How to get the License Key from a boot CD

bootlicensingwindows-server-2003

We recently acquired a server that's been in use for a while, but no associated software, logins, etc. We attempted to blank the administrator account password, but that didn't work. We also tried some deeper edits on the password, but no avail there either.

Now what I'm looking to do is to re-install windows using the existing registry key on the server now. I've read that you can access the product key in the registry, and using the password tool (a linux boot cd) we are able to view the registry. When I tried this, I got the ProductId (Which version of windows), not the registry key.

The OS I'm attempting to read from in Windows Server 2003 R2.

Best Answer

Ok I was able to retrieve it using the following:

Download AC2T KeyViewer (http://www.ac2tech.com/tools/keyviewer/keyviewer.zip)

I used a password reset tool (Not sure what it was, it was just the one I've been using for years) which had a registry viewer on the boot CD. I navigated to 

Microsoft->Windows NT->Current Version->DigitalProductId

Once I got that value (its really long, about 12 lines of hex), enter the whole thing into the 'Raw Key' tab of the KeyViewer application. It should spit out your Product Key. Note, this does not work in some versions of Windows Server.

Another alternative I've found is the following powershell script: 

# create table to convert in base 24
$map="BCDFGHJKMPQRTVWXY2346789"
# Read registry Key
$value = (get-itemproperty "HKLM:\\SOFTWARE\Microsoft\Windows NT\CurrentVersion").digitalproductid[0x34..0x42]
# Convert in Hexa to show you the Raw Key
$hexa = ""
$value | foreach {
  $hexa = $_.ToString("X2") + $hexa
}
"Raw Key Big Endian: $hexa"

# find the Product Key
$ProductKey = ""
for ($i = 24; $i -ge 0; $i--) {
  $r = 0
  for ($j = 14; $j -ge 0; $j--) {
    $r = ($r * 256) -bxor $value[$j]
    $value[$j] = [math]::Floor([double]($r/24))
    $r = $r % 24
  }
  $ProductKey = $map[$r] + $ProductKey 
  if (($i % 5) -eq 0 -and $i -ne 0) {
    $ProductKey = "-" + $ProductKey
  }
}
"Product Key: $ProductKey"

In this script, you can replace the $value variable with the following:

  1. Locate the memory locations 34 to 42 in the registry value above from the machine that will not boot.
  2. Convert each pair of numbers to decimal (ie. A1=161)
  3. Build an array with those values eg. $value = (161,...)

Running the script then return your product key.

Related Topic