| Previous | Next |
| SL_E_TKA_GRANT_NOT_FOUND | SL_E_TKA_INVALID_SKU_ID |
SL_E_TKA_CERT_NOT_FOUND
What Windows has already determined
SL_E_TKA_CERT_NOT_FOUND identifies a specific point in token-based activation: certificate-backed token activation for approved volume-licensing scenarios in isolated or high-security environments. Its diagnostic consequence is that no certificate matching the token-activation lookup could be found in the stores visible to the licensing process.
The stored HRESULT is 0xC004F305. Keep that value, the symbolic name, and the target Activation ID together; converting it to a generic “Windows is not activated” status discards the stage that selected the next diagnostic step.
Data that identifies the actual cause
The decisive record is to record requested thumbprint/criteria, machine and user certificate stores, service account context, smart-card presence, and private-key availability. Before changing the system for this HRESULT, add the following context:
- Product identity for this HRESULT: challenge/grant correlation and relevant licensing event IDs.
- Activation context for this HRESULT: target Activation ID and SKU.
- State at failure for this HRESULT: installed token issuance license identity.
- Correlation evidence for this HRESULT: certificate thumbprint, subject, issuer and validity interval.
- Change history for this HRESULT: private-key provider and exportability flag.
When investigating this result, protect secrets while collecting evidence. Full product keys, complete IID/CID values, private keys, PINs, challenge blobs, account credentials, and unredacted certificate material for this HRESULT do not belong in public tickets. Partial keys, hashes, thumbprints, IDs, timestamps, and state transitions are normally enough to correlate the failure.
Work from state to cause
- Identify whether this result came from key installation, activation, renewal, validation, certificate selection, offline deposit, or status query.
- tie that call to token issuance license, challenge, grant, certificate chain, private key, thumbprint, TPID, smart card and target SKU.
- capture the proof needed for this specific result: record requested thumbprint/criteria, machine and user certificate stores, service account context, smart-card presence, and private-key availability.
- use the related-code comparison below to avoid correcting the wrong layer.
- retest with a fresh operation generation and confirm that no parallel retry or stale response can overwrite the result.
Keep the mechanism’s contract in view: for this HRESULT: Certificate discovery, chain validation, challenge matching, grant parsing, and policy matching are distinct stages, so a generic certificate reinstall can conceal the failing boundary. In addition, the second rule for this HRESULT is: for this HRESULT: Token-based activation is a specialized volume activation method; the issuance license describes certificate criteria and is not interchangeable with a KMS host key or MAK.
This result is actionable because absence differs from finding a certificate whose chain or policy is invalid. Automation handling it should route the result to the owner of that layer rather than starting every recovery path at once.
Actions that usually make this harder to diagnose
- While diagnosing this result, avoid switching to a weaker certificate merely to bypass issuance-license criteria. That action changes evidence for this HRESULT without correcting the established boundary.
- avoid exporting or replacing private keys before preserving certificate and provider evidence. The result already narrows the problem more precisely.
- do not delete licensing stores, edit signed license files, alter firmware markers, bypass certificate checks, or use unofficial activation tools. During investigation, those actions can create a second integrity problem and destroy the evidence needed to repair the legitimate license.
Do not collapse these related states
| Result | Different boundary |
|---|---|
SL_E_TKA_GRANT_NOT_FOUND | Relative to it: the token issuance material does not contain the grant required for the target activation operation. |
SL_E_TKA_INVALID_SKU_ID | Relative to it: the target Windows edition or Activation ID is not enabled for token-based activation. |
SL_E_TKA_INVALID_BLOB | Relative to it: the token activation data blob cannot be parsed or validated as the required challenge/grant structure. |
Choosing remediation by the symbolic code prevents an entitlement problem from being treated as transport failure, or a state-transition result from being treated as a bad product key.
What a safe fix looks like
Recovery should preserve entitlement and state rather than erase symptoms. In this case, install the intended certificate in the correct store or make the smart card/provider available to the activation context; then query the same product instance and retain the post-fix it HRESULT and status.
Representative failure: The issuance license references a certificate that was renewed and removed from the machine store.
Verification after the change
Build a regression case that intentionally creates “no certificate matching the token-activation lookup could be found in the stores visible to the licensing process” and asserts it. The corrected the case should change only the decisive input, then verify the same Activation ID, final LicenseStatus/Reason, and any relevant grace, renewal, certificate, binding, or expiry data.
Technical references
- Plan for volume activation — diagnostic and operational context for this HRESULT.
- Slmgr.vbs token-activation options — supported tools and state fields used to verify it.
- Microsoft token-activation event guidance — Microsoft guidance for the activation mechanism represented by it.
- SoftwareLicensingProduct WMI class — platform behavior relevant to it.
Looking for a different code? Search another status or error code.