Over 36% of software in the world is pirated. Out of this, over 50% is due to what Microsoft calls "casual copying". We all know what this is and in some insignificant way, at one time or another most users have participated in it.  It has nothing to do with "cracking" software or disk cloning. It is simply the act of installing the same piece of software from its installation disks on more computers than your EULA allows. This could be something like loaning it to a friend or even just installing the same software on two computers in your home or office.

In order to combat this prevalent occurrence, Microsoft introduced a technology they call Product Activation into their Office XP software earlier this year.  The product would allow users to launch it up to 50 times before requiring an activation code to be sent to Microsoft over the Internet (Users could activate at anytime before that as well). Now the latest version of their flagship consumer OS, Windows XP, includes similar functionality.

Despite what some of Microsoft's competitors and the news media would have you believe, the only people who really need to worry about Product Activation are those involved in illicit use of their software.  Many people have been convinced that this technology will create a hassle for users or even worse, violate consumer's right privacy! I can assure you, with the utmost certainty, that not only is Product Activation benign, but it is easy to use and does its job without sending any personal information to Microsoft.

Most OEM computers will be activated in the factory before they are shipped and as long as you don't change your motherboard to a different manufacturer's, you will not be required to re activate you software. Further, customers who participate in the Microsoft Open License program by purchasing at least 5 software licenses will not be required to activate their software at all! For those of us with less than five computers activation is a simple and painless process.  After installing the OS, each time Windows XP boots the user will be prompted to activate the software. If after 30 days of use the software has not been activated, it will be disable until the activation process is completed.

Upon choosing to activate, XP asks the user if the would like to activate over the Internet or by calling a customer service agent via a toll free number. Customers who choose to use the activation hotline will be given their hash code (more on that in a minute) to provide to the operator. After the hash code and product ID are provided, an activation code is relayed to the user to input.  Waiting on hold aside, this only takes about five minutes and to their credit, hold times are reasonably short. The most convenient way to activate is, of course, via the Internet.

In this automatic process the Product Activation software uses a complex, non-reversible algorithm to generate 50-digit code from a combination of your computer's hardware property. I would like to emphasize that it is mathematically possible to create such an algorithm and there is in fact no way for Microsoft, or anyone else for that matter, to determine the configuration of your computer from this hash code. After this code is generated, the user is prompted to enter the Product ID code from their software package, which is then sent with the hash code to Microsoft in a request for an activation code. Barring any conflicts with this information and Microsoft's database, the user is unmolested by and generally unaware of this process. If there is a problem, users are simply prompted to call the 800 number and speak with a customer service representative.

To help prevent another form of piracy called drive cloning, Windows XP checks its hardware hash against its original value each time the computer is booted. This is the feature of product activation that has most people frazzled, confused and angry. In order to speak on this subject one must first understand what items of computer hardware are used to make up the hash and what level of significance (weighting) they are given when determining if the hash code has changed.

This code is made up of up to 12 items if available. These are: the display adapter, SCSI card, IDE adapter, NIC MAC address, RAM range (0-64MB, 64-128MB, etcetera), processor type, processor serial number, hard drive, hard drive volume serial number, CD / CD-RW / DVD drive, dockable (yes/no), and the version of the hash algorithm itself. All of these items are weighted the same except for the network adapter, hard drive and whether or not it dockable.

The most disconcerting reason you would be forced to reactivate is a reformat of your hard drive. A lot of people, myself included, format their machines regularly to improve performance. The good news is that XP is not only extremely stable, but the system restore and driver rollback features ensure that you will be able to get to a known good configuration at any time, practically eliminating the need for the monthly format. At any rate, you are allowed to reactivate a total of 4 times per year, once every 90 days. In the event you need to reactivate more than that, you can always call customer support.

Aside from the all-important hard drive, the next most influential component of the hash is the network adapter MAC address. In a system where the network card is not changed, up to 6 changes may be made to the system. When you change the NIC, or it was never present, up to 4 changes may be made. This includes the network card, unfortunately. The good news is that adding new items to the system does not affect the hash, and changing the same type of component more than once still only counts as one change. These caveats assure me that the majority of people will never reactivate and those that do will probably not do it more than 4 times a year anyway.

The most confusing part of the hash check is the dockable flag. This obviously applies to laptops and allows dockable units to change 9 or 7 components based on the same network adapter changes above. So what's so confusing? Laptops are essentially static devices. Their internal components remain practically the same through the length of the device's life.  So for whatever reason they are more lenient on "dockable" computers.

I think the Product Activation is a good thing for Microsoft, consumers and the software industry in general.  Piracy is a real problem and consumers will benefit from knowing that their software is legal and genuine.  The minor inconvenience of entering your Product ID is well worth the security one has in knowing that the product they have installed is in fact the product they think it is.

Another benefit for consumers is the ability to let their friends try the software in their own homes without useless demo product that needs to be uninstalled when the full packaged product is purchased. All you have to do is install the software on your friend’s machine without giving them the Product ID.  If after the activation grace period is up and they haven’t activated it they will need to buy the software for themselves and you don’t have to worry about be considered a pirate or being a party to anything illegal.

Pirates beware. Windows XP pushes updates to users. It would be perfectly legal for them to release an update that checked the legality of the software installed on your system. As long as they didn’t send any personally identifiable information without proof of wrong doing there would be no violation of piracy and nothing for a legitimate user to worry about. I encourage everyone who has obtained Windows XP through non-retail sources and is suspicious about the legality of their product to got to My Computer, click Help and the click “Is this copy of Windows legal?” or call 1-800-LEGIT.

I would also like to stress that Product Activation is not the same as Product Registration. Although you must activate Windows XP there is no requirement to share any personal information with Microsoft.  For those who choose to register their software, be aware that your registration information is in no way linked to the Product ID that you activated.  Also, Microsoft does not share your personal information with third parties or contact you without your express permission. I will discuss Microsoft and its competitor’s policies on user privacy in greater detail next week when I drill into Microsoft Passport service and Windows Messenger.

Until then any comments about this article are welcome and appreciated.

Comment On This Story - Discuss in the Forums

Article Copyright © 2001 James K. Searles