For years, organizations have relied on Microsoft’s Key Management Service (KMS) to activate Windows devices at scale. While KMS helped enable broad deployment scenarios, modern organizations increasingly require stronger assurances around device identity and activation integrity. Microsoft has continued to enhance activation capabilities with innovations that leverage hardware-backed validation to provide stronger protection against activation misuse and improve trust in device identity.
As attackers have exploited fake or cloned KMS servers, organizations face increased compliance and licensing risk. Microsoft is now further strengthening defenses with KMS Hardware-Secured, which uses Trusted Platform Module (TPM)-based attestation to help verify that a KMS host is running on trusted hardware before it can activate Windows devices.
Build trust into every activation
The cornerstone of this modernization is TPM-based attestation. Starting with upcoming Windows Server releases, KMS hosts must prove they are running on verified, uncompromised hardware before activating clients. This is achieved through TPM – a hardware root of trust that provides cryptographic proof of integrity.
TPM attestation delivers:
- Stronger security: Help ensure only verified servers can issue activation licenses.
- Tamper resistance: Help protect activation secrets from theft or spoofing by binding them to hardware.
- Future-ready compliance: Help ensure the infrastructure is ready for future activation security requirements.
The result is a more trustworthy activation model that helps reduce spoofing risk today while preparing organizations for future security requirements.
How TPM attestation works:
- Hardware identity: The KMS host uses TPM-backed attestation to prove its hardware identity. Microsoft verifies this proof before the host can activate devices.
- Platform integrity: The TPM confirms the KMS host has not been subject to tampering.
- Activation flow: Once verified, the KMS host can securely serve activation requests for Windows devices in the organization.
For customers, this means activation can be tied to a trusted host, not just a software configuration that can be copied or spoofed.
|
KMS Hardware-Secured |
Legacy KMS | |
|
Basis of trust |
Hardware root-of-trust via TPM |
Software-only; vulnerable to spoofing |
|
Deployment requirement |
TPM |
No hardware requirement |
|
Operational outcome |
Greater trust and simpler long-term operations |
Increased risk and operational overhead |
Getting ready for KMS-Hardware Secured requirements
Preparing now helps ensure your KMS environment is ready for the transition to hardware-based trust. The following steps can help you assess readiness and plan any required updates.
- Inventory your KMS hosts:
- For physical KMS host, confirm the host is certified for Windows Server on Windows Server Catalog. Ensure TPM is installed and enabled.
- For virtual KMS host, guidance for virtualized environments will be provided in future blogs.
- Validate TPM attestation: In an elevated Windows PowerShell session, run
Get-TpmSupportedFeature -FeatureList "Key Attestation”
A successful response that displays “Key Attestation” confirms the server supports the TPM attestation capability for KMS Hardware-Secured.
- Plan: Inventory your KMS hosts and identify any hardware upgrades needed to support KMS Hardware-Secured.
- Communicate: Share readiness plans with IT teams and monitor upcoming enforcement timelines.
Coming soon: KMS Hardware-Secured readiness check
Starting August 2026, Windows Server 2025 will provide readiness messaging to help administrators assess whether a KMS host is ready for hardware-based security, giving teams time to plan upgrades before enforcement begins.
Where you’ll see them
- Command line (slmgr /dlv)
✅ “This device is eligible to serve as a KMS host with hardware-based security.”
⚠️ “This device does not meet the requirements for using KMS host with hardware-based security.”
- Event logs
Warning entries under Applications and Services Logs > Key Management Service.
Plan your transition now
With the next Windows Server LTSC release, TPM attestation will become mandatory for KMS Hardware-Secured activation. Taking action now gives your organization time to prepare and transition on your own schedule.
As Windows security continues to evolve, trusted activation infrastructure will play an increasingly important role. KMS Hardware Secured helps position your environment for the future while aligning with Microsoft's continued investment in hardware-rooted trust.
Securing today. Preparing for what's next.
Learn more in the Windows Security book and Windows Server Security book. To stay up to date on the latest in security features and enhancements, visit the Microsoft Security site, follow the Microsoft Security Blog, or connect with Microsoft Security on LinkedIn and @MSFTSecurity.
Microsoft