TL;DR
- Host Security: Microsoft has introduced Trusted Platform Module attestation for enterprise Key Management Service activation hosts.
- Identity Check: The mechanism verifies server hardware identity and boot integrity before processing Windows activation requests.
- Rollout Timing: Windows Server 2025 will show readiness alerts in August 2026, while enforcement awaits an unscheduled Long-Term Servicing Channel version.
- Piracy Scope: HWID and TSforge do not use KMS hosts, so the new check does not directly address them.
- Virtual Hosts: Virtual-host guidance remains pending, leaving administrators without a documented equivalent of the physical-server readiness procedure.
Microsoft has introduced KMS Hardware Secured in July 2026, adding hardware-backed identity and integrity checks to enterprise Windows activation hosts. Its activation-server scope excludes individual Windows clients.
Microsoft will begin showing readiness messages in August 2026 on Windows Server 2025, which recently received a separate BitLocker recovery fix. Organizations whose physical hosts lack the required capability may need hardware upgrades. Enforcement is planned for the next Windows Server Long-Term Servicing Channel (LTSC) version, which has no announced release date.
Key Management Service (KMS) uses a client-server activation model: one local host activates a fleet of volume-licensed Windows devices. A Trusted Platform Module (TPM) is a tamper-resistant security processor that can bind cryptographic keys and boot-integrity measurements to a machine. KMS Hardware Secured requires the host to present that evidence before processing activation requests.
How TPM Attestation Changes Activation Trust
Each activation depends on a cryptographic chain of trust connecting the KMS host’s hardware identity and platform state to the request it processes. Boot measurements record the startup state, while a device key ties that evidence to a particular TPM. A copied operating-system image cannot reproduce the original hardware identity by itself, although published material does not quantify how many unauthorized servers will fail.
TPM-based keys unavailable outside the TPM cannot be copied and used without that hardware, so moving only the server software does not move its trusted identity. Published specifications do not establish how every unauthorized host will respond, but a conforming KMS host needs both compatible hardware and correctly configured software. Microsoft moved Windows client reporting to Azure Attestation in 2023; KMS Hardware Secured instead asks the server granting activations for hardware-derived evidence.
Microsoft’s physical KMS host readiness checklist asks administrators to confirm server certification, an installed and enabled TPM, and Key Attestation. Key Attestation proves possession of a hardware-bound key, while August’s warnings give teams time to inventory hosts and enable available TPM functions. Older servers may require hardware upgrades or TPM enablement or configuration before Microsoft sets the enforcement date.
Microsoft has not yet published guidance for KMS hosts running as virtual machines. Although virtual TPM support in Hyper-V has separate precedent, Microsoft plans future virtual KMS guidance. Organizations that consolidated activation infrastructure onto virtual servers currently lack a documented equivalent of the physical-host procedure.
The Piracy Boundary and What Comes Next
KMS client activations remain valid for 180 days, with clients attempting renewal every seven days. Managed devices can maintain activation through a local host during that window, giving fake KMS infrastructure a server role to imitate. Because clients return to a host for renewal, hardware-backed evidence targets a recurring server dependency while leaving unrelated activation methods outside the check.
In November 2025, KMS38 used a separate Windows helper file and was disabled by a different validation change, not TPM host attestation. Its shutdown does not demonstrate that the new KMS check stops methods built around other mechanisms.
HWID and TSforge do not contact a KMS host, so host attestation has no server to verify for either method. TSforge may instead target Microsoft’s broader licensing architecture without KMS emulation. Microsoft is hardening one activation route rather than disabling unauthorized Windows activation broadly.
Multiple Activation Key (MAK) and retail activation remain separate Microsoft activation paths. They are established alternatives, not new competitors to KMS Hardware Secured. Each path retains its own infrastructure and licensing procedures, so the new host check does not convert every Windows license into a KMS-managed activation.
Microsoft previously faced Windows 11 LTSC requirement bypasses and criticism of its Windows 11 TPM 2.0 requirement. Microsoft’s new plan moves the hardware check to activation hosts and ties enforcement to the next Windows Server LTSC version. Microsoft still must publish virtual-host guidance before those administrators have an equivalent documented readiness procedure.
