Microsoft Locks Windows KMS Activation to TPM Hardware Proof

Microsoft will start requiring proof that Windows activation servers run on real, verified hardware. A readiness check lands in Windows Server 2025 this August, the first phase of a new TPM based attestation layer called KMS Hardware-Secured. Full enforcement arrives with the next Windows Server Long-Term Servicing Channel (LTSC) release.

It is a hardware fix for an activation system that has always run on trust alone, the same trust enterprises have watched attackers spoof and casual pirates have exploited for years.

A Hardware Passport for Activation Servers

Key Management Service (KMS) is how most large organizations activate Windows and other Microsoft software across many devices at once. Instead of activating each machine individually, computers on the network check in with a central KMS host, which confirms the license and keeps the fleet activated.

Microsoft says that trust has been abused. The company wrote that “attackers have exploited fake or cloned KMS servers,” creating what it called increased compliance and licensing risk for the organizations that depend on them.

The cornerstone of this modernization is TPM-based attestation. Starting with upcoming Windows Server releases, KMS hosts must prove they are running on verified, uncompromised hardware before activating clients.

Microsoft wrote that in a Windows IT Pro blog post announcing the change. TPM, or Trusted Platform Module, supplies the cryptographic proof of integrity that makes the check possible, and hosts that cannot prove they run on verified, uncompromised hardware will not be allowed to issue activations once attestation becomes mandatory.

Nothing about the licensing agreement itself changes. What changes is the burden of proof a host has to carry before it is trusted to hand out activations.

Part of a Bigger Push to Lock Down Identity

Neowin, a tech news outlet that detailed the change this week, linked it to two other recent Microsoft security moves: a shift toward default passkeys in Entra ID, Microsoft’s identity platform, and a new AI assisted strategy for shipping Windows security updates.

Microsoft frames the KMS payoff as prevention. With hosts cryptographically proving their integrity, it becomes harder for attackers to tamper with activation systems, steal activation credentials, or spin up fake KMS servers inside a network Microsoft does not control.

A Long History of Fake KMS Hosts, One Blocked Last November

A Protocol Built on a Key and a Network Address

Traditional KMS was never built to cryptographically verify itself. A host publishes a network record that points client machines to it, and devices check in periodically to renew their activation, a grant intentionally valid for 180 days at a time.

That simplicity is exactly what made spoofing possible. Any machine that can answer on the right port and hand back a plausible activation response can pretend to be a KMS host, because nothing in the original protocol cryptographically proves which hardware is actually issuing the license.

One Popular Workaround Lost Its Edge Last November

The best known example of that weakness being exploited for free activation is KMS38, an open source tool built by a group called Massgrave, where MAS stands for Microsoft Activation Scripts. TechSpot reported in November 2025 that Massgrave’s own changelog showed its main KMS based activation option had been removed after Microsoft blocked it.

Massgrave’s download had circulated for years on two Microsoft owned platforms, Azure DevOps and GitHub, according to TechSpot’s reporting, alongside piracy forums and GitHub mirrors.

Massgrave’s developers responded by pointing users toward two alternative methods, HWID and TSforge activation, which continued to work after the block, the same report said.

Does Your Windows Server Even Have a TPM?

Not always. Windows Server has never required a Trusted Platform Module the way Windows 11 does for every PC. Microsoft’s own guidance lists TPM as optional for most Server SKUs, meaning a real share of existing KMS hosts, especially older physical servers and long running virtual machines, may not have the chip enabled or present at all.

The Hardware Reality Behind the Requirement

Microsoft’s own hardware documentation confirms it: TPM stays optional for most Windows Server SKUs, required only in narrow cases like the Host Guardian Services scenario. Windows 11, by contrast, has required a TPM 2.0 chip on every client PC since the operating system launched in October 2021, Petri reported separately.

Hardware based TPM chips carry their own bar to clear. Microsoft’s specification says they must ship with a pre-provisioned EK certificate and support specific cryptographic PCR banks, a standard plenty of older physical servers were never built to meet.

What Administrators Should Do Now

Microsoft’s own advice for the transition is simple, even while the final deadline stays undefined.

• Review existing KMS infrastructure and note which hosts are physical, virtual or cloud based
• Confirm whether current servers support TPM at all
• Verify TPM attestation capabilities on hosts that do have the chip
• Identify systems that may require a hardware upgrade or full replacement
• Start budgeting and scheduling before the mandatory requirement lands

Each step can start well before the mandatory deadline arrives, the moment the August 2026 readiness notifications go live.

The Compliance Clock Starts Ticking in August 2026

Windows Server 2025 shipped in November 2024 and Windows Server 2025 remains the current LTSC release, which is why it is first in line for the readiness notifications. The next LTSC release, whichever version number Microsoft eventually assigns, is where attestation stops being informational and starts being enforced.

1. August 2026: Windows Server 2025 begins showing readiness notifications indicating whether a KMS host meets the new TPM based security requirements.
2. Through the following months: organizations can test hosts, plan budgets and schedule upgrades while the check remains informational only.
3. Next Windows Server LTSC release: TPM attestation becomes a mandatory part of KMS Hardware-Secured activation, per Microsoft’s own confirmation.

What We Know

• Windows Server 2025 starts showing KMS TPM readiness notifications in August 2026.
• Microsoft has confirmed TPM attestation becomes mandatory in the next Windows Server LTSC release.
• Administrators can test host readiness now, well ahead of that deadline.

What’s Unconfirmed

• Which LTSC release enforces the requirement, and exactly when it ships.
• How virtualized or cloud hosted KMS servers will be attested. Microsoft has not yet published equivalent guidance for virtual hosts.

Neowin’s analysis points to Windows Server 2028 as the most likely candidate, based on the roughly three year cadence between LTSC releases since 2016, though Microsoft has not confirmed a version number or date.

Frequently Asked Questions

What Is KMS Hardware-Secured?

KMS Hardware-Secured is Microsoft’s name for the new trust layer added to Key Management Service activation. It changes how a host proves it is legitimate, not the licensing terms themselves. Organizations keep their existing volume license agreements and Generic Volume License Keys (GVLK); only the server’s identity check changes, from a key and network handshake to a TPM backed cryptographic proof.

Does the TPM Requirement Apply to Every PC or Just the Server?

The attestation happens at the KMS host level, the machine issuing activations, not on every device being activated. A Windows 10, 11 or Server client receiving activation from a compliant host does not need its own TPM attestation check to get activated; it just needs the host it talks to have passed one.

What Happens if a KMS Host Fails Its Readiness Check Today?

Nothing breaks yet. The notifications arriving in Windows Server 2025 starting in August 2026 are informational, flagging hosts that would not meet the new bar. Enforcement, where a failing host could lose its ability to issue activations, does not begin until TPM attestation becomes mandatory in the next Windows Server LTSC release.

Will This Require Buying New Servers?

Possibly, but not immediately. Microsoft’s device rules have required new hardware to implement and enable TPM 2.0 by default since July 28, 2016, so servers built before that point are the most likely to lack a usable chip and may need a firmware update, a new motherboard or a full replacement before the next LTSC deadline.