Microsoft to kill Windows KMS activator piracy tools with TPM-based attestation
Microsoft is expanding a hardware-based security wall around Windows activation with tamper-proof TPM chips.
image by Microsoft.
- Microsoft will require TPM attestation for servers that manage Windows client keys (KMS hosts).
- Starting in August 2026, Windows Server 2025 will begin providing readiness messages to administrators.
- This change is designed to combat activation misuse and unauthorized KMS servers often used in software piracy.
Microsoft is putting a hardware lock on Windows KMS activation. Servers that unlock Windows for entire companies will soon be required to prove their identity with tamper-resistant TPM chips. It’s bad news for pirates, who will lose a popular cracking method.
Microsoft’s Key Management Service (KMS) is an activation server that organizations use to activate Windows on all their devices, without entering any product keys.
The Redmond giant announced that it will require TPM attestation for such servers in the future.
“TPM attestation will become mandatory for KMS Hardware-Secured activation,” Microsoft announced in a blog post.
The Trusted Platform Module (TPM), now built into most recent CPUs, is a hardware security chip that stores cryptographic keys and performs cryptographic operations.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Each TPM carries a permanent unique identifier called the Endorsement Key (EK), making it an ideal tool for proving a device’s identity, but at a significant privacy trade-off. TPM 2.0 is already a baseline hardware requirement for Windows 11.
Microsoft will verify the TPM hardware proof before the KMS host can activate devices – the TPM confirms that the KMS host is genuine and has not been tampered with.
Windows Server 2025 will begin providing readiness messages to admins in August 2026, urging them to prepare for the transition. The messages will appear when running “slmgr /dlv,” a terminal command for detailed license status information, as well as in the KMS service logs.
When no TPM chip is accessible, the message will warn that “This device does not meet the requirements for using KMS host with hardware-based security.”
Devices that are ready for hardware-based security will return “This device is eligible to serve as a KMS host with hardware-based security.”
Check if your data has been leaked
Microsoft urges identifying any hardware upgrades needed to support KMS with hardware security. The tech giant doesn’t yet provide guidance for virtualized KMS instances, but promises to do so in the future.
“Starting with upcoming Windows Server releases, KMS hosts must prove they are running on verified, uncompromised hardware before activating clients,” the blog post reads.
Microsoft argues that the change is needed to fight against activation misuse and improve trust in device identity. Previously, attackers have leveraged fake or cloned KMS servers. Legacy KMSes are software-only, vulnerable to spoofing, and can be copied.
The move is a significant blow to Windows pirates. KMS emulation has been one of the oldest and most widespread methods to “activate” pirated Windows versions. Pirates abused this system to run a fake “homemade” KMS server as a downloadable “KMS Activator” or other tool, pointing Windows to it to obtain a license without paying.
TPM attestation requirement – Microsoft verifying if the device is genuine – will essentially kill KMS activators that either emulate KMS locally or point to a fake KMS server online.
However, other, more recent Windows “activation” methods exist that bypass Microsoft’s DRM architecture using HWID, Ohook, TSforge, and potentially other methods.