How Windows XP Handled Online Product Activation

Windows Product Activation (WPA) in Windows XP was Microsoft's first consumer-facing anti-piracy system designed to tie a software license to a specific computer. When activated over the internet, the operating system generated a non-reversible hardware fingerprint combined with the software product key, transmitted this data securely to Microsoft's activation servers, and received a digitally signed license file in return. This process ensured the 25-character product key was valid and prevented casual copying by verifying the software was not running on more machines than the license permitted.

The Product Key and Installation ID

Activation began with the 25-character alphanumeric product key entered during installation. Windows XP verified this key locally using a mathematical algorithm to ensure it was syntactically valid and belonged to the correct edition (Home or Professional).

Once verified locally, the system generated an Installation ID (IID). The IID was a 50-digit number broken into six-digit groupings. It contained two primary components: the hashed product key details and a cryptographic hash representing the computer's physical hardware.

Generating the Hardware Hash

To tie the license to a specific machine without collecting personal data, Windows XP scanned ten hardware components:

  • Display adapter
  • SCSI controller
  • IDE controller
  • Network adapter (MAC address)
  • RAM amount
  • Processor type and serial number
  • Hard drive device and serial number
  • Optical drive (CD-ROM/DVD)
  • Sound card
  • BIOS version

Each component was converted into a one-way mathematical value. These values were combined into an 8-byte hardware hash. The algorithm gave extra weight to the network interface card (NIC); if a network card was present, it formed a core part of the identification. Because the process used a one-way cryptographic hash, Microsoft could not reconstruct the user's specific hardware specs from the resulting value.

Secure Server Communication

When the user selected internet activation, the activation wizard initiated an encrypted connection to Microsoft's clearinghouse servers over HTTPS (SSL).

The client system transmitted:

  • The generated Installation ID (the product key data plus the hardware hash).
  • Operating system version and language information.
  • A handshake request requesting a license certificate.

No personal data, user files, or hardware names were transmitted—only the hashed numeric identifiers.

Server Validation

Upon receiving the payload, Microsoft’s activation servers performed three checks:

  1. Key Validity: Verified the product key was an authentic retail or OEM key and had not been reported stolen or leaked.
  2. Key Blacklisting: Checked the key against a revocation list.
  3. Hardware History: The server checked its database to see if the key had been used previously. If the key was already registered, the server compared the incoming hardware hash to the existing record. If the hashes matched, activation succeeded immediately. If the hardware hash differed significantly, the server checked whether the allowable threshold for hardware upgrades or machine transfers had been exceeded.

Issuing the Confirmation Token

If the request passed server validation, Microsoft returned a digitally signed confirmation token. Windows XP wrote this activation status to a local file named wpa.dbl (alongside a backup, wpa.bak) stored in the System32 directory. This file contained the signed cryptographic license pairing the hardware state to the operating system.

Once written, the 30-day activation timer was permanently disabled, granting unrestricted access to the operating system. If hardware components were later changed substantially, Windows XP recalculated the hardware hash at boot, compared it to wpa.dbl, and prompted for reactivation if too many components no longer matched.