0xC004F302: Silent Activation Fails on Entra Joined Windows 11 PCs

Fix it now

Microsoft publishes no meaning for 0xC004F302, 0xC004F026 or 0xC004F04F, so start from what is documented instead: silent activation needs a joined device, an assigned seat, an eligible activated base edition and a clear path to the licensing endpoints. Check those four before you repair anything.

dsregcmd /status
slmgr /dlv
netsh winhttp show proxy
slmgr /ato

1. In the dsregcmd /status output, read the Device State block. Microsoft Entra joined is AzureAdJoined YES with DomainJoined NO; hybrid joined is both YES. A Microsoft Entra registered device is not supported for subscription activation.
2. In the same output, read AzureAdPrt in the SSO State block. NO means the signed-in user has no primary refresh token and nothing will be presented to the licensing service.
3. In slmgr /dlv, confirm the base edition is Pro or Pro Education and reads as Licensed. The step-up sits on a base licence; it does not replace one.
4. Confirm the user holds an assigned seat in the Microsoft 365 admin centre under Users, Active users, Licenses and Apps.
5. If your tenant uses Conditional Access, check the documented exclusion before touching the machine again – it is a known cause of exactly this failure and it is covered in the next section.

Do not install an Enterprise key on a device that is meant to activate through a subscription. It creates a second, competing licensing state and makes the eventual diagnosis harder.

If that fixed it you can stop here. If not, the next section covers what silent activation actually needs and why none of these three codes tells you which part failed.

Why it happens

Silent activation exists so that nobody types a key. The device presents the signed-in user’s token, the licensing service returns an entitlement, and Windows applies it in the background. For that to work, several things have to be true at once: the device is Microsoft Entra joined or Microsoft Entra hybrid joined, the user holds an assigned licence, the base edition is one with a documented step-up path and is already activated, and the licensing and identity endpoints are reachable without interference.

None of the three codes in this record tells you which of those failed, and it is worth being blunt about why. Microsoft publishes no meaning for 0xC004F302, 0xC004F026 or 0xC004F04F on learn.microsoft.com or support.microsoft.com. Earlier versions of this article assigned each of them a specific reading – a missing local licence, a licence the operation depended on, missing management information – and those readings were reverse-engineered from the story rather than taken from the vendor. Run slui.exe 0x2a 0xC004F302 on the machine and you will get Microsoft’s own text for your build, which is a better starting point than anyone’s summary.

So diagnose from the requirements rather than from the code. Microsoft documents that Microsoft Entra registered devices and workgroup devices are not supported for subscription activation, and that only Windows Pro to Windows Enterprise and Windows Pro Education to Windows Education are supported step-ups. It documents that devices attempt to renew about every 30 days and must be connected to the internet to acquire or renew. And it documents a Conditional Access interaction that produces exactly this class of failure on devices that have been offline for a while.

That Conditional Access detail is the one most often missed, and it is set out in the table below. In short: without the documented cloud-app exclusion, a device that has been offline for an extended period may not reactivate automatically.

Full reference

What silent activation requires, as documented

Reading dsregcmd without guessing

AzureAdPrt in the SSO State block is the other line that matters. It reads YES when a primary refresh token is present for the signed-in user. AzureAdPrtExpiryTime tells you when it lapses if it is not renewed. A device with no PRT has nothing to present, and every minute spent on the licensing store is wasted until that is fixed.

Where to look for evidence

Earlier guidance told readers to re-run a licence acquisition task in Task Scheduler under Microsoft, Windows, Subscription. No Microsoft page documents such a task path, so it is not in this article. Signing out and back in achieves the same thing through a route that is documented.

Repairing the local licensing store, if you get that far

1. Reinstall the licence files: slmgr /rilc, which restores the known-good copies from %SystemRoot%\system32\oem and %SystemRoot%\System32\spp\tokens.
2. Restart the licensing service: net stop sppsvc then net start sppsvc.
3. Repair the component store with DISM /Online /Cleanup-Image /RestoreHealth, then run sfc /scannow.
4. Reboot, sign in as the licensed user, and re-check slmgr /dlv.
5. If licensing operations still fail, Microsoft’s documented tokens.dat rebuild is the next step, and it ends with installing the key using /ipk rather than removing anything with /upk.

How long to wait before calling it failed

Silent activation is a background operation and Microsoft publishes no guaranteed timing for it. What is published is the renewal cadence: about every 30 days, with an internet connection required. In practice, if a sign-out and sign-in cycle plus a reboot on a connected machine has not produced the step-up, treat it as failed rather than slow and work the requirements list above. Waiting longer on a device that is missing a prerequisite does not help.

Every code this article covers

Confirm the fix worked

1. slmgr /dlv reports the expected edition with a licence status of Licensed.
2. dsregcmd /status reports an Entra joined or hybrid joined device with AzureAdPrt YES for the signed-in user.
3. Settings, System, Activation reports activation through the subscription rather than a product key.
4. The user shows the expected product under Licenses and Apps in the admin centre, with no assignment error.
5. Sign out, sign back in and reboot, then re-check that the state holds without anyone intervening.

Questions people ask about this