What Happened To Windows Genuine Advantage?

Microsoft is now explaining what happened when their Windows Genuine Advantage site went bonkers and was giving out false information that legit copies of Windows were pirated. On the Microsoft WGA blog site it was explained this way:

So What Happened?

Now that we have had time to dive into the details more on what happened that caused the temporary problems last weekend, I want to share what we found so far. We still have more work to do, but we now understand what occurred and why. We’ve also implemented several changes to prevent this kind of thing from happening again.

What exactly happened?

Two key things happened. First, activations and validations were both affected when preproduction code was accidentally sent to production servers. Second, while the issue affecting activations was fixed in less than thirty minutes (by rolling back the changes) the effect of the preproduction code on our validation service continued after the rollback took place.

How did this happen in the first place?

Nothing more than human error started it all. Pre-production code was sent to production servers. The production servers had not yet been upgraded with a recent change to enable stronger encryption/decryption of product keys during the activation and validation processes. The result of this is that the production servers declined activation and validation requests that should have passed.

Why did it take so long to fix?

While the response to the activation issue was quick (less than thirty minutes) the effect on our validation service continued even after the rollback took place. We expected the rollback to fix both issues at the same time but we now realize that we didn’t have the right monitoring in place to be sure the fixes had the intended effect.

If the servers are down, why don’t you just assume the systems are genuine?

We do. It’s important to clarify that this event was not an outage. Our system is designed to default to genuine if the service is disrupted or unavailable. In other words, we designed WGA to give the benefit of the doubt to our customers. If our servers are down, your system will pass validation every time. This event was not the same as an outage because in this case the trusted source of validations itself responded incorrectly.

So after reading this explanation what do you think? Also if you had experienced a WGA failure what did you think was happening?

Comments welcome.

More detailed information here.

[tags]wga, blog, microsoft, [/tags]