Windows Activation Failures After November 2025 Updates: A Defender’s Guide to Detecting, Troubleshooting, and Recovering from Error 0x80041008

---
title: Windows Software Protection Service Failure or Licensing Error
description: Detects failures or crashes of the Software Protection service (sppsvc.exe), which may indicate activation failures or WMI/licensing corruption.
references:
  - https://learn.microsoft.com/en-us/windows-server/get-started/activation-error-codes
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\sppsvc.exe'
    CommandLine|contains:
      - '-service'
      - '-restart'
      - '-debug'
  filter:
    ParentImage|endswith: '\svchost.exe'
    ParentCommandLine|contains: 'sppsvc'
  condition: selection and not filter
falsepositives:
  - Legitimate service restarts by administrators or troubleshooting scripts
level: medium
---
title: WMI Query for Software Licensing Service Returning Errors
description: Detects WMI queries targeting SoftwareLicensingService or SoftwareLicensingProduct that may fail or return invalid data, indicating activation or licensing issues.
references:
  - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/softwarelicensingservice
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.discovery
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'SoftwareLicensingService'
      - 'SoftwareLicensingProduct'
      - 'slmgr.vbs'
      - 'Get-WmiObject'
      - 'Get-CimInstance'
      - '0x80041008'
falsepositives:
  - Legitimate activation scripts, KMS client setup, or IT troubleshooting
level: low

// Hunt for processes or events related to Software Protection service failures or activation errors
SecurityEvent
| where EventID in (7034, 7036, 7045) // Service crash, service start/stop, service install
| where ServiceName =~ 'sppsvc' or ServiceName =~ 'Software Protection'
| where TimeGenerated > ago(7d)
| project TimeGenerated, Computer, EventID, ServiceName, ServiceState, ServiceFileName
| sort by TimeGenerated desc

// Correlate with process execution of licensing tools
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ('slmgr.vbs', 'slui.exe', 'sppsvc.exe', 'cscript.exe', 'wscript.exe', 'powershell.exe')
| where ProcessCommandLine has_any ('SoftwareLicensingService', 'SoftwareLicensingProduct', '0x80041008', '/ato', '/dli', '/dlv', '/xpr')
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated desc

-- Hunt for processes and files related to Software Protection and licensing anomalies
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, ParentPid
FROM pslist()
WHERE CommandLine =~ '(slmgr|slui|sppsvc|SoftwareLicensing|0x80041008|/ato|/dli|/dlv|/xpr)'
   OR Exe =~ '(slmgr|slui|sppsvc)\.exe'
   OR Name =~ 'sppsvc'

-- Check for recent modifications to licensing-related registry keys or files
SELECT * FROM glob(globs='C:\\Windows\\System32\\spp\\store\\**')
WHERE Mtime > now() - 7 * 24 * 3600

SELECT * FROM glob(globs='C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SoftwareProtectionPlatform\\**')
WHERE Mtime > now() - 7 * 24 * 3600

#Requires -RunAsAdministrator
# Windows Activation Failure Remediation Script (0x80041008)
# Author: Security Arsenal
# Date: 2026-01-15
# Description: Diagnoses and attempts to repair Windows activation/licensing failures after November 2025 updates.

$ErrorActionPreference = 'Continue'
$LogFile = "$env:TEMP\ActivationRepair_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"

function Write-Log {
    param([string]$Message, [string]$Level = 'INFO')
    $Timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    $LogEntry = "[$Timestamp] [$Level] $Message"
    Write-Host $LogEntry
    Add-Content -Path $LogFile -Value $LogEntry
}

Write-Log "Starting Windows Activation Repair Script"
Write-Log "Log file: $LogFile"

# 1. Check current activation status
Write-Log "Checking current activation status..."
$ActivationStatus = Get-CimInstance -ClassName SoftwareLicensingProduct -Filter "Name like 'Windows%'" | Where-Object { $_.PartialProductKey }
if ($ActivationStatus) {
    $ActivationStatus | ForEach-Object {
        Write-Log "Product: $($_.Name), LicenseStatus: $($_.LicenseStatus), PartialKey: $($_.PartialProductKey)"
    }
} else {
    Write-Log "No licensing products found or WMI query failed." -Level 'WARN'
}

# 2. Restart Software Protection service
Write-Log "Restarting Software Protection service (sppsvc)..."
try {
    Stop-Service -Name sppsvc -Force -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 2
    Start-Service -Name sppsvc -ErrorAction SilentlyContinue
    Write-Log "sppsvc service restarted successfully."
} catch {
    Write-Log "Failed to restart sppsvc: $($_.Exception.Message)" -Level 'ERROR'
}

# 3. Rebuild WMI repository (if corrupted)
Write-Log "Attempting to rebuild WMI repository..."
try {
    # Stop WMI service
    Stop-Service -Name winmgmt -Force -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 2
    
    # Reset WMI repository
    $WmiReset = Start-Process -FilePath 'winmgmt.exe' -ArgumentList '/resetrepository' -Wait -PassThru -NoNewWindow
    if ($WmiReset.ExitCode -eq 0) {
        Write-Log "WMI repository reset successfully."
    } else {
        Write-Log "WMI repository reset returned exit code $($WmiReset.ExitCode)." -Level 'WARN'
    }
    
    # Restart WMI service
    Start-Service -Name winmgmt -ErrorAction SilentlyContinue
    Write-Log "WMI service restarted."
} catch {
    Write-Log "WMI repair failed: $($_.Exception.Message)" -Level 'ERROR'
}

# 4. Re-register licensing DLLs (if applicable)
Write-Log "Re-registering licensing-related DLLs..."
$LicensingDLLs = @(
    "$env:SystemRoot\System32\sppobjs.dll",
    "$env:SystemRoot\System32\sppc.dll",
    "$env:SystemRoot\System32\sppwmi.dll"
)
foreach ($dll in $LicensingDLLs) {
    if (Test-Path $dll) {
        try {
            $RegResult = Start-Process -FilePath 'regsvr32.exe' -ArgumentList "/s `"$dll`"" -Wait -PassThru -NoNewWindow
            if ($RegResult.ExitCode -eq 0) {
                Write-Log "Registered $dll successfully."
            } else {
                Write-Log "Registration of $dll returned exit code $($RegResult.ExitCode)." -Level 'WARN'
            }
        } catch {
            Write-Log "Failed to register $dll : $($_.Exception.Message)" -Level 'WARN'
        }
    }
}

# 5. Attempt re-activation
Write-Log "Attempting to re-activate Windows..."
try {
    # Force online activation
    $ActivateResult = Start-Process -FilePath 'cscript.exe' -ArgumentList "//$B //$Nologo $env:SystemRoot\System32\slmgr.vbs /ato" -Wait -PassThru -NoNewWindow
    if ($ActivateResult.ExitCode -eq 0) {
        Write-Log "Activation command executed successfully."
    } else {
        Write-Log "Activation command returned exit code $($ActivateResult.ExitCode)." -Level 'WARN'
    }
    
    # Check activation status again
    Start-Sleep -Seconds 5
    $PostActivation = Get-CimInstance -ClassName SoftwareLicensingProduct -Filter "Name like 'Windows%'" | Where-Object { $_.PartialProductKey }
    if ($PostActivation) {
        $PostActivation | ForEach-Object {
            $Status = switch ($_.LicenseStatus) {
                0 { 'Unlicensed' }
                1 { 'Licensed' }
                2 { 'OOBGrace' }
                3 { 'OOTGrace' }
                4 { 'NonGenuineGrace' }
                5 { 'Notification' }
                6 { 'ExtendedGrace' }
                default { "Unknown ($($_.LicenseStatus))" }
            }
            Write-Log "Post-activation - Product: $($_.Name), LicenseStatus: $Status"
        }
    }
} catch {
    Write-Log "Re-activation failed: $($_.Exception.Message)" -Level 'ERROR'
}

# 6. Final recommendations
Write-Log "Script completed. Review log at $LogFile"
Write-Log "If activation still fails, consider:"
Write-Log "  1. Rolling back the November 2025 cumulative update (KB5046xxx/KB5047xxx)"
Write-Log "  2. Running System File Checker: sfc /scannow"
Write-Log "  3. Running DISM: DISM /Online /Cleanup-Image /RestoreHealth"
Write-Log "  4. Contacting Microsoft Support or your volume licensing administrator"

Write-Host "`nRepair script completed. Check $LogFile for details." -ForegroundColor Cyan