Microsoft has confirmed that this month's security updates break part of the Windows licensing stack. Commands that activate Windows, set up Key Management Service or manage product keys now fail with error 0x80041008, invalid parameter, on Windows 10, Windows 11 23H2 and Windows Server 2019, 2022 and 2025.
What happened
The known issue was published on Wednesday as service alert WI1549486. It hits two commands in the Software Licensing Management Tool: slmgr.vbs /skms-domain, which points a client at the KMS server, and slmgr.vbs /ipk, which installs a product key. Microsoft says the error appears when you activate Windows, configure KMS or manage keys - precisely the steps a deployment script, a bulk licence job or an imaging pipeline runs without anyone watching.
The updates involved are KB5131096 for Windows 10 21H2 and 22H2, KB5131087 for Windows 11 23H2, KB5131085 for Windows Server 2019, KB5131090 for Windows Server 2022 and KB5131080 for Windows Server 2025. Windows 11 24H2, 25H2 and 26H2 are not on the list.
Devices already activated stay activated - KMS activation holds for up to 180 days - and images that already carry the KMS client key are unaffected as long as nobody runs those two commands. Citrix has documented the knock-on effect: Machine Creation Services image preparation fails its rearm step with the same error, and machines cloned from an image that never rearmed share a single KMS client machine ID, so a whole catalog can miss the activation threshold. Microsoft says a fix is days away and points organisations that cannot wait at business support.
Who is affected
Organisations that automate activation or licensing instead of deploying a pre-keyed image.
- Windows Server 2019, 2022 and 2025 fleets carrying the 10 November updates.
- Windows 10 21H2/22H2 and Windows 11 23H2 endpoints that are built or re-keyed by script.
- VDI and imaging pipelines, including Citrix MCS and any task sequence that rearms or re-keys during deployment.
- Estates running slmgr in post-install scripts or bulk MAK jobs.
What to do now
Pause scripted activation and image rearm jobs until the fix lands, and confirm that existing KMS clients still show as activated.
- Check the build of anything you plan to deploy this month against the list above before you run a task sequence.
- Test one machine with slmgr.vbs /dlv to confirm the licence state instead of assuming the script worked.
- Keep using the pre-November master image for catalog updates until Microsoft ships the fix and you have tested rearm on it.
- Do not remove the November security updates to dodge this; the same updates close actively exploited flaws.
- Log a case with Microsoft business support if a deployment is blocked and you cannot wait for the fix.
What this means for South African businesses
Most SMEs here do not touch KMS, but their provider does, and a silent failure in a deployment script shows up as a licence warning thirty days later on machines that were already handed to staff. The bigger exposure is the imaging route: a cloned image that never rearmed can put a whole batch of new laptops on one activation count. My judgement is that the risk is not lost licences but lost visibility - the script returns an error nobody reads, and the estate drifts unlicensed until an audit finds it, so this is worth one deliberate check rather than a rebuild.
Source: BleepingComputer.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.