🪟 How to Activate Windows on ggRock Systems

Seeing that pesky "Activate Windows" watermark on your Machines? Whether it's showing up on the desktop or bleeding through the ggLeap UI — don't worry, we've got you covered! 😄

This guide walks you through different ways to activate Windows on ggRock systems, depending on what kind of licenses you have.

🚨 The Problem

Your Machines may display a watermark that says "Activate Windows". It might show on the desktop, or even behind full-screen apps like ggLeap, causing distraction or confusion.

✅ The Solutions

There are a few different ways to activate Windows, depending on what kind of licensing you have:

🏢 Option 1: KMS Activation (for Volume-License or Enterprise customers)

If you're in an enterprise environment, KMS (Key Management Service) is a great way to manage activation at scale — one central server activates all your Machines automatically.

🔧 Learn more here: 👉 Activate using Key Management Service (KMS) – Microsoft Docs

🔑 Option 2: MAK Activation (also for Volume-License customers)

MAK (Multiple Activation Key) licensing is perfect for ggRock deployments where you want a simple, one-time activation per Machine.

📘 More info: 👉 Plan for Volume Activation – Microsoft Docs

🛠️ Option 3: Manual or Scripted Activation (Retail or OEM keys)

This method works if:

• You bought individual retail keys, or
• Your PCs came with OEM licenses embedded in the BIOS

Step-by-Step Manual Activation

1. Enable Keep Writebacks on the system.
2. Open an elevated command prompt (right-click Start > Command Prompt (Admin) or Windows Terminal (Admin)).
3. Run: slmgr.vbs -rearm
4. Reboot the Machine.
5. Go to Settings > Update & Security > Activation, then click Change product key.
6. Enter the valid product key (from BIOS, retail, or your records).

Need help finding your key? Microsoft offers several ways to retrieve a product key.

💻 Scripted Activation Examples

These can help automate the process at scale!

🧬 Script: Activate Using Key from BIOS

This script finds and activates your OEM key automatically:

@echo off
setlocal
rem Uninstall and clear current key
cscript //nologo "%SystemRoot%\System32\slmgr.vbs" /upk
cscript //nologo "%SystemRoot%\System32\slmgr.vbs" /cpky
rem Try to get embedded OEM key (works on Win10 with WMIC)
set "pk="
for /f "tokens=2 delims==" %%K in ('
wmic path softwarelicensingservice get OA3xOriginalProductKey /value 2^>nul
') do set "pk=%%K"
rem If WMIC is missing (Windows 11+), fall back to PowerShell
if not defined pk (
for /f "usebackq delims=" %%K in (`
powershell -NoProfile -Command "(Get-CimInstance -ClassName SoftwareLicensingService).OA3xOriginalProductKey"
`) do set "pk=%%K"
)
rem Stop if no key found
if not defined pk (
echo No embedded OEM key found. Exiting...
exit /b 1
)
echo Installing product key: %pk%
cscript //nologo "%SystemRoot%\System32\slmgr.vbs" /ipk %pk%
cscript //nologo "%SystemRoot%\System32\slmgr.vbs" /ato
cscript //nologo "%SystemRoot%\System32\slmgr.vbs" /dli
endlocal

🧾 Script: Activate Based on Service Tag (Retail Keys)

@ECHO OFF
for /F "skip=2 tokens=2 delims=," %%A in ('wmic systemenclosure get serialnumber /FORMAT:csv') do (set "serial=%%A")
REM Set product key based on serial number
if %serial%==COMPUTERSERVICETAG1 set pk=XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
if %serial%==COMPUTERSERVICETAG2 set pk=XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
cscript %WINDIR%\System32\slmgr.vbs /upk
cscript %WINDIR%\System32\slmgr.vbs /cpky
cscript %WINDIR%\System32\slmgr.vbs /ipk %pk%
cscript %WINDIR%\System32\slmgr.vbs /ato
cscript %WINDIR%\System32\slmgr.vbs /dli

🌐 Script: Activate Based on MAC Address (Retail Keys)

@ECHO OFF
REM Get the MAC address of the first Ethernet adapter and convert it to uppercase
for /F "tokens=3 delims=," %%A in ('"getmac /v /fo csv | findstr /i Ethernet"') do (
set "MACADDR=%%A"
REM Only capture the first MAC address
goto :found
)
:found
REM Debugging step: Check the raw MAC address
echo Raw MAC Address: %MACADDR%
REM Remove leading and trailing spaces from MAC address and convert it to uppercase
set MACADDR=%MACADDR: =%
set MACADDR=%MACADDR: =-%
REM Debugging step: Check the formatted MAC address
echo Formatted MAC Address: %MACADDR%
REM Set product key based on MAC address
if /i "%MACADDR%"=="D8:43:AE:9D:95:68" set pk=XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
if /i "%MACADDR%"=="D8:43:AE:9D:97:2B" set pk=YYYYY-YYYYY-YYYYY-YYYYY-YYYYY
if /i "%MACADDR%"=="D8:43:AE:9D:95:E3" set pk=ZZZZZ-ZZZZZ-ZZZZZ-ZZZZZ-ZZZZZ
if /i "%MACADDR%"=="D8:43:AE:9D:9D:C2" set pk=AAAAA-AAAAA-AAAAA-AAAAA-AAAAA
REM Debugging step: Check the product key value
echo Product Key: %pk%
REM If product key is set, run slmgr commands
if defined pk (
cscript %WINDIR%\System32\slmgr.vbs /upk
cscript %WINDIR%\System32\slmgr.vbs /cpky
cscript %WINDIR%\System32\slmgr.vbs /ipk %pk%
cscript %WINDIR%\System32\slmgr.vbs /ato
cscript %WINDIR%\System32\slmgr.vbs /dli
) else (
echo Error: Product key not found.
)

❓ Frequently Asked Questions

Almost every activation question on ggRock comes down to one idea: activation lives in the image, not on each station's disk — so the trick is getting the activated state baked into your snapshot. Here are the ones operators ask most.

Why does the "Activate Windows" watermark keep coming back, even on machines I already activated?

Because ggRock discards writebacks on reboot by default. If you activate Windows during a normal session and don't save it, that change is thrown away the next time the station boots from the snapshot — and the watermark returns. The fix is to bake activation into the image once (see the recommended workflow below). If the watermark is showing on every station, the activated state isn't in your snapshot yet. If it's only on a new or recently swapped station, that box simply hasn't re-activated against its own hardware yet.

Which licensing method should I use — KMS, MAK, or retail/OEM?

It depends on scale and what infrastructure you have:

• KMS — best at scale if you (or your institution) run a KMS host. Clients self-activate automatically and renew on their own, with no finite pool to burn through.
• MAK — the simplest volume option when you don't want to run activation infrastructure. One finite pool of activations, one count per machine.
• Retail / OEM — fine for one-offs, or for OEM keys embedded in each PC's BIOS, but it doesn't scale cleanly across a shared image.

With a MAK key, does each reboot or restore consume an activation — and how many will I actually use?

No to the first, "one per physical PC" to the second. A MAK activation is bound to the machine's hardware, not to a boot event — Microsoft records the hardware ID on first activation, so reboots, nightly power cycles, end-of-session restarts, and ggRock restores on that same hardware never draw down your pool again. In practice a 40-seat center consumes roughly 40 activations total. Size your key with a little headroom for hardware swaps and future seats.

Do I have to activate every PC separately and save a snapshot for each one?

No — and this is the part that trips most people up. Because every station boots from the same shared ggRock image, you run the activation procedure once, against the image — not once per machine. There's no need to capture a separate snapshot for each PC. Each station then spends a single activation automatically the first time it checks in against its own hardware.

What's the recommended workflow for getting activation to stick?

Whatever method you use, the principle is the same: bake the activated state into the image one time.

1. Enable Keep Writebacks on the image.
2. Install your key and activate — slmgr /ipk <YOUR-KEY> then slmgr /ato.
3. Confirm it took with slmgr /xpr (or slmgr /dli) — you want a "permanently activated" result before saving.
4. Apply Writebacks to persist the key and activation state into the snapshot.

After that, boot your stations normally. With MAK, each unique machine spends one count on its first activation; reboots and restores afterward are free.

Will normal daily operation slowly drain my activation pool?

It won't. Once each machine has activated that first time, day-to-day operation — session-end restarts, daily on/off cycles, restores to the clean image — consumes zero additional activations. The only things that draw a new count are adding a new PC or a significant hardware change.

Does KMS work the same way — will it burn through a pool?

No. Unlike MAK, KMS doesn't draw from a finite count. KMS clients activate against your KMS host and quietly renew on a recurring cycle, so there's nothing to exhaust. Just make sure the KMS client configuration is baked into the image like any other activation state.

How do I check whether a station is actually activated?

Run slmgr /xpr for a quick "activated / expires" readout, or slmgr /dli for license status and details. You can also check Settings > Update & Security > Activation. Always verify here before you Apply Writebacks — saving an unactivated image just bakes the watermark in for everyone. 🙂

What's the recommended ggRock workflow?

Bake the activated state into the snapshot one time:

1. Enable Keep Writebacks on the image.
2. Install the MAK key and activate — slmgr /ipk <YOUR-KEY> then slmgr /ato.
3. Confirm it took with slmgr /xpr (or slmgr /dli) — you want a "permanently activated" result before you save.
4. Apply Writebacks to persist the key and activation state into the snapshot.

After that, boot your stations normally. Each unique machine spends exactly one count on its first activation; every reboot and restore afterward is free.

📌 Final Notes

• Every Machine booting Windows via ggRock must be properly licensed.
• Only volume-license customers can use KMS or MAK methods.
• Retail/OEM keys may run out of activations — be prepared to contact Microsoft if needed.

Need more help with licensing? Start with Microsoft's overview: 👉 Windows Product Licensing – Microsoft

Updated on: 17/06/2026