Security1 publisher2 min readPublished
Microsoft pauses KB5002907 after it strips licenses from perpetual Office 2016 and 2019
Microsoft paused KB5002907 after the Microsoft 365 catch-up update deactivated, and sometimes removed, perpetual Office 2016 and 2019 installs. Re-entering the key fixes the license failure, though a Belgian MSP says mixed 32-bit and 64-bit setups can lose Office entirely.
The Watch · Security desk
What happened
- KB5002907 is Microsoft's catch-up update for Microsoft 365 Apps installs that have fallen more than 90 days out of date.
- On September 24, five unrelated customers of a Belgian MSP called within about ten minutes, with dozens of PCs showing perpetual Office as an "Unlicensed Product."
- Microsoft's support bulletin now says it is investigating unexpected results on some Office 2016 and 2019 devices and has paused the rollout.
- Microsoft says some affected installs appear unlicensed, and that in what it calls rare cases Office is removed from the machine.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- contradiction Admins cannot use the optional label to rule a PC out, since Van Hautte says the update installed itself on his customers' machines despite Microsoft's description.
- exposure PCs pairing 32-bit Office with a 64-bit Access Runtime are the ones Van Hautte says end up with no Office, so recovery there means a full reinstall instead of a key.
- cost Recovery depends on the original product key or the Microsoft account holding the license, so shops that have lost track of either cannot use the quick fix.
- decision The pause protects only PCs that have not yet installed KB5002907; machines that already took it still need their license state checked one by one.
The release notes limit the update to one population. They say it "is available only for Windows PCs with Microsoft 365 Apps installations" on Current Channel or Monthly Enterprise Channel [2]. The machines that broke were outside that group. "The affected installations are all Office 2016 and Office 2019 Home & Business (perpetual/one-time purchase licenses)," Christian Van Hautte, who runs an MSP in Belgium, told BleepingComputer [6]. Of the update, which he said was released around September 23, he said "it is clearly also landing on perpetual (non-subscription) Office installs and breaking their license state." [7]
Van Hautte says KB5002907 appears to remove and reinstall, or migrate, the existing Office installation [10]. Office setup does not allow 32-bit and 64-bit Office products on one machine. On a PC running 32-bit Office 2016 or 2019 beside a 64-bit Microsoft Access Runtime, he says, the old suite comes off and the reinstall fails, leaving the device without Office [11]. Microsoft has not confirmed that mixed bitness is the cause [12].
So in the public reports, architecture is what marks a machine for the worst outcome. Van Hautte ties the removals to mixed 32-bit and 64-bit components [11]. None of the other accounts BleepingComputer gathered, from Reddit and Microsoft's forums, singles out PCs running perpetual and subscription Office side by side [13][14].
For the license failure, a key is enough. Van Hautte said re-entering the original Office product key restored activation [8], and Microsoft advises customers to reactivate the purchased product [17]. One Reddit user found keys worked on some devices. Others needed a sign-in to a Microsoft account and a license selection [14].
Removal is the harder case. Another administrator reported several unrelated customers whose Office had been uninstalled completely, and similar reports appeared on Microsoft's forums [13].
Delivery is disputed. Microsoft says KB5002907 is offered through Windows Update and does not install automatically [4]. Van Hautte said it installed automatically on his customers' devices [9].
Microsoft paused the rollout after BleepingComputer contacted it. A spokesperson said "Additional customer guidance will be communicated via appropriate channels." [16]
The reports describe no attacker and no exploit. The damage in each is lost access to Office on machines running one-time purchase licenses [6][13].
What to watch
- The "additional customer guidance" Microsoft promised, and whether it includes steps to restore installs the update removed.
- Whether Microsoft confirms or rules out mixed 32-bit and 64-bit components as the trigger for full removal.
- Whether KB5002907 returns with targeting that excludes perpetual Office 2016 and 2019 installs.