A hot potato: After introducing Windows 11, Microsoft forced the entire PC ecosystem to turn the Trusted Platform Module (TPM) into a standard component for every new motherboard or CPU. Now, Redmond is exploiting the now-pervasive device to further strengthen the Windows activation process in the enterprise market.
Microsoft recently announced a brand-new addition to Key Management Service (KMS), a standard feature for mass activation of Windows devices in enterprises and other large-scale organizations. The KMS feature will soon rely on hardware-based security, using TPM's encryption "brain" to verify the legitimacy of the server hosting KMS data.
Redmond explained that attackers have traditionally abused KMS to spoof the activation process, which is both a security issue and a way for individual users to avoid paying for a new Windows license. The new "TPM-based attestation" option will use the TPM for verifying the cryptographic proof of the integrity of a KMS server.
TPM-based attestation will first check the hardware identity of the KMS host, proving that the server has been verified by Microsoft as a legitimate hardware device. Then, the feature will confirm that the KMS host has not been tampered with in any way. Finally, the TPM chiplet will let the now-verified KMS host manage the mass activation requests required by the organization.
TPM-based attestation will become a mandatory requirement for KMS activation starting with the next Windows Server release, Microsoft stated. The corporation will begin to pressure business customers by sharing its "readiness messaging" in Windows Server 2025, starting from August 2026. Sysadmins will need to adapt and prepare their organizations in time, checking whether their KMS infrastructure is ready for hardware-based activation security.
"As Windows security continues to evolve, trusted activation infrastructure will play an increasingly important role," Microsoft stated. "KMS Hardware Secured helps position your environment for the future while aligning with Microsoft's continued investment in hardware-rooted trust."
Popular tools designed to activate pirate copies of Windows have used KMS-based methods for quite some time. In 2025, Microsoft stopped the workaround employed in the so-called "KMS38" activation method, although "pure" KMS activation should still work as expected.
The elusive Massgrave collective provides open-source tools for "unofficial" Windows activation procedures, including an Online KMS method that needs to "phone home" to a fake KMS server every six months. TPM-based attestation might very much be the end of Online KMS-based piracy, although we will have to wait and see how the story actually ends. Massgrave recently introduced the new TSforge Activation method, which can allegedly bypass Microsoft's entire DRM architecture for software product activation.