Microsoft will require a TPM chip to activate Windows via KMS in the enterprise environment

Microsoft has announced a change to the way businesses activate Windows on a large scale. And the company will strengthen its Key Management Servicepopularly known by its acronym KMS. This is the system that allows hundreds or thousands of computers to be activated from an internal server without depending on an individual key per device, requiring that this server prove to be running on verified and unmanipulated hardware.

The change does not affect home users or individual Windows licenses. It is aimed exclusively at corporate environments, where KMS has been the standard method for deploying the operating system in volume for years. The problem that Microsoft says it has detected is that this server can be cloned or completely spoofed by software, which has allowed attackers to activate copies of Windows illegitimately by pretending to be a legitimate KMS host.

How does hardware verification work?

The solution relies on the TPMthe security chip that Windows 11 requires since its launch in 2021 and that today is integrated into practically all modern processors. With this new function, named KMS Hardware-Securedthe server that manages the activations must prove its identity through a cryptographic attestation based on that chip before being able to activate any equipment.

The process broadly consists of the KMS host submitting proof of identity supported by the TPM, which Microsoft validates before granting permission to issue activations. That same chip also confirms that the server has not been tampered with. Only when both checks are correct is the host enabled to respond to activation requests from the rest of the organization’s computers. In practice, this ties trust to a specific physical piece, rather than a software configuration that anyone can copy.

A progressive change that will end up being mandatory

Microsoft is not enforcing this requirement immediately. From August 2026Windows Server 2025 will begin displaying readiness warnings indicating whether a particular server already meets hardware-based security requirements, both on the command line using the command slmgr /dlv as in the system event log. It is, in essence, a grace period so that administrators can plan the transition without surprises.

That warning phase will end at some unspecified future time, when the next LTSC version of Windows Server makes mandatory TPM attestation to continue using KMS Hardware-Secured. Microsoft recommends that IT teams take inventory of their KMS servers now, verify that the physical ones are certified in the Windows Server catalog and that they have TPM enabled, and run the PowerShell command Get-TpmSupportedFeature -FeatureList “Key Attestation” to confirm if the current hardware is supported.

Microsoft has been insisting on TPM as a Windows security pillar for years, a requirement that at the time generated quite a bit of controversy among users with older, incompatible computers. Applying it now also to the enterprise activation infrastructure is a logical extension of that same strategy, although the true impact will be felt by the system administrators in charge of keeping their organizations’ KMS server fleet up to date, not the end user of a home PC.