| Previous | Next |
| SL_E_TKA_INVALID_THUMBPRINT | SL_E_TKA_CRITERIA_MISMATCH |
SL_E_TKA_THUMBPRINT_CERT_NOT_FOUND
The activation stage represented here
The actionable meaning of SL_E_TKA_THUMBPRINT_CERT_NOT_FOUND is tied to token-based activation. At certificate-backed token activation for approved volume-licensing scenarios in isolated or high-security environments, Windows determined that the supplied thumbprint is well formed but no visible certificate matches it.
The stored HRESULT is 0xC004F30E. Keep that value, the symbolic name, and the target Activation ID together; converting it to a generic “Windows is not activated” status discards the stage that selected the next diagnostic step.
Two platform rules are especially relevant to this result. Token-based activation is a specialized volume activation method; the issuance license describes certificate criteria and is not interchangeable with a KMS host key or MAK. Certificate discovery, chain validation, challenge matching, grant parsing, and policy matching are distinct stages, so a generic certificate reinstall can conceal the failing stage.
How to test the failing stage
- Preserve this result,
0xC004F30E, timestamp, caller, and the exact licensing method. - Read the current product state before making changes, including key channel, LicenseStatusReason, and relevant time or binding data.
- Test the documented condition directly: search machine/user stores under the activation account, compare normalized thumbprints, check renewal/replacement, and inspect smart-card insertion.
- Do not continue until the evidence supports this distinction: format validation succeeded; the referenced certificate is absent from the accessible stores.
- Perform the targeted action, then repeat the same query/activation path and compare state, events, and expiry/renewal information.
A useful diagnostic record
To verify this, search machine/user stores under the activation account, compare normalized thumbprints, check renewal/replacement, and inspect smart-card insertion. Before changing the system, add the following context:
- Product identity: challenge/grant correlation and relevant licensing event IDs.
- Activation context: target Activation ID and SKU.
- State at failure: installed token issuance license identity.
- Correlation evidence: certificate thumbprint, subject, issuer and validity interval.
- Change history: private-key provider and exportability flag.
Choose recovery by the producing stage
| Result | Different condition |
|---|---|
SL_E_TKA_CRITERIA_MISMATCH | Relative to this result: the candidate certificate fails one or more explicit criteria in the token issuance license. |
SL_E_TKA_INVALID_THUMBPRINT | Different condition: the certificate thumbprint supplied to token activation is syntactically invalid or uses an unacceptable representation. |
SL_E_TKA_FAILED_GRANT_PARSING | Different condition: the token issuance license contains a grant section that cannot be parsed into valid licensing rules. |
The diagnostic fork is precise: format validation succeeded; the referenced certificate is absent from the accessible stores. A broad instruction to “try another key” or “check the Internet” would discard the more specific condition already established by the code.
Recommended handling
Use the targeted fix: install or expose the exact certificate/private key, or update the configuration to its current thumbprint. Avoid simultaneous key changes, store resets, service restarts, and network changes because they make it impossible to identify which precondition mattered.
Representative failure: Certificate renewal changes the thumbprint but automation still references the retired certificate.
Actions that usually make this harder to diagnose
- Avoid exporting or replacing private keys before preserving certificate and provider evidence.
- Avoid switching to a weaker certificate merely to bypass issuance-license criteria.
Verification after the change
Verification should include a failing fixture for “the supplied thumbprint is well formed but no visible certificate matches it” and a passing fixture after the targeted fix. Reboot or restart only when the documented mechanism requires it, and confirm that the state persists afterward.
Technical references
- Plan for volume activation — supported tools and state fields used to verify the resulting state.
- Slmgr.vbs token-activation options — Microsoft guidance for the activation mechanism represented by this HRESULT.
- Microsoft token-activation event guidance — platform behavior relevant to this HRESULT.
- SoftwareLicensingProduct WMI class — diagnostic and operational context.
Looking for a different code? Search another status or error code.