Clean OEM Windows installation

Windows

cs CZE

If you bought a new computer or laptop with a pre-installed OEM Windows version, the standard way to (re)install the system is to use the Recovery partition, or the recovery media disks. However, there are cases, where someone might want to perform a clean system installation, for example:

  • you do not want the software pre-installed in the recovery installation
  • your drive failed and needed to be replaced, so you do not have the recovery installation any more
  • you want to install a different language version of the system (which is possible for Windows Vista, Windows 7 and Windows 8, as long as you use the same version and edition, like Home, Pro, Enterprise, Ultimate)
  • you want a different partition alignment than the default one (e.g. one partition for the system and another for the data instead of the default single partition covering the entire drive)
  • you want to prepare a customized version for the organization with Volume Licensing and still use the OEM licences for the computers bought with them
  • etc.

But there are also disadvantages of the clean installation, for example you will need to search and manually install drivers and/or other support software. It is also known that some manufacturers refuse a warranty claim, if the computer system has been reinstalled from any other source than the recovery partition.

Note that in case of specific hardware (e.g. RAID configuration of the disk controller) you might need to perform some non-trivial steps to be actually able to do the clean installation of Windows (which might not be necessary when installing from the recovery partition, as those usually contain all the required drivers). This is not covered by the article.

Disclaimer

The steps described below are legal, as long as you own a valid OEM licence and install it on the same computer or laptop bought with that OEM licence, instead of the standard installation from the recovery partition. Those steps will only work on a computer with a valid OEM licence to activate the clean system, and will not work for illegal installations without a valid licence. The options to activate an illegal Windows installation will not be discussed here, because I do not support software piracy.

Windows OEM licence keys

Computers, which are built by large manufactures that come with pre-Installed Windows system, come with two different Product Keys:

  1. OEM SLP: This key comes pre-installed in Windows, when it comes from the factory. This key is geared to work with the special instructions found only on that manufacturer’s computer hardware. So when Windows was installed using the OEM SLP key (at the factory) Windows 7 looks at the motherboard and sees the special instructions and self-activates. (that’s why you do not need to activate the Windows after re-installing from the recovery partition)
  2. COA SLP: This is the product key that you see on the sticker on the side (or bottom,[ or inside the battery compartment]) of your computer. It is a valid product key, but should normally only be used in limited situations (such as if the OEM SLP key stops self-activating for whatever reason). The key must be activated by phone.

That means: After you install the system from the recovery partition, it is installed and activated with the first key (OEM SLP). You can extract that key with some tools, like Magic Jelly Bean Keyfinder, however you cannot use this key to do a clean installation of the Windows and activate it (without a special procedure, which is described below).

On the other side, you can use the COA SLP key to do that.

Options to do the clean installation with the OEM licence

As the above suggests, there are principally two options how to (legally) install the clean Windows with your valid OEM licence:

1. Using the COA (Certificate Of Authenticity) SLP key

With that method, you just install the same version of Windows (like the pre-installed version is) with the product key from the COA sticker on the computer (which is, again, a different one than you would get if you extracted the product key from the recovery installation!).

This method is relatively straightforward, so it should be preferred whenever possible. You basically install the system the same way as a regular retail version of the Windows by providing the COA product key during the installation. However, the difference is, that you will not be able to activate the system over the internet – the internet activation will usually not pass for the installation with the COA SLP product key (that is not true for OEM licences bought as a separate option, but it is the usual case with the OEM pre-installed recovery installations).

You will always need to activate the installation over the phone. But you will normally not need to speak with anybody, just to provide some numbers to the automated system and get some other numbers back to insert to the activation form.

Unfortunately, sometimes this option is no longer available. With some new computers shipped with pre-installed Windows 8 (or even Windows 7 as a downgrade option), there is no COA product key on the COA sticker, so you’ll not have the COA product key in such case.

2. Using the OEM SLP certificate

That is the option which will be discussed further in the detail. Principally, you will:

a) extract the OEM manufacturer certificate and key from the current recovery installation
b) insert it into the new clean installation to “turn” it into an OEM installation and activate it

Using that option, the clean new installed system will be pre-activated the same way as the installation from the recovery partition, so you will not need to activate the system over the internet.

Note again, that this is legal, as long as you have the valid OEM installation shipped with your computer (and you replace the recovery installation by the clean one). You will still only have a single OEM installation on the computer. This cannot be used to install the system to another computer, because the certificate and pre-activation would not work there – it is only working together with the licence information stored in the motherboard (BIOS) of the original computer. (see below for the detailed explanation)

Obtaining the installation media

To do the clean installation of Windows, you will of course need to have the unmodified installation media of the same version of Windows like the OEM recovery version (Vista/7/8, Home/Professional/Ultimate/etc.). Contrary to Windows XP, there is no difference between OEM and Retail installation media for Vista/7/8, so you can use the Retail (FPP) media and install and activate it with the aforementioned COA SLP key, or with the OEM installation procedure.

There are some options to obtain the installation media legally on the internet, e.g. under MSDN subscription, or from Digital River.
(if you obtained the unmodified installation media from any other sources in the internet, it is highly recommended to refer to the mentioned MSDN subscription source and check the SHA checksum of the ISO image, if they are the same – it is strongly discouraged to use any dubious sources, where the installation media might be tampered by viruses, malware etc.)

Backup the existing system recovery

In any case, it is strongly encouraged to backup the existing recovery partition – the manufacturers usually provide some tool to burn the recovery media (DVDs), which will allow you to restore the original state of the computer or laptop (including restoring of the recovery partition). This is always encouraged even if you are not going to reinstall the system by a clean installation and/or remove the recovery partition to use its space by your data.

You’ll usually need around 5 empty DVD media.

Retrieve the OEM SLP key and the manufacturers certificate from the current recovery installation

Before cleaning the system installed from the recovery partition and starting the new clean installation, it is needed to retrieve the OEM SLP product key and the manufacturers certificate from it.

It is not the only option, but it is the easiest one (the certificate can be usually also found on the recovery partition, and the OEM SLP product keys are generic keys, i.e. each pre-installed system of the same version from the same manufacturer has the same OEM SLP product key, so they can be also found listed on the internet – they are useless without the certificate and the SLP licensing information in the BIOS).

Unfortunately the manufacturers certificate is not stored standalone anywhere in the Windows installation, but it is in the token.dat database (normally under "C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtection\Platformtoken.dat").

The easiest option to export the certificate is to use the SLIC Toolkit. After starting the executable, navigate to the “Advanced” tab. Then press the “Backup” button to store the certificate:

SLIC Toolkit - Backup

The program will ask for location to store the OEM SLP product key ("ProductId.txt") and the exported manufacturers certificate ("*.xrm-ms" file). Once the export is complete, you should see the confirmation screen:

SLIC Toolkit - Finished

If the SLIC Toolkit does not work for you (this might be the case under Windows 8, as it uses newer SLP version), you’ll need to look for the certificate manually on the recovery partition (look for "*.xrm-ms" file) or extract it from the tokens.dat file in hexadecimal editor (that is more advanced option not discussed here).

After you have the OEM SLP product key and the certificate, store it somewhere else than the computer you are about to re-install (especially if you will clean the entire drive and create new partitions).

This was the hardest part, now you can install the new clean system.

Installation of the clean system

The clean system installation should now be performed as usual, you can remove the original partition and also the recovery partition (but make sure you created the recovery DVD media before, so that you will be able to revert the computer back to the factory settings at any time).

You can either use the OEM SLP key to pass the installation screens or to skip entering the product key during the installation.

Before performing the next step (import of the OEM certificate), it is recommended to at least install the network or Wi-Fi card driver and connect to the internet (it is possible that the activation will fail without the internet connection).

Importing the OEM SLP certificate and the product key into the new clean installation

After the clean installation is done, prepare the certificate and the product key number. Then, open the Windows command line with administrator privileges.

First import the OEM manufacturers certificate into the installation:

slmgr -ilc C:\Lenovo.xrm-ms

(use the correct path and name of the certificate)

Then (re)insert the product key:

slmgr -ipk xxxx-xxxx-xxxx-xxxx-xxxx

(use the product key you exported in the previous step)

Restart the computer afterwards and check Properties of This Computer, to see if the Windows has been correctly activated.

You might also use those commands to check the status of the activation:

slmgr -xpr
slmgr -dlv

The "-xpr" parameter should display the expiration information, the "-dlv" parameter displays the detailed license information.

Detailed explanation of SLP

The Windows system pre-installed by the large manufacturers usually uses SLP (System Locked Pre-installation) to auto-activate the Windows installed by the manufacturer or re-installed from the recovery partition.

It works as a combination of OEM SLP product key (used to install the system), the OEM manufacturers certificate (used to decrypt the SLP table in the BIOS) and the SLP BIOS table itself. That means, the SLP table holding the actual licensing information must be present in the computers motherboard BIOS, so that the Windows boot loader can check it there. If the SLP table is not present in the BIOS (i.e. if you try to install the system on a different computer), the system will not activate (and it will actually not be possible to activate it at all). For the system to be able to read and decrypt the SLP licensing information from the BIOS, the specific manufacturers OEM certificate needs to be imported into the Windows installation – this is already done for the pre-installed system from the recovery partition, but the certificate is not present in the system if a clean installation is made (in particular, that is because each manufacturer has its own different certificate).

Advertisements

One thought on “Clean OEM Windows installation

  1. An excellent guide! Not entirely sure why this process is not more well-known. Is there a process to manually read the Platformtoken.dat file without needing the (frankly sketchy) SLIC_ToolKit ?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s