0x803F8001 and 0x803F8003: No Usable Entitlement for the Signed-In Account

Fix it now

These two codes are not the same finding. Microsoft publishes 0x803F8001 as no entitlement for the product, often because a different account is signed in, and 0x803F8003 as an entitlement that exists but is in an invalid state and cannot produce a licence. Check which one you have first.

dsregcmd /status
slmgr /dlv
slmgr /ato

1. Confirm which identity the device is using. In the dsregcmd /status output, read the Device State and the user account it reports, and check it is the licensed work account rather than a personal account with the same address.
2. In the Microsoft 365 admin centre, open Users then Active users, select that user and read Licenses and Apps. No seat is the whole of 0x803F8001.
3. If no seat is assigned, assign one there, or from Billing then Licenses, then the product, then Assign licenses. Assignment fails silently against an exhausted subscription, so buy seats first if none are free.
4. For 0x803F8003, the seat is usually present. Look for an assignment error against the user in the admin centre or in Microsoft Entra ID before touching the machine.
5. Have the user sign out of Windows and back in so a fresh token is issued, then run slmgr /ato and read slmgr /dlv.

0x803F8190 in the same family is neither of these. Microsoft publishes it as the licence not allowing the product to be used in the current country or region of the device.

If that fixed it you can stop here. If not, the next section separates the four codes properly, because two of them have nothing to do with seat assignment.

Why it happens

With subscription activation there is no key to install. The device presents the signed-in user’s token, the licensing service looks up what that identity is entitled to, and the device applies what comes back. Every step is about the user, which is why two people can sign into the same laptop and get different answers. The machine is a bystander.

The two headline codes describe different states, and the v1 version of this article treated them as one. Microsoft publishes 0x803F8001 as: you do not have an entitlement for the product, and you might be using a different Microsoft account from the one used to purchase it. That second clause is doing real work – the commonest cause is the wrong identity, not a missing purchase. 0x803F8003 is published differently: your entitlement for the product is in an invalid state that prevents a licence from being created. The entitlement is there. Something about it cannot be turned into a licence, and buying another seat will not change that.

The other two codes in this record point somewhere else again. 0x803F8190 is published as the licence not allowing the product to be used in the current country or region of the device – a geography restriction, not an assignment problem. And 0xC004E015, which the v1 article filed under missing entitlements, is documented by Microsoft with a specific local cause: a corrupted tokens.dat file at C:\Windows\System32\spp\store\2.0\tokens.dat, resolved by rebuilding it. That is a repair on the machine, not a conversation with your reseller.

Two prerequisites sit underneath all of this and neither shows up in the error: the device has to be Microsoft Entra joined or hybrid joined, and the base edition has to be one with a documented step-up path. A Windows Home device with a perfectly assigned seat will still fail.

Full reference

What each code in this record actually says

Rebuilding the licence store, as Microsoft documents it

1. Stop the service: net stop sppsvc.
2. Change to %windir%\system32\spp\store\2.0 on Windows 10, Windows 11 and Windows Server 2016 or later.
3. Rename the file: ren tokens.dat tokens.bar.
4. Start the service: net start sppsvc.
5. Reinstall the licence files: cscript.exe %windir%\system32\slmgr.vbs /rilc.
6. Restart the computer twice, then install the product key with cscript.exe %windir%\system32\slmgr.vbs /ipk <product key>.

Microsoft’s instruction with this procedure is not to use the /upk switch to uninstall a product key. Installing the intended key over the existing one with /ipk is the documented route, and it does not leave the machine unlicensed while you look for the replacement.

What subscription activation requires before any of this matters

• A Microsoft Entra joined or Microsoft Entra hybrid joined device. Entra registered and workgroup devices are not supported.
• An eligible base edition: Windows Pro stepping up to Windows Enterprise, or Windows Pro Education stepping up to Windows Education.
• An assigned Windows Enterprise E3 or E5 subscription, or an equivalent entitlement through a Microsoft 365 plan that carries one.
• Internet connectivity. Devices attempt to renew about every 30 days and must be online to acquire or renew.
• Up to five devices per user licence. On a sixth, the device that user has left alone longest reverts to Pro or Pro Education.

Reading dsregcmd output without guessing

The other line to read is AzureAdPrt in the SSO State block. YES means a primary refresh token is present for the signed-in user; NO means there is nothing for the device to present, and no amount of tenant work will change the result until the user signs in again and gets one.

Microsoft’s own text for any of these codes can be printed on the machine with slui.exe 0x2a followed by the code, for example slui.exe 0x2a 0x803F8003. Use it to check what your build reports rather than trusting anyone’s summary, including this one.

Every code this article covers

Confirm the fix worked

1. The user shows the expected product under Licenses and Apps in the admin centre, with no assignment error recorded.
2. dsregcmd /status reports an Entra joined or hybrid joined device with AzureAdPrt YES for that user.
3. slmgr /dlv reports the expected edition with a licence status of Licensed.
4. Settings, System, Activation reports the device as activated through the subscription.
5. Sign out and back in once more and re-check, so the result is not simply cached from your test.

Questions people ask about this