Using smlgr with MAK keys on Windows 11 Enterprise

Question

Using smlgr with MAK keys on Windows 11 Enterprise

Van Fifty 40

I was reading the following which applies to Windows 10 and would like to know if it also applies to Windows 11 Enterprise:

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn502526(v=ws.11)

It mentions "slmgr.vbs /ipk <MultipleActivationKey>" it then states "If users install a MAK by using the UI, the MAK client attempts to activate itself over the Internet one time. If the users install a MAK key by using the Slmgr.vbs script, the MAK client does not try to activate automatically."

I would like to confirm, if a system is disconnected from the Internet and slmgr.vbs /ipk is used then the license will be associated with the OS but Windows 11 will not activate? Even after connecting to the Internet Windows will still not activate and the MAK count will remain unchanged.

To activate, one would need to connect to the Internet and then also invoke : slmgr.vbs /ato

This will then use up one MAK count and Windows 11 will be activated, correct?

If slmgr.vbs /ato is invoked multiple times after activation on the same activated system then the MAK count will remain unchanged?

0 comments

Answer accepted by question author

Marcin Policht 109.6K MVP Volunteer Moderator

If a MAK key is specified in unattend.xml during Windows setup or Sysprep deployment, Windows 11 Enterprise will generally behave differently than when the key is manually installed later with slmgr.vbs /ipk. In the unattended setup case, Windows Setup integrates the key as part of the deployment and the Software Protection Platform is allowed to perform automatic activation when network connectivity becomes available, unless automatic activation has been explicitly disabled. In other words, a machine deployed with a MAK embedded in unattend.xml will normally attempt activation automatically once it can reach Microsoft’s activation servers, and you typically do not need to invoke slmgr.vbs /ato manually.

What you observed on Windows 11 Enterprise is consistent with the current activation behavior. Windows builds still include scheduled and event-triggered activation attempts through the Software Protection Platform service. The Event Viewer entries you found showing Action=AutoActivate and Trigger=NetworkAvailable confirm that Windows 11 is performing automatic activation retries when connectivity appears. So in practice, on Windows 11 Enterprise, installing a MAK with /ipk alone does not guarantee that activation will remain deferred indefinitely after Internet access is restored.

Because of that, if your goal is to preload the MAK onto systems but prevent activation until a later controlled step, setting the Manual registry value to 1 under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Activation is the correct approach. That disables automatic activation behavior and prevents the Software Protection Platform from automatically attempting activation when the network becomes available. In that configuration, the machine would remain in the Notification or grace state until slmgr.vbs /ato or another explicit activation method is invoked.

Regarding MAK activation counts, reimaging the same physical machine can consume another MAK activation even if the hardware itself has not changed. MAK activation is not strictly tied only to hardware identity; it is tied to an activation request generated by the installation instance. A clean reinstall or reimage produces a new Windows installation with a new installation ID, and Microsoft’s activation infrastructure may treat it as a separate activation event. Sometimes the activation servers correlate it closely enough to avoid incrementing the count again, but this is not guaranteed. In enterprise environments, repeated reimaging of the same devices using MAK keys can absolutely lead to additional MAK activations being consumed over time.

That behavior is one of the reasons Microsoft generally recommends KMS or Active Directory-Based Activation instead of MAK for frequently reimaged enterprise systems. MAK is best suited for systems that are relatively static or rarely redeployed.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Van Fifty 40 Reputation points

2026-06-05T20:03:13.49+00:00

After making the registry modification the system which was licensed with slmgr /ipk did not automatically activate when connected to the Internet.

Previously without the registry modification the Event Viewer entries Action=AutoActivate / Trigger=NetworkAvailable had error code 0x80072EE7. There was also Action=AutoActivate / Trigger=TimerEvent with error code 0x8007139F and Action=AutoActivate / Trigger=UserLogonSessionId=2 with error code 0xC004E028.

After the registry modifications these same Actions/Trigger errors still appeared under event viewer but this time the error code for all of them was 0x80004005 which to my understanding is an Unspecified Error and I am guessing was the result of the registry entry blocking automatic activation as desired.

Thanks again for your help!

1 additional answer

Your answer

Van Fifty 40 Reputation points

2026-06-05T20:03:13.49+00:00

After making the registry modification the system which was licensed with slmgr /ipk did not automatically activate when connected to the Internet.

Previously without the registry modification the Event Viewer entries Action=AutoActivate / Trigger=NetworkAvailable had error code 0x80072EE7. There was also Action=AutoActivate / Trigger=TimerEvent with error code 0x8007139F and Action=AutoActivate / Trigger=UserLogonSessionId=2 with error code 0xC004E028.

After the registry modifications these same Actions/Trigger errors still appeared under event viewer but this time the error code for all of them was 0x80004005 which to my understanding is an Unspecified Error and I am guessing was the result of the registry entry blocking automatic activation as desired.

Thanks again for your help!

Answer 1

Marcin Policht 109.6K MVP Volunteer Moderator

Yep - the behavior described in that Windows 10 / Windows Server documentation still applies to Windows 11 Enterprise when using a MAK (Multiple Activation Key). When you run:

slmgr.vbs /ipk <MAK-key>

you are only installing the product key into the licensing store. That alone does not activate Windows if the key was installed through slmgr.vbs. So in your scenario, on a system that is disconnected from the Internet will install the MAK into Windows 11 Enterprise, but Windows will remain in the unactivated state.

If the machine is later connected to the Internet, Windows still will not automatically activate merely because the MAK is present. The activation attempt is not automatically triggered simply due to connectivity being restored after a scripted /ipk installation.

Activation occurs when you explicitly invoke:

slmgr.vbs /ato

or otherwise initiate activation through the UI/API. At that point, Windows contacts Microsoft's activation servers, consumes one MAK activation from the pool, and activates the installation. After the system is already activated, running:

slmgr.vbs /ato

again on the same unchanged installation normally does not consume additional MAK activations. Microsoft activation servers recognize the existing activation state/hardware identity. Repeated /ato calls on the same installation are generally harmless and do not continually decrement the MAK count. Note though that substantial hardware changes or reinstallation/reimaging can cause the system to be treated as a new activation event, which can consume another MAK activation.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Van Fifty 40 Reputation points

2026-06-04T00:55:23.6566667+00:00

Thank you for the detailed reply, much appreciated!

If the MAK key is specified in unattend.xml and passed to sysprep (link) , will a system imaged with this setup also require slmgr.vbs /ato to be invoked for Windows to activate or will it activate automatically when connected to the Internet?

You also mentioned :

Note though that substantial hardware changes or reinstallation/reimaging can cause the system to be treated as a new activation event, which can consume another MAK activation.

Does this mean that if a MAK activation occurs and the activation count is decremented and the exact same machine is reimaged again, though the hardware is not changed, then it is possible another MAK activation on this system could consume another MAK activation?
Van Fifty 40 Reputation points

2026-06-05T15:21:30.39+00:00

On Windows 11 Enterprise my SetupComplete.cmd runs a script which invokes cscript //nologo c:\windows\system32\slmgr.vbs /ipk [key]

After imaging, when cscript //nologo c:\windows\system32\slmgr.vbs /dli is invoked it shows a License Status of Notification. When I connected the machine to the Internet and re-invoked slmgr /dli the License Status changed to Licensed. In the GUI, System > Activation, it shows that Windows is activated. I did not need to issue the slmgr /ato command.

I checked in event viewer (Windows Logs > Application) on a machine that has yet to be activated and is disconnected from the Internet. I see multiple level Error for Security-SPP where it mentions "License Activation (slui.exe) failed with the following error code: hr=0x80072EE7. Command-line arguments: RuleId=(alphanumeric string) Action=AutoActivate; AppId=(alphanumeric string); SkuId=(alphanumeric string);NotificationInterval=1440;Trigger=NetworkAvailable

It seems that Windows 11 Enterprise is still trying to automatically activate. At the link in my OP, it mentions:

Disabling Automatic Activation To disable automatic activation on any MAK client, set the DWORD registry value Manual to 1. This value is in the registry subkey HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Activation.

I am thinking this is required to prevent automatic activation after invoking slmgr /ipk [key] ?