Starting August 2026, Windows Server 2025 will begin surfacing readiness alerts for a new hardware-backed KMS activation model that requires a TPM 2.0 chip and Secure Boot. Microsoft plans to make TPM attestation mandatory for Key Management Service hosts in a future Windows Server release, fundamentally changing how volume activation trust is established.
What’s Changing: A Hardware-Rooted Trust Model for KMS
For two decades, the Key Management Service (KMS) has provided a straightforward way for organizations to activate Windows and Office clients in bulk. A KMS host — typically an inconspicuous server — responds to activation requests over the network, validated by a volume license key and DNS records. But Microsoft is now adding a critical layer of hardware-based security to this process.
The new “KMS Hardware-Secured” model leverages the Trusted Platform Module (TPM) to attest that the KMS server itself is running on a legitimate, uncompromised platform. Rather than simply trusting the software configuration and a key, the activation service will check cryptographic proof tied to the server’s physical hardware. A host that cannot provide valid TPM-backed attestation will not be eligible to participate in this enhanced activation scheme.
The rollout begins with non-blocking readiness notifications in Windows Server 2025 starting in August 2026. These alerts will inform administrators whether their KMS hosts possess the necessary TPM 2.0, Secure Boot, and firmware prerequisites. The actual enforcement — when attestation becomes mandatory — is expected in a subsequent Windows Server Long-Term Servicing Channel (LTSC) release, for which Microsoft has not yet set a name or date.
Who’s Affected and What the Alerts Will Tell You
If your organization uses KMS activation today, these readiness checks will apply to every server acting as a KMS host. That includes primary and backup hosts, branch-office servers, and even forgotten lab machines that may still be publishing DNS records. The alerts will likely appear in Windows Server’s event logs or management tools and will indicate whether a host meets the baseline hardware security requirements.
Microsoft is initially targeting Windows Server 2025 for these alerts. Administrators running older Windows Server versions (2016, 2019, 2022) as KMS hosts won’t see the readiness notifications directly, but they should still begin planning, because future LTSC releases that mandate attestation will eventually force a migration. If you’re currently using a virtual KMS host, you’ll need to examine whether your hypervisor and guest configuration support virtual TPM (vTPM) and Secure Boot in a way that satisfies attestation.
Why TPM Attestation? Stopping Cloned Activations and Impersonation
Traditional KMS has a weakness: a determined attacker who obtains a host’s software image or configuration can clone it, stand up a rogue activation server, and potentially intercept or confuse client activation traffic. Because KMS relies on a simple DNS service record and a key, there’s little inherent proof that the server is the genuine article.
Hardware attestation closes this gap. The TPM provides a hardware-rooted identity and can report measurements of the server’s boot process and firmware integrity. Microsoft’s attestation service (or a future on-premises equivalent) can verify these measurements, ensuring the KMS host hasn’t been tampered with. This aligns with Zero Trust principles: trust no asset solely based on its network location or configuration.
For IT administrators, this also strengthens compliance posture. Auditors often ask, “How do you know your activation servers are legitimate?” With hardware attestation, you can point to a cryptographically verified chain of trust rather than just a server name and a hope that no one duplicated the VM.
The Practical Impact: What IT Teams Must Do Now
The August 2026 alerts are a grace period, not a crisis. But they’re a signal that you should act before enforcement arrives. Here’s a concrete checklist:
- Inventory every KMS host. List all servers running the Volume Activation Services role, regardless of OS version. Include hosts that may have been set up for Office activation, test labs, or disaster recovery sites.
- Check TPM 2.0 presence and health. For each physical host, boot into firmware settings and ensure TPM 2.0 is enabled and activated. In Windows, run
tpm.mscorGet-Tpmin PowerShell to confirm status. - Enable Secure Boot. All KMS hosts should be running with UEFI and Secure Boot enabled. Legacy BIOS or Compatibility Support Module (CSM) modes won’t cut it.
- Review virtual hosts. If your KMS runs in a VM, verify that the hypervisor supports vTPM and that it’s attached. Check that the VM’s firmware is set to UEFI and Secure Boot is on. Note: Microsoft hasn’t fully detailed requirements for virtualized attestation, so stay tuned for guidance.
- Audit DNS records. KMS discovery relies on
_vlmcs._tcpSRV records. Ensure only authorized servers can register them, and prune any stale entries. - Update Windows Server and firmware. Apply the latest cumulative updates and OEM firmware patches. The Secure Boot certificate refresh (which has a June 2026 deadline) must be completed to keep Secure Boot functional; that involves manually installing updated certificates on servers that didn’t ship with the 2023 certificates.
- Prepare a migration plan. If any KMS host lacks a TPM, you’ll need to move the role to a compliant server. Remember that a new KMS host must accumulate a minimum number of activation requests (25 for clients, 5 for servers) before it activates clients, so plan the cutover carefully.
For now, no action will disrupt existing KMS activation. The alerts are advisory. But postponing until the mandatory deadline could force a rushed migration in the middle of other projects.
How We Got Here: Microsoft’s Steady March Toward Hardware-Based Trust
This isn’t Microsoft’s first push to tie critical services to hardware roots of trust. Windows 11 famously requires TPM 2.0 for client devices. Windows Server 2022 introduced Secured-core server certification, which mandates TPM 2.0, Secure Boot, and virtualization-based security. Over the past five years, Microsoft has evangelized hardware-backed security for identity protection (Windows Hello), disk encryption (BitLocker), and even general device health attestation.
KMS, however, had remained untouched — a relic of the “trust the network” era. The move to bolt on TPM attestation was inevitable as organizations increasingly run KMS inside virtual machines that can be cloned in seconds. The 180-day activation window and DNS-based discovery are convenient, but they’re also fragile from a security standpoint. Microsoft’s phased approach — alerts first, enforcement later — mirrors how the Secure Boot certificate update was handled: plenty of warning, followed by a hard cutoff.
The June 2026 Secure Boot certificate expiry is a separate but overlapping deadline. Some KMS hosts may need both the certificate update and a TPM readiness evaluation. Administrators who handle both in a single maintenance window can save time and reduce risk.
What’s Still Unclear
Microsoft has not published exhaustive technical documentation for KMS Hardware-Secured. Critical unknowns include:
- Exactly which attestation service KMS will use (cloud-based Device Health Attestation or an on-premises standard).
- How virtualized TPMs will map to host hardware trust — will nested virtualization be supported? What about cloud-hosted VMs?
- Whether there will be an exception process for air-gapped or highly secured networks where cloud attestation is impossible.
- The precise name and release date of the Windows Server version that will enforce attestation.
IT architects should build flexibility into their plans. A virtual KMS that works today might require a move to a physical server or a specific hypervisor version tomorrow.
The Bigger Picture: Activation Security as Critical Infrastructure
KMS might seem like a low-priority utility, but its compromise could disrupt every Windows client and server in an organization. An attacker who controls a KMS host could deny activations, push fake activation policies, or undermine licensing compliance. By tying activation authority to hardware that’s harder to spoof, Microsoft is raising the bar for adversaries while giving legit admins a stronger chain of custody.
The August 2026 readiness alerts are an important early warning. Savvy IT departments will use the time to modernize their activation infrastructure, not just tick a TPM checkbox. That means pairing hardware attestation with ongoing security practices: restricted admin access, network segmentation, DNS monitoring, and centralized logging. The goal is a KMS host that’s trusted not just by its name, but by its silicon.