Bottom line: KMS servers must henceforth perform TPM-based hardware attestation before they are permitted to activate Windows clients.
Starting with upcoming Windows Server releases, Microsoft requires Key Management Service hosts to verify their hardware authenticity and system integrity via a Trusted Platform Module. This measure is intended to prevent software piracy and fraudulent activation servers.
Microsoft is tightening security requirements for Windows operating system license activation in enterprise networks. In future, servers that provide the Key Management Service (KMS) must prove their identity and system integrity via a Trusted Platform Module (TPM) chip. The hardware-based attestation process confirms before license issuance to client devices that the KMS host is running on genuine and unaltered hardware.
For administrators, the transition period begins in August 2026: from that point onward, Windows Server 2025 will issue status messages in the KMS logs as well as in the slmgr /dlv command output, indicating whether a device meets the prerequisites for operating a hardware-secured KMS host. These notices are intended to give organizations time to adjust their infrastructure. For virtualized KMS instances, Microsoft announced separate requirements for a later date.
The innovation addresses an established security problem: previous software-based KMS servers are susceptible to manipulation and cloning. Developers of unofficial activation tools systematically exploited this functionality to provide emulated KMS servers and thereby circumvent licensing costs. By mandating TPM attestation, software emulations and fraudulent online servers are technically blocked, since the hardware signature cannot be replicated.
Source: www.it-daily.net · Published 29 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 of the EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.