Microsoft will require TPM-based attestation for KMS Hardware-Secured activation with the next Windows Server Long-Term Servicing Channel release, shifting KMS host trust from a software-only configuration to a hardware-verified identity.
The change is intended to make it harder to abuse cloned or spoofed Key Management Service hosts. Under the new model, a KMS host must use its Trusted Platform Module to attest that it is running on approved, uncompromised hardware before it can activate Windows devices. Microsoft validates that proof, after which the host can serve activation requests inside the organization.
For administrators, the immediate task is inventory rather than migration. Existing KMS deployments continue to operate, but organizations relying on physical KMS hosts should identify systems that may not satisfy the upcoming hardware-based requirements.
KMS Hardware-Secured changes three important aspects of the activation model:
Systems that do not qualify will instead report:
Warnings will also be recorded under Applications and Services Logs > Key Management Service in Event Viewer.
For physical KMS hosts, Microsoft recommends confirming that the server is certified for Windows Server in the Windows Server Catalog, that a TPM is installed and enabled, and that the TPM supports key attestation. From an elevated PowerShell session, run:
A response listing Key Attestation indicates that the server supports the TPM capability Microsoft expects for KMS Hardware-Secured. Microsoft has not yet published equivalent guidance for virtualized KMS hosts; that information is expected in future updates.
Organizations should use the August readiness checks to identify unsupported KMS hosts, budget for any necessary server replacements, and avoid leaving activation infrastructure planning until the next Windows Server LTSC release makes TPM attestation a requirement.
The change is intended to make it harder to abuse cloned or spoofed Key Management Service hosts. Under the new model, a KMS host must use its Trusted Platform Module to attest that it is running on approved, uncompromised hardware before it can activate Windows devices. Microsoft validates that proof, after which the host can serve activation requests inside the organization.
For administrators, the immediate task is inventory rather than migration. Existing KMS deployments continue to operate, but organizations relying on physical KMS hosts should identify systems that may not satisfy the upcoming hardware-based requirements.
KMS Hardware-Secured changes three important aspects of the activation model:
- Host identity: The TPM provides cryptographic evidence tied to the host hardware rather than relying solely on a KMS configuration that could be copied.
- Protection of activation material: Hardware binding is designed to reduce the risk that activation secrets can be stolen, spoofed, or reused on a fraudulent KMS host.
- Future compliance: TPM attestation will become mandatory for the hardware-secured activation model in the next Windows Server LTSC release.
slmgr /dlv. Eligible systems will report:This device is eligible to serve as a KMS host with hardware-based security.Systems that do not qualify will instead report:
This device does not meet the requirements for using KMS host with hardware-based security.Warnings will also be recorded under Applications and Services Logs > Key Management Service in Event Viewer.
For physical KMS hosts, Microsoft recommends confirming that the server is certified for Windows Server in the Windows Server Catalog, that a TPM is installed and enabled, and that the TPM supports key attestation. From an elevated PowerShell session, run:
Get-TpmSupportedFeature -FeatureList "Key Attestation"A response listing Key Attestation indicates that the server supports the TPM capability Microsoft expects for KMS Hardware-Secured. Microsoft has not yet published equivalent guidance for virtualized KMS hosts; that information is expected in future updates.
Organizations should use the August readiness checks to identify unsupported KMS hosts, budget for any necessary server replacements, and avoid leaving activation infrastructure planning until the next Windows Server LTSC release makes TPM attestation a requirement.
References
- Primary source: Windows IT Pro Blog
Published: Wed, 22 Jul 2026 16:00:00 GMT
Loading…
techcommunity.microsoft.com