Corporations Suffer Microsoft Activation Bug

Uncle Bob writes "Trustworthy Computing, eat your heart out! As of the 2003-04-14 update, people are reporting that Office 2000 SR1a is now asking to be "registered" again. And again, and again. Very little information has been posted on the traditional news sites (the only link I could find was The Register. Note - The Register's story is not quite accurate, but the registration bug is real. Our company with approx 80,000 PCs has been hit...."

This hit us.

[sakailind]

This hit my company yesterday. We've got about 500 Windows 2000 workstations with Office 2000 and a site license. At the time we were negotiating I was arguing that we should be looking at free software and Linux, but was laughed at. While I'll agree it wasn't the best time for Linux on the desktop, this does have me pulling a 'I told you so' as hundreds of our employees are bugged each time they try to start office.

The solutions microsoft has suggested to us thus far:

• Set the clock back two years. Means all our files have bad datestamps, and interferes with our content management system, so this is not an option.
• Go through a four page process to clean the registry. This leaves you at a point where Office starts again, but it is still complaining upon startup. IE you still only have 50 times before you need to do this again.
• Install new site license key. They've promised we'll get the opportunity to try that RSN. No idea if/when they'll get us a key - they've been stalling on this one. It could be that it's impossible without another patch first.

Are we happy? Oh noo....

upgrade

[asv108]

To OpenOffice.org [openoffice.org](No Reg Required). Openoffice is now to the point where it is more than adequate for 90% of MS Office users, especially those who just use word and powerpoint. For the other 10%, just keep using MS Office.

Re:What is true, then?

[xanadu-xtroot.com]

If the Reg is false, then what's the true story?

The dude didn't say "false", he said "The Register's story is not quite accurate, but the registration bug is real.". What part of that did you not get? The article referenced doesn't get *EVERY TINY LITTLE DETAIL* right, but the fact still remains that this is something that I get to look forward to getting calls and e-mails about in the VERY near future (I'm the Admin...).

Re:sra1a?

[Anonymous Coward]

Got SR1 here, too. No trouble.

Crack

[Anonymous Coward]

There is a crack for SR1a that gets rid of the registration, but you can't update to any service packs or anything because the file it modifies gets overwritten. The crack can ONLY modify the SR1a file. Oh well.

Re:This hit us.

[jsupreston]

Dear God, please don't set the server clock back. If you do, NDS will be barking, yelling, crying, whining for a very long time. I know. I had a guy helping me when I ran a large NetWare shop, and he did this once. Took a while to clean up his mess.

Re:Yay for not upgrading

[afidel]

SR1 has a lot of problems including the fact that it won't work with Visio 2000. Most corp environments run SR1a because it fixed a bunch of issues with the origional SR1. In fact if people are having a problem with Office and they had recently installed another app the first thing I do is check the SR version, if it is SR1 then I install the SR1a update off a network share and reboot, about 70-80% of the time this fixes the problem. I'm glad I'm not at my last position anymore I can just imagine the fun with this bug and an office of 250 pissed off engineers.

A microsoft article on this...

[TWagers]

I work for the help desk of a company that supports 30,000 windows PC's, and while we have never officially deployed or distributed Office 2000, we do have a few users that have it installed. We got an advisory from our backline support that this problem is discussed in a technical article Microsoft provided to its partners. The partner-level article is 816642 - You Cannot Register Office 2000 After You Change the System Date. The link is https://premier.microsoft.com/premier/library/defa ult.aspx?path=/premier/kb/en-us/816/6/42.ASP?KBID= 816642 , but if you don't have premium support, you can't view it, and I can't find a mirror of it via Google. The cause? Well, the issue appears related to the "End of life" code written into the product, which is what that article discusses. Apparently, Microsoft coded Office 2000 to 'expire' and to need to be reativated at some point, but apparently there's a glitch in that code that causes it to happen over and over again.

Re:This hit us.

[David McBride]

To protect against replay attacks, most security frameworks (including Kerberos, as used by Active Directory) insist that the clock skew (ie the difference in time) between two machines is smaller than a specified threshold -- in the case of Kerberos, the default is 5 minutes.

By implication, if you put the clocks on your workstation back two years to fix this Office problem you must *also* do the same to every other host those workstations talk to, like the Domain Controllers.

And if you put the clocks back on the DCs, every machine they talk to must have their clocks put back, and so on. Pretty soon, you're going to have to put the clocks back for a significant portion of your entire computing infrastructure.

Which means that people are going to start getting very confused (and concerned) when web frontends, emails and other documents from affected companies start showing dates in 2001...

I guess we can call this the Real Millennium Bug.

Anyone seen any cases yet?

Re:Piracy

[Hobophile]

games which won't work with certain CD drives thanks to the way the Safedisk copy protection system works,

I am going to second this point, as it truly is one of my pet peeves.

The new Securom 4 is absolutely awful about this. I have many friends whose brand new games will not play because Securom tries to do things with their brand new CD-ROM drives that those drives just don't handle well.

What are these customers supposed to do? Buy a new CD-ROM drive? What if that one doesn't work either?

The one solid workaround that I have found is to use Daemon Tools in conjunction with a product like Alcohol 120% to create a perfect MDS image of the CD.

Let's face it. With names like "Daemon Tools" and "Alcohol" these products are clearly not targetting your casual software buyer, who is just as likely as a pirate to be locked out of a game he legally purchased. They won't know what's going on, they just know that their game doesn't work 90% of the time. Oh, and good luck returning that opened software if they simply can't get it to work at all.

The irony here is that anyone who makes an effort to play games illegally is probably familiar with these tools, which is to say precisely the people Safedisc, Securom and others are trying to stop.

Most asinine of all is that the games which have CD-keys and are more or less entirely multiplayer oriented -- Warcraft 3, Unreal Tournament 2003 -- have for some reason adopted the most bleeding edge versions of Securom. Anyone serious about the game is going to need a legitimate copy of the game in order to have a valid CD key! Why force them to have the real CD inserted as well?

So far Bioware, with Neverwinter Nights, gets my award for the most clued-in company in this regard. NWN shipped with Securom 4 support, which was almost immediately disabled by the first patch.

I only wish Blizzard would do the same for Warcraft 3, so I could stop explaining to my friends that everyone gets those "Please insert the game CD" messages, and that their options are: repeatedly click 'OK' until the stars align properly and the game decides you're not evil; or, use an MDS image with Daemon Tools and you won't have any more trouble.

Re:Why is it

[rabidcow]

Related stories?

• http://www.vnunet.com/News/1140296 [vnunet.com]
  
• http://www.theage.com.au/articles/2003/04/17/10501 72679775.html [theage.com.au]
  

Re:upgrade

[johnnyb]

He needs to look into his program. What is happening is that his computer is not transfering his extra fonts to the PDF. This makes them bigger, but is necessary for a portable PDF. If he is using Mathematica, I know there is an option for this (although that may just be for Postscript).

Re:This hit us.

[JWW]

On another note. If your company is subject to FDA part 11 requirements and you set the time back, they can shutdown your operations and send a nasty letter to your CEO.

That Microsoft is even suggesting that workaround is insulting.

Re:Why is it

[spinlocked]

Apparently it's affecting few systems, and not every install of SR1a

If you RTFA, you'll notice that it is affecting corporate users running Microsoft Select software. Microsoft Select is a bulk licensing scheme which saves corporations from all that tedious mucking about with license keys (a practical impossibility with this size of user base).

I happen to know the 'global energy company' which is mentioned in The Register article. They pay Microsoft a huge sum of money for their software and this is going to affect their relationship significantly - they are not amused. I expect there will be a significant discount on future licenses, a large penalty payment or a very high profile public relations disaster for Microsoft.

Re:This hit us.

[Blkdeath]

Yeah, they won't notice the difference because they will still save the files on their C drive. At least that's been my experience.

Some steps to follow;

1. Move existing documents from C: to x: (network home directory)
2. Change application defaults to x:
3. (Optional) Set group policy to redirect "My Documents" to x:
4. Issue written instructions to save to x:, with backing from management (yours and theirs), accompanied with notice that only files saved to x: come with any guarantee that they will still be there the next morning (vis, if their computer goes south, you replace parts and re-image, but the server is backed up regularly)

The key is to remind all employees regularly (twice/year or thereabouts) in writing, and keep management abreast of the situation and the reasons for doing so to ensure maximal CYA. If they don't listen to you and they lose work ("HDD crashed? Sorry, we can't justify $3k for data recovery for your workstation. But it's ok, your work is all stored on the server, right?"), it's their problem, and their job on the line.

The BOFH approach, while fun, doesn't work terribly well with common users. You have to explain the situation to them and attempt to reason it out in language they understand. If they know more than you about these computers (then why aren't they doing your job?), ensure that they've received their bi-monthly copy of the computer usage guidelines and hope it never has to come to a head.

Re:Why is it

[Anonymous Coward]

> Related stories?

Hardly. Both of them deal with security patches for the various operating systems, nothing about Office 2000, the subject of the main article.

Four Licensing Schemes/ Three versions

[ashitaka]

Office 2000 came in Standard, Professional and Developer. No Access, with Access and Acces plus extra dev tools respectively.

These can be purchased under four licensing levels:

1. Individual Retail: High unit cost, includes CD, with single-use registration key.

2. Open: Lower unit cost, CD bought separately (C$30), multiple-use registration key.

3. Select: Even lower unit cost, CD included, no registration required.

4. Enterprise: Select with Software Assurance.

Note that it is only the latter two where registration should not be required that are being affected.

Maybe they did do it that way

[BobBoring]

Microsoft often has bugs that turn up weeks and months later. Did the guy that got hit say he didn't pre-flight the stuff on the test LAN in the back shop?

BTW From my read of the article it requires a certain W2k version/license combo + a specific Office 2000 SR1 upgrade to trigger the bug AND the problem only starts to occur after a certain date and time. That's why setting the clock back 2 years works. In that case no matter how thoroughly you tested the deployment beforehand unless you routinely set your test beds clocks ahead by several years you'd never see the bug.

Re:I don't believe in open source.

[subzerohen]

Free != free

My Dads old employee used to have a really good CAD program for designing chips. It was developed inhouse. They could have sold it but management said: "We are a hardware company not a software company." Now they pay $10K per seat for similar software.

90% of developers don't produce software that is sold by the companies they work for. They produce software that the company uses. Anything that can lower development costs is a good thing.

Re:This hit us.

[RoLi]

I can't believe somebody is really taking this advice seriously.

You have so much problems - Emails with the wrong date which make you look stupid (and may cause to not be read at all), programs complaining about files made in the future, confusion about which day is today ("but my calendar said that the 8th was saturday") and lots of other problems.

Just download openoffice [openoffice.org] or get a warez MSOffice from mldonkey.

Re:This hit us.

[David McBride]

You don't understand the specifics of the situation. Of *course* they tested the upgrade on numerous machines, and had a nice, careful incremental rollout.

The problem here is that the software has a bug which only triggered after a certain amount of time / a particular date goes past / can't validate it's existence with Microsoft HQ / whatever.

It is quite simply not feasible to test for this kind of problem.

Moreover, if you were running open-source software you wouldn't have to worry about the license-management systems screwing up -- there aren't any -- and you'd most likely have a solution in a much shorter time.

(``Change the clock on affected PCs'' is _not_ a solution -- see my other comment [slashdot.org] to this story.)

Re:Institutionalized Stupidity

[tassii]

Except, of course, this WAS the enterprise addition.

How complex are your documents?

[Mr. Underbridge]

It's been a year since we switched over from Microsoft Office, and there have only had a handful of documents that have had MS Office/Open Office incompatibilities.

I use Office for a variety of data analysis tasks, and I rarely have a document more complicated than a letter that doesn't get corrupted in some way when making the transition. Even simple graphs lose their axes (or worse). More complicated plots get completely corrupted. I've never had a powerpoint presentation that opened correctly.

Additionally, openoffice's implementation of the spreadsheet is a certified joke. It is missing many of the statistical functions from excel, making life difficult. Also, it's not smart enough to determine what app goes with a certain file. For example, if I have an ASCII datafile, I have to tell it every time to open it as CSV, or it opens it in the word processor (and that gets really OLD quickly, especially when you're editing a lot of files and forget to keep doing it).

I do support wholeheartedly the idea of an open source office suite, but OpenOffice isn't yet ready. If you've had good fortune with file conversion, you are truly lucky. And I've found OO to be kludgey even outside of conversion, even missing features. I never thought I'd see a worse designed UI than MSOffice, but Star/Open Office nailed it.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Set the clock back? NO!

[Animats]

Don't ever set your clock back. Some other copy protection schemes, such as Globetrotter/Macrovision's FLEXLM, interpret that as an attempt to extend an expired license and lock out the license [globetrotter.com]. (FLEXLM returns an error code of -88) Worse, FLEXLM records, in some secret place, that this has happened. Setting the clock forward again may not fix it. One Softimage|3D manual said that the computer had to be discarded if this had happened.

Similar bug in original Office 2k

[aking137]

This error can occur in (AFAIK) the first version of Microsoft Office 2000, on at least Windows NT (SP6a) and Windows 2000 (original release).

Within the first few seconds of running Office, users are prompted with the one line message:

"Do you wish to register Microsoft Office 2000 Professional?"

Whether the users click Yes or No, Office (whether it be Word|Excel|Access|Publisher|Powerpoint) just simply exits.

It had me confused for a bit, until I realised that you have to log on to the machine as /local administrator/ and then click 'No'. I suspect the reason is that when you submit your answer, Office tries to amend a file or registry key that is writable only by local administrator, and so it fails.

Once this has been done once per machine, Office 2000 has worked fine for us.

Presumably this simple fix no longer applies for Office 2000 SR1a, since it made a Slashdot post.

Re:Confusion...

[omega9]

You're typing it yourself and you're still missing it. SP != SR. You're correct that O2K is currently at Service Pack 3 (SP3), but there was a Service Release 1 (SR1 [and SR1a]) of O2K some time ago.

For instance, MOUS testing software is *extremely* picky, and must be installed onto a machine with Office 2K SR1 SP2. STAB @ that.

Re:Sweet.

[racermd]

The expected lifespan of just about any desktop computer system in the corporate environment is 5 years (you can only deduct 1/5 of the computer's cost each year). That has more to do with how the IRS allows companies to use computers as deductions and less about the actual technology and/or software. As we all know, the real-world lifespan of a computer is more like 2-3 years until either the technology is no longer cost effective to support or newer and faster systems are just less expensive to purchase. I agree with your comment, however. The manufacturer should be responsible for the reliability and quality (kwalitee?) of it's products, whether hardware or software.

More interesting, however, is why these companies haven't tested their upgrades prior to deployment. Surely a company with 80,000 comptuers has a few system on which to form a small testing environment behind an internal firewall? "Upgrades" from MS shouldn't be exempt from security and stability testing prior to deployment. And just because MS says it's a fix doesn't mean that it will work with your company's configurations. In reality, this should be a non-issue as proper testing would reveal any major problems. The fact that this *is* an issue should be a wake-up call to all IT managers and those above them that proper testing is required on *ALL* software and upgrades.

Sheesh. Some people.

Re:Sweet.

[Jason Earl]

This particular bug is triggered by the date. In other words, the testing procedure would have had to include moving the clock forward past a certain "magical" date.

Personally, I think that this sort of testing should be done by Microsoft. As far as I am concerned that's why you are paying hundreds of dollars a seat for their software. If this bug was triggered by the existence of some third party software then I could maybe see your point, but this is a simple bug in MS Office. The fact of the matter is that after a certain date certain versions of Office 2000 try to register themselves and fail (because Microsoft shipped a broken wizard).

Re:But OpenOffice is actually NOT FREE?

[sparcv9]

This is a valid point that I've not seen brought up, and is the reason I do not include OpenOffice in Slackware (believe me, there are a lot of requests). I'd love to be shown how I'm wrong about this.

Feel free to Google for OpenOffice's build requirements, and then follow the link to the gpc site.

Patrick is not making this up. (And why would he? The lack of an office suite in Slackware doesn't help him in any way.) While the dependency on gpc is not listed on the Build Requirements [openoffice.org] section of OpenOffice's website, a simple Google search for openoffice gpc [google.com] reveals a slew of mailing list posts concerning the dependency.

Digging around will net you a patch [linux-debian.de] from Debian to remove the gpc requirement..