Microsoft is preparing a significant change in Windows volume activation. The company will introduce KMS Hardware-Secured, an evolution of Key Management Service that will require activation servers to demonstrate their identity through cryptographic certification backed by the Trusted Platform Module (TPM). The goal is to prevent fake, cloned, or software-emulated hosts from easily impersonating legitimate KMS servers.
The essentials of the new TPM-protected KMS in 30 seconds
- Microsoft will link KMS server identities to keys protected by the TPM.
- The validation will target enterprise hosts that activate devices, not directly each home PC.
- Windows Server 2025 will begin showing readiness alerts in August 2026.
- Certification will be mandatory in the next LTSC version of Windows Server.
- Virtualized environments will require additional, yet-to-be-published instructions.
- The change will make it harder for fake KMS activators but won’t eliminate all illegal copies of Windows on its own.
This strengthening affects one of the most widely used mechanisms by companies, governments, and large organizations to activate hundreds or thousands of devices from an internal infrastructure. It also targets a well-known technique to bypass Windows licensing: setting up a fake KMS server that responds as if it belonged to an organization with volume licenses.
The key difference from the current model is that trust will no longer depend solely on software configuration. The server will need to provide hardware-linked proof, validated via the TPM, before being authorized to handle activation requests.
From software trust to hardware-linked identity
Key Management Service allows an organization to manage Windows activation without each device contacting Microsoft directly. KMS clients search the network for an authorized host and periodically renew their activation status.
This system reduces administrative work and simplifies management of large deployments, labs, virtual desktops, and devices on restricted networks. However, the traditional design also allows a fake implementation to mimic expected responses.
Unauthorized tools have exploited this behavior for years to simulate an enterprise environment. A PC receives a seemingly valid KMS response and remains activated for a set period. A scheduled service or task can repeat this process to renew that status.
KMS Hardware-Secured adds an extra layer. The server must use the TPM as a trust root and demonstrate that its cryptographic identity is associated with a specific platform. Microsoft will verify this proof before allowing the host to distribute activations.
This approach complicates several types of abuse:
- Copying the configuration of a legitimate server;
- Exporting secrets and reusing them on another machine;
- Cloning a KMS virtual machine without maintaining the trust chain;
- Emulating the service entirely via software;
- Modifying the platform without reflecting that change in the certification.
The TPM can protect keys so they are not exportable as standard files. It can also provide evidence of boot state and platform integrity, although Microsoft still needs to specify what measurements it will require from the KMS server.
The TPM won’t inspect every Windows PC
The announcement might be interpreted as a new anti-piracy measure, but its scope is more limited than some headlines suggest.
Microsoft has not announced that each PC’s TPM will seek out activators, analyze files, or determine the legitimacy of installed licenses independently. The certification applies to the KMS host, meaning the server claiming authorization to activate other systems within an organization.
Customers will continue to send requests to their configured server. The difference is that this host must have previously passed a hardware-based validation.
For a home user with a digital license, a commercial key, or an OEM license included with the device, no action should be necessary. It also doesn’t directly alter activation methods tied to a Microsoft account or OEM keys.
However, it could indirectly affect tools relying on a fake KMS infrastructure. If the ecosystem starts demanding a certified cryptographic identity, merely reproducing activation protocols or responses will no longer suffice.
That doesn’t mean all illegal methods will disappear. Different techniques that don’t function as a standard KMS server are still possible, and those maintaining such tools are likely to seek new approaches.
Windows Server 2025 will begin compatibility assessments in August
The transition will start with an informational phase.
From August 2026, Windows Server 2025 will display messages indicating if a device is prepared to act as a hardware-secured KMS host. During this period, warnings will help IT teams identify incompatibilities before certification becomes mandatory.
Admins can check the extended license status using:
slmgr /dlv
The system may show a message confirming that the device meets the requirements to serve as a hardware-secured KMS server. Otherwise, it will state that the host does not meet the necessary conditions.
Warnings will also appear in Event Viewer, under:
Applications and Services Logs > Key Management Service
Microsoft recommends verifying if the TPM supports key attestation using PowerShell:
Get-TpmSupportedFeature -FeatureList "Key Attestation"
If the response includes Key Attestation, the device has the basic capability required for the new architecture.
This check is not exhaustive. It is also necessary to ensure the TPM is enabled, firmware is updated, and the server is compatible with the corresponding Windows Server version.
The upcoming LTSC version will make certification mandatory
Microsoft has confirmed that TPM certification will be mandatory with the next Long-Term Servicing Channel (LTSC) edition of Windows Server.
The specific product name and schedule haven’t been disclosed yet. Also, no details have been provided on when the traditional KMS model will be phased out in environments migrating to the new server.
Organizations should start reviewing their current hosts. Some physical devices might include a compatible TPM that remains disabled in UEFI. Older servers could lack the module or have one that doesn’t support the required key attestation.
Migration may involve:
- Enabling the TPM in firmware;
- Updating BIOS or UEFI firmware;
- Replacing a physical module;
- Moving the KMS service to another server;
- Reviewing backup and recovery procedures;
- Documenting how to preserve host identity during failure.
The change also impacts disaster recovery plans. If the host’s identity is tied to a specific TPM, restoring from a backup alone might be insufficient. Recovery should also involve hardware-protected keys and any re-enrollment mechanisms Microsoft establishes.
The virtualized environment remains an open question
Many organizations no longer run KMS on independent physical servers. Instead, they host virtual machines on Hyper-V, VMware, Proxmox VE, hyperconverged platforms, or private clouds.
Microsoft has acknowledged it will publish specific instructions for such setups later. For now, adding a vTPM to a VM won’t automatically satisfy all requirements.
A virtual TPM depends on the hypervisor’s security, the physical host, and a key protection service. So, the trust chain is more complex than with an on-premises physical server.
Several technical questions remain open:
- How will vTPMs be certified by Microsoft?
- What happens when a VM migrates to another node?
- Will hot migration be supported?
- How will replicas for disaster recovery work?
- Does cloning preserve the VM’s identity or not?
- What requirements will VMware, Hyper-V, or Proxmox need to meet?
- How will restoration after host failure be handled?
These issues are especially important in clusters where high availability moves VMs automatically. If certification depends on underlying hardware, Microsoft will need to provide a way to maintain security without hindering typical virtualization operations.
More security, but also increased operational dependence
The main advantage of this new approach is clear: attackers will face greater difficulty copying a KMS server or stealing its activation credentials.
TPM-based certification reduces impersonation risks, secures secrets, and offers Microsoft a higher assurance of server identity. It can also help organizations detect unauthorized hosts within their network.
However, reliance on hardware adds complexity. A motherboard failure, server replacement, or poorly planned migration could impede new device activation if recovery procedures are not well-documented.
Organizations should treat the KMS server as a critical security and licensing asset—not as an auxiliary machine that can be cloned or rebuilt without impact.
This change aligns with Microsoft’s broader strategy. Windows has moved functions like BitLocker, Windows Hello, Credential Guard, Secure Boot, key protection, and remote attestation toward hardware-backed trust roots over the years.
KMS was one of the few remaining components heavily reliant on software-based identity. The move to Hardware-Secured KMS aims to close that gap.
What administrators should do now
First, inventory all KMS servers within the organization. Many might be outdated, secondary, or used for recovery—often undocumented or under-documented.
Next, identify:
- Windows Server version;
- Physical or virtual server;
- Presence and version of TPM;
- Support for
Key Attestation; - Hypervisor type;
- Backup procedures;
- Recovery processes;
- Network and DNS dependencies;
- Number of clients relying on each host.
Also, monitor Microsoft’s updates on virtualization and mandatory deployment deadlines.
It’s not advisable to upgrade hardware solely based on current guidance. Often, enabling existing features suffices, but early detection of incompatible servers is prudent.
The new architecture doesn’t make TPM a tool that reviews each installed Windows automatically. Its role is more specific: acting as a cryptographic credential for the server authorized to activate devices in an organization.
Frequently Asked Questions
Will Microsoft use TPM to verify if each Windows installation is genuine?
Not according to the announced plans. Certification will apply to the enterprise KMS server, not to individual PCs or Windows installations.
When will these changes start?
Starting August 2026, Windows Server 2025 will display readiness alerts. Certification will be mandatory with the next LTSC release.
Will virtual KMS servers require vTPM?
It’s likely that hardware-based trust will need some form of virtual TPM, but Microsoft has not yet published full requirements for virtualized environments.
Will KMS activators disappear?
The change may block or limit methods relying on fake servers or software emulation. However, it doesn’t guarantee the elimination of all unauthorized activation methods.
Sources:
- Microsoft Tech Community, Strengthening Key Management Service (KMS) with Hardware-Based Trust.
- Microsoft Learn, documentation on Key Management Service and volume activation.
- Microsoft Learn, technical documentation on TPM and Key Attestation.
- Microsoft Learn, virtualization security and virtual TPM in Windows Server.
