I'm a sysadmin at a factory where production-floor computers run Windows IoT Enterprise LTSC. We're upgrading roughly 80 offline clients from Windows 10 2016 LTSB to 21H2 LTSC, including some older hardware that technically wasn't certified for Windows 10 but still runs it reliably.
Because these systems cannot reach Microsoft's activation servers directly, I currently activate them manually with slmgr.exe and SLUI 4. The offline activation process requires entering the installation ID into Microsoft's web form, solving a CAPTCHA, signing in with a Microsoft account, and completing two-factor authentication. The session is sometimes reusable across browser tabs, but each activation still takes around two to five minutes, and the process must be restarted for every machine.
I've already automated the repetitive command entry with a small Python script that generates QR codes, but the web-based activation is still taking a lot of time. A locally hosted activation service has apparently been ruled out because of production VLAN and central IT security policies. Are there any approved options—such as Active Directory-based activation, VAMT, KMS, or another supported workflow—that could make this process faster without bypassing Microsoft's activation requirements?
3 Answers
If policy allows it, an internally hosted activation service would normally be the cleanest solution. You can activate the service once and have the clients contact it periodically, rather than completing phone or web activation on every machine. Some clients may also discover an activation service on their local subnet. Since your security team has prohibited local activation servers in the production VLANs, this would need to be reviewed with central IT rather than implemented independently.
VAMT is worth discussing with your licensing or central IT team. It can manage volume activation and help activate multiple systems, but it generally depends on having the right volume licensing arrangement, such as MAK keys or a KMS infrastructure. If KMS is forbidden and you only have individual offline activation available, VAMT may not solve the underlying problem, but it could still provide a more manageable supported workflow.
My understanding is that VAMT would require MAK keys or KMS, so it may not be available to us. I’ll raise it during our next team meeting anyway.
Since the machines are domain joined, ask the domain owner whether Active Directory-based activation is available. Depending on your licensing setup and permissions in the centrally managed AD environment, you may be able to publish the appropriate activation keys and let the clients activate through AD instead of using the web form individually. Your local OU may not have enough control, but central IT might be able to configure it.
Our systems are in a sub-OU of the global AD, so I’m not sure what permissions we have. I’ll ask the domain owner whether AD-based activation is possible.
That option has already been rejected by our CISO and central IT because of the VLAN design. Their standard process assumes these devices arrive pre-activated, so manual activation was chosen for the exceptions.