Windows 10 Enterprise Activation - IOT

IoTEnterprise ESU addon is exclusive to IoTEnterprise edition, it cannot be activated for regular Enterprise edition

further more, IoTEnterprise ESU addon currently does not work to install ESU updates for IoTEnterprise edition, because the ESU manifest used for checking contains wrong values for product policies:
Client-IOT-ESU-Year1 is wrong, the correct is Client-IoT-ESU-Year1 (yes, the o must be lowercase to work)

you should contact Microsoft or your CSP to replace your IoTEnterprise ESU addon key with regular ESU addon key (it works for all editions)

Hi sccm t,

In your first image, the ESU key installation failed with Error 0xC004E016, which means "Invalid Product Key" or "Product Key not recognized." Your failing device is missing the required Prerequisite Updates.

Failing Device (the next image): The version is 10.0.19041.4522. This build is outdated. The "Software Protection Platform" (the service that handles keys) on this older version does not yet know that the specific ESU key you are trying to install exists. Your "Correct" device is running a newer version (ending in .6691 or similar), which includes the "Licensing Preparation Package." This package is required for Windows to recognize and accept ESU keys.

You cannot script the activation of the ESU key until the operating system has been updated to support it.

1. Update the Device: You must install the latest Cumulative Update and Servicing Stack Update (SSU) on the target device. Specifically, ensure the "Licensing Preparation Package" (usually included in recent cumulative updates) is installed.
2. Restart: Reboot the machine to apply the updates to the Software Protection service.
3. Run the Script Again: Once updated, the slmgr /ipk command will no longer return 0xC004E016, and the script will successfully detect and activate the ESU license.

VP

Hi sccm t,

I wanted to follow up on your MECM deployment script to ensure the activation is proceeding smoothly for your 50+ devices. As we identified, the primary failure points were the script running in a standard user context (causing the Access Denied error 0xC0000022) and the absence of a base Windows Enterprise license due to previous uninstall commands. The corrected script provided in my last response addresses these critical issues by enforcing Administrator privileges at launch and automatically restoring the standard Generic Volume License Key (GVLK). This approach ensures the base OS is valid so the ESU add-on can successfully attach to its specific Activation ID, resolving both the permission errors and the "No Product Key" status.

If the issue has been successfully resolved, please consider accepting the answer as it helps other people sharing the same question benefit too. Thank you!

VP

Hi sccm t,

The error code 0xC0000022 shown in your PowerShell console (Image 3) means STATUS_ACCESS_DENIED.

You are running the PowerShell script in a standard user session. The commands slmgr (Software Licensing Manager) and Get-WmiObject (accessing system licensing classes) require Administrator privileges.

Additionally, your first Screenshot shows "Kein Product Key gefunden" (No Product Key found). This confirms that your previous attempts (which ran /upk) successfully deleted the Base OS key. You currently have no valid license on the machine, so adding an "Add-on" (ESU) key might fail or behave unpredictably because there is no "Base" license to add it to.

For your MECM deployment and your current test, the script needs to do two things:

Restore the Base Windows 10 Enterprise Key (The standard KMS client key).

Install and Activate the ESU Key.

Here is the final, production-ready script. I have updated it to include the Base OS repair step and automatic Administrator checks.

1. ADMIN CHECK: Ensure the script is running with elevated privileges (Required for slmgr)

if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Warning "This script must be run as Administrator!"
    Exit 1
}

CONFIGURATION: Replace this with your specific ESU Product Key

$esuKey = "XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"

Standard Windows 10 Enterprise GVLK (Generic Volume License Key) for KMS. This is required to restore the Base OS license you deleted previously.

$baseEnterpriseKey = "NPPR9-FWDCX-D2C8J-H872K-2YT43"

EXECUTION

Phase 1: Restore Base OS License (Fixing the "No Product Key" error)

Write-Host "1. Restoring Base Windows 10 Enterprise KMS Key..." -ForegroundColor Cyan
cscript /nologo $env:SystemRoot\System32\slmgr.vbs /ipk $baseEnterpriseKey

Phase 2: Install the ESU Add-on Key

Write-Host "2. Installing ESU Add-on Key..." -ForegroundColor Cyan
cscript /nologo $env:SystemRoot\System32\slmgr.vbs /ipk $esuKey

Phase 3: Find and Activate ONLY the ESU License

Write-Host "3. Locating ESU Activation ID..." -ForegroundColor Cyan

Using Get-CimInstance (modern replacement for Get-WmiObject) for better MECM compatibility

$esuLicense = Get-CimInstance SoftwareLicensingProduct | Where-Object { $_.Name -like "*Client-ESU-Year1*" -and $_.PartialProductKey }

if ($esuLicense) {
    $activationID = $esuLicense.ID
    Write-Host "   > Found ESU ID: $activationID" -ForegroundColor Green
    
    Write-Host "4. Activating ESU License..." -ForegroundColor Cyan
    cscript /nologo $env:SystemRoot\System32\slmgr.vbs /ato $activationID

Phase 4: Final Verification

$finalStatus = (Get-CimInstance SoftwareLicensingProduct | Where-Object { $_.ID -eq $activationID }).LicenseStatus
    if ($finalStatus -eq 1) {
        Write-Host "   > SUCCESS: ESU License is Licensed." -ForegroundColor Green
    } else {
        Write-Host "   > FAILURE: ESU License Status code is $finalStatus" -ForegroundColor Red
    }
} else {
    Write-Host "   > ERROR: ESU License not found. Key installation likely failed." -ForegroundColor Red
}

Optional: Attempt to trigger Base OS KMS activation as well

Write-Host "5. Triggering Base OS KMS Activation..." -ForegroundColor Cyan
cscript /nologo $env:SystemRoot\System32\slmgr.vbs /ato

For your Manual Test: You must right-click the PowerShell script and select "Run as Administrator".

For MECM (SCCM): When you create the Application or Package in MECM, ensure the "Installation Behavior" is set to "Install for System" (not "Install for User"). The SYSTEM account has the necessary permissions to write to WMI and manage licenses.

The Base Key: I included $baseEnterpriseKey = "NPPR9-...". This is the official public Microsoft key for Windows 10 Enterprise KMS clients. It is safe and necessary to use this to repair the machine that currently has "No Product Key".

Hello,

You are treating the ESU (Extended Security Update) key as if it were a replacement for the Windows Operating System key. It is not.

The Problem is your script runs /upk (Uninstall Product Key). This deletes your base Windows Enterprise license. You then install the ESU key. The ESU key is an "Add-on" license, not a base OS license. When the script runs /ato (Activate), Windows attempts to activate the Base OS. Since you deleted the base key and didn't replace it with another OS key (only an add-on), Windows reports "No Product Key found" (Error 0xC004F014).

The "Problem Solve" (Troubleshoot) button works because it is smart enough to detect the ESU add-on and activate that specific license ID, while also likely restoring the generic KMS key for the base OS.

To resolve, you must modify your script to stop deleting the base license and to target the specific Activation ID of the ESU key.

Here is the corrected logic for your PowerShell script. This replaces your current installation/activation block:

1. Install the ESU Product Key (Do NOT run /upk or /cpky before this):Replace $newKey with your ESU key

Write-Host "Installing ESU Add-on Key..." -ForegroundColor Yellow
cscript /nologo $env:SystemRoot\System32\slmgr.vbs /ipk $newKey

2. Find the Activation ID for the ESU Add-on: We use WMI to find the specific ID for the "Client-ESU-Year1" license

$esuLicense = Get-CimInstance SoftwareLicensingProduct | Where-Object { $_.Name -like "*Client-ESU-Year1*" -and $_.PartialProductKey }

if ($esuLicense) {
    $activationID = $esuLicense.ID
    Write-Host "Found ESU Activation ID: $activationID" -ForegroundColor Cyan

3. Activate ONLY the ESU License ID

Write-Host "Activating ESU License..." -ForegroundColor Yellow
    cscript /nologo $env:SystemRoot\System32\slmgr.vbs /ato $activationID

4. Verification

Write-Host "Activation command sent. Checking status..."
    $status = (Get-CimInstance SoftwareLicensingProduct | Where-Object { $_.ID -eq $activationID }).LicenseStatus
    if ($status -eq 1) {
        Write-Host "ESU License Activated Successfully!" -ForegroundColor Green
    } else {
        Write-Host "ESU Activation Failed. Status Code: $status" -ForegroundColor Red
    }
} else {
    Write-Host "Error: ESU License not found installed on the system." -ForegroundColor Red
}

So in short, removed /upk and /cpky: We keep the existing Windows Enterprise activation intact (KMS). Instead of slmgr /ato (which tries to activate the whole Windows OS), we find the unique ID of the ESU license and run slmgr /ato <GUID> to activate just that add-on.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

VP