When SL_E_LUA_ACCESSDENIED returns 0xC004F025, diagnosis has reached the local Software Protection Platform. The decisive condition is: the operation requires an elevated administrator token and the caller is not authorized.
Windows reports “The Software Licensing Service reported that the action requires administrator privilege”.
Position
Stage
Role
Product instance
Application ID and Activation ID identify the exact licensed object.
License inputs
Packages, dependencies, signatures and policies feeding this result are loaded for that object.
Requested transition
Record the exact licensing operation that returned this HRESULT.
Commit or status
Do not infer the intended licensing state from outputs produced by the failed operation.
What the constant itself tells you
The code comes from Software Protection Platform; correlate it with one product object rather than the computer as a whole.
Use the exact HRESULT and first failing operation before attempting a broad activation reset.
Its HRESULT severity is failure; later status messages can describe only the resulting state.
The exact first caller and object identity are needed to distinguish a producer error from cleanup noise.
Data that proves the condition
Evidence
Question answered
Application ID, Activation ID and product name
Which Application ID and Activation ID returned the code?
LicenseStatus, LicenseStatusReason and grace values
Was the failure during package load, policy evaluation, authorization or service maintenance?
first API/slmgr method and earliest Security-SPP event
Is the named object absent, invalid, mismatched, duplicated or in the wrong lifecycle state?
caller identity and elevation
Can whether a clean reboot reproduces the result without modifying state be captured before changing state?
whether a clean reboot reproduces the result without modifying state
Does the evidence support “rerun the supported tool elevated and retain the same product/Activation ID” rather than server-side denial after an elevated request is accepted?
A controlled investigation
Before remediation, confirm that the failure is not instead the neighboring condition: server-side denial after an elevated request is accepted.
Record 0xC004F025, UTC time, caller and the first method or server request that returned it.
Capture whether a clean reboot reproduces the result without modifying state.
Windows product licensing state is inconsistent with the operation being requested
SL_E_PROXY_KEY_NOT_FOUND
a required proxy or indirection key cannot be resolved in local licensing policy data
SL_E_LICENSE_DECRYPTION_FAILED
the service found the license but could not decrypt its protected payload
A focused reproduction for this exact result
Control
Design
Failing fixture
A standard-user process attempts to install a key or license package.
Single variable
Change only the narrow input or state named by the HRESULT while product identity remains fixed.
Positive control
A known-good value for that condition succeeds and the failing fixture still reproduces the code.
Different result
If the experiment instead proves “Windows product licensing state is inconsistent with the operation being requested”, diagnose that condition separately rather than treating it as this HRESULT.
Correction and regression check
A supported correction is to rerun the supported tool elevated and retain the same product/Activation ID.
Changes that make this code harder to diagnose
Avoid using rearm or key replacement as a universal package/policy repair.
Avoid copying license packages or protected stores from another computer.
Avoid force-deleting policy, plug-in or license files while sppsvc owns them.