Microsoft is preparing to transition its enterprise Windows activation from a software-trust model to one based on verified hardware. The company announced KMS Hardware-Secured.
A new Key Management Service capability that uses Trusted Platform Module (TPM) attestation to validate KMS hosts before they can activate Windows devices.
For years, enterprises have utilized KMS to activate large Windows deployments internally. While this model supports extensive deployments, legacy KMS primarily relies on software configuration.
This reliance has led to abuse by attackers and unauthorized users who create cloned or fake KMS servers, posing licensing, compliance, and security risks for organizations.
KMS Hardware-Secured aims to mitigate these risks by requiring the KMS host to demonstrate that it is operating on trusted, uncompromised hardware.
Microsoft Moves Windows Activation to Hardware
Microsoft will verify TPM-backed attestation before allowing the server to provide activation services to Windows clients. A TPM acts as a hardware root of trust, storing and protecting cryptographic material in a dedicated hardware component.
This setup makes secrets more difficult to copy, steal, or spoof than software-based credentials. In the KMS Hardware-Secured workflow, the TPM provides cryptographic evidence of the host’s hardware identity and platform integrity.
The process begins when a KMS server submits TPM-based attestation data. Microsoft then validates this proof to confirm that the system meets integrity requirements.
Once approved, the host can process Windows activation requests from devices within the organization. If the host does not meet the hardware-attestation requirements, it will not qualify as a hardware-secured KMS activation server.
This shift significantly alters the activation trust model. Instead of trusting a KMS server based solely on its software configuration and activation keys, organizations will tie activation authority to a verified physical platform.
Microsoft stated that this approach should enhance resistance to activation-secret theft, KMS spoofing, and unauthorized cloning. This requirement will begin appearing in upcoming Windows Server releases.
Microsoft announced that TPM attestation will become mandatory for KMS Hardware-Secured activation with the next Windows Server Long-Term Servicing Channel release. The timeline allows enterprises to inventory their existing KMS infrastructure and plan necessary hardware upgrades.
Starting in August 2026, Windows Server 2025 will display readiness messages to help administrators determine whether a KMS host can support the new model. Administrators can check eligibility using the slmgr /dlv command or monitor warnings in the Key Management Service event logs.
For physical KMS hosts, Microsoft recommends ensuring that the server is certified in the Windows Server Catalog and that TPM is installed and enabled.
Organizations can also verify support from an elevated PowerShell session using the following command:
Get-TpmSupportedFeature -FeatureList "Key Attestation"
A response indicating “Key Attestation” confirms that the server supports the TPM capability needed for KMS Hardware-Secured. Microsoft noted that guidance for virtual KMS environments will be provided later.
This change reflects a broader industry trend toward hardware-backed security controls. As attackers increasingly target identity systems, secrets, and trusted infrastructure, Microsoft is extending hardware-rooted trust into enterprise Windows activation.
