Recently, Microsoft has been taking many steps to improve the security of Windows and other Microsoft products as a whole. For example, the tech giant recently announced a big change to Entra ID authentication with default passkeys. Plus, it is also introducing AI-enhanced Windows security updates as it highlighted the new update strategy.

Following that, Microsoft has announced that it is preparing to strengthen the security of Windows volume activation too by introducing a new hardware-backed trust model for its Key Management Service (KMS). The enhancement, called KMS Hardware-Secured, will use Trusted Platform Module (TPM)-based attestation to verify that KMS hosts are running on trusted hardware before they can activate Windows devices.

The announcement marks the latest step in Microsoft’s efforts to modernise Windows activation as companies face growing challenges around device identity, software licensing, and the misuse of activation procedures.

KMS, if you are not already aware, is Microsoft’s volume activation technology designed for organisations that need to activate large numbers of Windows devices across a network. Instead of each device connecting individually to Microsoft’s activation servers, a KMS host within the enterprise environment handles activation requests from eligible client devices, thus making deployment easier in such settings.

According to Microsoft, the new KMS Hardware-Secured capability addresses risks from fake or cloned KMS servers, which attackers have used to bypass activation controls. By introducing TPM attestation, Microsoft aims to ensure that only verified KMS hosts running on uncompromised hardware can issue Windows activation licenses.

For anyone who doesn’t know, perhaps, TPM is a dedicated hardware security component that provides a hardware root of trust. TPM basically enables devices to generate and protect cryptographic keys that help ensure the integrity of the platform. Through TPM-based attestation, a device can produce cryptographic proof that it is running on trusted hardware and has not been tampered with. Many Windows security features like Windows Hello, BitLocker, System Guard, and more, rely on TPM.

Under the new activation model, a KMS host first uses TPM-backed attestation to establish its hardware identity, and then Microsoft verifies this attestation before allowing the server to activate Windows devices. The TPM also confirms the integrity of the platform, helping ensure the host has not been compromised. Once verification is complete, the KMS host can securely process activation requests from Windows devices within the organisation.

Hence, businesses using KMS are thus being encouraged to begin assessing their environments ahead of the transition. For virtualised KMS hosts, Microsoft adds that guidance will be provided in the future.

Beginning next month, in August 2026, Windows Server 2025 will introduce readiness messaging to help admins determine whether their KMS hosts meet the new hardware-based security requirements. Status information will be available through the slmgr /dlv command. An eligible device will say “This device is eligible to serve as a KMS host with hardware-based security,” while a non-eligible one will show “This device does not meet the requirements for using KMS host with hardware-based security.”

Finally, Microsoft has confirmed that TPM attestation will become mandatory for KMS Hardware-Secured activation with the next Windows Server Long-Term Servicing Channel (LTSC) release, which likely means Windows Server 2028. As such, the company recommends to begin preparing for the transition process early on. You may find more details on the official blog post here on Microsoft’s Tech Community website.