How to Fix KB5002907 Office Deactivation in 2016 and 2019

A widespread wave of KB5002907 Office deactivation incidents has disrupted perpetual workstation deployments across corporate and homelab environments. Originally designed by Microsoft as an optional servicing package to nudge outdated Microsoft 365 Apps installations onto modern update branches, the update inadvertently targeted legacy perpetual builds. Workstations operating licensed copies of Microsoft Office 2016 and Office 2019 suddenly stripped activation tokens, displayed intrusive “Unlicensed Product” banners, or in severe scenarios, executed complete background uninstalls. Here is the technical breakdown of the fault and the definitive procedure to remediate affected systems.

Root Cause Analysis: Why KB5002907 Office deactivation Occurs

The core defect of KB5002907 lies in the Click-to-Run (C2R) update detection engine and its interaction with the Windows Software Protection Platform (SPP). The update payload was authored to identify Microsoft 365 installations that had failed to pull branch builds for 90 days or longer. However, due to overlapping build manifests between early C2R channels of Office 2016/2019 and legacy enterprise channels of Microsoft 365, the servicing package misidentified perpetual Volume (VL) and Retail Home & Business installations as defunct subscription tenants.

Upon installation via Windows Update, the deployment script executes an update-orchestration routine that purges existing licensing tokens stored in %ProgramData%\Microsoft\OfficeSoftwareProtectionPlatform and replaces them with modern subscription discovery triggers. Because a perpetual product key cannot authenticate against Microsoft Entra ID or subscription tenant licensing endpoints, the local licensing daemon flags the suite as deactivated.

Following thousands of incident reports from enterprise administrators, Microsoft officially halted the distribution of the update. As documented in the official Microsoft Support KB5002907 documentation, rollout has been suspended while engineering teams adjust the target detection rules. For broader updates context and patch rollback strategies, explore our Windows Updates troubleshooting archive.

Technical Comparison: Update Impact Across Office Tiers

The severity of the disruption depends on the delivery architecture and license model configured on the workstation:

Step 1: Identifying and Preventing KB5002907 Deployment

When analyzing a KB5002907 Office deactivation issue on client endpoints, note that the package is delivered under the umbrella of optional Microsoft servicing components rather than core Windows LCU packages, querying traditional Windows Hotfix tables via Get-HotFix often yields zero returns. Instead, administrators must query Windows Update Client events and review update history.

Open an elevated PowerShell prompt to verify if your device has received or staged the package:

# Query Windows Update agent history for the problematic KB
$Session = New-Object -ComObject Microsoft.Update.Session
$Searcher = $Session.CreateUpdateSearcher()
$HistoryCount = $Searcher.GetTotalHistoryCount()
$Searcher.QueryHistory(0, $HistoryCount) | Where-Object { $_.Title -match "KB5002907" } | Select-Object Date, Title, ResultCode

If the update has not yet installed, immediately disable the automatic delivery of non-OS servicing bits through Windows Settings:

1. Navigate to Settings > Windows Update > Advanced options.
2. Toggle off “Receive updates for other Microsoft products” until a certified revision is pushed.

Step 2: Purging Corrupt Licensing Tokens with ospp.vbs

If Word, Excel, or Outlook are reporting an unlicensed state, running the internal Office Software Protection Platform script (ospp.vbs) is the fastest way to extract conflicting subscription tokens and restore perpetual activation.

Launch Command Prompt as Administrator and navigate to the architecture-specific Office folder:

:: For 64-bit Office on 64-bit Windows or 32-bit Office on 32-bit Windows
cd "C:\Program Files\Microsoft Office\Office16"

:: For 32-bit Office on 64-bit Windows (x86 on x64)
cd "C:\Program Files (x86)\Microsoft Office\Office16"

Run the diagnostic status check to display all installed license keys and their state:

cscript ospp.vbs /dstatus

Inspect the output. Under the corrupted state, you will frequently notice two separate licenses: a defunct “Office 365” subscription token alongside your genuine “Office 16 / Office 19 HomeBusiness or ProPlus” entry. Take note of the Last 5 characters of installed product key for the unwanted or broken token.

Execute the uninstall command to remove the conflicting key:

cscript ospp.vbs /unpkey:XXXXX

(Replace XXXXX with the 5 characters identified from the /dstatus command)

Step 3: Restoring Perpetual Activation and Rebuilding Cache

Once the orphaned subscription tokens are flushed, restart the Software Protection service and initiate an online re-arm to bind your original perpetual key:

:: Restart the local licensing protection service
net stop sppsvc
net start sppsvc

:: Force token regeneration and trigger immediate activation
cscript ospp.vbs /act

Verify that the output concludes with <Product activation successful>. If your deployment utilizes a local KMS host, verify your endpoint mapping using:

cscript ospp.vbs /sethst:kms.yourdomain.local
cscript ospp.vbs /act

For additional enterprise system deployment guides and productivity software maintenance, visit our dedicated Office suite deployment guides hub.

Remediating Rare Scenarios: Missing Executables

In edge cases where the C2R updater attempted a complete channel migration and was interrupted, binary files (such as WINWORD.EXE or EXCEL.EXE) may disappear from the installation directory. In this scenario, do not attempt to run third-party uninstaller utilities, as they purge registry licensing entries permanently.

Execute an in-place Click-to-Run self-repair from an administrative console:

"C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe" scenario=Repair platform=x64 culture=en-us DisplayLevel=True

This command instructs the Click-to-Run streaming client to fetch missing binaries from the local CDN cache and repair the file associations without destroying your licensing registry hives.

Frequently Asked Questions

Did Microsoft permanently revoke perpetual Office licenses with KB5002907?

No. The update does not revoke legal licenses. The issue is a client-side detection failure in the optional servicing manifest that mistakenly attempts to migrate perpetual builds to subscription channels. The license remains valid on Microsoft activation servers.

Can KB5002907 be uninstalled via wusa.exe?

No. wusa.exe targets standalone Windows update packages (.msu). Because KB5002907 is delivered through the Click-to-Run virtualization and servicing pipeline, wusa.exe /uninstall will return an error stating the update is not installed on the system.

How can enterprise administrators block KB5002907 across an Active Directory domain?

Administrators should unapprove or decline the package within Windows Server Update Services (WSUS) or Microsoft Configuration Manager (MECM). Alternatively, deploy a Group Policy Object targeting Computer Configuration > Administrative Templates > Windows Components > Windows Update and configure “Do not include drivers and optional Microsoft product updates”.