Recently I was cleaning up old test VMs from my laptop and while doing so observed that a test VM with Windows 10 Enterprise Evaluation version would restart almost every hour. This interested me and I decided to figure out how Microsoft is achieving this.

Issue

After Windows license expires, you will see a similar message as shown below and then VM will auto shutdown every hour.

Investigation

As always, I started my investigation from Event logs. Since we are going to troubleshoot shutdowns, we need to filter messages in logs that are related to restarts. Easiest way to do so is to filter by respective Event Ids. In this case I chose to filter logs by following event ids : 41, 1074, 6006, 6008 as shown below :

Brief explanation of Event Ids

After applying the filters you will see list of events corresponding to event ids.

Now that we have filtered the events, i decided to look into events that occurred around the time VM rebooted which was around 9:50am

In the General section of the above came across below information :

The process C:\Windows\system32\wlms\wlms.exe (TEST2) has initiated the shutdown of computer TEST2 on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned)
Reason Code: 0x80000000

From the above message it was clear that wlms.exe initiated the reboot.

Next, I opened up task manager and looked for wlms.exe, on further investigation wlms.exe took me straight to WLMS service. WLMS stands for Windows License Monitoring Service and it is installed by default on all Windows Evaluation versions.

How to stop shutdown every hour

Lets take a closer look at WLMS service

Even though I am logged in with admin account, I do not have access to disable this service . To disable this services please follow below steps :

  1. Download PsExec tools from Microsoft site here
  2. After downloading extract the tool in a folder
  3. open cmd and Run as administrator
  4. cd to the folder path
  5. execute psexec -i -s cmd.exe
  6. This will open another cmd prompt as shown below :

7. Now type whoami to confirm user as shown below:

8. Type services.msc as shown below :

9. This will open services and now you can navigate to Windows License Monitoring Service and can disable it

10. Restart the VM

Conclusion

By following above steps we can disable the hourly shutdown of VM after expiry of license but the easiest way is to Activate the windows by providing a legal key. Since this is not a supported method please do not use this on laptops/VMs that are in production.

Leave a Reply

Your email address will not be published. Required fields are marked *