A brief history of anti-piracy at Microsoft

A brief history of anti-piracy at Microsoft

Summary: I’m revisiting Microsoft’s Genuine Advantage program this week, in light of the introduction of a new WGA Notifications tool for Windows XP and Windows Server 2003. As background, I thought it might be interesting to post a brief history of how Microsoft’s anti-piracy programs have evolved over the past 25 years.

TOPICS: Windows

I’m revisiting Microsoft’s Genuine Advantage program this week, in light of the introduction of a new WGA Notifications tool for Windows XP and Windows Server 2003. (Microsoft’s official description is here; the download page is here.) As background, I thought it might be interesting to post a brief history of how Microsoft’s anti-piracy programs have evolved through the generations.

This post is mainly just a factual recitation. I'll refer back to it in the follow-up posts where I analyze the effects of these and other, related changes in Microsoft software over the years.

Note: I believe that all of the details in this post are accurate, but I'm continuing to research the topic and plan to post additions, updates, and corrections as needed. Most recent update 3 March 2007.

MS-DOS and Windows 2.x/3.x: No serialization or copy protection. If you make a copy of the floppy disk(s) containing the installation files, you can install it on any computer. The impact of casual copying is relatively minor, because of Microsoft's wide use of per-processor licensing agreements. This practice, introduced in 1988 and ended as part of a 1994 antitrust settlement, made sure that nearly every PC sold by large OEM computer makers included MS-DOS or Windows or both.

Windows 95/98/Me, Windows 2000:
Serialization arrives. During installation, you’re required to enter a serial number. The serial number isn’t necessarily unique—it just matches an approved list or algorithm that the installation routine checks during Setup; any valid serial number will allow the installation to continue. There’s no technical mechanism to prevent casual or wholesale copying. The serial numbers become slightly more complex over time, starting with 10 numbers for retail versions of Windows 95 (17 numbers for OEM versions), and evolving by 1998 to the familiar 25-character product key (5 groups of five characters, in mixed alphanumeric format), typically printed on a yellow sticker attached to the installation media. OEM and retail serial numbers use identical formats beginning with Windows 98.

Windows XP:
Introduces Windows Product Activation, which requires you to enter a product key in the same 25-character alphanumeric format used in earlier editions. What’s new is the requirement to have Microsoft approve the continued use of that key after an initial grace period. This process, called activation, computes a numeric hash (with no personally identifiable information) from 10 components of your system and sends this hash plus the product key to Microsoft over the Internet (there's a cumbersome phone-based process if you don't have online access). This is the first use of product activation in Windows, although the concept has been tested in some non-U.S. markets with the release of Office 2000.

Activation is a crude attempt at two-factor authentication, where a physical key (as identified by the hardware hash) is combined with a PIN (the 25-character product key). Because changes in system hardware can cause the hardware hash to change, this factor includes an algorithm that tolerates minor changes but forces reactivation after passing a predefined threshold. Activation is a one-time process. If you reinstall, you have to reactivate, but as long as you haven't changed motherboards or network cards (the two most heavily weighted components of the activation algorithm) the hardware hash should match the one stored on Microsoft's server and reactivation should succeed automatically. By design, you should be asked to reactivate only if it appears that the new hardware is "substantially changed."

OEM copies play by different activation rules than retail copies, and large corporations use volume licensing keys (VLKs), which don't require activation. Within a few years, stolen, leaked, or otherwise compromised VLKs become the easiest way to score a bootleg copy of Windows XP. Consumers increasingly become inadvertent victims of piracy as system builders and lazy technicians use unauthorized copies to avoid the cost of a legal copy or the hassle of restoring the original Windows installation.

Windows XP SP1:
Makes a few minor adjustments to Windows Product Activation, notably adding a three-day “grace period” that begins counting down when significant hardware changes are detected. When time's up, you have to reactivate or Windows stops working. This service pack also blocks Setup when you enter one of two well-known and widely published stolen product keys.

Windows Server 2003:
Uses same activation system as Windows XP.

Windows Genuine Advantage pilot program:
Microsoft quietly kicks off a pilot program in September 2004 to identify Windows users who initially pass product activation using a stolen product key or one that has been generated by a so-called keygen utility that can produce a valid (and potentially unused) retail product key. Validation is designed to check the current status of the product key to see whether it has been detected and added to the "block list" on Microsoft's servers. Previously, this block list would have prevented only new activations using that key; validation allows Microsoft to identify systems that have slipped through the activation process.

Windows Genuine Advantage 1.0:
The software contains two components:

  • Windows Genuine Advantage Validation is an ActiveX component that periodically checks the product key and some system components to confirm that the product key is still valid.
  • Windows Genuine Advantage Notifications displays a series of messages on any computer that has failed the Windows Genuine Validation check.

Microsoft launches WGA Validation in mid-2005. In November 2005, the first phase of WGA Notifications begins. By the first half of 2006, WGA has moved out of pilot phase and into full-scale worldwide deployment. Technically, WGA is still an opt-in program, but you're unable to manually download updates or new system components (including Internet Explorer 7) without first passing a validation check. If you refuse to download and install the WGA Notifications components, you're allowed access to Critical Updates through Automatic Updates or by manually downloading them from the Microsoft Download Center. Direct access to the Windows Update and Microsoft Update sites requires validation.

Windows Genuine Advantage Notifications 1.7.0017+:
This WGA update, which has been available for download since November 2006, is delivered through Automatic Updates but installed only after the user clicks to provide consent. The most significant changes include:

  • A new installation wizard and license agreement, which together provide more details about what the utility is and what it does. Installing the update does not require a system restart.
  • The range of available options now includes yellow-state messaging, which identifies systems that fail to complete validation; previously, this type of error often caused a false positive, in which the Notifications utility incorrectly informed users that a system was "non-genuine" and that they "might be a victim of counterfeiting."
  • Improved support options are now available for OEMs and customers. New diagnostic and repair tools for dealing with common errors are now available from the notification page itself.

Windows Vista:
The components of WGA and product activation are integrated into Windows Vista as a small part of the much larger Windows Software Protection Platform. Failing validation results in the loss of some features, followed eventually by a descent into "reduced functionality mode," where most Windows features stop working completely. In reduced functionality mode, you can browse the web for up to an hour (presumably to figure out how to get things working again), but you can't load any programs. Roughly 100 days after the release to manufacturing of Windows Vista, there have been no widespread reports of glitches in the activation or validation process.

Topic: Windows

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • When will we be brave enough...

    ... to not buy what we don't like?

    See my small cartoon:

    • As soon as there is a better alternative.

      I know MS haters hate to hear that but its true. You live in a really twisted dreamland if you think the majority of the public purchases a product they dont like if there is an alternative that does what they want at a price they want. Its always the way it has worked and likely always will be.

      Give me an OS that runs all my software, vertually no use of command lines, runs all my games without need of some third party software or patch, and con be installed on any combination of hardware that I choose to have assembled. Well, for now I guess Windows is where its at. Maybe one day there might be something else, but not yet.
      • Re: As soon as there is a better alternative.

        [i]Give me an OS that runs all my software, vertually no use of command lines, runs all my games without need of some third party software or patch, and con be installed on any combination of hardware that I choose to have assembled. Well, for now I guess Windows is where its at.[/i]

        Well, if you're going to condition your OS challenge on the ability to run made-for-Windows software without using an emulator, then, yes, Windows is where it's at. Definitely.

        none none
      • Maybe if you used

        Open Source software you would be able to catch your spelling errors... ]:)
        Linux User 147560
  • Whatever you do...

    ...[i]"Don't copy that floppy!"[/i]

    Thanks for sharing!
    D T Schmitz
    • Glad someone caught...

      ,,,my small hidden touch of humor.
      Ed Bott
  • Before XP

    I'd just note that product activation was trialled before it came to Windows XP -- in some versions of Office 2000 sold in some countries such as Australia, Brazil and China (and also including US academic copies). There's some detail in this old edition of Office Watch:


    I recall the most annoying thing about it was there was no de-activation process when you removed Office off a machine so you could install it on another one -- instead you had to ring up Microsoft and convince them that had happened.
    • Thanks

      I remember that detail but left most mentions of Office out of this timeline. I've added a note.
      Ed Bott
  • Wish you went a little further

    MS has been claiming that this new version of Windows will be practically "crack proof"; moreover, that the OS will be far more capable of detecting it has been breached, tampered with or subverted, both as it is happening AND <after the fact>. Wish you went into a bit more detail on the ramping up measures Microsoft chose to employ to turn up the heat on piracy and activation subversion in Vista (beyond WGA). That really is where the rubber meets the road on this whole drawn out initiative, but you pretty much skimmed right past it like Vista is just more of the same ol' [SOS].

    So what is your inside take? Is Vista indeed smart enough to circumvent the hacker end-arounds, even after an initially successful exploit? Is it "auf wiedersehen baby" for the keygens, the activation timer manipulators, and the VLKs found previously in the wild? If so, what exactly are the new measures MS has put into place in Vista to serve as their ever vigilant guard dog and activation-bypass sniffer?

    PS. WGA to date has been little more than a pain in the ass, how else can you put it? The pirates seem to fly right by it, while Joe Q Public has to put up with ever more dog hoops to jump through.
    • Stay tuned

      As I tried to point out, this is just the factual backgrounder. The more pointed analysis is coming up...
      Ed Bott
      • Excellent

        Tuned I shall stay. Thanks.
  • Ed, why do you?

    And other news-persons who have the audience and the knowledge to explain the intricate aspects of software, NOT point out the fact (when discussing piracy) that Microsoft has made hundreds of billions of dollars and become the biggest corporation in the world all the while being robbed blind by piracy (according to their claims)?

    Is it that you don't see it, or you just don't see it in that way?

    It would seem to me that anybody who made that much money while piracy or (_________fill in the blank) was occurring would be actively promoting it (piracy or whatever) rather than trying to stamp it out.

    I know it is ludicrous to say promote piracy, but at least not harass, extort, and demoralize your customers, for crying out loud.
    Ole Man
    • Not that simple

      But it's a good question and one I plan to take up later this week.
      Ed Bott
    • Ed, why do you?

      I always thought it was interesting that in the early period there was no real piracy of the Operating System at least until [b]after[/b] the loss of the anti-trust case.

      So who's responsible for that piracy then?

      Cheers, Thomo the Lost
      • Coincidence

        There has always been piracy. The thing that has made it easier to spread pirated copies and also easier to provide countermeasures like activation is the rise of the Internet. It's no accident that leaps in anti-piracy technology are tied to widespread availability of internet bandwidth.
        Ed Bott
  • piracy

    you also have to remember that 90% of the computers in use back in the 80s were businesses who would be sued by MS for breach of licencing and machines like the sinclair spectrum ZX81 that came with a hard coded OS such as Qdos that could not be changed or pirated without a lot of knowledge.
  • 2006: HollywoodDog switches to Mac

    Finds Windws already badly designed interfaces and security to be incompatible with nagging and persistent mistrust.
    The Dog determines that spending more money for higher quality hardware and software solution better for long run.