If you support Microsoft products that aren’t volume-licensed, chances are that somewhere you have a long list of the Microsoft product keys you use to install those products. This important list is extremely vulnerable to errors. You might have misread characters when you added the keys to the list. You might have read the key correctly but then mistyped or miswrote it. Or you might have trouble reading your list due to document age or bad handwriting. Product keys consist of 25 alphanumeric characters formatted in groups of five characters, which are separated by hyphens. Although I haven’t been able to find any documentation detailing which characters are used, it isn’t that difficult to determine. Based on my analysis of 160 product keys from 2002 forward, it looks like Microsoft uses the following 24 characters, which appear to be generated as truly random sequences:
2346789BCDFGHJKMPQRTVWXY
Remembering this set is much easier if you look at the 12 unused characters out of the 36 possible alphanumeric symbols:
015 AEIOU LNSZ
The first set of characters is the numerals 0, 1, and 5. The reasons for avoiding them might be fairly obvious if you’ve dealt with lists of keys before: 0, 1, and 5 are all easy to confuse with various letters (e.g., the numeral 0 with the letter O), particularly when handwritten. The second set of unused characters—A, E, I, O, and U—are vowels. Although some of these can be confused with other characters, it seems more likely that these are eliminated intentionally to avoid producing sequences that look like words. Not using vowels doesn’t really enhance the security of a particular product key, but it does eliminate the possibility that a truly random key generation scheme will produce sequences that look offensive to particular users. The final set of unused characters—L, N, S, and Z—can be easily misread. A lowercase l can be misread as the numeral 1 or the uppercase I. A lowercase nn can be misread as a lowercase m. The letter S can be misread as a numeral 5, and the letter Z can be misread as the numeral 2. Now let’s talk about some of the basic common-sense tricks you can use to help keep your product key lists usable and safe. To make your product key lists usable, you should:
- Record before installing. You should make it a habit to record a product’s key before you install the product, then perform the installation using the key you copied. This ensures that your copied product key is correct. If you made a mistake, you should still have the original key at hand for correction.
- Include the hyphens when recording. You should include the hyphens in the product keys when recording them. Not only does this make it easier to read the codes back, but it also provides you with a way of finding simple errors. Consider the following two ways someone might make the same mistake reading or recording a product key:
23w46789bhcdfgjkmpqrtwxy 23w4-6789b-hcdfg-jkmpq-rtwxy
Both are identical, except the first one doesn’t break down the product key into its five-character sets. There is no obvious way to determine where the problem is in the first example. In the second example, a quick inspection tells you that the first five-character sequence is missing a character, making it fairly easy to guess that the letter w might really be two consecutive Vs (vv). - Be careful with easily confused characters and use uppercase letters. Most people are a little sloppy with handwriting, making it easy to confuse some characters. For example, B and 8 are easily confused when not written carefully. You also might want to stick with uppercase letters when recording product keys. Several lowercase letters in the product key character set are easy to confuse, such as g and q, and f and t.
- Enlarge. If you’re handwriting product keys, write large. If you have a typed list that you print out, use a large font. If you simply photocopy keys on licenses (handy for keeping them with license information), use the photocopier’s enlargement feature. Enlarging only takes an extra second and makes your copies much easier to read and less likely to be made illegible if they are copied again later.
After you’ve created your product key list, you need to make sure it’s securely stored. Because key use is tracked by Microsoft during activation, if your keys are accessible to people who misuse them, your products could eventually be impossible to activate during installation or patch updates. Here are a few points to consider:
- Treat the keys as confidential information, much like passwords. Make sure the lists are always protected and accessible to as few people as possible. If they’re stored in a network-accessible location, ensure that the permissions in the file or database are limited to only IT staff responsible for performing machine installations. You might also want to audit access.
- If you’re an IT support service provider, your clients might expect you to maintain their keys. The most secure way to handle this is to have the keys stored on the clients’ sites (not your site) and make sure the clients are aware that they have ultimate responsibility for the keys. If this isn’t feasible (a small client organization might be too disorganized to do this properly), you might need to store the keys for the client, but again restrict access to only those people who need to perform installations for that particular client.
- If at all possible, perform product setups in batch. This minimizes how frequently you need to open the key list, which can expose it to overtheshoulder copying.