Resetting the rearm count in Windows 7

After installing Windows 7, and before activation, the operating system will run in an Initial Grace Period license status for 30 days. When this grace period expires, users can rearm Windows 7 for an additional 30 days, and do this up to 3 times, effectively allowing the OS to run legally for 120 days without a genuine product key.

When a user uses up all three rearms available rearms, the only option left is to enter a genuine product key to activate Windows 7, or leave the operating system in a crippled, non-genuine state.  Users will then be subjected to certain annoyances such as black desktop background, repetitive notification messages stating that this copy of Windows is illegal or counterfeited, and a reminder to register the software at login.

Through a Windows Product Activation (WPA) vulnerability that Microsoft introduced in Windows 7, it is possible to reset the remaining rearm count back to 4. There is no limit to the number of times that the rearm count can be reset, meaning that a user could theoretically run an unlicensed copy of Windows 7 forever, without the need for proper activation, and without applying any activation hacks.

This WPA vulnerability is related to a WPA registry key which contains the ‘Last Rearm Time’. When the WPA registry key is deleted, the whole licensing status of Windows 7 is re-initiated to the Initial Grace Period as if Windows 7 has just been installed. The deletion of the WPA registry key is achieved via the following command:

reg load HKLM\MY_SYSTEM “%~dp0Windows\System32\config\system”
reg delete HKLM\MY_SYSTEM\WPA /f
reg unload HKLM\MY_SYSTEM

Given the importance of this WPA registry key, Microsoft has locked it (and its sub-keys) from been modified or deleted in a normal user session. The only way to run this command is within the WinRE (Windows Recovery Environment) or WinPE (Windows Preinstallation Environment).

In our managed environment, this method of rearming Windows is ultra handy in our SOE creation, in that we do not have to keep starting from scratch when we run out of rearms.  This ‘hard’ rearm reset  gives us one less thing to worry about if we need to tweak anything in our images.

To perform this ‘hard’ reset; create a batch script file with the following commands:

  1. reg load HKLM\MY_SYSTEM "%~dp0Windows\System32\config\system"
    reg delete HKLM\MY_SYSTEM\WPA /f
    reg unload HKLM\MY_SYSTEM
    Save the file as delwpa.bat on drive C:\ at the root folder level. For example, C:\delwpa.bat. Note that some users may require to run the text editor such as Notepad as administrator to save to C:\ root directory.
  2. Restart the computer.
  3. Press F8 right after the BIOS screen to get to the “Advanced Boot Options”.
  4. Select Repair Your Computer.
  5. Select your keyboard input method, and click Next.
  6. Enter user name and password login credentials, and click OK.
  7. In the “System Recovery Options”, open Command Prompt.
  8. Type C: to go to the main drive, and the execute the delwpa.bat file by typing its name:delwpa.batNote: On some computers such as virtual machine or computer with recovery partition, the main drive may have another drive letter, e.g. D:
  9. The console should display messages saying that the commands were executed successfully. Close the console window and reboot the machine.
  10. After system start-up, log into Windows. Your system will display message such as “This product is not genuine”. Just ignore it.
  11. To check the activation status, open an elevated command prompt window as administrator, and run the following command:slmgr /dlvThe dialog box with the following details should appear:
    License Status: Initial Grace Period
    Time remaining: 30 days
    Remaining windows rearm count: 3

Tip: As an alternative, it’s possible boot from a Windows 7 Repair Disc or a Windows 7 installation disc to go to WinPE environment.  This method will bypass the need to enter login credentials. Pressing F8 will bring user to WinRE console.

13 Responses to Resetting the rearm count in Windows 7

  1. John says:

    Hmm, doesn’t work with x86 Windows 7 Enterprise, SP1. I get “ERROR: The System was unable to find the specified registry key or value” after the first command. Perhaps MS have patched this?

  2. Nuno says:

    when I type the delwpa.bat in command prompt it says that the command is not recognized. I did everything as you just told, but in the very end the file doesn’t run. I tried also typing in “run delwpa.bat”, but still not work. Can anybody help me…

    • @Numo: You need to make sure that when you copy and paste the first line in the delwpa file that the speech marks ” come across correctly. i.e. replace them using your keyboard, as sometimes when copying and pasting the speech marks appear as the slightly curled marks, instead of straight speech marks which messes up the running of the command.

  3. hey, are this also applicable on Windows 8 Enterprise Evaluation?

  4. Robert says:

    Excellent tip. I also create images for mass deployment that I need to tweak occasionally and I cannot have the image contaminated with a product key.

  5. Ben Watkins says:

    The script didn’t work but it deleting the entry manually from did.

    boot winpe

    run regedit

    select HKEY_LOCAL_MACHINE

    File, load hive

    open file: c:\Windows\System32\config\system (where c = your HDD)

    it will ask you for a name, this is just a temporary reference to the hive, type in whatever (eg SYSTEM-LOCAL)

    expand HKEY_LOCAL_MACHINE\SYSTEM-LOCAL

    delete WPA

    Reboot.

    When I did this, the windows activation status was “not available” until I registered my key using the slmgr /ipk command, then it changed to ‘3 days to activate’ and slmgr /dlv showed a rearm count of 5

  6. Jeremy says:

    From the Windows 7 CD – choose repair computer. Then press “F10” to open the command prompt.

  7. Pingback: How to rearm windows 7 instance | O tym jak internet popsułem…

  8. kreatorz says:

    great.. rearm reset-ted and my problem solved!

  9. Phil says:

    It worked for me thank you.

    Although i had to replace the “%~dp0Windows with “d:\windows, running under F8 repair my computer.

    so under that PE environment takes the c: drive and it becomes the d: drive instead

  10. Klaus Werner says:

    Gute Methode ohne Aktivierung auszukommen!
    Vielen Dank!

  11. Malik says:

    I did the following to reset the re-arming process:
    1- Run regedit , it will open the Registry Editor
    2- On the left of registry editor, expand the following to reach your required file HKEY_LOCAL_MACHINE > SOFTWARE > MICROSOFT > WINDOWS NT > CURRENT VERSION > SOFTWARE PROTECTION PLATFORM.
    3- Click on SOFTWARE PROTECTION PLATFORM and on the right of registry editor u will see the file ” SkipRearm”. Right-click on SkipRearm, then modify the skiprearm value from 0 to 1.
    4- Now run command prompt as administrator and type slmgr -rearm.
    …..your job done…

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

%d bloggers like this: