Microsoft is tightening the security around Windows Server volume activation by introducing a new hardware-backed trust model for the Key Management Service. This change targets a specific vulnerability where attackers could bypass licensing checks using fake or cloned KMS servers. IT administrators must now ensure their activation infrastructure runs on trusted hardware to maintain valid licensing status.
New hardware trust model blocks fake KMS servers starting with 2025 readiness checks
The core of this update is KMS Hardware-Secured, which leverages Trusted Platform Module (TPM) technology to verify the integrity of the host machine. Instead of relying solely on software credentials, the system now attests that the KMS host is operating on uncompromised hardware. This adds a layer of physical security to the activation process, making it significantly harder for unauthorized servers to issue valid keys.
Windows Server 2025 will begin rolling out readiness messaging in August 2026 to prepare organizations for this shift. Administrators can currently check their system's eligibility for the new security model by running the slmgr /dlv command in the command line. This early warning period allows teams to audit their hardware inventory and identify any servers that lack the necessary TPM support before the mandate takes effect.
The mandatory requirement for TPM attestation will officially take hold with the next Windows Server Long-Term Servicing Channel (LTSC) release, which is expected to be Windows Server 2028. Until that time, existing KMS configurations will likely remain functional, but new deployments should plan for hardware compliance. This timeline gives enterprises a multi-year window to upgrade legacy servers that do not meet the new security standards.
Microsoft is effectively closing a gap in volume activation security by tying license validation to specific hardware trust anchors. The phased rollout from readiness checks in 2026 to mandatory enforcement in 2028 provides a clear path for compliance. Organizations should prioritize auditing their KMS host hardware to avoid activation failures during the transition.
Discussion
0 comments
Log in to join the thread with a thoughtful take, question, or correction.