Reset activation state for Microsoft 365 Apps for enterprise

• Applies to:

  Microsoft 365 Apps for enterprise

This article is written and maintained by Eric Splichal, Senior Support Escalation Engineer, Matt Philipenko, Microsoft 365 Apps Ranger, and Tim Johnson, Customer Engineer.

You might need to perform tasks such as the following for your organization:

• Tenant to tenant migration
• Repurpose a device for a different user
• Change the license mode for Microsoft 365 on a device

To complete these tasks, you need to clear prior activations of Microsoft 365 apps for enterprise to remove their related licenses and cached Office account information. This removal will reset the applications to a clean state. You can then activate them with a different Office account or change to a different license mode. To reset the activation state, close all Office applications and use one of the following methods.

Note

• The steps below apply to Microsoft Project and Microsoft Visio also.
• The steps and scripts in this article apply to Windows installations of Office apps. For Office for Mac installations, see How to remove Office license files on a Mac.

Method: Use Microsoft Support and Recovery Assistant

The Assistant fully automates all the steps required to reset Office activation, and is available in two versions. Use the version that's appropriate for your requirement.

• The Enterprise (command-line) version of the Assistant
  The Enterprise version of the Assistant is a command-line version that can be scripted and is recommended to reset Office activation on multiple devices and on devices that you can't access immediately.

  Download Enterprise version

• UI version
  The UI version of the Assistant is recommended if you need to reset Office activation on a single device, or on a small number of individual devices.

  Download UI version

Method: Use scripts to automate the cleanup process

Run the following scripts that automate each section of the process. We recommend that you run the OLicenseCleanup.vbs and signoutofwamaccounts.ps1 scripts listed below, while WPJCleanUp.cmd is required only if your device is Workplace Joined. For details about the specific steps that each script automates, select the associated Details link. Use the "Select if using automated scripts" link to navigate back to this method.

1. To remove previous licenses and cached account information: download the OLicenseCleanup.zip file, extract the OLicenseCleanup.vbs script, and run it using elevated permissions. Details
2. To clear the WAM accounts on the device that are associated with Office: download the signoutofwamaccounts.zip file, extract, and run the signoutofwamaccounts.ps1 script with elevated permissions. If you save signoutofwamaccounts.ps1 in the same location as OLicenseCleanup.vbs, then it will be executed automatically when you run OLicenseCleanup.vbs. Details
3. To remove Workplace Joined accounts: download WPJCleanUp.zip, extract the WPJCleanUp folder, and run WPJCleanUp.cmd. Details

Method: Clear prior activation information manually

If you prefer to perform the steps for the cleanup process manually, use the information in this method. The process consists of the following sections.

Section A: Remove Office licenses & cached accounts

This section is subdivided into three parts. Some of the parts require editing registry entries.

Important

Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.

Part 1: Remove previous Office activations

Check for and remove existing licenses on the device. Make sure to check all the noted locations for potential license types, which include vNext, Shared Computer Activation, and legacy licenses.

1. Remove all license token files and folders if found in the following locations:

   • For vNext license type:
     • %localappdata%\Microsoft\Office\Licenses (Microsoft 365 Apps for enterprise version 1909 or later)
   • For Shared Computer Activation license type:
     • %localappdata%\Microsoft\Office\16.0\Licensing

2. Check for and remove legacy licensing by using the ospp.vbs script.

   • IMPORTANT Make sure that:

     • If you want to run the script on a remote computer, the Windows firewall allows Windows Management Instrumentation (WMI) traffic on the remote computer.
     • The user account you use is a member of the Administrators group on the computer on which you run the script.

   • Before you run the ospp.vbs script, you must set the correct directory. Run one of the following commands from an elevated command prompt, as appropriate for your Office installation: 

     • For a 64-bit Office installation on a 64-bit operating system:
       • cd "C:\Program Files\Microsoft Office\Office16"
     • For a 32-bit Office installation on a 64-bit operating system:
       • cd "C:\Program Files (x86)\Microsoft Office\Office16"

3. Run the following command to get a list of the licenses currently in use:

   • cscript ospp.vbs /dstatus

     The output is in this format:

     NOTE The output could include licenses for multiple applications. If it displays No installed product keys detected, skip steps 4 and 5 and go to step 6, "Delete the following registry entry", below. 

     If a partial product key is returned for the applications whose licenses you want to remove, note the value displayed for Last 5 characters of the installed product key to use in step 4, below. 

4. Run the following command to remove the license for an application by using the associated partial product key:

   • cscript ospp.vbs /unpkey:<last 5 characters of product key>

     • For example: cscript ospp.vbs /unpkey:2WC00

   • You should see the message "Product key uninstall successful" when the license is removed.

5. Repeat the cscript ospp.vbs /unpkey command as needed to remove the licenses for the applications listed in the output from step 3.

6. Delete the following registry entry:

   • HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Licensing

Part 2: Remove cached Office account identities in HKCU registry

Delete the following registry entry:

• HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity

If you have Shared Computer Activation enabled, remove the Identity registry key location from the HKEY_USERS\<The user SID>\Software\Microsoft\Office\16.0\Commonregistry key. To get the currently signed in user's SID, run the command whoami /user in a non-elevated command prompt.

Part 3: Remove Office credentials stored in Windows Credential Manager

1. Open Control Panel > Credential Manager.

2. Select Windows Credentials.

3. Remove all credentials listed for Office by selecting the drop-down arrow next to each one, and select Remove.

   

4. Check for and delete any values present under the following registry key: HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System

Select if using automated scripts

Section B: Clear cached Office credentials for managed devices

For managed devices, there are additional locations from which you need to remove cached Office credentials. Devices are considered managed if they're Microsoft Entra joined (AADJ), Microsoft Entra hybrid joined (HAADJ), or Workplace Joined (WPJ). These configurations use Web Account Management (WAM), which stores credentials in different locations.

There are no steps that you can run manually to clear WAM accounts associated with Office on the device for AADJ and HAADJ devices.

Download the signoutofwamaccounts.zip file, extract, and run the signoutofwamaccounts.ps1 script as administrator.

The signoutofwamaccounts.ps1 script will remove the tokens and accounts associated with Office and is safe to run. On AADJ and HAADJ devices, it will not affect the Single Sign-On (SSO) state of the applications and the device state.

The script can only be run on Windows 10 version 1803 and later. If your operating system isn't compatible, you'll see the notification "Unsupported Windows 10 version!".

To check whether your device is managed, run the dsregcmd /status command in an elevated command prompt.

In the output that displays, check the values for the AzureAdJoined, EnterpriseJoined and DomainJoined parameters in the Device State section. Then use the following table to determine whether your device is AADJ or HAADJ:

AzureAdJoined	EnterpriseJoined	DomainJoined	Device state
YES	NO	NO	Microsoft Entra joined (AADJ)
NO	NO	YES	Domain Joined (DJ)
YES	NO	YES	Hybrid AD Joined (HAADJ)

For more information, see Troubleshoot devices by using the dsregcmd command.

Select if using automated scripts

Section C: Clear Workplace-Joined accounts

When you clear a WPJ account on a device, the Single Sign-On (SSO) behavior for the current Windows session will be removed as well. All applications in the current Windows session will lose their SSO state, and the device will be unenrolled from management tools and unregistered from the cloud. The next time you try to open an application, you'll be asked to sign-in.

Check whether your device is Workplace Joined if you're not sure. Run the dsregcmd /status command from an elevated command prompt as described in Section B, above.

The state of Workplace Joined (WPJ) (Microsoft Entra registered) devices is displayed in the User State section of the output. If the value displayed for the WorkplaceJoined parameter is YES, it indicates that your device is Workplace Joined.

To clear WPJ accounts:

1. On the device, select the Start button and then choose Settings.
2. Select Accounts > Access Work or School.
3. Select the work or school account to be removed, and then select Disconnect.

Select if using automated scripts

References

• Account or subscription verification errors activating Microsoft 365 Apps
• Sign in issues when activating Microsoft 365 Apps
• Microsoft 365 Apps activation network connection issues
• Microsoft 365 Apps activation error: "Your organization has disabled this device"
• Microsoft 365 Apps activation error "There's a problem with your account"
• "We are unable to connect right now" error when users try to activate Microsoft 365 Apps for enterprise
• Troubleshoot issues with shared computer activation for Microsoft 365 Apps
• Device identity and desktop virtualization
• What is device identity in Microsoft Entra ID?
• OneDrive for Business can't sync after tenant migration