Microsoft plans to require hardware-based TPM attestation for enterprise Key Management Service (KMS) activation hosts, with enforcement arriving in the next Windows Server Long-Term Servicing Channel (LTSC) release. Starting August 2026, Windows Server 2025 will begin showing readiness warnings, giving administrators a window to prepare their infrastructure.

What Exactly Changed? KMS Hardware-Secured, Explained

Microsoft calls the new mechanism KMS Hardware-Secured. It isn’t just a generic “TPM required” rule—it demands that a KMS host use a Trusted Platform Module to cryptographically prove its integrity and identity before it can activate Windows devices across an organization. The goal is to neutralize fake or cloned KMS servers that have long exploited software-only trust assumptions.

A KMS server running on a copied virtual disk or a duplicated image will no longer be able to pass itself off as legitimate. The TPM attestation process ties the server’s activation authority to a specific hardware platform with a non-exportable private key, making impersonation significantly harder. Microsoft’s own documentation identifies this as a defense against credential theft and replay attacks.

The rollout unfolds in two phases:

  • Readiness phase – August 2026: Windows Server 2025 KMS hosts will display warnings in slmgr /dlv output and in the Key Management Service event log if they lack the required TPM capability.
  • Enforcement phase – Next Windows Server LTSC release: TPM attestation becomes mandatory. Microsoft hasn’t announced a date for that future LTSC version.

Virtualized KMS hosts get a temporary caveat: Microsoft has promised separate guidance for virtual environments, meaning Hyper-V, VMware, and Azure Stack HCI administrators should wait before finalizing any migration or compliance strategy.

What It Means for You

Enterprise IT Administrators

This change affects you directly. Every KMS host you operate—physical or virtual—will eventually need to satisfy the TPM attestation requirement. The readiness period gives you time, but ignoring the warnings in August 2026 could lead to a sudden activation outage on the next LTSC upgrade. Start inventorying your KMS infrastructure now. Older servers might need a hardware refresh, or virtualized setups might require design changes once Microsoft delivers its guidance.

Small and Midsize Businesses

If your organization uses volume licensing with an internal KMS host, the same rules apply. Smaller environments often run KMS on an aging box that “just works.” That box might lack a TPM 2.0 chip or have it disabled in firmware. Use the upcoming readiness indicators to spot gaps early, and budget for a replacement if needed.

Home Users and Retail Windows Licensees

You can ignore this entirely. KMS Hardware-Secured targets enterprise activation infrastructure only. It does not introduce a new TPM check for Windows 11 Home or Pro devices that activate with a digital license or a retail key. Microsoft’s announcement and independent analyses, including reporting by Windows Latest, confirm that consumer activation paths remain unchanged.

How We Got Here

Key Management Service has been the backbone of Windows volume activation for two decades. An organization runs one or more KMS hosts internally, and client machines check in periodically—every 180 days by default—to renew their activation. The model scales well but creates a single point of trust. If an unauthorized party can spin up a rogue KMS host that appears legitimate, it can activate an entire fleet of machines without proper licensing.

Fake KMS servers have plagued enterprises and been widely used in unauthorized activation tools. They often rely on cloned software configurations and spoofed network responses. Microsoft’s move introduces a hardware-rooted identity that is cryptographically bound to the server itself, raising the difficulty of impersonation dramatically.

This aligns with a broader Microsoft strategy of anchoring trust in hardware. Windows 11’s TPM 2.0 requirement, Secure Boot, System Guard, and Windows Hello all leverage TPM-based integrity measurements. KMS Hardware-Secured extends that philosophy to the activation infrastructure that organizations depend on.

What to Do Now – A Readiness Checklist

Don’t wait until the next LTSC is around the corner. Use this checklist to prepare:

  1. Inventory every KMS host. Document OS version, hardware model, physical/virtual location, and dependencies. Note which hosts are critical and which could be decommissioned.
  2. Check the TPM state. Ensure a TPM is installed and enabled in UEFI/BIOS. You can verify via tpm.msc or Get-Tpm. Microsoft’s support documentation notes that TPMs can be disabled in firmware even on capable hardware.
  3. Validate key attestation support. The precise feature required is TPM Key Attestation. Run this PowerShell cmdlet on each KMS host:
    powershell Get-TpmSupportedFeature -FeatureList "Key Attestation"
    A True result means the TPM supports the needed feature. Not all TPMs or firmware versions do.
  4. Monitor Windows Server 2025 readiness messages. Starting August 2026, regularly check slmgr /dlv output for “Hardware-Secured Activation Ready” status and watch for warnings in the Key Management Service operational log (under Applications and Services Logs).
  5. Plan for resilience. Microsoft recommends at least two KMS hosts if you manage more than 50 clients. Having a second host that meets the new requirement can prevent a single point of failure during the transition.
  6. Rehearse disaster recovery. Hardware binding means that a motherboard replacement, TPM clear, or image restore could invalidate the attestation. Update your recovery runbooks to include TPM-specific steps and ensure you have a documented backup host.
  7. Wait for virtualization guidance. Don’t redesign your virtual KMS architecture until Microsoft publishes the promised vTPM guidance. Meanwhile, document your current setup—hypervisor, vTPM configuration, backup and migration practices—so you can evaluate the eventual guidance quickly.

Outlook

Microsoft’s phased approach is designed to give enterprise customers runway, but many details remain unresolved. The most significant unknown is the release date of the next Windows Server LTSC. Historically, LTSC versions appear roughly every three years, but Microsoft has not confirmed a timeline. The virtualization guidance is also critical; organizations running KMS on Hyper-V or VMware cannot fully assess compliance until that arrives.

The bigger picture is clear: trust is shifting from software assertions to hardware proof. For KMS, that’s a welcome improvement. Activation infrastructure is too sensitive to rely on a server’s good word alone. With KMS Hardware-Secured, it will have to show its work.