typed in from the COA is the same as the one in the system. It also reports that that key was reported lost or stolen.


    Since all these systems have an OEM version of Windows purchased from the distributor in the same batch, I am suspicious that somehow Microsoft has marked this batch as "lost or stolen". Is there any way to find that our without doing a lot of work such as running the MGA diagnostic on each of these systems?

    Tuesday, April 22, 2008 9:25 PM


  • Hello DJ-VAR,


    This issue is being looked into and we will let you know as soon as we find anything with regard to this matter.


    Lori MS



    Wednesday, April 30, 2008 10:31 PM

All replies

  • Here is what the COA from one of these systems looks like:


    Windows XP Professional                  1-2CPU

    OEM Software


    <bar code>                                  E85-02178


    Product Key xxxxx-xxxxx-xxxxx-xxxxx-xxxxx


    <bar code>



    Vertically on the right from bottom to top is: X10-37254


    Tuesday, April 22, 2008 10:04 PM
  • Using one of the machines that fails validation:


    Please follow this simple troubleshooting procedure:


    1. Download and run the MGA Diagnostic Tool: http://go.microsoft.com/fwlink/?linkid=52012


    2. After running the MGA Diagnostic Tool, click on the "Windows" tab and then click on "Copy".


    3. Next, visit the following website and create a post in the "WGA Validation Problems" forum and paste the results of the WGA Diagnostic Data in a detailed post. http://forums.microsoft.com/Genuine/default.aspx?SiteID=25


    4. A WGA troubleshooting specialist will analyze the data and recommend an appropriate solution.


    Wednesday, April 23, 2008 12:14 AM
  • I am sure that you will find the MGADiag results to be like I said, the key is reported lost or stolen = blocked key.  Now the questions are (1) why is this (and the other) key(s) blocked and (2) how do I get this customer, who through no fault of their own or my (reseller) fault the key has been blocked, to be whole again and who is going to pay for my time to do all this?


    Diagnostic Report (1.7.0095.0):
    WGA Data-->
    Validation Status: Blocked PID
    Validation Code: 11
    Online Validation Code: N/A
    Cached Validation Code: N/A
    Windows Product Key: *****-*****-Y4YTD-73X64-GT6V8
    Windows Product Key Hash: VlDRX+i5BbPYun3RrySFPvDB1ao=
    Windows Product ID: 55274-OEM-2249945-97767
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 5.1.2600.2.00010100.2.0.pro
    CSVLK Server: N/A
    ID: {580FAC54-620B-4B81-B5D1-D363D98DA249}(3)
    Is Admin: Yes
    TestCab: 0x0
    WGA Version: Registered,
    Signed By: Microsoft
    Product Name: N/A
    Architecture: N/A
    Build lab: N/A
    TTS Error: N/A
    Validation Diagnostic: 025D1FF3-171-1
    Resolution Status: N/A

    WgaER Data-->
    ThreatID(s): N/A
    Version: N/A

    WGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    WGATray.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Professional Edition 2003 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: B4D0AA8B-604-645_025D1FF3-171-1

    Browser Data-->
    Proxy settings: vmcserver1:8080
    User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{580FAC54-620B-4B81-B5D1-D363D98DA249}</UGUID><Version>1.7.0095.0</Version><OS>5.1.2600.2.00010100.2.0.pro</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-GT6V8</PKey><PID>55274-OEM-2249945-97767</PID><PIDType>3</PIDType><SID>S-1-5-21-3521297673-3796672709-3934532433</SID><SYSTEM><Manufacturer>Software Engineering Unlimited</Manufacturer><Model>P4P800GAHUT</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1012.002</Version><SMBIOSVersion major="2" minor="3"/><Date>20040322000000.000000+000</Date></BIOS><HWID>4DC430E701846052</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>1</iJoin><SBID><stat>2</stat><msppid></msppid><name>Software Engineering Unlimited</name><model>P4P</model></SBID><OEM/><BRT/></MachineData>   <Software><Office><Result>100</Result><Products><Product GUID="{90110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>950B74FF5C8FD02</Val><Hash>tuSFfR6itAZYofuGrylnnX0B0gw=</Hash><Pid>73931-641-8541424-57290</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="100"/><App Id="16" Version="11" Result="100"/><App Id="18" Version="11" Result="100"/><App Id="19" Version="11" Result="100"/><App Id="1A" Version="11" Result="100"/><App Id="1B" Version="11" Result="100"/><App Id="44" Version="11" Result="100"/></Applications></Office></Software></GenuineResults> 


    Thursday, April 24, 2008 12:07 AM
  • Two more computers at this customer site are failing WGA validation. The previous ones were all sold to the customer at the same time and were probably built with Windows XP from the same OEM multi-pack. Under the guess that we might have had some Windows XP left from that multi-pack and used on systems later on, I checked some computers that were sold a little before or after the ones that had failed WGA validation. Out of 6 computers that I checked, 2 more are now failing WGA validation.


    I'll have to go to the customer site and crawl under desks with a flash light to check the COAs, but I have no reason to believe that these two failures are any different than the others, that is, the PID in the system will match the one on the COA, the PID has not been used on more than one PC, the licenses was purchased from an authorized distributor on in OEM multi-pack, the PID has not been reported lost or stolen by the customer or me (the reseller), not has it been traded-in in any way.


    I'll also have to check more computers at this customer site for WGA validation.

    Thursday, April 24, 2008 8:36 PM
  • Hello DJ-VAR,


    This issue is being looked into and we will let you know as soon as we find anything with regard to this matter.


    Lori MS



    Wednesday, April 30, 2008 10:31 PM