Help Desk

Overview

ECE Design software activates and deactivates licenses by sending a request to our license server over the internet. Both operations talk to the same server, so if one fails the other usually fails too.

If a computer cannot activate or deactivate a license, it is normally because the machine is on an out-of-date release, or because something on the local network — a firewall, proxy, or antivirus product — is blocking or changing that request.

This article is written for IT staff and assumes administrator access to the affected machine. It gives you a set of tests to confirm whether that machine can reach our license server, and how to read the results.

What makes the call, and why it matters

The request does not come from AutoCAD, and it does not come from the signed-in user. It comes from a Windows service:

That matters for three reasons:

• Proxy settings. A service running as LocalSystem does not use the proxy or PAC file set up for the signed-in user. It uses the machine-wide WinHTTP proxy. If your proxy is applied per user by Group Policy, the service never sees it.
• Certificates. LocalSystem trusts the Local Computer certificate store. A firewall or antivirus root certificate installed only into the user's certificate store will not be trusted by the service.
• Firewall rules. Windows Defender Firewall and most endpoint products allow traffic per program. A rule that lets powershell.exe out does not let ECE License Services.exe out.

So a test you run while signed in as yourself can pass while the service still fails. Step 6 repeats the tests as LocalSystem, and that is the result that counts.

License server details

Every license operation uses the same host and the same port:

This is true only on current releases. On builds of 2026.1.180 and earlier, deactivation was sent over plain HTTP on port 80 while everything else used HTTPS. On those builds, activation succeeds and deactivation fails on any network that allows HTTPS but blocks or redirects plain HTTP. That is why Step 1 is the version check, and why updating fixes most "cannot deactivate" reports on its own.

None of this uses ping (ICMP). A failed ping does not mean the server is unreachable — our host blocks ping by design. The tests that matter are the port test (Step 3) and the connection test (Step 4).

Before you begin

Work through these on the computer that cannot activate or deactivate, in order. Step 1 is a version check. Steps 2 to 5 are commands you run in Windows PowerShell as the signed-in user. Step 6 repeats them as LocalSystem. Note the result of each step.

Step 1 – Update to a current release (do this first)

Check the installed version of the ECE Licensing Manager:

(Get-Item "C:\Program Files\ECE Design\ECE Licensing Manager\ECE License Services.exe").VersionInfo.FileVersion

You can also read it from the ECE License Manager page on the machine, at http://localhost:1968/Version.

The version has four numbers, for example 2026.1.162.1921. The third number is the build.

• Build 180 or lower (for example 2026.1.162.1921) → update before going any further. Deactivation on these builds needs outbound plain HTTP, which many networks block. Updating resolves it without any firewall change.
• Build higher than 180 → the version is fine. Carry on to Step 2.

Download the current release from your ECE Design account, or contact us and we will send you the installer. Update the ECE Licensing Manager on the affected machine, then try the activation or deactivation again before running the remaining steps — on most machines that is the whole fix.

Step 2 – Confirm the address resolves correctly

nslookup ecelm.ecedesign.com

Expected: the address returned is 40.67.178.37.

• A different address → a DNS or hosts-file problem on the network.
• No result → DNS is not working, which by itself blocks activation and deactivation.

Confirm the hosts file is not overriding the address (this should return nothing):

Get-Content C:\Windows\System32\drivers\etc\hosts | Select-String ecedesign

Step 3 – Test the connection to the server (key test)

Test-NetConnection ecelm.ecedesign.com -Port 443

Expected: TcpTestSucceeded : True

• True → the computer can reach the license server. If activation or deactivation still fails, the cause is likely TLS inspection (see Step 4), the service account (Step 6), or an application-side setting.
• False → a firewall or proxy is blocking outbound HTTPS to this host. This is the most common network cause.

Step 4 – Test the connection end to end

Use curl.exe for this, not Invoke-WebRequest. Both are built into Windows 10 and 11. The difference matters: curl.exe reports the result as a plain number, while Invoke-WebRequest raises a red error for any status other than a success code. A working connection that returns 404 looks like a failure in PowerShell and looks like a pass in curl. We are testing whether the connection gets through, not whether a page exists.

curl.exe -s -o NUL -w "status: %{http_code}\n" https://ecelm.ecedesign.com/

• Any three-digit status number (200, 404, 405 — all fine) → the connection is getting through. This is a pass.
• Status 000 → the connection did not complete. This matches a False in Step 3. Run curl.exe -v https://ecelm.ecedesign.com/ to see how far it got.
• A certificate or SSL error → a firewall or antivirus product is inspecting secure traffic and breaking the connection. This is common with Zscaler, Palo Alto, Fortinet, and some corporate antivirus.

If you have to use PowerShell instead of curl, use this form, which reports an error status as a pass rather than throwing:

try   { "status: $((Invoke-WebRequest 'https://ecelm.ecedesign.com/' -UseBasicParsing -TimeoutSec 20).StatusCode)" }
catch { if ($_.Exception.Response) { "status: $([int]$_.Exception.Response.StatusCode) (connection OK)" }
        else { "BLOCKED: $($_.Exception.Message)" } }

Step 5 – Trace the route (find where it is blocked)

tracert ecelm.ecedesign.com

This shows the path the connection takes across the network. If it stops at the first hop, the block is on your own firewall or gateway.

Step 6 – Repeat the tests as LocalSystem (the result that counts)

Steps 2 to 5 test your own account. The software runs as LocalSystem. The steps below repeat the same tests under that account.

These commands need an elevated PowerShell. Right-click Windows PowerShell and choose Run as administrator. To confirm, this must print True:

([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

If it prints False, creating the task below fails with ERROR: Access is denied.

a. Save this as C:\Windows\Temp\ece-lic-test.ps1. It writes its own results file, so no output redirection is needed:

$exe = "C:\Program Files\ECE Design\ECE Licensing Manager\ECE License Services.exe"
$out = @(
  "Run at  : $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
  "Running as: $([Security.Principal.WindowsIdentity]::GetCurrent().Name)"
  "Version : " + (Get-Item $exe -EA SilentlyContinue).VersionInfo.FileVersion
  "DNS     : " + ((Resolve-DnsName ecelm.ecedesign.com -Type A -EA SilentlyContinue).IPAddress -join ',')
  "TCP 443 : " + (Test-NetConnection ecelm.ecedesign.com -Port 443 -WarningAction SilentlyContinue).TcpTestSucceeded
  "HTTPS   : " + (curl.exe -s -o NUL -w '%{http_code}' https://ecelm.ecedesign.com/)
  "Proxy this account will use:"
  (netsh winhttp show proxy)
)
$out | Out-File -FilePath C:\Windows\Temp\ece-lic-test.txt -Encoding utf8

b. Delete any results file from a previous attempt, then create the task and run it as LocalSystem:

Remove-Item C:\Windows\Temp\ece-lic-test.txt -Force -ErrorAction SilentlyContinue
schtasks /create /tn ECELicTest /tr "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Windows\Temp\ece-lic-test.ps1" /sc once /st 00:00 /ru SYSTEM /rl HIGHEST /f
schtasks /run /tn ECELicTest

WARNING: Task may not run because /ST is earlier than current time. is expected and can be ignored — the task is started by hand with /run, never on a schedule. What matters is that both commands report SUCCESS.

c. Wait about 15 seconds, read the results, then remove the task:

Get-Content C:\Windows\Temp\ece-lic-test.txt
schtasks /delete /tn ECELicTest /f

Check the first two lines before reading anything else. Run at must be the time you just ran it, and Running as must be NT AUTHORITY\SYSTEM. If the time is old you are looking at a leftover file from an earlier attempt; if the account is your own name rather than SYSTEM, the task did not run under the right account. In either case the results below those lines do not apply — delete the file and start again from step b.

If a test passed in Steps 2 to 5 but fails here, the block applies to the service account only. Check three things: proxy settings applied per user rather than per machine, a TLS-inspection root certificate installed only into the user's certificate store, and firewall rules written for the browser or for PowerShell rather than for ECE License Services.exe.

Step 7 – Read the service's own log

The service records every attempt in a file that rolls over daily:

C:\ProgramData\ECE Design\License Manager\Logs\ECE License Manager -YYYYMMDD.log

Try the activation or deactivation again, then open today's file and look at the last entries. This is the most direct evidence of what the service actually saw, so please send it to us along with your test results.

Interpreting the results

Most common fix

Do all four of these:

• Update the ECE Licensing Manager to a build higher than 2026.1.180 (Step 1).
• Allow outbound traffic to ecelm.ecedesign.com and to 40.67.178.37 on port 443.
• Exclude that host from TLS/SSL inspection on the firewall and on any antivirus product.
• Apply the firewall rule to the program C:\Program Files\ECE Design\ECE Licensing Manager\ECE License Services.exe, not only to the signed-in user or to the browser. If a proxy is in use, set it machine-wide so the service picks it up — netsh winhttp show proxy shows what the service will use, and netsh winhttp set proxy sets it.

If the connection cannot be fixed

We can deactivate a license from our side, but the license files must be removed on the client as well. There are two files:

License.lic
SerialNumber.txt

For a stand-alone license they are in the product folder, for example C:\ProgramData\ECE Design\MTOWorx. For a network license they are in C:\ProgramData\ECE Design\Network. Confirm to us that they have been removed and we will release the license so it can be applied to another machine.

See also: How to Activate ECE Software Licenses Manually and Deactivating Software License.

Still need help?

If activation or deactivation still fails after these steps, please reply with the output of Step 6 and the log file from Step 7, and our support team will pinpoint the issue.