0xC004F025 SL_E_NOT_GENUINE — Windows Error Code

Q: What does the Windows error code 0xC004F025 mean?

It is the Win32 / NTSTATUS code SL_E_NOT_GENUINE (decimal -1073415131). The software is not genuine. License validation failed.

Q: How do I decode 0xC004F025 in PowerShell?

Run [ComponentModel.Win32Exception]::new(-1073415131).Message in any PowerShell session. For HRESULT-style codes, use err.exe from the Windows SDK or the WinDbg !error command.

Q: Where does Windows typically log this error?

It depends on the originating subsystem (Windows Update → %WinDir%\WindowsUpdate.log; AD/Kerberos → Security event log on the DC; BSOD → minidump under C:\Windows\Minidump; MSI → %TEMP%\msi*.log; WMI → Microsoft-Windows-WMI-Activity). Always cross-reference the timestamp and module name with the Application and System event logs.

Description

SL_E_NOT_GENUINE (hex code 0xC004F025, decimal -1073415131) is a Windows critical-level error code in the Office & M365 Activation family. Microsoft surfaces this code through the Win32 API, the Common Language Runtime, the kernel, the event log, PowerShell, command-line tools (sfc, dism, gpupdate, sc), and Windows-side applications such as Outlook, Teams, Office, and System Center.

The software is not genuine. License validation failed.

This page documents what triggers 0xC004F025, the most common scenarios where it appears, the likely root causes, and a step-by-step troubleshooting workflow you can run against affected endpoints. It is intended for system administrators, MSP technicians, helpdesk engineers, and anyone diagnosing Windows behavior in a managed environment.

In-depth explanation

This is a critical-severity Windows error. It typically indicates a kernel-mode failure, an unrecoverable security violation, hardware failure, or a fatal driver bug. Treat any occurrence as a P1 incident: isolate the host, capture a memory dump if available, and pull the latest minidump from C:\Windows\Minidump for analysis.

It is part of the Software Licensing (SL) / Office Click-to-Run activation error space. It typically surfaces in slmgr.vbs output, the Office Activation Wizard, the SL service log, or the M365 admin center.

The code can be looked up programmatically in PowerShell with [ComponentModel.Win32Exception]::new(-1073415131).Message (for Win32 / NTSTATUS codes that map cleanly), or with net helpmsg <decimal> for the legacy decimal range. For HRESULT-style codes, decode the facility and code with err.exe from the SDK or via the WinDbg !error command.

Common causes

License key blocked, revoked, or used on too many devices.
KMS host unreachable, missing SRV records, or activation count below threshold.
Office identity (Microsoft 365 account) signed-out, expired, or licenses unassigned.
Time skew or invalid system clock blocking license validation.
Network proxy or TLS inspection breaking the activation endpoint.

Troubleshooting steps

Run cscript %ProgramFiles%\Microsoft Office\Office16\OSPP.VBS /dstatus to view current license state and KMS host.
For Microsoft 365: sign out from File > Account, restart the app, sign back in, and verify license assignment in the M365 admin center.
For KMS clients: slmgr /skms <kms-host>:1688 and slmgr /ato to force activation against a known-good KMS host.
Check time and timezone — invalid system clock prevents license validation.
If proxy / TLS inspection is in place, exclude the activation endpoints (activation.sls.microsoft.com, *.officeapps.live.com).

Decode in PowerShell

# Decode 0xC004F025 (-1073415131) in PowerShell
[ComponentModel.Win32Exception]::new(-1073415131).Message

# Or via WinDbg / err.exe (Windows SDK)
# err 0xC004F025

# Or net helpmsg (legacy decimal range only)
# net helpmsg <decimal>

Frequently asked questions

What does the Windows error code 0xC004F025 mean?

It is the Win32 / NTSTATUS code SL_E_NOT_GENUINE (decimal -1073415131). The software is not genuine. License validation failed.

How do I decode 0xC004F025 in PowerShell?

Run [ComponentModel.Win32Exception]::new(-1073415131).Message in any PowerShell session. For HRESULT-style codes, use err.exe from the Windows SDK or the WinDbg !error command.

Where does Windows typically log this error?

It depends on the originating subsystem (Windows Update → %WinDir%\WindowsUpdate.log; AD/Kerberos → Security event log on the DC; BSOD → minidump under C:\Windows\Minidump; MSI → %TEMP%\msi*.log; WMI → Microsoft-Windows-WMI-Activity). Always cross-reference the timestamp and module name with the Application and System event logs.

Is this code recoverable?

Critical-severity codes usually require kernel-level investigation (driver, hardware, system file repair). Error and warning codes are typically recoverable through the troubleshooting workflow on this page — start with the elevated-shell + log review steps.

Should I open a Microsoft support case for this?

Open a case if the error reproduces after applying the troubleshooting steps, particularly if it blocks production workloads, occurs across multiple endpoints, or is associated with a security boundary (BitLocker recovery, Kerberos failure, DCOM hardening, SmartScreen / WDAC). Have a fresh CBS log, minidump, or Get-WinEvent export ready before opening the case.