I have a Windows 7 hard drive that was cloned from an other W7 hard drive.
The original hard drive activated just fine. The cloned drive says
activated, and slmgr /dlv shows Status:Licensed, but this cloned drive, when
booted from, keeps popping up a Windows message saying that this is not a
genuine OS version.

I tried to correct using WSUS, but no luck. That's fine. I don't need to
'legitimize' this hard drive/OS.

Anyway, it got me to thinking does a Windows OS goes out to Microsoft each
time it's loaded, or once in s a while after it's been loaded. Or, is the "I
am legitimate" monikor, or the "I am not legitimate" monikor, kept on the
hard drive, once established.

I think it's kept on the hard drive once established. Here's why I think
that.

I booted my machine from the hard drive that keeps popping up the 'this is
not a genuine Windows version', but I wasn't connected to the internet.
After a minute or so, the same 'not genuine' message popped up.

Does this mean that the message is recorded on the hard drive, and that the
Windows OS doesn't need to go out to the internet (Microsoft) to verify, once
initially verified?

I imagine the same holds for Win7, Win10, and Win11?

On 9/20/2022 11:15 PM, Boris wrote:
> I have a Windows 7 hard drive that was cloned from an other W7 hard drive.
> The original hard drive activated just fine. The cloned drive says
> activated, and slmgr /dlv shows Status:Licensed, but this cloned drive, when
> booted from, keeps popping up a Windows message saying that this is not a
> genuine OS version.
>
> I tried to correct using WSUS, but no luck. That's fine. I don't need to
> 'legitimize' this hard drive/OS.
>
> Anyway, it got me to thinking does a Windows OS goes out to Microsoft each
> time it's loaded, or once in s a while after it's been loaded. Or, is the "I
> am legitimate" monikor, or the "I am not legitimate" monikor, kept on the
> hard drive, once established.
>
> I think it's kept on the hard drive once established. Here's why I think
> that.
>
> I booted my machine from the hard drive that keeps popping up the 'this is
> not a genuine Windows version', but I wasn't connected to the internet.
> After a minute or so, the same 'not genuine' message popped up.
>
> Does this mean that the message is recorded on the hard drive, and that the
> Windows OS doesn't need to go out to the internet (Microsoft) to verify, once
> initially verified?
>
> I imagine the same holds for Win7, Win10, and Win11?
>

Actually, it doesn't, but let's concentrate on the problem. (W10 and W11 are
server-side licensed, and the mechanics are likely to be different. You
can probably tip over W10 or W11, by changing the motherboard and its NIC identifier.)

https://www.computerworld.com/article/2546248/update--windows-genuine-advantage---what-it-is--how-to-ditch-it.html

"For example, in my tests I was able to make the WGA "counterfeit" warning
appear by changing the date of the system clock one month later. The Web-based
WGA program was able to determine that was the problem and it suggested I reset
the system date. When I did that, the WGA warnings disappeared. While most
WGA detections don't resolve that easily, it can't hurt you to learn as much as
you can about why WGA believes your copy Windows is illegitimate."

slmgr /dlv tells you your product is licensed, but WGA thinks otherwise.

Another reason WGA may create a false positive, is if it cannot
contact a specific Microsoft server. I don't know the details of
this. Perhaps Winston knows whether the server is turned off or
is running.

Paul

Boris wrote:

> I have a Windows 7 hard drive that was cloned from an other W7 hard
> drive. The original hard drive activated just fine. The cloned drive
> says activated, and slmgr /dlv shows Status:Licensed, but this cloned
> drive, when booted from, keeps popping up a Windows message saying that
> this is not a genuine OS version.
>
> I tried to correct using WSUS, but no luck. That's fine. I don't need
> to 'legitimize' this hard drive/OS.
>
> Anyway, it got me to thinking does a Windows OS goes out to Microsoft
> each time it's loaded, or once in s a while after it's been loaded. Or,
> is the "I am legitimate" monikor, or the "I am not legitimate" monikor,
> kept on the hard drive, once established.
>
> I think it's kept on the hard drive once established. Here's why I
> think that.
>
> I booted my machine from the hard drive that keeps popping up the 'this
> is not a genuine Windows version', but I wasn't connected to the
> internet. After a minute or so, the same 'not genuine' message popped
> up.
>
> Does this mean that the message is recorded on the hard drive, and that
> the Windows OS doesn't need to go out to the internet (Microsoft) to
> verify, once initially verified?
>
> I imagine the same holds for Win7, Win10, and Win11?

Activation is based in part on hardware. If you install on one machine then
clone the drive and move it to another machine, unless it's largely
identical to the source machine, Windows will (probably) detect that it's
been moved to another machine and will de-activate itself. This can also
happen if you change a lot of hardware on a machine (no cloning required).

On the other hand, if you cloned the drive and then booted the clone in the
same machine... no clue, can't help, not what I would expect.

--
To err is human. To leave a paper trail is moronic.

On 9/20/2022 10:44 PM, Auric__ wrote:

>
> Activation is based in part on hardware. If you install on one machine then
> clone the drive and move it to another machine, unless it's largely
> identical to the source machine, Windows will (probably) detect that it's
> been moved to another machine and will de-activate itself. This can also
> happen if you change a lot of hardware on a machine (no cloning required).

I recently fixed a toshiba laptop for someone and it required a new
motherboard and CPU. I was expecting problems, but it doesn't seem to
mind.

On 9/21/2022 12:17 AM, sticks wrote:
> On 9/20/2022 10:44 PM, Auric__ wrote:
>
>>
>> Activation is based in part on hardware. If you install on one machine then
>> clone the drive and move it to another machine, unless it's largely
>> identical to the source machine, Windows will (probably) detect that it's
>> been moved to another machine and will de-activate itself. This can also
>> happen if you change a lot of hardware on a machine (no cloning required).
>
> I recently fixed a toshiba laptop for someone and it required a new motherboard and CPU.  I was expecting problems, but it doesn't seem to mind.
>

Was the Toshiba using SLIC for the license key, and a Royalty OEM OS install ?
That would likely be a smoother transition, than a motherboard with different
NIC being put in the machine, with a Retail OS installed using the COA key.
I think they still do care, and will make a fuss if at all possible :-)
That's my experience here at least. My laptop has a Retail OS install using
the COA. I might have needed phone activation for that.

The Royalty OEM OS is not lax, it's just a difference in the way it behaves.
If you put the Toshiba disk on a non-Toshiba motherboard, then I would
expect trouble. The OS Toshiba puts on the machine, should run as smooth
as butter on the Toshiba motherboard, even if another Toshiba motherboard
is rotated in.

Paul

sticks <wolverine.01@charter.net> wrote in
news:tge38g$1o9hr$1@dont-email.me:

> On 9/20/2022 10:44 PM, Auric__ wrote:
>
>>
>> Activation is based in part on hardware. If you install on
>> one machine then clone the drive and move it to another
>> machine, unless it's largely identical to the source
>> machine, Windows will (probably) detect that it's been
>> moved to another machine and will de-activate itself. This
>> can also happen if you change a lot of hardware on a
>> machine (no cloning required).
>
> I recently fixed a toshiba laptop for someone and it
> required a new motherboard and CPU. I was expecting
> problems, but it doesn't seem to mind.

Same motherboard model, and same (embedded) CPU, right?

On 9/21/2022 5:25 AM, Paul wrote:
> On 9/21/2022 12:17 AM, sticks wrote:
>> On 9/20/2022 10:44 PM, Auric__ wrote:
>>
>>>
>>> Activation is based in part on hardware. If you install on one
>>> machine then
>>> clone the drive and move it to another machine, unless it's largely
>>> identical to the source machine, Windows will (probably) detect that
>>> it's
>>> been moved to another machine and will de-activate itself. This can also
>>> happen if you change a lot of hardware on a machine (no cloning
>>> required).
>>
>> I recently fixed a toshiba laptop for someone and it required a new
>> motherboard and CPU.  I was expecting problems, but it doesn't seem to
>> mind.
>>
>
> Was the Toshiba using SLIC for the license key, and a Royalty OEM OS
> install ?
> That would likely be a smoother transition, than a motherboard with
> different
> NIC being put in the machine, with a Retail OS installed using the COA key.
> I think they still do care, and will make a fuss if at all possible :-)
> That's my experience here at least. My laptop has a Retail OS install using
> the COA. I might have needed phone activation for that.
>
> The Royalty OEM OS is not lax, it's just a difference in the way it
> behaves.
> If you put the Toshiba disk on a non-Toshiba motherboard, then I would
> expect trouble. The OS Toshiba puts on the machine, should run as smooth
> as butter on the Toshiba motherboard, even if another Toshiba motherboard
> is rotated in.

The laptop was out of service for about a year. I don't know for sure,
but I imagine he bought it at a Best Buy. It was almost brand new and
got a rather large bowl dropped on it from a shelf above. The owner is
living out of an RV. He went out and bought another one to get by.
I knew it would need a new keypad as a couple of the keys got damaged in
the crash. It had a lighted keyboard, and the only thing it would do
when the power button was pushed was blink the lights on the keyboard.
I had to take it apart to do that replacement, so I figured I'd take a
look inside and go from there.

Once I got a good look at the motherboard, a very interesting problem
was evident. It had a square metal heat sink mount with 4 tabs that the
copper portion over the CPU attached to. The part appeared to me to be
put in place wrong. It had a thin side on the left, and a wider side on
the right. There was visible outlines on the board showing it's
location, and on the left the line was farther than the actual metal,
and on the right it was not visible. It looked like it was 180* wrong.
What was amazing was that this was the exact spot where this bowl hit
the keyboard. There was a couple rows of very small circuits soldered
underneath the mounting bracket. It must have been just high enough off
these electronics when new that it worked. But somehow this bowl found
the one place that would really harm the board and there it hit, pushing
the metal onto the circuits and shorting out things on the board. At
least that's what I figured happened.

Ordered a new board, and sure enough, the new one was the opposite and
all the circuits on the right side were visible. I took a picture of
the two side by side. Hard to believe it came from the factory like
that. Put it back together and got disk noise as well as lights, but
still no boot. It had 2-4 Gig sticks of ram, and trying them one by one
showed that one of those too was now junk. It would boot with the bad
ram removed, but was too damn slow to do much with.

Talked him into getting 16 Gig, the limit for the machine, since it was
only a little bit more. Once the ram showed up I got it all running and
told him I would do the updates since I had wired ethernet and he was
going to have a bunch of updates. I warned him about the possibility of
MS not liking the new hardware, and figured worse case he might have to
buy an operating system again. BTW, it was running windows 10.

I hadn't noticed when I was working on it, but it actually had no wired
ethernet port. All it had was wireless. But it was good wi-fi and
pretty fast. Once I got all the updates done and removed lots of crap
he didn't need, I gave it back to him. He was quite pleased as it only
cost about $110 for all the parts. He likes it better than the one he
bought after he broke it and says it is much faster. 16 Gig and an I7
processor.

Hopefully, he does not run into activation problems at all since it was
the same board and processor. I'm sure I'll hear about it if he does.

On 9/21/2022 1:57 PM, DanS wrote:
> sticks <wolverine.01@charter.net> wrote in
> news:tge38g$1o9hr$1@dont-email.me:
>
>> On 9/20/2022 10:44 PM, Auric__ wrote:
>>
>>>
>>> Activation is based in part on hardware. If you install on
>>> one machine then clone the drive and move it to another
>>> machine, unless it's largely identical to the source
>>> machine, Windows will (probably) detect that it's been
>>> moved to another machine and will de-activate itself. This
>>> can also happen if you change a lot of hardware on a
>>> machine (no cloning required).
>>
>> I recently fixed a toshiba laptop for someone and it
>> required a new motherboard and CPU. I was expecting
>> problems, but it doesn't seem to mind.
>
> Same motherboard model, and same (embedded) CPU, right?

Yep. Just had to move over the wi-fi card and remove the button style
RTC battery. His didn't have that, but a long wire I couldn't see where
it ended up, so I just hooked that back up.

Paul <nospam@needed.invalid> wrote in news:tge19q$1o66k$1@dont-email.me:

> On 9/20/2022 11:15 PM, Boris wrote:
>> I have a Windows 7 hard drive that was cloned from an other W7 hard
>> drive. The original hard drive activated just fine. The cloned drive
>> says activated, and slmgr /dlv shows Status:Licensed, but this cloned
>> drive, when booted from, keeps popping up a Windows message saying that
>> this is not a genuine OS version.
>>
>> I tried to correct using WSUS, but no luck. That's fine. I don't need
>> to 'legitimize' this hard drive/OS.
>>
>> Anyway, it got me to thinking does a Windows OS goes out to Microsoft
>> each time it's loaded, or once in s a while after it's been loaded.
>> Or, is the "I am legitimate" monikor, or the "I am not legitimate"
>> monikor, kept on the hard drive, once established.
>>
>> I think it's kept on the hard drive once established. Here's why I
>> think that.
>>
>> I booted my machine from the hard drive that keeps popping up the 'this
>> is not a genuine Windows version', but I wasn't connected to the
>> internet. After a minute or so, the same 'not genuine' message popped
>> up.
>>
>> Does this mean that the message is recorded on the hard drive, and that
>> the Windows OS doesn't need to go out to the internet (Microsoft) to
>> verify, once initially verified?
>>
>> I imagine the same holds for Win7, Win10, and Win11?
>>
>
> Actually, it doesn't, but let's concentrate on the problem. (W10 and W11
> are server-side licensed, and the mechanics are likely to be different.
> You can probably tip over W10 or W11, by changing the motherboard and
> its NIC identifier.)
>
> https://www.computerworld.com/article/2546248/update--windows-genuine-adv
> antage---what-it-is--how-to-ditch-it.html
>
> "For example, in my tests I was able to make the WGA "counterfeit"
> warning
> appear by changing the date of the system clock one month later.
> The Web-based WGA program was able to determine that was the
> problem and it suggested I reset the system date. When I did that,
> the WGA warnings disappeared. While most WGA detections don't
> resolve that easily, it can't hurt you to learn as much as you can
> about why WGA believes your copy Windows is illegitimate."
>
> slmgr /dlv tells you your product is licensed, but WGA thinks otherwise.

Yep.

>
> Another reason WGA may create a false positive, is if it cannot
> contact a specific Microsoft server. I don't know the details of
> this. Perhaps Winston knows whether the server is turned off or
> is running.
>
> Paul
>
>

Again, I'm not connected to the internet, but still getting WGA
Notification nag.

Thanks for the article. I was taken by how much the author believed that
legitimate installs can still get nagged. Nonetheless, I followed
suggestions on how to stop the nag, but my registry didn't contain the
subkey Notify, and a search on Windows>System32 didn't show any WGA files.
By the way, neither did the 'working' hard drive, which was the source of
the cloned hard drive that is the subject of this post.

(I'm going to look at my XP SP1 machine, and see if it follows the
article. It's running fine, no problem, though.)

I happened to bump into this:

https://www.youtube.com/watch?v=Dycy8TTa6QE

I followed the first stage of eliminating the nag, but going to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
\Notify

and deleted the Notify folder. I rebooted, and tried to do the second
stage of this video, delete the file WgaTray.exe, but that file didn't
exist.

I've rebooted many times, and I still haven't gotten the nag screen since
deleting the Notify folder.

This is a case of fixing a problem, but not solving it.

On 9/21/2022 10:00 PM, Boris wrote:
> Paul <nospam@needed.invalid> wrote in news:tge19q$1o66k$1@dont-email.me:
>
>> On 9/20/2022 11:15 PM, Boris wrote:
>>> I have a Windows 7 hard drive that was cloned from an other W7 hard
>>> drive. The original hard drive activated just fine. The cloned drive
>>> says activated, and slmgr /dlv shows Status:Licensed, but this cloned
>>> drive, when booted from, keeps popping up a Windows message saying that
>>> this is not a genuine OS version.
>>>
>>> I tried to correct using WSUS, but no luck. That's fine. I don't need
>>> to 'legitimize' this hard drive/OS.
>>>
>>> Anyway, it got me to thinking does a Windows OS goes out to Microsoft
>>> each time it's loaded, or once in s a while after it's been loaded.
>>> Or, is the "I am legitimate" monikor, or the "I am not legitimate"
>>> monikor, kept on the hard drive, once established.
>>>
>>> I think it's kept on the hard drive once established. Here's why I
>>> think that.
>>>
>>> I booted my machine from the hard drive that keeps popping up the 'this
>>> is not a genuine Windows version', but I wasn't connected to the
>>> internet. After a minute or so, the same 'not genuine' message popped
>>> up.
>>>
>>> Does this mean that the message is recorded on the hard drive, and that
>>> the Windows OS doesn't need to go out to the internet (Microsoft) to
>>> verify, once initially verified?
>>>
>>> I imagine the same holds for Win7, Win10, and Win11?
>>>
>>
>> Actually, it doesn't, but let's concentrate on the problem. (W10 and W11
>> are server-side licensed, and the mechanics are likely to be different.
>> You can probably tip over W10 or W11, by changing the motherboard and
>> its NIC identifier.)
>>
>> https://www.computerworld.com/article/2546248/update--windows-genuine-adv
>> antage---what-it-is--how-to-ditch-it.html
>>
>> "For example, in my tests I was able to make the WGA "counterfeit"
>> warning
>> appear by changing the date of the system clock one month later.
>> The Web-based WGA program was able to determine that was the
>> problem and it suggested I reset the system date. When I did that,
>> the WGA warnings disappeared. While most WGA detections don't
>> resolve that easily, it can't hurt you to learn as much as you can
>> about why WGA believes your copy Windows is illegitimate."
>>
>> slmgr /dlv tells you your product is licensed, but WGA thinks otherwise.
>
> Yep.
>
>>
>> Another reason WGA may create a false positive, is if it cannot
>> contact a specific Microsoft server. I don't know the details of
>> this. Perhaps Winston knows whether the server is turned off or
>> is running.
>>
>> Paul
>>
>>
>
> Again, I'm not connected to the internet, but still getting WGA
> Notification nag.
>
> Thanks for the article. I was taken by how much the author believed that
> legitimate installs can still get nagged. Nonetheless, I followed
> suggestions on how to stop the nag, but my registry didn't contain the
> subkey Notify, and a search on Windows>System32 didn't show any WGA files.
> By the way, neither did the 'working' hard drive, which was the source of
> the cloned hard drive that is the subject of this post.
>
> (I'm going to look at my XP SP1 machine, and see if it follows the
> article. It's running fine, no problem, though.)
>
> I happened to bump into this:
>
> https://www.youtube.com/watch?v=Dycy8TTa6QE
>
> I followed the first stage of eliminating the nag, but going to
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
> \Notify
>
> and deleted the Notify folder. I rebooted, and tried to do the second
> stage of this video, delete the file WgaTray.exe, but that file didn't
> exist.
>
> I've rebooted many times, and I still haven't gotten the nag screen since
> deleting the Notify folder.
>
> This is a case of fixing a problem, but not solving it.
>

It might be hiding in some other spot. C:\Windows\SysWOW64\WgaTray.exe

Use Agent Ransack, or whatever you use for file searches, and
see if it can find it.

It is possible to use permissions to prevent Agent Ransack or even
Everything.exe from finding stuff. NFI.exe is the next best thing
at a time like that.

nfi.exe is in here (3,772,278 byte ZIP). In the nfi folder. nfi.exe is 21,744 bytes.

https://web.archive.org/web/20070104083656if_/http://download.microsoft.com:80/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip

In an Administrator Command Prompt window, run something like:

cd /d C:\users\boris\Downloads\ # presumed location of unpacked nfi.exe

nfi.exe c: > nfi_c_out.txt

notepad nfi_c_out.txt

And then you can look for your wgatray.

NFI works by reading the Master File Table and not attempting to
traverse things with permissions. The Master File Table, or $MFT,
does not have precise file sizes in it, but it does have the
names of files to make our lives easier. At one time, the first
version of Everything.exe only read file names and it used the
$MFT. But the author of it, succumbed to the interest in knowing
file sizes, and this "blinded" the tool to a certain extent.

There are still a few things that NFI cannot see.

Just about every "file" utility in Windows, returns a different
number of files. The differences in the outputs can be striking,
and not just "a little off" ((like a hundred thousand files missing).
With NFI, maybe four things are missing, but how would we know
for sure ? One thing I'd like to know, is how the staff at Macrium
"know they got all the files" :-) I've never heard of any
reference-quality utilities for this sort of purpose.

Paul

On Wed, 21 Sep 2022 19:55:28 -0500, sticks <wolverine.01@charter.net>
wrote:

>The laptop was out of service for about a year. I don't know for sure,
>but I imagine he bought it at a Best Buy. It was almost brand new and
>got a rather large bowl dropped on it from a shelf above. The owner is
>living out of an RV.

Interesting. I think using a laptop instead of a desktop is a mistake
for almost everyone, but I recognize that there are some people for
whom it's necessary. I had never thought of someone living in an RV
before.

sticks <wolverine.01@charter.net> wrote in
news:tggc1e$1ujmp$2@dont-email.me:

>>> I recently fixed a toshiba laptop for someone and it
>>> required a new motherboard and CPU. I was expecting
>>> problems, but it doesn't seem to mind.
>>
>> Same motherboard model, and same (embedded) CPU, right?
>
> Yep. Just had to move over the wi-fi card and remove the
> button style RTC battery. His didn't have that, but a long
> wire I couldn't see where it ended up, so I just hooked
> that back up.
>

I've had the pleasure (?) of having to replace the MB of two Dell machines in the past, and
was lucky enough to find inexpensive Dell replacement MBs (from sources other than
Dell), and neither of them triggered re-activation.

(I'm talking, the 2nd one was probably 10 years ago, at least.)

On 9/22/2022 12:23 PM, DanS wrote:
> sticks <wolverine.01@charter.net> wrote in
> news:tggc1e$1ujmp$2@dont-email.me:
>
>>>> I recently fixed a toshiba laptop for someone and it
>>>> required a new motherboard and CPU. I was expecting
>>>> problems, but it doesn't seem to mind.
>>>
>>> Same motherboard model, and same (embedded) CPU, right?
>>
>> Yep. Just had to move over the wi-fi card and remove the
>> button style RTC battery. His didn't have that, but a long
>> wire I couldn't see where it ended up, so I just hooked
>> that back up.
>>
>
> I've had the pleasure (?) of having to replace the MB of two Dell machines in the past, and
> was lucky enough to find inexpensive Dell replacement MBs (from sources other than
> Dell), and neither of them triggered re-activation.
>
> (I'm talking, the 2nd one was probably 10 years ago, at least.)
>

Dell got hit during the Bad Cap era. That would be
a reason for some of the Dells needing work.

Paul

On 9/22/2022 9:12 AM, Ken Blake wrote:
> On Wed, 21 Sep 2022 19:55:28 -0500, sticks <wolverine.01@charter.net>
> wrote:
>
>> The laptop was out of service for about a year. I don't know for sure,
>> but I imagine he bought it at a Best Buy. It was almost brand new and
>> got a rather large bowl dropped on it from a shelf above. The owner is
>> living out of an RV.
>
>
> Interesting. I think using a laptop instead of a desktop is a mistake
> for almost everyone, but I recognize that there are some people for
> whom it's necessary. I had never thought of someone living in an RV
> before.
I agree completely! I've tried to explain the benefits of a desktop
over a laptop to many people, and ALL of them ended up getting the
laptop. Then they ask me to fix them. These are mostly retired people,
and others who are using them in their homes and have room for a
desktop. It's like a status symbol for them I guess.

I am now retired, and always had to have a laptop for work. I still
have the last one I bought, and it rarely ever gets used. I don't even
take it on vacation anymore, since almost everything I need to do can be
done over the phone.

As far as my friend living out of the RV, I think he and his wife have
had about enough of that. They've been at it for a year now and will be
looking for a house this winter somewhere warm. Trying to take care of
all their banking, legal stuff, and everything else you do with a
computer is a real hassle in camping grounds. He got one of those wi-fi
hotspots, but has data limits, and that gets old too. When he visits
and I'm sitting out in the garage at my workbench with a nice desktop
system he gets a little envious.

Little does he know how many times I've wished I was in HIS shoes,
traveling anywhere I wanted, away from all the demands that get placed
on you when you have roots in the ground. Well, at least I have a
working laptop. 8-)