Microsoft “Banned Activators”? The Truth Is More Nuanced

Back in the 1990s, when personal computers first emerged, the PC market had two major pain points:

1. Expensive branded PCs—even high-end models could cost tens of thousands of yuan, far beyond the reach of ordinary consumers.
2. Costly genuine Windows—a boxed copy of Windows 98 retailed for nearly 2,000 yuan, out of reach for most users.

Enter activators: tools that helped technically savvy users install Windows from official images and automatically activate their systems. These tools existed in a gray zone but were widely used.

Recently, users complained that Microsoft’s built-in antivirus, Defender, flagged the classic activator MAS (Microsoft Activation Scripts). At first glance, it seemed like Microsoft was cracking down on activators—but the truth is more nuanced:

1. MAS itself isn’t malware—it’s just a batch processing tool with no pirated activation codes, and its source code is publicly available.
2. Defender doesn’t flag the official MAS—tests on multiple forums and tech media showed that running the original MAS on the same system did not trigger alerts.

So why the confusion? MAS works by connecting to third-party activation servers to simulate corporate or OEM activation, making pirated systems believe they have genuine licenses. The problem arises when some third-party servers have been tampered with and contain malware or trojans—this is what triggers Defender.

In other words, Microsoft isn’t at fault. It protects users from harmful servers, not activators themselves. Users who downloaded tampered versions bear the risk themselves. The episode even shows a certain leniency: official MAS users remain unaffected.

The takeaway is clear: using gray-zone tools carries inherent risk, and Defender is simply safeguarding your PC against malicious servers.