Full Diagnostic Tree & Step-by-Step Overview
In what specific state or phase does the 0xC004C060 activation error appear?
- Error 0xC004C060 appears immediately after typing a product key into the Office activation wizard or Account settings.
- Error appears after reinstalling Office on a machine that previously had a different Office version (e.g., Home & Business vs ProPlus/M365).
- Office installs successfully, but opening any application displays 'Unlicensed Product' or 'This product key is no longer valid'.
- Activation fails over a corporate network or VPN using Volume Licensing (KMS / MAK) or Microsoft Entra ID (Azure AD).
What type of product key or licensing channel is being entered into the Office setup wizard?
- The key is a standalone Perpetual Retail / Home & Student / Professional key purchased from a third-party seller.
- The key is an Enterprise Multiple Activation Key (MAK) or Key Management Service (KMS) host key.
- The key was redeemed to a Microsoft Account, but logging in displays 0xC004C060 or 'No product found'.
- The error occurs when entering a key for an architecture mismatch (e.g., 32-bit key on 64-bit Click-to-Run installation).
Validating Perpetual Key Status and Replacing Blocked Digital Keys
Solution:
Root Cause: Microsoft Activation Server Product Key Revocation (Blocked MAK/Retail Key)
Error code 0xC004C060 explicitly translates in the Windows Software Licensing API to SL_E_KEY_REVOKED ("The activation server determined the specified key is blocked"). When purchasing standalone Office keys from unauthorized third-party resellers or grey-market marketplaces, these keys are frequently stolen Volume License Multiple Activation Keys (MAK) or OEM developer keys. Once Microsoft's telemetry detects that a key has exceeded its maximum allowed activation threshold or was resold in violation of the Licensing Terms, the activation servers permanently flag and revoke the Product Key ID (PKID).
# Diagnostic Verification:
Open Command Prompt as Administrator and navigate to the Office installation directory: cd "C:\Program Files\Microsoft Office\Office16" *(or C:\Program Files (x86)\Microsoft Office\Office16)*
Run the Office Software Protection Platform status script: cscript ospp.vbs /dstatus
Observe the output under ERROR CODE. If 0xC004C060 or SL_E_KEY_REVOKED is displayed next to the partial product key, the key is permanently blocked on Microsoft servers.# Step-by-Step Fix:
Verify Key Entitlement on Microsoft Account Dashboard:Open a web browser and navigate to your official Microsoft Account Subscriptions page.Sign in with the personal or business account associated with your purchase.Check if your Microsoft Office product edition (e.g., *Office Home & Business 2021* or *Office 2024*) is explicitly listed under Services & subscriptions.Redeem Genuine Key to Account (If using a new genuine key card):Go to setup.office.com, sign in, and enter your 25-character product key to bind it permanently to your Microsoft Account.Remove Revoked Key from Office Installation:Identify the last 5 characters of the revoked product key from the /dstatus output (e.g., WB123).Run administrative Command Prompt and execute: cscript ospp.vbs /unpkey:WB123
Re-activate Office via Account Sign-In:Launch Word or Excel, click File > Account > User Information > Sign In, and authenticate with the Microsoft Account containing the valid entitlement.# Prevention & Long-Term Monitoring:
Only purchase Office licenses directly from Microsoft or authorized retail partners to avoid grey-market MAK key revocation.
Re-arming KMS Client Licenses and Switching to Correct Volume Licensing Channel
Solution:
Root Cause: KMS/MAK License Channel Mismatch and Activation Threshold Exceeded
In enterprise environments, error 0xC004C060 occurs when a system attempts to activate an Office installation using a Multiple Activation Key (MAK) that has reached its configured activation limit, or when a generic Volume License key (GVLK) is used without a reachable Key Management Service (KMS) host. If an administrator attempts to apply a MAK key to an installation configured strictly for KMS (or vice versa), the Office Licensing Service throws error 0xC004C060.
# Diagnostic Verification:
Open Command Prompt as Administrator and run: cscript ospp.vbs /dstatus
Check the LICENSE DESCRIPTION line. If it indicates OFFICE16_KMSClient_2021 or VOLUME_PAK, but the key being entered is a MAK key, a channel mismatch exists.# Step-by-Step Fix:
Convert Office to Volume License GVLK (KMS Activation):If activating against an internal KMS host server, install the official Microsoft GVLK product key for your version (e.g., Office LTSC 2021 Pro Plus GVLK: FXYTK-NJJ8C-GB6YT-3BP37-67W82): cscript ospp.vbs /inpkey:FXYTK-NJJ8C-GB6YT-3BP37-67W82
Set Specific KMS Host IP/FQDN:Point the Office client to your internal KMS server: cscript ospp.vbs /sethst:kms.yourdomain.com
cscript ospp.vbs /setprt:1688
Execute Activation Request:Force immediate online/KMS activation: cscript ospp.vbs /act
Apply MAK Key Correctly (If using MAK instead of KMS):If activating via MAK, ensure the correct MAK key is applied: cscript ospp.vbs /inpkey:YOUR-VALID-MAK-KEY
cscript ospp.vbs /act
# Prevention & Long-Term Monitoring:
Use Volume Activation Management Tool (VAMT) to track MAK activation counts across enterprise networks before deploying images.
Clearing Cached Token Stores and Binding Account Digital Entitlements
Solution:
Root Cause: Entitlement Token Desynchronization in Microsoft Account Licensing
When Office is purchased or redeemed via a Microsoft Account, activation does not rely on a typed 25-character product key. Instead, the Microsoft Account Server issues a signed digital license token (XrML) to the client machine. If the local Office Software Protection Platform or Web Account Manager (WAM) caches a revoked key hash from a previous trial or expired installation, the client sends the old key hash to the server during authentication, resulting in error 0xC004C060.
# Diagnostic Verification:
Navigate to your Microsoft Account Subscriptions page.Confirm the product is visible under your account, yet typing your account email in Office fails to remove the activation prompt.# Step-by-Step Fix:
Sign Out of All Office Applications:Open Word, go to File > Account, and click Sign Out under all user profiles listed.Close all Office applications.Remove Stale Credentials in Windows Credential Manager:Press Win + R, type control /name Microsoft.CredentialManager, and hit Enter.Select Windows Credentials.Under Generic Credentials, locate and remove all entries starting with MicrosoftOffice16_Data:, Identity, or ADAL.Reset Office Activation State using PowerShell:Open PowerShell as Administrator and execute: Get-AppxPackage -Name "*OfficeHub*" | Reset-AppxPackage
Relaunch Office and Re-authenticate:Open Excel, click Sign In, and enter your Microsoft Account credentials to bind the active digital license.# Prevention & Long-Term Monitoring:
Always sign out of expired trial profiles before installing perpetual or subscription-based Office editions.
Re-installing Correct Matching Architecture and Product SKU Container
Solution:
Root Cause: Click-to-Run Architecture and Product ID SKU Mismatch
Microsoft Office Click-to-Run deployment architecture segregates product SKUs into distinct licensing containers (e.g., ProPlus2021Retail vs HomeBusiness2021Retail). If a 64-bit Click-to-Run installation of Office 365 or ProPlus is present on the machine, and a user attempts to enter a 32-bit standalone Office 2019/2021 Home & Student key, the licensing service attempts to apply the key against an incompatible product ID container, returning error 0xC004C060.
# Diagnostic Verification:
Open Control Panel > Programs and Features.Inspect the exact name of the installed Office package (e.g., *Microsoft 365 for enterprise* vs *Microsoft Office Home and Business 2021*).# Step-by-Step Fix:
Completely Remove Incompatible Office Installations:Download the official Microsoft Office Uninstallation Support Tool (SaRA) or use PowerShell to remove existing Office packages.Download Correct Office Installer matching your Product Key:Log into setup.office.com or your Microsoft Account Subscriptions dashboard.Select the exact matching edition and architecture (32-bit or 64-bit) corresponding to your key.Click Download to obtain the official .img or setup executable.Perform Fresh Installation and Activate:Run the installer, launch Word upon completion, and enter your matching product key.# Prevention & Long-Term Monitoring:
Ensure deployment scripts (ODT configuration.xml) specify the exact ProductID matching your organization's key license agreements.
What leftover licensing state or legacy key residue is blocking the fresh installation?
- Multiple conflicting product keys (e.g., old Office 2016/2019 keys alongside Office 2021/365) exist in OSPP.
- The local licensing token store (`tokens.dat`) in `%ProgramData%` is corrupted or permission-locked.
- Legacy Click-to-Run (C2R) registry keys under `HKLM\SOFTWARE\Microsoft\Office\ClickToRun` persist.
- Software Protection service (`sppsvc`) or Office Software Protection service (`osppsvc`) is disabled.
Purging Residual Legacy Product Keys via `ospp.vbs` Command Script
Solution:
Root Cause: Accumulation of Residual Revoked Keys in OSPP License Store
When reinstalling Office or upgrading editions, the Office installer does not automatically purge previously installed product keys from the Office Software Protection Platform (OSPP) database. If a machine previously contained a trial key, an expired subscription key, or a revoked third-party key, those 5-digit key partials remain bound to the system. During activation, Office attempts to validate all installed key partials sequentially. When it encounters the revoked legacy key, it throws error 0xC004C060 even if a valid key was also entered.
# Diagnostic Verification:
Open Command Prompt as Administrator.Navigate to the Office script directory: cd "C:\Program Files\Microsoft Office\Office16" *(Adjust path to Program Files (x86) if 32-bit)*
Run status query: cscript ospp.vbs /dstatus
Observe if multiple blocks of product information appear (e.g., 2 or 3 distinct LICENSE NAME blocks listed with different partial product keys).# Step-by-Step Fix:
Record All Partial Product Keys:Inspect the /dstatus output for every product block.Note the last 5 characters of every listed product key (e.g., Processing: Office16PROPLUSR_Grace ... Last 5 characters of installed product key: 2B3C4).Uninstall Every Listed Product Key:Execute the uninstall command for each partial key individually: cscript ospp.vbs /unpkey:2B3C4
Repeat this step until every partial key is removed.Confirm Clean License State:Run cscript ospp.vbs /dstatus again and verify that the output reports No installed product keys detected.Apply Valid License and Activate:Enter your valid product key: cscript ospp.vbs /inpkey:YOUR-VALID-25-CHAR-KEY
Force immediate activation: cscript ospp.vbs /act
# Prevention & Long-Term Monitoring:
Always execute ospp.vbs /unpkey cleanup commands prior to capturing OS reference images or performing Office edition upgrades.
Resetting the Software Protection Platform `tokens.dat` Master Cache
Solution:
Root Cause: Corruption of the Digital Licensing Token Store (tokens.dat)
Windows and Office store validated cryptographic licensing certificates and digital tokens in a binary cache file named tokens.dat. If a system experiences a sudden power outage, hard reset, or improper uninstallation during license writing, the tokens.dat file can suffer byte-level structure corruption. The Office Software Protection Platform reads damaged token headers, fails to parse valid license grants, and returns error code 0xC004C060.
# Diagnostic Verification:
Open Event Viewer (eventvwr.msc) > Windows Logs > Application.Look for Event ID 1014 or 8200 from source Software Protection Platform Service stating file read errors on tokens.dat.# Step-by-Step Fix:
Stop Licensing Services:Open Command Prompt as Administrator and execute: net stop sppsvc
cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus *(Ignore errors if service is stopped)*
Rename Corrupted Token Store:Navigate to the Software Protection Platform data directory: cd %SystemRoot%\System32\spp\store\2.0 *(or 1.0 depending on Windows version)*
Take ownership and rename tokens.dat: ren tokens.dat tokens.bar
Restart Software Protection Service:Execute in administrative Command Prompt: net start sppsvc
*Explanation: Windows will automatically rebuild a clean, empty tokens.dat file.* Re-install Office License Keys:Navigate back to the Office directory: cd "C:\Program Files\Microsoft Office\Office16"
Re-apply your genuine product key and trigger activation: cscript ospp.vbs /inpkey:YOUR-VALID-PRODUCT-KEY
cscript ospp.vbs /act
# Prevention & Long-Term Monitoring:
Exclude the %SystemRoot%\System32\spp\store directory from aggressive third-party disk cleaning and optimization utilities.
Clearing Orphaned Click-to-Run Registry Hives and Configuration Locks
Solution:
Root Cause: Persisted ClickToRun Registration Subkeys and Product SKU Locks
Microsoft Office Click-to-Run (C2R) installs virtualization registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun. When Office is uninstalled via standard Control Panel, legacy registry subkeys containing old activation GUIDs and revoked product keys sometimes remain in the system registry. When a new copy of Office is installed, the Click-to-Run engine reads the old configuration keys, causing a conflict that triggers error 0xC004C060.
# Diagnostic Verification:
Open Registry Editor (regedit) and inspect: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
Check if ProductReleaseIds contains references to old or expired SKUs (e.g., ProPlusRetail when installing HomeBusiness2021Retail).# Step-by-Step Fix:
Backup Registry:Press Win + R, type regedit, press Enter, click File > Export, and save a backup copy to your Desktop.Delete Orphaned Office Licensing Subkeys:Navigate to and delete the following registry subkeys if present: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\OEM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Registration
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Licensing
Clear ClickToRun Product Override Keys:Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs.Delete subkeys that do not correspond to your currently installed Office edition.Reboot Machine and Trigger Activation:Restart Windows, open Word, and execute online activation.# Prevention & Long-Term Monitoring:
Use official Microsoft OffScrub VBS scripts or the Microsoft Support and Recovery Assistant (SaRA) tool for clean uninstallations.
Enabling and Repairing Software Protection Service (`sppsvc`) Dependencies
Solution:
Root Cause: Software Protection Service (sppsvc) Startup Failure or Lockout
The Windows Software Protection Service (sppsvc) manages digital rights, activation validation, and license enforcement for both Windows and Microsoft Office. If sppsvc is disabled by third-party OS optimization scripts, or if its service account permissions (NT SERVICE\sppsvc) are corrupted, Office cannot communicate with the licensing subsystem, resulting in error 0xC004C060.
# Diagnostic Verification:
Open PowerShell as Administrator and check service state: Get-Service -Name sppsvc
Observe if the service status displays Stopped and fails to start when running Start-Service sppsvc.# Step-by-Step Fix:
Re-enable Software Protection Service Startup Type:Open administrative Command Prompt and run: sc config sppsvc start= auto
net start sppsvc
Fix Service Account Registry Permissions:Press Win + R, type regedit, and navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppsvc
Ensure the Start DWORD value is set to 2 (Automatic).Restore Security Descriptor for SPPSVC:Execute in administrative Command Prompt to reset default ACL permissions: sc.exe sdset sppsvc D:(A;;CCLCSWLOCRNDRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRNDRC;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCLCSWRPWPDTLOCRRC;;;S-1-5-80-123231216-2592883651-3715271367-3753151631-3961423157)
Relaunch Office and retry activation.# Prevention & Long-Term Monitoring:
Do not disable core Windows licensing services (sppsvc, wlidsvc) when applying system debloating scripts.
What system file, network port, or local environment conflict is blocking validation?
- System clock date/time desynchronization or incorrect time zone settings block SSL/TLS handshakes.
- Network firewall, proxy server, or custom DNS blocks Microsoft activation endpoints (`ols.officeapps.live.com`).
- Windows Web Account Manager (WAM) or Azure AD / Entra ID token broker plugin is corrupted.
- Local `hosts` file contains static redirection entries overriding Microsoft activation servers.
Synchronizing System Clock and Windows Time Service (W32Time)
Solution:
Root Cause: TLS/SSL Certificate Validation Failure Due to Clock Skew
Microsoft Office online activation servers validate incoming requests using HTTPS/TLS encrypted connections. Secure Sockets Layer (SSL) certificates issued by Microsoft activation servers have strict validity timestamps. If the local system time on the client computer differs by more than 5 minutes from Universal Coordinated Time (UTC) due to CMOS battery failure or time zone misconfiguration, the SSL handshake fails, and the activation client falls back to an error state (0xC004C060).
# Diagnostic Verification:
Inspect the Windows taskbar clock time and date.Open PowerShell and check time difference against a public NTP server: w32tm /stripchart /computer:time.windows.com /samples:1
# Step-by-Step Fix:
Synchronize System Time via PowerShell (Run as Administrator):Resync time against NTP servers: net start w32time
w32tm /resync /force
Adjust Time Zone and Automatic Synchronization Settings in GUI:Go to Settings > Time & Language > Date & time.Toggle Set time automatically to On.Toggle Set time zone automatically to On.Click Sync now under *Additional settings*.Relaunch Office Application:Open Word or Excel and trigger online activation.# Prevention & Long-Term Monitoring:
Replace depleted motherboard CMOS batteries (CR2032) on older hardware displaying recurring time drifts.
Whitelisting Microsoft Office Activation URLs and Port 443 Outbound Traffic
Solution:
Root Cause: Corporate Firewall or Proxy SSL Interception on Activation Endpoints
During activation, Office contacts Microsoft Content Delivery Networks (CDNs) and activation endpoints over TCP port 443 (HTTPS). If a corporate network firewall, deep packet inspection (DPI) security appliance, or proxy server blocks or decrypts traffic destined for Microsoft licensing URLs, the activation handshake fails with error
0xC004C060.
# Diagnostic Verification:
Open PowerShell and test network connectivity to Microsoft activation endpoints: Test-NetConnection -ComputerName ols.officeapps.live.com -Port 443
Test-NetConnection -ComputerName activation.sls.microsoft.com -Port 443
If TcpTestSucceeded returns False, network traffic is blocked.# Step-by-Step Fix:
Add Exception Rules to Corporate Firewall / Proxy:Ensure outbound HTTPS (Port 443) traffic to the following FQDNs is permitted and exempted from SSL Inspection / Interception: ols.officeapps.live.com
activation.sls.microsoft.com
licensing.mp.microsoft.com
odc.officeapps.live.com
Bypass Local Proxy in Windows Settings:Press Win + I > Network & internet > Proxy.Temporarily disable Use a proxy server to verify if proxy policy is causing the block.Execute Activation Request:Open Command Prompt as Administrator and run cscript ospp.vbs /act.# Prevention & Long-Term Monitoring:
Refer to the official Microsoft Official Support Guide for updated IP address ranges and URLs required for Microsoft 365 and Office activation.
Re-registering Microsoft Entra ID Web Account Manager (WAM) Broker Plugin
Solution:
Root Cause: Web Account Manager (WAM) AppX Package Execution Failure
On Windows 10 and Windows 11, modern Office activation relies on the native Web Account Manager (WAM) framework (Microsoft.AAD.BrokerPlugin). If the AppX package for WAM becomes corrupted or unregistered during a Windows Feature Update, Office cannot pop up the interactive login prompt or retrieve OAuth 2.0 tokens, causing activation routines to fail with error 0xC004C060.
# Diagnostic Verification:
Attempting to click Sign In inside Office results in an immediate crash of the sign-in window or displays a blank white box.# Step-by-Step Fix:
Re-register AAD Broker Plugin AppX Package via PowerShell:Open PowerShell as Administrator and run: Add-AppxPackage -Register "C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AppxManifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown
Re-register Web Account Manager Package:Execute: Get-AppxPackage -AllUsers *AccountsControl* | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
Restart Computer:Reboot Windows to finalize AppX assembly registrations.Relaunch Office and complete activation.# Prevention & Long-Term Monitoring:
Avoid force-deleting SystemApps directories during automated OS image customization.
Cleaning Windows `hosts` File and Resetting Network Sockets
Solution:
Root Cause: Static Redirection of Activation Servers in Windows hosts File
Certain third-party software utilities, legacy activation bypass tools, or malware modifications insert static loopback redirection entries (127.0.0.1 or 0.0.0.0) into the Windows hosts file targeting Microsoft licensing servers. When legitimate Office activation attempts to contact activation.sls.microsoft.com, the request is looped back to the local machine, resulting in instantaneous connection rejection and error 0xC004C060.
# Diagnostic Verification:
Open Command Prompt and test DNS resolution of activation servers: ping activation.sls.microsoft.com
If the IP address resolves to 127.0.0.1 or 0.0.0.0, the hosts file contains static redirection rules.# Step-by-Step Fix:
Open hosts File in Notepad as Administrator:Click Start, type notepad, right-click Notepad > select Run as Administrator.In Notepad, click File > Open.Navigate to: C:\Windows\System32\drivers\etc.Change file filter from *Text Documents (*.txt)* to All Files (*.*).Select hosts and click Open.Delete Microsoft Activation Redirection Lines:Search for any lines containing microsoft, sls, officeapps, or live.com.Delete those lines entirely.Click File > Save.Flush DNS Cache and Reset Winsock:Open Command Prompt as Administrator and execute: ipconfig /flushdns
netsh winsock reset
Reboot machine and activate Office.# Prevention & Long-Term Monitoring:
Lock read/write permissions on C:\Windows\System32\drivers\etc\hosts to prevent unauthorized software modifications.
What enterprise identity or group policy conflict is blocking authentication?
- Microsoft Entra ID Conditional Access policy or Multi-Factor Authentication (MFA) blocks device trust.
- Shared Computer Activation (SCA) is enabled on a non-RDS desktop installation.
- Group Policy disables Web Account Manager (WAM) forcing legacy ADAL authentication.
- Domain-joined hybrid machine lacks Primary Refresh Token (PRT) validation.
Evaluating Conditional Access Policies and Excluded Device Compliance
Solution:
Root Cause: Entra ID Conditional Access Policy Blockade
In enterprise environments utilizing Microsoft Entra ID (formerly Azure AD), Conditional Access (CA) policies dictate access terms for Office activation endpoints. If a policy requires a Compliant Device or Hybrid Entra ID Joined Device, and an employee attempts to reinstall Office on a non-compliant or unmanaged endpoint, the Entra ID token broker issues an access rejection, manifesting inside Office desktop apps as activation error 0xC004C060.
# Diagnostic Verification:
Open Event Viewer (eventvwr.msc) > Applications and Services Logs > Microsoft > Windows > AAD > Operational.Look for Event ID 1098 or 1025 containing error string AADSTS53000 (*Device is not in compliant state*) or AADSTS50199.# Step-by-Step Fix:
Verify Device Join State via Command Prompt:Open Command Prompt and run: dsregcmd /status
Check the output under Device State: Verify AzureAdJoined : YES and IsDeviceJoined : YES.
Trigger Intune Device Compliance Sync:On the target machine, go to Settings > Accounts > Access work or school.Select your work account > click Info > scroll down and click Sync.Review Entra ID Sign-in Logs (For IT Administrators):Log into the Microsoft Entra Admin Center.Navigate to Users > Sign-in logs.Filter by user account and locate the failed Office activation attempt to inspect the specific Conditional Access policy rule causing the block.# Prevention & Long-Term Monitoring:
Create exclusion rules in Conditional Access policies for initial device provisioning and staging groups.
Disabling Shared Computer Activation (SCA) on Dedicated Single-User Devices
Solution:
Root Cause: Shared Computer Activation (SCA) Mode Misconfiguration
Shared Computer Activation (SCA) is a specialized licensing mode designed strictly for Remote Desktop Services (RDS / Terminal Services) or shared virtual desktop infrastructure (VDI). When SCA is enabled, Office does not issue a persistent local license token; instead, it requests a temporary, short-lived token from Microsoft servers upon every user launch. If SCA is accidentally enabled on a dedicated physical PC running a perpetual license or standard Microsoft 365 Business license, activation fails with error 0xC004C060.
# Diagnostic Verification:
Open Registry Editor (regedit) and check: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
Check if string value SharedComputerLicensing is set to 1.# Step-by-Step Fix:
Open Registry Editor as Administrator:Press Win + R, type regedit, and press Enter.Disable Shared Computer Licensing Registry Value:Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration.Double-click SharedComputerLicensing and change its Value data to 0.Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing.If SharedComputerLicensing exists here, set its value to 0 or delete the key.Clear Office Licensing Cache:Open Command Prompt as Administrator and run: cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /act
Restart Office and activate normally.# Prevention & Long-Term Monitoring:
Ensure Group Policy objects enabling SCA (Computer Configuration > Administrative Templates > Microsoft Office 2016 > Licensing Settings) are filtered strictly to Terminal Server OU scopes.
Re-enabling WAM Authentication and Clearing ADAL Override Registry Keys
Solution:
Root Cause: Legacy ADAL Authentication Override Registry Keys
In older Office 2016/2019 deployments, administrators deployed registry tweaks to disable modern Web Account Manager (WAM) and force legacy Active Directory Authentication Library (ADAL) workflows (DisableADALatopWAMOverride). Because modern Microsoft 365 and Office 2021/2024 activation backends have fully deprecated legacy ADAL endpoints, leaving these registry overrides active prevents Office from negotiating valid activation tokens, throwing error 0xC004C060.
# Diagnostic Verification:
Open Registry Editor (regedit) and inspect: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
Check if DisableADALatopWAMOverride or EnableADAL keys exist.# Step-by-Step Fix:
Open Registry Editor:Press Win + R, type regedit, and hit Enter.Delete Deprecated Identity Registry Keys:Navigate to: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity.Delete the following DWORD values if present: DisableADALatopWAMOverride
DisableAADWAM
EnableADAL
Enforce Native WAM Execution:Ensure DisableUrlRedirection is set to 0 or deleted.Restart Windows and launch Office to complete modern authentication.# Prevention & Long-Term Monitoring:
Remove legacy Office 2013/2016 identity registry customization GPOs across domain environments.
Acquiring Fresh Primary Refresh Tokens (PRT) via `dsregcmd` Re-registration
Solution:
Root Cause: Invalidation of the Entra ID Primary Refresh Token (PRT)
On Hybrid Entra ID joined devices, Windows obtains a Primary Refresh Token (PRT) during user logon. Office desktop applications use the PRT to silently authenticate and acquire activation tokens without prompting the user for passwords. If the device PRT becomes invalidated due to a password reset on another machine or domain controller desynchronization, Office activation calls fail with error 0xC004C060.
# Diagnostic Verification:
Open Command Prompt and inspect PRT status: dsregcmd /status
Check the SSO State section. If AzureAdPrt : NO or AzureAdPrtWithTpm : NO, the primary refresh token is missing or invalid.# Step-by-Step Fix:
Lock and Unlock Windows Workstation:Press Win + L to lock the Windows screen, then unlock the machine by re-entering your Active Directory password.Force PRT Refresh via Command Prompt:Open Command Prompt as Administrator and execute: dsregcmd /leave *(Only if necessary to unjoin corrupt state)*
dsregcmd /join
Clear WAM Broker Cache Folder:Open File Explorer and navigate to: %localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
Rename or clear the AC subfolder.Restart Computer and Launch Office:Run dsregcmd /status to confirm AzureAdPrt : YES, then launch Office to complete silent activation.# Prevention & Long-Term Monitoring:
Ensure domain controllers maintain active synchronization with Entra Connect sync services to prevent stale password hashes.