Using Intune remediation – check the windows license activation is subscription or KMS based

Microsoft offers Windows Enterprise E3 and E5 subscriptions as part of Microsoft 365, providing additional enterprise-level capabilities beyond the standard Windows 10 Pro edition.

This activation method eliminates the need for traditional Key Management Service (KMS) activation and offers more flexibility in licensing management.

For more information about windows subscription activation and how it works, please refer https://learn.microsoft.com/en-us/windows/deployment/windows-10-subscription-activation

Devices activated through a subscription show the activation state as 'Windows is activated with a digital license' and display the active Windows enterprise subscription.

Activation of the windows 10 or windows 11 using the subscription is straight forward as long as the network endpoints and the users are assigned with subscription license.

How do we find out the devices that are activated with subscription?

There are no built-in or custom reports that can help you to track with list of devices that are activated using subscription model.

In this blog post, we will see how to use Remediations feature in Intune to check if the windows 10 or windows 11 is activated using digital/subscription or KMS/other methods.

Remediations are basically Powershell scripts that detect and fix something for you automatically. In Configuration Manager world, it is configuration Items and baselines.

For more information about the remediations in intune and sample scripts refer https://learn.microsoft.com/en-us/mem/intune/fundamentals/powershell-scripts-remediation

Microsoft has recently renamed Proactive Remediations is to Remediations and is available from Devices > Remediations blade.

Now lets dive into the subject the blog post.

To identify devices activated with digital (E3 or E5) subscriptions, we will examine the Software Licensing Product information stored in the WMI provider with the softwarelicensingproduct class located in the 'root\cimv2' namespace.

For digital subscription activation, the last five characters of the PartialProductKey will be '3V66T'.

Based on this information, we can build a Powershell script to detect and report the status.

The following is the basic flow of the script.

Although, there is no remediation script involved in this  but we will simply use the use the detection script in the remediation as well that does nothing.

Download the DigitalActivation.zip from Github

Steps how to implement it?

Go to intune, devices, remediation, Create script package

Assign to Group of devices with onetime schedule or recurring as per your requirement.

End results:

add a column ‘Pre-remediation detection output’ to see the status

You can now export the data to CSV and find out the devices that are subscription based or KMS based.