| Previous | Next |
| SL_E_TKA_GRANT_NOT_FOUND | SL_E_TKA_INVALID_SKU_ID |
SL_E_TKA_CERT_NOT_FOUND
What Windows has already determined
SL_E_TKA_CERT_NOT_FOUND identifies a specific point in token-based activation: certificate-backed token activation for approved volume-licensing scenarios in isolated or high-security environments. Its diagnostic consequence is that no certificate matching the token-activation lookup could be found in the stores visible to the licensing process.
The stored HRESULT is 0xC004F305. Keep that value, the symbolic name, and the target Activation ID together; converting it to a generic “Windows is not activated” status discards the stage that selected the next diagnostic step.
Data that identifies the actual cause
Record requested thumbprint/criteria, machine and user certificate stores, service account context, smart-card presence, and private-key availability. Before changing the system, add the following context:
- Product identity: challenge/grant correlation and relevant licensing event IDs.
- Activation context: target Activation ID and SKU.
- State at failure: installed token issuance license identity.
- Correlation evidence: certificate thumbprint, subject, issuer and validity interval.
- Change history: private-key provider and exportability flag.
Work from state to cause
- Identify whether this result came from key installation, activation, renewal, validation, certificate selection, offline deposit, or status query.
- Tie that call to token issuance license, challenge, grant, certificate chain, private key, thumbprint, TPID, smart card and target SKU.
- Capture the proof needed for this specific result: record requested thumbprint/criteria, machine and user certificate stores, service account context, smart-card presence, and private-key availability.
- Use the related-code comparison below to avoid correcting the wrong layer.
- Retest with a fresh operation instance and confirm that no parallel retry or stale response can overwrite the result.
Certificate discovery, chain validation, challenge matching, grant parsing, and policy matching are distinct stages, so a generic certificate reinstall can conceal the failing stage. Token-based activation is a specialized volume activation method; the issuance license describes certificate criteria and is not interchangeable with a KMS host key or MAK.
This result is actionable because absence differs from finding a certificate whose chain or policy is invalid.
Actions that usually make this harder to diagnose
- Avoid switching to a weaker certificate merely to bypass issuance-license criteria.
- Avoid exporting or replacing private keys before preserving certificate and provider evidence.
Do not collapse these related states
| Result | Different condition |
|---|---|
SL_E_TKA_GRANT_NOT_FOUND | Different condition: the token issuance material does not contain the grant required for the target activation operation. |
SL_E_TKA_INVALID_SKU_ID | Different condition: the target Windows edition or Activation ID is not enabled for token-based activation. |
SL_E_TKA_INVALID_BLOB | Different condition: the token activation data blob cannot be parsed or validated as the required challenge/grant structure. |
Choosing remediation by the symbolic code prevents an entitlement problem from being treated as transport failure, or a state-transition result from being treated as a bad product key.
What a safe fix looks like
Recovery should preserve entitlement and state rather than erase symptoms. In this case, install the intended certificate in the correct store or make the smart card/provider available to the activation context; then query the same product instance and retain the post-fix it HRESULT and status.
Representative failure: The issuance license references a certificate that was renewed and removed from the machine store.
Verification after the change
Build a regression case that intentionally creates “no certificate matching the token-activation lookup could be found in the stores visible to the licensing process” and asserts it. The corrected case should change only the relevant input, then verify the same Activation ID, final LicenseStatus/Reason, and any relevant grace, renewal, certificate, binding, or expiry data.
Technical references
- Plan for volume activation — diagnostic and operational context.
- Slmgr.vbs token-activation options — supported tools and state fields used to verify the resulting state.
- Microsoft token-activation event guidance — Microsoft guidance for the activation mechanism represented by this HRESULT.
- SoftwareLicensingProduct WMI class — platform behavior relevant to this HRESULT.
Looking for a different code? Search another status or error code.